2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]

England and Wales High Court
(Queen's Bench Division) Decisions
You are here: BAILII >> Databases >> England and Wales High Court (Queen's Bench Division) Decisions >> Lin &
Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)
URL: http://www.bailii.org/ew/cases/EWHC/QB/2015/2484.html
Cite as: [2015] EWHC 2484 (QB)

[New search] [Context ] [View without highlighting] [Printable RTF version] [Help]
Neutral Citation Number: [2015] EWHC 2484 (QB)
Case No: HQ15X0311

IN THE HIGH COURT OF JUSTICE
QUEEN'S BENCH DIVISION
Royal Courts of Justice
Strand, London, WC2A 2LL
25/08/2015

Before:
MR JUSTICE GREEN
____________________
Between:

(1)  Zaw Lin 
(2) Wai Phyo
- and Commissioner of Police for the Metropolis

Claimants
Defendant

____________________
Gerry Facenna, Julianne Kerr Morrison, and, Nikolaus Grubeck (instructed by Leigh Day) for
the Claimants
Anya Proops, and, Christopher Knight (instructed by instructed by Directorate of Legal
Services, Metropolitan Police Service) for the Defendant
Hearing date: 21st August 2015
____________________
HTML VERSION OF JUDGMENT
____________________
Crown Copyright ©
Mr Justice Green :
http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

1/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

A. Introduction: Issues and facts
(i) The issue / preliminary matters
1. This case concerns the application by two defendants facing capital charges in criminal
proceedings in Thailand for disclosure to them of personal data held by the Defendant, the
Commissioner of Police for the Metropolis ("MPS"). The data is contained in a confidential
report ("the Report") prepared by the MPS into a murder inquiry conducted in Thailand. The
purpose of the Report was to enable the MPS to provide reassurance to the families of the
victims about the investigation being conducted by the Thai authorities. The application is
brought under section 7(9) of the Data Protection Act 1998 ("DPA 1998").
2. This matter has been brought before the Court on an urgent and expedited basis during the
vacation. As of the present date the trial of the Claimants (who are the accused in the Thai
criminal proceedings) in Thailand is ongoing having commenced in early July 2015. The
prosecution has nearly completed presenting its case; the accused (the Claimants in these
proceedings) will open their defence shortly and it is anticipated that the trial will continue until
mid/late September 2015, when the court will adjourn to consider the evidence and arrive at
verdicts. The decision is taken by a judge; there is no jury. I am told that the defence can tender
evidence, which therefore includes any disclosure ordered as a result of these proceedings, until
the end of their case.
3. In order to address certain procedural issues arising I convened a case management hearing on
19th August 2015 and the substantive hearing was held on 21st August 2015. Judgement is now
being given upon an expedited basis. I indicated to the parties at the case management hearing
on 19th August 2015 that, having made enquiries myself by that stage and regardless of
outcome, I would grant permission to appeal and that the Court of Appeal would hear any
appeal very expeditiously in order that the final outcome of this case would be in time to enable
any disclosure that was ultimately ordered to be assessed and placed before the Thai court, if
that was considered appropriate. I took this view because the issues of both law and fact are
complex, novel and difficult. The stakes are very high for both sides. For the Claimants they
could hardly be higher: life or death. For the Defendant it has been urged upon me that an
incursion by a court into the ability of the police, or of Ministers, to make promises of
confidentiality to foreign authorities, could have substantial and adverse consequences for law
enforcement and/or the fulfilment of public policy or security objectives.
4. In order to explain my reasoning it has been necessary in this judgment to record the arguments
of the accused in the Thai proceedings. I should make clear at the outset of this judgment that,
in setting out arguments made by the parties and in particular the Claimants about the Thai
criminal investigation and the proceedings, nothing that I say is intended to express any view by
this Court whatsoever on the merits of the issues arising in the Thai courts or upon the conduct
of those proceedings by the authorities there.
5. On 19th November 2014 each Claimant submitted a subject access request to the MPS under
section 7(9) DPA 1998 (set out below at paragraph [72]). They each sought disclosure of
material held by the MPS in connection with its review. The MPS accepts that, prima facie, it
does hold information ("personal data") relating to the Claimants. However, it relied upon
section 29 DPA 1998 (set out below at paragraph [74]) which permits access requests to be
refused in certain defined circumstances relating to criminal law enforcement. In this case the
MPS says that in preparing the Report: (i) it was processing the Claimant's personal data for
purpose of family liaison which it submits is a legitimate part of crime enforcement; and (ii), it
was proportionate on the facts to withhold the data, even in a death penalty case.
6. The MPS has confirmed that the total of the potentially relevant "personal data" is to be found
http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

