United Kingdom Information Tribunal including the National Security Appeals Panel

IN THE INFORMATION TRIBUNAL

(NATIONAL SECURITY APPEALS PANEL)

	BETWEEN - PHILIP HILTON	Appellant
	- and -
	SECRETARY OF STATE FOR FOREIGN AND COMMONWEALTH AFFAIRS	Respondent

DECISION

1. We were appointed members of the Data Protection Tribunal (now renamed the Information Tribunal) under section 6(4) of the Data Protection Act 1998 ("the Act") and designated by the Lord Chancellor to hear national security appeals pursuant to Schedule 6 paragraph 2(1). The appeal was brought by Philip Hilton ("the Appellant") under section 28(4) of the Act.

Jurisdiction

2. GCHQ (Government Communications Headquarters) is a data controller who processes personal data within the scope of the Act. "Processes" includes "holds" (section 1(1)). Section 7 of the Act requires data controllers to respond to requests made by individuals for information as to whether their personal data are being processed (section 7 (1)(a)) and, if they are, to have them described and communicated to them (section 7(1)(b) and (c)).
3. By section 28, personal data are exempt from these, and other, provisions of the Act "if the exemption is required for the purpose of safeguarding national security" (section 28(1).
4. When a data controller fails to comply with a request made in accordance with the Act, the individual may apply to the Court for an order that he shall comply with the request (section 7(9). An application the Court, in a case where the data controller relies upon the national security exemption, is regulated by further provisions of section 28. By section 28(2) "a certificate signed by a Minister of the Crown certifying that the exemption ….. is or at any time was required for the purpose there mentioned in respect of any personal data shall be conclusive evidence of that fact."
5. An individual "directly affected" by the Minister's certificate may challenge it by appealing to this panel of the Information Tribunal under section 28(4) of the Act. The powers of the Tribunal on such an appeal are set out in section 28(5) –

"(5) If on an appeal under subsection (4), the Tribunal finds that, applying the principles applied by the court on an application for judicial review, the Minister did not have reasonable grounds for issuing the certificate, the Tribunal may allow the appeal and quash the certificate."

6. A second branch of the jurisdiction of the Tribunal in national security cases, under section 28(6) of the Act, is not relevant in this appeal.

Background

7. On 30 July 2000 the Respondent issued a Certificate under section 28(2) of the Act relating to personal data processed by GCHQ (hereinafter "the original Certificate"). The Secretary of State for the Home Department issued a Certificate in similar terms dated 22 July 2000 relating to personal data processed by the Security Service.
8. On 1 October 2001 by its Decision in Baker v. Secretary of State for the Home Department [2001] UKHRR 1275, the Tribunal quashed the certificate dated 22 July 2000. The Secretary of State for the Home Department issued a revised form of Certificate dated 10 December 2001 relating to personal data processed by the Security Service.
9. On 8 December 2001, the Respondent issued a revised form of certificate relating to personal data processed by GCHQ (hereinafter "the Certificate"). The Appellant challenges the validity of the Certificate by this appeal.
10. Paragraph 5 of the Certificate states that-

"5. This certificate in all respects supersedes [the original Certificate] in respect of GCHQ, dated 30th July 2000 and the said superseded certificate is hereby revoked."

Facts

11. The Appellant was born on 13 March 1963. He was employed by GCHQ from November 1987 until February 1989 as a Russian Linguist (GC10 Grade, 'J' Division) in the Joint Technical Language Service.
12. Since March 1989 he has worked in the City of London, mostly (and currently) as a stockbroker.
13. By letters dated 1 August, 15 August and 27 August 2000 the Appellant required access pursuant to the Act to his personal data processed by or on behalf of GCHQ. He requested in particular to be informed inter alia

"whether any personal data, sensitive or otherwise, has been transferred to: other parts of the Civil Service; any regional Police Constabularies; the Security service….; the Secret Intelligence Service…….; financial regulators such as the Securities and Futures Authority and the Financial Services Authority; my current or previous employers (a list is attached); any organisations outside the United Kingdom."

14. GCHQ replied by letter dated 6 September 2000 that –

"2….As an ex-member of staff we retain records on you under the category of Staff Administration on our personnel database and in your personal file. It is our policy to retain such information for 85 years from date of birth or for 5 years from the date of the last action, whichever is latest….

3. We have no record of information being transferred to any of your other employers.

4. Any other personal data held by GCHQ is exempt from the notification and access provisions of [the Act] on the ground that such exemption is required for the purposes of safeguarding national security……. There is therefore no data to which you are entitled to have access, but you should not assume from this letter that any such data is or is not held about you."

