Associate Edward Rees looks at the recent case of X v The Transcription Agency LLP and another [2023] EWHC 1092 (KB) (9 May 2023), in which the High Court drew on principles of judicial independence and some post-Brexit EU case law to support a broad construction of the UK GDPR's 'judicial exemption'.
In what is understood to be the first High Court decision on this issue, the court opted for a broad construction of the ‘judicial exemption’ to provisions of the United Kingdom General Data Protection Regulation, Retained Regulation (EU) 2016/679 (UK GDPR) under the Data Protection Act 2018 (DPA 2018). Judges may act in a ‘judicial capacity’, and benefit from the judicial exemption, in a wider range of circumstances than internal guidance to the judiciary had previously envisaged. Additionally, third parties (such as court transcribers) may also rely on the judicial exemption to the extent they may be controllers of the information in question. On a procedural front, authority now exists indicating that the High Court may exercise its inherent jurisdiction to consider the withheld personal data in a closed session without the claimant/data subject present.
What are the practical implications of this case?
We now have High Court authority on how to construe the DPA 2018’s judicial exemption, and where to draw the line between judges who are and are not processing personal data in a judicial capacity. Practitioners may be generally more accustomed to courts being ‘pro-data subject’ and interpreting UK GDPR exemptions restrictively. However, the judge in this case took account of the important principle of maintaining judicial independence to allow for a broader interpretation. Accordingly, we now know the judicial exemption can apply to communications with court staff and third parties, and that it continues after a judgment is handed down.
The court declined to rely on internal data protection guidance issued to the judiciary as a tool for interpreting DPA 2018. Interestingly, it did draw on post-Brexit EU case law in reaching its conclusions.
Mrs Justice Farbey adopted a ‘purposive’ approach to DPA 2018, asserting it is not intended as a mechanism for obtaining documents with a view to engaging in further litigation or holding judges to account. The appropriate route for challenging a judge would be the appellate jurisdiction or the Judicial Conduct Investigations Office (JCIO), where matters of judicial conduct are involved.
The judgment also addresses a procedural gap in DPA 2018; while previous data protection legislation had expressly allowed the courts to consider withheld information without disclosing the same to the data subject, the current legislation is silent on this point. Farbey J has now provided welcome guidance to practitioners that the tried-and-tested model of ‘open’ and ‘closed’ sessions used in the Freedom of Information Act 2000 (FOIA 2000) and Environmental Information Regulations 2004 (EIR 2004), SI 2004/3391 context is also applicable in UK GDPR proceedings.
What was the background?
Following a series of High Court claims against a government department, the claimant (X) found himself in detailed assessment proceedings in relation to the costs orders made both in favour of and against him. The Costs Judge, who was the second defendant in this case, awarded X only a small fraction of his costs. X had complained about the second defendant to the JCIO, which dismissed the complaint in its entirety.
X made a data subject access request (DSAR) to the second defendant for his personal data, including the second defendant’s communications with the judiciary, court administrators and transcription companies. In a response on behalf of the second defendant, HMCTS stated that, where the requested information was not already in X’s possession, it would fall into one of two categories of exemption from disclosure under DPA 2018. Firstly, the judicial exemption under DPA 2018, Sch 2 Pt 2, s 14 applied. Secondly, the presence of third-party personal data meant that anything not covered by the judicial exemption would be exempt from disclosure under the DPA 2018, Sch 2 Pt 3, s 16(1)–(3).
X made a separate DSAR to the first defendant, which was a transcription agency involved in producing transcripts of the earlier proceedings. X sought copies of the transcription agency’s communications both internally and between it and the second defendant and court offices. The first defendant relied on the same exemptions as the second defendant.
X challenged both defendants’ reliance on the exemptions—he sought declaratory relief but not compensation. X’s claims against both defendants were dismissed.
What did the court decide?
The key takeaways from Farbey J’s judgment can be divided into two categories, discussed below.
The scope of the judicial exemption
The court took the view that the judicial exemption under DPA 2018 should be broad in scope and construed to cover all judicial functions. Therefore, it covers more than just the personal data processed when a judge is producing a judgment or decision. It extends to communications with HMCTS staff and clerks (where these relate to the judge’s case load) and continues after judgment has been handed down. It also covers a judge’s correspondence with a transcription agency, drafts of transcriptions, and communications with the JCIO.
X relied heavily on ‘Data Protection: The Responsibilities of the Judiciary’ (Version 1/2019, issued 7 May 2019) (the Judicial Guidance), which is internal guidance addressed to the judiciary and cites ‘administrative functions carried out by members of the judiciary eg …communications with HMCTS staff, judges’ clerks…’ among its examples of ‘non-judicial processing’. The judge concluded the examples in the Judicial Guidance were non-exhaustive and not all of them would stand up to scrutiny, especially when such communications are ‘obvious candidates for judicial processing’. Farbey J also disagreed with the claimant that the Judicial Guidance could function as an external aid to interpreting the DPA 2018, or that refusing to do so would render the Judicial Guidance otiose.
Instead, the court’s broad interpretation of the judicial exemption was informed by long-standing English common law principles recognising the independence of the judiciary and its corresponding immunity from civil liability (Anderson v Gorrie [1895] 1 QB 688; Hinds v Liverpool County Court [2008] EWHC 665 (QB)). Post-Brexit EU case law touching on the EU’s General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR) and judicial independence also factored into the judgment. Farbey J considered X v Autoriteit Persoonsgegevens [2022] 3 CMLR 26, 1069, where the Court of Justice adopted a broad interpretation of ‘judicial capacity’ under article 55(3) of the EU GDPR, in support of the policy objective of judicial independence and keeping courts out of the reach of Member States’ data protection authorities. The court’s approach was also purposive; a broad judicial exemption upholds the notion that DPA 2018 should not be used as a vehicle to extract information about judges.
The procedure for considering whether the judicial exemption applies to the withheld information
Farbey J held that the court had an implied power to consider the withheld information in a ‘closed’ session, without X or his counsel present. Although the DPA 2018 lacked express provision for this procedure (in contrast with the predecessor legislation, section 15(2) of the Data Protection Act 1998), the High Court’s inherent jurisdiction filled this statutory lacuna. The court rejected X’s argument that the omission of an equivalent to DPA 1998, s 15(2) meant that the current legislation should be interpreted as not allowing ‘closed’ sessions. Accordingly, there is now a precedent for UK GDPR disputes to be heard in ‘open’ and ‘closed’ sessions (as appropriate), equivalent to the procedure endorsed in Browning v Information Commissioner [2014] EWCA Civ 1050 in relation to FOIA 2000 and EIR 2004 proceedings.
Case details
- Court: King’s Bench Division
- Judge: Mrs Justice Farbey
- Date of judgment: 9 May 2023
This article was first published by Lexis®PSL on 15 June 2023.