2/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

in drafts of the final report and in one email from 2014. I shall refer throughout this judgment to
this material generically as the "Disputed Information", but I also refer to the "Report" to
indicate the final version of the Report prepared by DCI Lyons and his team.
7. With that introduction I turn now to the facts.
(ii) The basic facts: the murders
8. On 15 September 2014 two young British tourists, Hannah Witheridge and David Miller, were
brutally murdered on the island of Koh Tao in Thailand. Hannah was also raped. The crimes
made international news. The Claimants in this case –  Zaw Lin  and Wai Phyo – are
Burmese nationals who were living in Thailand. They were arrested and charged by the Royal
Thai Police ("RTP") with the murders of Hannah and David. The Claimants confessed to these
attacks both during interviews with the police and then later during a video recorded
demonstration of how they acted before police officers. Later they were taken to the scene of
the murders where they re-enacted the attacks this time with the world's media in attendance.
Later on the Claimants alleged that the confessions had been tortured out of them and the
confessions have now been retracted. They have subsequently complained of the conduct of the
prosecution and by the courts and they allege they cannot obtain a fair trial. If convicted the
Claimants face the death penalty and indeed this is actively sought by the prosecution. The
incident, but also the misgivings about the handling of the prosecution arising out of the
Claimants allegations, has received worldwide coverage in the media. For obvious reasons the
case is one of great sensitivity to the Thai authorities.
(iii) The deployment of the DCI Lyons of the MPS to Thailand and the concerns
expressed by the MPS about confidentiality
9. The misgivings raised were sufficient for the Prime Minister to engage in discussion with the
Prime Minister of Thailand with the consequence that the two reached agreement that The
Commissioner of Police for the Metropolis (MPS) would send a team led by a senior officer to
Thailand to conduct an independent inquiry. That senior officer was DCI Lyons. The legal basis
for this cooperation was section 26 Police Act 1996. This empowers a police authority to
provide advice and assistance to foreign police authorities and it includes a power to send police
officers on a temporary basis to a third country to engage with such foreign authorities. The
power can only be exercised with the express authority of the Secretary of State subject to such
conditions as the Minister might consider appropriate.
10. In the present case the authority granted by the Minister took account of the fact that Thailand
maintained the death penalty and that in the absence of assurances about the possible
punishment that might be imposed at the end of the trial the officers assigned to go to Thailand
were to undertake, in essence, a listening or observer role. The authority emphasised the need to
avoid "straying in the area of advice and support". Evidence before the Court included that
from Ms Cressida Dick, an Assistant Commissioner with the MPC seconded to the Foreign
Office but at the time an Assistant Commissioner responsible for Specialist Crime and
Operations. She has explained that because assurances about the death penalty were not
forthcoming "…the s26 authority was prepared on the basis that the initial stage of his [DCI
Lyons's] deployment would be comprised of observational work which would serve the family
liaison function, and the wider needs of the families".
11. In paragraph 15 of her witness statement Ms Dick has explained that "… the Commissioner of
the RTP had sought and obtained express agreement from DCI Lyons at the outset that his
observations of the deployment, as set out in the Report, would only be shared with the Miller
and Witherbridge families, and would not be disclosed any further".
12. There are three further points which arise from this evidence. These are: that agreements of this
http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