The letter further relied upon the original Certificate issued by the Respondent, dated 30 July 2000.

15. The Appellant appealed to the Tribunal against the original Certificate by letter dated 21 January 2001. His grounds were –

"I do not constitute a threat or risk to National Security so there is no reason for the certificate to apply to my personal data, sensitive or otherwise…. I want to access documents held in respect of my personal data relating to travel restrictions to so-called communist countries to confirm whether such restrictions still apply and whether there are any restrictions in using Russian language professionally."

16. In the course of further correspondence, GCHQ stated that "no travel restrictions apply to you, and no restrictions apply to your use of your language skills" (letter dated 19 February 2001). By the same letter, GCHQ clarified the position by responding to the subject access request under three headings –

(i) the Appellant was invited to inspect his personnel file and the personnel database held by GCHQ relating to him. There was no record of any of this personal information being transferred to other employers;

(ii) GCHQ also holds personal data relating to the Appellant on a security vetting file, comprising "data used to maintain the security clearance which you had when you were employed by us. It contains data about you, your personal circumstances, your assets and your liabilities and your conduct. This data might be disclosed to other intelligence agencies and to other parts of Government."; and

(iii) "any other personal data the might be held by GCHQ in relation to you."

The national security exemption was claimed in respect of categories (ii) and (iii). The letter continued –

"Other than the data referred to in (i) above, there is therefore no data to which your are entitled to have access, and you should not assume that any data, other than referred to in (i) and (ii) above, is or is not held about you."

17. GCHQ in the same letter referred to its duties under the Intelligence Services Act 1994 and stated that it "rigorously complies with those obligations and they are overseen by commissioners appointed under the Regulation of Investigatory Powers Act 2000."
18. The Respondent served a Respondent's Notice dated 10 April 2001, and on 17 April 2001 the Appellant wrote "The 'neither confirm nor deny' principle is absurd and is being used as a pretext to avoid disclosure." On 17th December 2001, the Appellant requested disclosure of personal data held under the category Staff Administration, as previously indicated. This was provided to him on 30 January 2002.
19. The Appellant was then advised by the Tribunal Secretariat that the original Certificate had been "withdrawn" by the Respondent, and on 14 March 2002 he requested "all personal data which was previously exempt for reasons of national security." GCHQ replied confirming the withdrawal and offering op pay the Appellant's reasonable costs of the appeal, which it regarded as being "now at an end." But it maintained the national security exemption, relying of the Certificate dated 8 December 2001.
20. By letter dated 22 April 2002, the Appellant appealed to the Tribunal against the Certificate dated 8 December 2001. The ground of appeal was stated as "I do not constitute a threat or risk to National Security in the United Kingdom."

The Respondent's Notice dated 10 July 2002 contained a "Summary of circumstances relating to the issue of the certificate and the reasons for so doing" and stated that "Following assessment of the particular case by GCHQ the following determinations were made in the Appellant's case:

1 It was determined [that certain data vis. That relating to security vetting could be disclosed].

2 In relation to any other personal data processed which GCHQ may process in relation to the Appellant (which is neither confirmed nor denied) it was determined that adherence to that principle and the full range of exemptions from Section 7(1) of [the] Act, remained required for that purpose."

21. The Respondent relied upon the following grounds –

"7. There is no apparent challenge to the reasonableness of the Certificate….

The right of appeal under section 28(4) …. Is not the appropriate avenue for a challenge to the lawfulness of any underlying processing of personal data by GCHQ ….

If …. the Appellant wishes to challenge the lawfulness of any processing of personal data by GCHQ rather than the Certificate…. Issued by the Respondent, he should pursue the remedies available to him under other statutes, in particular (though not limited to) [RIPA 2000]….

Further or alternatively, the Respondent had reasonable grounds for issuing the Certificate…."

Attached to the Notice were (1) the Certificate, (2) the Reasons referred to in the Certificate, and (3) a document dated 3 December 2001 headed "GCHQ Arrangements for Dealing With Subject Access Applications under [the Act,]" and (4) the Prime Minister's Statement on Security Vetting made in the House of Commons as a Written Answer dated 15 December 1994.

22. On 8 September 2002 the Appellant gave notice to amend his notice of appeal by adding "throughout my life I have been engaged in completely lawful activities which in no way could be deemed to threaten or harm the national security of the United Kingdom." He also observed that the Respondent's reasons for rejecting the appeal were generalised without any specific evidence to suggest that giving him data about himself could harm national security.