3/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

sort are routine; that they are considered to be "essential"; and, that without them the
engagement would simply not occur. The Assistant Commissioner thus explains that in her
experience "… agreements of this kind are commonplace and essential where foreign
governments and policing authorities provide us with access to their information, and vice
versa, whether on an ad hoc or routine basis. I was content that DCI Lyons's agreement was
wholly appropriate, and it is my view that without such agreement, it would not have been
possible for DCI Lyons's team to achieve any of their objectives".
13. The purpose of the engagement was therefore not that the MPS could conduct its own
investigation. Further, because the MPS will not, as a matter of as a matter of settled policy,
assist foreign authorities to pursue investigations where there is a risk of the imposition of the
death penalty, the purpose of the inquiry was also not to enable the MPS to provide advice to
the Thai authorities. In further consequence the Report has not been provided to the Thai
authorities.
14. Nonetheless as is evident from the documents that I have read, the Thai authorities and the RTP
cooperated fully with DCI Lyons and his team who were, in consequence, able to produce a
comprehensive report on all aspects of the investigation. This has enabled the MPS to provide
reassurance to the families of the victims. The RTP was of course fully aware of the reaction of
the international media. The evidence of Ms Dick indicates that the Thai authorities were
sensitive to the risk that a report might be used to engender further public criticism but also, and
importantly, that it could if publicised prejudice the trial planned to be held in Thailand. This
latter point was uppermost in the thinking of the MPS. Assistant Commissioner Dick was
concerned that the MPS's work could inadvertently prejudice the trial. She wished to ensure that
any work undertaken by DCI Lyons and his team did not "become part of the Thai evidential
chain". Had this occurred it risked placing the MPS, its officers and the UK "… at extreme
legal and reputational risk". In paragraphs 18 and 19 of her statement Assistant Commissioner
Dick states:
"18. It would be a significant and I believe a damaging step to provide the Report
or parts of it to the suspects to use in their defence when we were not willing to
give it to the Thai authorities. I believe that it would significantly undermine the
Thai authorities' relationship with UK law enforcement, if not the wider
relationship between the two governments given the very high-profile nature of the
case. In future cases, it would have a significant impact on Thai cooperation with
UK police investigations and would affect the wide variety of cases where UK
citizens, businesses and interests because drawn into the Thai criminal justice
system, whether as victims, suspects, witnesses or family members. The reputation
of UK policing and "Scotland Yard" in particular is very high internationally. This
enables significant success and support around the world which benefits UK
citizens and interests. I am concerned that the breach of trust involved in releasing
the report in this manner would affect the UK police and MPS reputation beyond
Thailand.
19. Whenever we approach sharing or receiving information internationally we will
always consider the issue of confidentiality. If we do not receive the appropriate
assurances about how our information will be treated within another country we
cannot cooperate with them. Equally, we would not expect another agency in
another country to cooperate with us if they did not receive the assurances they
may receive about how their information may be used."
15. Later Assistant Commissioner Dick expressed the opinion that if the legal risks of deployment
of teams abroad included the risk of subsequent disclosure pursuant to the DPA 1998 then this
would: "… make it very difficult for the MPS to give assurances the foreign authorities require
to preserve the integrity of their own criminal procedures".
http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

4/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

16. Detective Superintendent John Sweeney of the Homicide and Major Crime Command in the
MPS also gave detailed evidence but I will only summarise the overarching themes. He gave
evidence about his extensive experience of arranging and conducting foreign engagements of
this sort. He echoed the concerns of Assistant Commissioner Dick. He also gave evidence about
the practical difficulties of securing deployment in foreign jurisdictions given that invariably the
very reason why a deployment takes place is because the incident abroad is complex or
controversial. This in turn invariably implies a high level of sensitivity on the part of the foreign
authority as to the use to which any resultant report might be put; "acute diplomacy" is the order
of the day and securing the trust of the foreign authorities is an important and often difficult
task for the MPS.
(iv) The Report of DCI Lyons
17. DCI Lyons duly produced his Report and he gave a detailed verbal summary to the families
18. I propose now to summarise the Report. I am conscious of the need not, in effect, to disclose the
Report incidentally through this judgment. It is however necessary to say what I can about the
Report because it lies at the heart of this case and because I should do what I can to explain to
the Claimants (and also to the public) the basis of my judgment. In describing the Report I have
therefore relied upon the evidence in the public domain given by the MPS itself as to the
contents of the Report. I have also relied upon information as to its contents from press reports
including press statements issued about the Report by the families via the Foreign and
Commonwealth Office ("FCO"). I have, of course, had full sight of the actual Report and drafts
thereof and all other material which contains "personal data" about the Claimants. I am clear
that the description that I give below preserves confidentiality. DCI Lyons in his Witness
Statement to the court provided a summary of the Report and that is the starting point. The
Report sets out the background to the deployment of DCI Lyons and his team to Thailand. It
records the misgivings that were circulating in the media about the investigation though of
course the Report does not indicate that these misgivings were accepted. Instead of referring to
the Report for details of these "misgivings" I can explain them by reference to material in the
public domain in the form of press coverage and witness statements and other evidence placed
before me in this case.  Zaw Lin  says in his statement that when he was arrested he was
stripped naked and exposed to extremely cold air from an air conditioning unit. He says he was
beaten, kicked and punched. He says that the police held a plastic bag over his head and neck to
suffocate him. He says there were threats to kill him, electrocute him and burn him and he
denies that he had a lawyer or translator present when interviewed and that he was deprived of
food until he eventually signed a confession because he could not withstand any further
mistreatment. Wai Phyo has also given a witness statement to this court. He makes the same
complaints, in more or less identical language. These allegations are strenuously denied by the
RTP. In referring to these allegations I reiterate: I am doing no more than recite evidence that is
in the public domain. I can also refer to a letter from Mr Ross Allen, head of Consular
assistance, the FCO, dated 27th November 2014 to Ms Maya Foa (who has given evidence in
this case for the Claimants) of the Death Penalty Team at Reprieve. Mr Allen acknowledges the
concerns of the Government about allegations of corruption and mistreatment of the accused
and says that these concerns have been raised with the RTP. He explains that the Prime Minister
had also had discussions with the Thai Prime Minister about the matter. He explains that
because of these concerns "... we exceptionally agreed that a UK Police team should review the
Thai investigation". This I believe suffices to explain the background to the Report. The Report
also refers to the fact widely reported in the press that the reconstruction of the crime scene had
been insensitive to the families as had the release of photographs of the victims on the beach.
19. The Report describes the victims and their characters in glowing terms: they were talented and
blameless young people who were brutally murdered whilst on holiday.
http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

5/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

20. The Report summarises the evidence collected by the RTP. It includes summaries of physical
evidence collection relating to the accused. It summarises the witness evidence relating to the
movements of the accused and their activities. DCI Lyons makes the comments that "[a]s may
be expected" (ie in a report which describes an investigation into a crime) "... much of this
material also contains the personal details of third parties, namely witnesses, other identified
individuals (including members of the families of Hannah and David), Thai police officers,
translators and lawyers." I have emphasised the words "as may be expected" because it
highlights the point that in many respects what is being described in the Report is no more than
the routine conduct of a serious crime investigation. This is not a Report which contains, for
instance, state secrets.
21. In his Witness Statement DCI Lyons describes his approach to the Report as being, in effect,
one of studied neutrality. He says: "It is not, and was never intended to be, an attempt to present
a case for or against any particular suspect. It is a summary of the RTP investigation, the
evidence collected and the lines of enquiry pursued so far as we saw from our observations. It
was my role to approach the RTP with an open mind, and this was the way in which I
approached the drafting of my Report".
22. The Report describes the approach adopted by the MPS in preparing for its inquiry. It then
addresses the details of the crimes. It chronicles the events leading up to the discovery of the
bodies. The Report sets out in detail the steps taken by the RTP in investigating the crime and in
pursuing suspects and leads. It provides an account of how evidence was collected such as the
performance of mass DNA testing, the identification and retrieval of CCTV footage from across
the island, and the retrieval and collation of cell phone data etc. It describes the autopsy results.
It records the third party witness evidence collected.
23. With regard to the accused the Report describes the events leading up to their arrest and it
records their interviews including their confessions. In particular the Report makes reference to
the fact that confessions were made at more than one time. DCI Lyons points out that he cannot
comment upon the allegations made later that the confessions were procured by torture "in an
open statement" but he does say that the accused repeated their confessions in court before the
judge in the presence of their own lawyers. He also says that the accused have not adduced
medical or other evidence which might corroborate their torture claim. I should add for the sake
of completeness that the Claimants did not accept the accuracy of all of these statements.
24. The report sets out in some detail relevant Thai criminal law procedures. It chronicles meetings
with the families. It makes a very limited number of recommendations concerning matters of
procedure and, for instance, in respect of the handling of relations with the families. It does not
comment qualitatively upon the Thai investigation in any material sense.
25. It is thus fair to say that in very large measure the Report is descriptive and contextual. It does
not contain value judgments about the Thai authorities. Even where it does refer to the evidence
that forms the core of the prosecution case it is largely general or merely summarises what is in
documents which the MPS team were shown. Very roughly I estimate that the percentage of
information contained in the overall Report which would amount to personal data which would
even in principle be subject to disclosure under the DPA 1998 would be in single digits. It is
apparent from the above that the preponderant part of the Disputed Information could not ever
be subject to disclosure under the DPA 1998.
26. The description that I have given above is of the Report as a whole; not the "personal data"
therein. It will be clear however that the personal data that is found within the Report relates to
the above matters. Of course it does not follow that in relation to any given, specific, item of
personal data that it is necessarily a comprehensive or cogent piece of stand-alone evidence.
(v) The submission of subject access requests under the DPA 1998 and
http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