The Certificate and Reasons

23. The Certificate and the Minister's Reasons are annexed to this Decision, together with a document headed "GCHQ Arrangements" which, we understand, was published with the Reasons and is, in any event, in the public domain. It is not necessary for us to summarise their contents in this Decision, which is not for general publication.

Evidence

24. The Appellant set out his case in a letter to the Tribunal Secretary dated 4 February 2003.
25. The Respondent relied upon a Witness Statement by Stephen Gale, the Director of Business and Public Affairs for GCHQ, with enclosures (Exhibit SG1) and evidence regarding the law and practice in other countries (Exhibit SG2).

The Appeal Hearing

26. This took place on Friday 7 March 2003. No application was made for it to be held in public, and it was held in private pursuant to Rule 23(1) of The Data Protection Tribunal (National Security Appeals) Rules 2000.

Submissions

27. At the hearing, the Appellant developed his written submissions and he summarised his position as follows – "My position is very clear. I'm not a threat to national security. I'm not a risk to national security. I've done no harm to the economic well-being of the UK. I'm not a terrorist. I'm not a criminal and I'm not a saboteur. I'm not seeking to undermine Parliament. I'm not a spy and there's vital supporting data; my positive vetting certificate., my certificate of qualification, the Prime Minister's statement on vetting and Stephen Gale's view on vetting. I conduct my life, now and at all times in the past, in a lawful manner."
28. It was confirmed during the hearing that the Appellant as a GCHQ employee was regularly vetted for security purposes, at six-month intervals. He also told us that when he left, in 1989, he was told by the Security Department that his activities would be monitored for a further period of three years. Mr. Tam was not able to confirm this, but we have no reason to doubt that it is correct.
29. Mr. Tam, counsel, appeared on behalf of the Respondent. His principal submissions were the Appellant was challenging, not the reasonableness of the Certificate, but the decision made by GCHQ pursuant to the certificate in his individual case. That is not a matter for this Tribunal, Mr. Tam submitted, but for the Investigatory Powers Tribunal established under the Regulation of Investigatory Powers Act, 2000 ("RIPA"). In response to questions by the Tribunal, he submitted that the "GCHQ Arrangements" document attached to the Respondent's Reasons for issuing the Certificate, which as we understand the position is in the public domain, gives appropriate and sufficient guidance to GCHQ officials as to the Minister's policy in relation to subject access requests.
30. Copies of the written submissions and a full transcript of the hearing are available to both parties and it is unnecessary for us to summarise the submissions further in this Decision, which is not for general publication.

Issues

31. The oral hearing was particularly valuable in this case, because it enabled us to distinguish clearly between three different categories of personal data to which the Appellant's request relates. These are –

(1) The contents of his "personnel" file, which have been released to him in response to his request. This disclosure in fact is of little or no significance, because the documents in question are all ones which the Appellant himself provided to GCHQ or of whose existence he was already aware – such as his application for employment in 1986, security questionnaires which he completed and signed during his period of employment by GCHQ and other documents of that sort. No issue as to these documents arises in this appeal;

(2) Documents whose existence is admitted by GCHQ or which, on the evidence must, certainly exist. These are (1) the contents of the "vetting file" which GCHQ opens and keeps for all its employees, including confidential reports on prospective employees obtained by GCHQ from third parties and (2) personal data relating to surveillance or "monitoring" of former employees during the three years following their employment, which for the Appellant covers the years 1989 – 1992. In relation to this category, no question arises as to a NCND response to a request under section 7(1)(a) of the Act; GCHQ relies upon the Certificate to justify not complying with a request for disclosure under section 7(1)(b) of the Act; and

(3) Personal data which may or may not exist; that is, any data outside categories (1) and (2) which GCHQ may or may not hold, depending on whether there was additional surveillance or monitoring of the Appellant, when he was an employee or since he left in 1989, and specifically since 1992. It is in relation to this third category that the non-committal NCND reply has been given. Discussion