6/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

subsequent events
27. As I set out at the start of this judgment on 19th November 2014 each Claimant submitted a
subject access request to the MPS under section 7(9) DPA 1998.
28. In their Witness Statements before this court the Claimants have explained why they consider
their applications to be valid. Each makes essentially the same points: (i) that the information
contained in the Report might be incorrect; (ii) that at the time the Report was prepared the
accused had not then been shown any of the evidence that the MPS team had sight of; (iii) that
the MPS team had access to at least part of the case that the RTP was going to advance; (iv) that
the Report might contain information that was useful to the accused as part of their defences;
(v) that were many false statements made in the press about the accused and these might be
perpetuated in the Report; (vi) that these falsehoods might be given greater publicity if the
Report was made public ie the information shared.
29. Much of the reasoning is focused upon establishing that the Report must contain "personal
data". This is not now an issue in dispute. The MPS accepts that it does. The Claimants have
endeavoured to clothe their arguments in the somewhat technical language of the DPA. It seems
to me that the bottom line of these arguments, stripped bare of technical garb, can be put in two
ways. First, the views of the MPS carry weight. Scotland Yard has an international reputation.
If the Report is seen as favourable to the prosecution and contains material supportive of the
RTP investigation (which is in effect how the Claimants say it has been presented in public by
the families) then they should have the right to see the personal data so they can correct any
misapprehensions. Secondly, that in any event they should be able to use any personal data
which is favourable to their defence.
30. The MPS refused the requests upon the basis that the Disputed Information that was held by the
MPS which would otherwise be subject to disclosure was exempt from disclosure under section
29 DPA 1998. This provides an exemption from disclosure in relation to data relating to
criminal enforcement activities. In a letter of 19th December 2014 the MPS contended that: the
UK officers deployed to Thailand had not conducted any investigation into the murders; that the
Thai authorities permitted the MPS officers to have observer status only; that the MPS did not
provide advice or assistance to the RTP; that the MPS did not take physical possession of any
evidence; that the RTP provided to the MPS an interpreter who translated some of the
documents for the MPS; that the MPS subsequently visited the families of the deceased to
explain verbally limited aspects of the investigation as well as the judicial process in Thailand;
that none of the MPS officers conducted or participated in or assisted in any witness interviews
nor were present during interviews; that the officers did not take photographs or measurements
of any crime scene; and that no officers conducted, assisted or observed any test or analysis
carried out.
31. The MPS sent letters dated 23rd December 2014 to the Claimant's legal representatives in which
it was stated that disclosure would be likely to prejudice the prevention and detection of crime
and/or the apprehension or prosecution of offenders.
32. The position of the Claimants as now pleaded in the Particulars of Claim can be summarised in
the following way. The Claimants are concerned that because of the very high profile nature of
the case they risk not receiving a fair trial in Thailand. They refer to media coverage which is,
they submit, hostile to them. In particular they cite the public reaction of the families of the
victims to the report given to them by the MPS. Specifically they refer to the fact that the FCO
issue a joint statement on behalf of the families on 6th December 2014 in which the families
said they were confident in the work carried out by the Thai authorities and that from what they
had seen the suspects had a difficult case to answer. The statement included these words: "the
evidence against them appears to be powerful and convincing". The statement however also
http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

7/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

says this: "They [i.e. the accused] must respond to these charges and their arguments must be
considered with the same scrutiny as those of the prosecution…" The Claimants also cite the
public reaction of the Thai authorities to the favourable response given by the families
following receipt of the MPS verbal summary: "Relatives of the deceased in the UK have stated
that they are confident in the evidence in the Koh Tao case and the evidence was clear beyond a
shadow of a doubt". This material was covered in the Thai press.
33. They submit that having access to their own personal data would not undermine the prosecution
but would remove or reduce the risk of prejudice of unfairness created by the MPS sharing the
Claimants' personal data with the families and the dissemination of the gist of the report into the
public domain. They say that they could correct inaccuracies in that data.
(vi) The issue
34. The action is brought under section 7(9) DPA 1998. The action raises an important point about
the extent to which police authorities, which are cooperating with foreign police authorities,
either to further the latter's inquiries or to gather information for their own purposes, must make
the fruits of their labour available in so far as it contains personal data which falls within the
scope of the DPA 1998.
35. The relevant legal framework which governs this question derives from both EU and domestic
law; and there is also a strong input from the European Convention on Human Rights ("the
Convention"). The relevant EU measure is Directive 95/46/EC of the European Parliament and
of the Council of 24 October 1995 on the protection of individuals with regard to the processing
of personal data and on the free movement of such data ("The Directive"). The domestic
implementing measure is the DPA 1998.
36. The dispute between the parties boils down to a relatively narrow compass which concerns the
powers of the MPS to withhold data. In short there is significant common grounds between the
parties which means that it is agreed that prima facie the Claimants are entitled to disclosure of
personal data about them contained in the Disputed Information unless the MPS can invoke an
exemption from disclosure. It is thus common ground that: (i) the MPS is a data controller
within the meaning of section 1(1) DPA 1998; (ii) the Claimants are data subjects within
section 1(1) of the Act; (iii) the Disputed Information contains some material that amounts to
personal data; and (iv) but for the operation of any exemption the MPS would be bound to
disclose to the Claimants that personal data. The issue thus turns on whether the MPS has a
lawful right to refuse access. The Directive in two places (Articles 3 and 13) sets out that it does
not apply to matters outside the scope of EU law (which in large measure includes international
criminal law enforcement matters) and in any event even where EU law applies Member States
are empowered to introduce into national law exemption from disclosure based upon (loosely)
considerations of criminal law enforcement. The heart of the dispute in this case is about
whether, on the facts of this case, the MPS was entitled to withhold access.
37. I should at this stage briefly address a concern that the Claimants have about the identification
by the MPS of specific items of "personal data" in the Report. In oral argument Mr Facenna for
the Claimants submitted that I should be sceptical of the claim by the MPS that the amount of
personal data in the Report was small. I heard submissions about the scope and effect of
sections 1 and 2 DPA 1998. Mr Facenna in particular submitted that a Report that was about a
crime allegedly committed by the two Claimants should in very large measure be treated as
personal data, more or less in its entirely. He referred me to the Guidance issued by the
Information Commissioner "Determining what is personal data". On pages 16 and 17 the
following is stated:
"It is important to remember that it is not always necessary to consider
'biographical significance' to determine whether data is personal data. In many
http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

8/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

cases data may be personal data simply because its content is such that it is
'obviously about' an individual. Alternatively, data may be personal data because it
is clearly 'linked to' an individual because it is about his activities and is processed
with the purpose of determining or influencing the way in which that person is
treated. You need to consider 'biographical significance' only where information is
not 'obviously about' an individual or clearly 'linked to' him.
When considering 'biographical significance', what is important is whether the data
go beyond recording the individual's casual connection with a matter or event
which has no personal connotations for him. Does the processing of this data affect,
or is it likely to affect, the individual? Data may, for example, have personal
connotations for an individual if it provides information about an individual's
whereabouts or actions at a particular time.
Example
Where an individual is listed as an attendee in the minutes of a meeting
then the minutes will have biographical significance for the individual
in that they record the individual's whereabouts at a particular time.
The fact that an individual attended the meeting will be personal data about that
person. However, this does not mean that everything in the minutes of that meeting
is personal data about each of the attendees.
38. I do not go so far as to construe the whole Report as constituting personal data. Whilst it is
correct that it was compiled after the Claimants were arrested as suspects it is nonetheless a
report about an investigation as a whole and it contains a good deal of information about
matters which are not directly or indirectly about the Claimants. It is possible that the MPS has
erred on the side of caution, rather that adopting an expansive interpretation of personal data. In
the extremely limited time available I have not been able to perform a very detailed item by
item analysis of the exact and true parameters of the personal data. But I have been very alive to
the fact that the identification on the part of the MPS might, in all good faith, be conservative
and I have certainly borne this in mind when reviewing the actual evidence and have, as I
explain more fully below, given the Claimants the benefit of the doubt where I have been
uncertain.
B. The procedure to be adopted to determine the dispute
39. The issue that I have to decide gives rise to troubling and significant problems of procedural
fairness. I have been provided with a copy of the Disputed Information on a closed basis for my
inspection, in other words it has been shown to me but not to the Claimants or their
representatives. I have power under section 15(2) DPA 1998 to receive information which is not
shown to the Claimants. This provides: E+W+S+N.I.
"(2) For the purpose of determining any question whether an applicant under
subsection (9) of section 7 is entitled to the information which he seeks (including
any question whether any relevant data are exempt from that section by virtue of
Part IV) a court may require the information constituting any data processed by or
on behalf of the data controller and any information as to the logic involved in any
decision-taking as mentioned in section 7(1)(d) to be made available for its own
inspection but shall not, pending the determination of that question in the
applicant's favour, require the information sought by the applicant to be disclosed
to him or his representatives whether by discovery (or, in Scotland, recovery) or
otherwise."
http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