32. Mr. Tam is correct in his submission that the jurisdiction of the Tribunal under section 28(4) of the Act is limited to determining whether the Respondent had reasonable grounds for issuing the Certificate dated 8 December 2001. We are not directly concerned with the issue whether GCHQ's response to the Appellant's request was justified in this particular case.
33. This does not mean, however, that the facts of this case are not relevant to the issue under section 28(4). The Appellant's underlying submission is that a certificate which enables GCHQ to invoke "national security" even in a case where that claim is manifestly unreasonable and excessive, as he says that it is in his case, cannot be said to have been issued on reasonable grounds. The result, he says, is "absurd," and the Certificate which permits it must itself be regarded as unreasonable.
34. We will consider this submission separately in relation to categories (2) and (3) of personal data which we have identified above. First, however, we should say that the Appellant (in this or any other appeal) has not argued that section 28 requires the Respondent himself to respond to each individual request under section 7 of the Act; in other words, that the decision cannot be delegated. He submits that it should not be delegated to GCHQ itself in terms which permit this kind of unreasonable response.
35. Mr. Tam did not accept that the Respondent has 'delegated' any of his powers, and he submitted that, even if this were an appropriate description of the effect of the Certificate, nevertheless the scheme of the Act is consistent with delegating the power to decide whether an exemption applies to the data controller to whom the request is made. Section 7(4) is to this effect. However, we reject this submission. The data controller's decision under section 7(4) is subject to review by the Court (section 7(9)). The issue raised by this appeal is whether the Respondent had reasonable grounds for delegating the power to GCHQ when they were the data controller in question and there is no corresponding provision for appeal or review.
36. With regard to category (2), the issue is straightforward. The Certificate authorises GCHQ to refuse a section 7(b) or (c) request on grounds of national security when they consider that it is necessary to do so. We note, however, that the scope of the authority given to them by the Respondent is more restricted than the corresponding delegation to the Security Services by the Secretary of State for the Home Department in his (revised) Certificate dated 10 December 2001. The Respondent's Reasons are accompanied by the document "GCHQ Arrangements" giving extended guidance both as to the respondent's policy with regard to answering subject access requests and as to the procedures to be followed in individual cases. We consider that this guidance is desirable and is to be commended, and it is not necessary for us to decide in this appeal what the position would be if no such arrangements were put in place.
37. Category (3) raises the question whether the NCND reply is consistent with the Act, and if so in what circumstances it may properly be used. The Appellant does not contend that it can never be justified, and his primary submission that it should not be permitted to be used when the individual making the request is a former employee of GCHQ who was subject to a vetting process before, during and after his employment and who can assert as he does that he cannot have been a legitimate target of interest to GCHQ or to the Security Services since his employment ended. The Respondent's case, he submits, contradicts itself. GCHQ was satisfied then that he was suitable for employment in matters involving national security; answering his requests for his personal data under section 7(1) of the Act cannot reasonably be said to be prejudicial to national security now.
38. Among the Respondent's Reasons is the following broad statement – "If SIS or GCHQ said when it did not hold information on a particular person, inevitably over time those on whom it did hold information would be able to incrementally deduce that fact." (paragraph 5.4).
39. The Reasons also confirm that this is used to justify a non-committal answer, except when the fact that they hold relevant data has already been published, or when they are themselves willing to acknowledge it –

"There are circumstances when the neither confirm nor deny policy is not used. For example when the interests of national security require a disclosure." (paragraph 5.7).

40. Although the Certificate requires an exercise of discretion by GCHQ in every case, it permits the NCND reply even in a case where a definite response to the particular request would not itself be directly harmful to national security, because of the possible inference that might then be drawn in other cases where the NCND reply was given.
41. We find it difficult to accept that the NCND reply can always be justified on this ground, because as a matter of commonsense it may be thought that there are some cases where a definite response would not enable any inference to be drawn in other cases. However, despite our intuitive view, we have not been able to formulate any definition of those cases, possibly rare, where a definite reply could be given, as a general rule, without a potential risk to national security by reason of inferences which might be drawn in other cases. It seems inevitable that the decision in individual cases must be left to GCHQ themselves. The question is whether the Respondent had reasonable grounds for issuing the Certificate in a form which leaves the assessment of "national security" entirely to them.
42. This leads to the question whether, if the Certificate is valid, such decisions made by GCHQ are subject to control and supervision under the Act. This Tribunal has no power to review individual cases under section 28(4) (paragraph 33 above). Its jurisdiction under section 28(6) is not relevant when a NCND reply is given to a request under section 7(1)(a) of the Act, because by definition no personal data are identified. (Section 28(6) in any event has not been invoked in this appeal.) An application to the Court under section 7(9) would be met by the Certificate, which would stand as conclusive evidence under section 28(2). The only possible course for the applicant would be to bring proceedings against GCHQ for judicial review of their decision in the particular case. It seems unlikely that Parliament intended this in a case where national security considerations arise, having regard to the fact that this Tribunal was created for such cases under section 28. However, the limited scope of section 28 may have that possibly unintended effect.
43. It is in these circumstances that the Respondent places much reliance on the fact that GCHQ are subject to supervision and control by state agencies and bodies other than the Courts. He refers in particular to the Investigatory Powers Tribunal established under RIPA. For the reasons given in our (published) Decision in Mr. Gosling's appeal, we hold that-

(1) the jurisdiction of the IPT is defined widely enough to include a complaint that GCHQ were not justified in claiming that a NCND response(or the refusal to disclose data in Category (2)) was necessary to safeguard national security in the particular case ( though we are doubtful whether Parliament intended that it should routinely decide matters of this sort); and

(2) delegating to GCHQ the power of deciding these issues of national security is lawful and consistent with decisions of English and European Courts. Relevant sections of the Gosling Appeal Decision are attached hereto as Annex B.

44. The Tribunal has also considered whether the Certificate ought reasonably to include express restrictions on the exercise of the power delegated to officials of GCHQ. Among the possibilities are –

(1) express guidelines as to what factors are relevant and should be taken into account by the decision maker;

(2) a requirement that the decision shall be made by an official of certain seniority;

(3) the Certificate might contain an expanded definition of "national security"; and

(4) the Certificate might be worded so that there is a presumption against using the NCND reply, of in favour of disclosure, rather than expressing it as a proviso to an instruction that generally does apply.

45. The Respondent's Certificate is accompanied not only by "Reasons" but by the "GCHQ Arguments" document to which we have referred above. The guidelines so given are likely to be useful and effective, and it is not unreasonable to attach them to the Certificate, rather than incorporate them in the Certificate itself. If, as we conclude, there is no means of ensuring that they are complied with, except by complaining to the IPT or (possibly) by applying to the Court for judicial review, it is immaterial whether they form part of the Certificate, or not. (We note also that any such application to the Court might be refused on the ground that the IPT provides a sufficient safeguard against abuse.)
46. We do not regard either (2) or (3) above as practicable or useful additions to the guidelines set out in the "GCHQ Procedures" document, and we should add that we have been unable to find any judicial definition of "national security" even in those cases where the Courts have considered the extent of their powers to review executive decisions of that kind. Nor do we consider that (4) would be likely to have more than a cosmetic effect, though that alone may be regarded as a worthwhile improvement if the Certificate is re-issued at some future date.
47. This appeal raises a specific issue with regard to the "vetting File" which GCHQ acknowledges holding on the Appellant as a former employee. Mr. Tam submitted that there are strong reasons why, in the interests of national security, the contents of such files should not be made public, or disclosed to the former employee. GCHQ should be able to communicate freely with third parties for this purpose, on a strictly confidential basis, and the methods they use to vet future and existing employees should likewise remain confidential. Disclosure of particular replies or of methodology adopted clearly could create a risk of national security being compromised. We accept this submission, which we must observe has the effect of weakening the Appellant's contention that withholding the vetting file, and relying on the NCND formula, was an "absurd" decision in his case. We bear in mind the House of Lords has recognised the importance of confidentiality for informants to public bodies in carrying out their functions: D. v. N.S.P.C.C. [1978] AC 171.
48. The Appellant was also concerned by the possibility that the contents of his vetting file, and any other personal data held by GCHQ, may have been inaccurate when they were acquired or may have become inaccurate or no longer relevant since that date. Mr. Tam reminded us that the Certificate does not exempt GCHQ from the operation of the fourth and fifth 'data protection principles' set out in Schedule 1 to the Act –

"4. Personal data shall be accurate and, where necessary, kept up to date.

5. Personal data processed for a purpose or purposes shall not be kept for longer than is necessary for those purposes."

How relevant these principles are, however, to the contents of a vetting file for and ex-employee is not clear, to us at least. Mr. Tam stressed that the principles apply only so far as is "necessary," and if the data are not made available to the individual concerned this remains a matter for the data controller himself. When the Certificate permits data to be withheld or the NCND reply to be given, it is difficult to see how the principles can be enforced. We recognise this as a significant argument in favour of disclosure, which we have taken into account in reaching our conclusions.

Conclusions

49. We conclude that the Respondent had reasonable grounds for issuing the Certificate dated 8 December 2001. Our primary reason is that an unjustified claim by GCHQ to give a NCND response or to withhold personal data on national security grounds can be made the subject of a complaint to the Investigatory Powers Tribunal under the Regulation of Investigatory Powers Act 2000.
50. We have no jurisdiction to rule on whether a NCND response or withholding data by GCHQ in accordance with the Certificate was justified in any particular case. The Data Protection Act, in our view, does not provide any means of challenging the GCHQ decision, either before this Tribunal or before the Courts. It appears to us that the appropriate statutory method of challenging the decision in an individual case is by making a complaint to the Investigatory Powers Tribunal.
51. The appeal is therefore dismissed.

(Signed) Sir Anthony Evans (President)

James Goudie Q.C.

Kenneth Parker Q.C.