9/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

40. Section 15(2) thus empowers me to "inspect" the information in issue but I have no power to
compel the MPS to provide it to the Claimants. The MPS has moreover made it very clear that
it will not provide the Report voluntarily to the Claimants.
41. Prima facie, if the MPS is correct and the material is immune from disclosure because of a
statutory exemption then it would defeat the purpose of the statutory exemption if the Claimants
were to be given sight of the material for the purposes of advancing their arguments.
42. On the other hand if the Claimants are denied access they are hindered in their ability to
advance arguments both in rebuttal of those advanced by the MPS and, equally, to advance a
positive case as to the probative and forensic value of the data to their defence. The issue before
me is unlike a traditional PII application brought in the course of criminal proceedings where
the court, if it considers that the material the prosecution wishes to withhold from disclosure (eg
about an informant) would be of value to the defence, can in effect put the prosecution to an
election: disclose or withdraw. In the present case I do not have the prosecution in the Thai
proceedings before me and do not have power to put them to that election and of course they do
not possess the personal data anyway. The present case is also unlike the closed material
hearings that occur in security and terrorism cases in this jurisdiction where special advocates
may be instructed to appear to represent the interests of the accused.
43. I note that the Court of Appeal in Durant v Financial Services Authority [2003] EWCA Civ
1746 ("Durant") was also shown the disputed information in issue is that case (cf at paragraphs
[2] and [12]) and it was the subject of witness statement evidence from officials within the FSA.
No particular procedure seems to have been adopted to enable the applicant to advance
submissions cognisant of the content of the Disputed Information. However the facts of that
case were a very far cry indeed from those before me.
44. I cannot, in these proceedings, ignore the fact that this is a death penalty case. I confess to
profound unease at a procedure whereby a disclosure exercise is being conducted with the
accused arguing with their eyes covered. It was essentially for this reason that I convened the
case management hearing on 19 August 2015. At that hearing the following became clear:
First, the MPS is adamant that it will not disclose the Disputed Information
to the Claimants or their legal advisers on a voluntary basis (even subject to a
confidentiality ring) and I cannot compel them to do so. Mr Facenna for the
Claimants in any event expressed his disquiet at the prospect of being in such
a ring (had it been offered). He pointed out that whilst such cases were
common place in commercial and regulatory litigation this being a death
penalty case the inability to take instructions from his clients or their legal
advisers in Thailand and the potential conflict of interest that might arise if
he had to gve an undertaking to this court and could not therefore
communicate freely with his clients, were very troubling limitations. It was
one thing to be in a ring with a limited ability to take instructions in a
commercial or regulatory case but quite another to be so in a death penalty
case. In any event because the MPS was not prepared to release the Disputed
Information (as was their right) this option was academic.
Secondly, Ms Proops for the MPS submitted that pursuant to section 15(2)
DPA 1998 if I had serious questions to pose about individual items of
information then I could do so in a closed hearing which would entail the
public and the Claimants being excluded from the court room. She submitted
that my right to question the MPS was a necessary concomitant of the right
of "inspection" which the court had under section 15(2). I agree that in
principle this must be so. If I have the right to inspect the Disputed
Information that must imply a right to seek assistance so as to be able to
http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

10/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

understand it. For instance if the Disputed Information had been expressed as
an algebraic formula it might have made little sense to me unless I could seek
an explanation of it. Mr Facenna submitted however that the right to
"inspection" was just that - a limited right for a judge to inspect, and it did
not carry with it a further right to seek explanations and clarifications from
the representatives of the authors of the information. He also submitted that
there was no express power in the DPA 1998 for any form of closed
procedure to take place. In my judgment the Court has an implied power
flowing from section 15(2) to seek clarification from the representatives of
the authors of the material but also the inherent jurisdiction to seek
clarification as to the evidence before it. I do not therefore accept Mr
Facenna's analysis. I do however have an objection to using a closed
procedure from the perspective of natural justice, heightened in a case such
as this involving the death penalty. I can conceive of little which is more
inimical to the perception and practice of open and fair justice than that the
Judge should be alone in a court with a State body discussing whether a
death penalty accused should receive or be denied (potentially relevant)
disclosure in circumstances where the lawyers of the accused were excluded
from the dialogue. This is especially so when the essential nature of the
information being discussed is not, for instance, related to terrorism or
national security but, on the contrary, is common place summaries of routine
criminal procedures – it is not sensitive material per se. For this reason I was
not attracted to the notion of any sort of closed procedure.
Thirdly, it was submitted by both parties that if I were really concerned that
there was injustice which I was incapable of addressing myself then I should
consider the appointment a special advocate who could appear to represent
the interests of the accused. I gave serious consideration to this. If this case
had not been so urgent I would have considered this option more closely. No
suggestion was however made by the Claimants that the Court should
appoint a special advocate it being considered that there was no clear power
so to do. At all events given the urgency and the time constraints there was
no basis upon I could sensibly have delayed this hearing given the progress
of the trial in Thailand, the urgent need for me to hear the case and deliver a
judgment, and the equally urgent need for the losing party to have a chance
to pursue an appeal and therefore for the Court of Appeal to have time to
convene and determine any appeal.
45. I ultimately came to the conclusion that, given the exigencies of the situation, the best way to
proceed was for me to raise any questions and queries that I had about individual pieces of
information contained in the Disputed Information in open court articulating my queries and
questions in the abstract ie without disclosing the specific information in issue. This way Mr
Facenna could at least (I hoped) respond by reference to my generic description of the
information and according to principle. Further, I sought to mitigate further possible prejudice
to the accused by seeking to accord to them the benefit of any doubt that there might exist. The
performance of this actual task was however complicated by two matters. First, the Claimants
have not put before the Court any information as to the state of play in the Thai proceedings. I
am told that communicating with the Thai lawyers (who work pro bono) is difficult and that,
not being able to see the Disputed Information, the Claimants did not consider it would be
meaningful to the Court to have a comparison. Nonetheless for the purpose of assessing
whether any personal data might be useful in the context of the defence it has made life much
more difficult that I know very little indeed about the actual Thai proceedings. Secondly, Ms
Proops objected to my even attempting to pose in abstract terms questions to Mr Facenna for
him to answer about the relevance of what might be in the Report to the defence in the Thai
http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

11/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

proceedings. When I said to her that I had no intention to letting the cat (ie the Report) out of
the bag but that I could see no objection to putting before Mr Facenna the odd hair from its back
she nonetheless said that even a highly limited and (frankly) innocuous disclosure like this
would be objectionable and contrary to section 15(2) DPA 1998. I invited Mr Facenna to
identify (over the lunch adjournment) the information that was now in the public domain about
the prosecution case (which was nearing completing in the Thai proceedings) and as to the
evidence that was in fact in the possession of the Claimants. This proved not to be possible.
46. For the record I consider that the way in which I have been required to form a judgment in this
case to be deeply unsatisfactory. In a future case which involves analogous sensitivities (which
of course not all DPA 1998 cases will do) a consideration of the procedure to be adopted should
occur well before the actual hearing; the onus must be on the parties to address this at the
earliest possible stage.
C. Relevant legal framework
47. I turn now to the legal context. In this section I set out the relevant legislative and legal
framework. There are two sets of legislative measures which are of prime relevance to the
dispute, namely the Directive and the DPA 1998. The latter is the first port of call with the
former existing as a source of guidance as to the construction of the DPA 1998. The Convention
arises because it has been prayed in aid by the Claimants, in effect, to stiffen the sinews of the
Court in the application of any necessity or proportionality weighing exercise.
48. The parties advanced detailed written and oral submissions about the correct approach to be
adapted to the construction of the DPA in the light of the Directive and the Convention. There
are a number of points of difference between the parties. These focus upon the scope and effect
of section 29 DPA 1998. First, the Claimants submit that personal data obtained for the
purposes of a report used for family liaison purposes does not fall within the scope of the
exception in section 29 DPA 1998; whereas the MPS submit that construed purposively it does.
Secondly, the MPS submit that viewed literally section 29 DPA 1998 does not involve a
weighing or proportionality exercise which requires it to weigh the importance of its public
policy in not disclosing against the Claimants' public policy in disclosure. On this occasion the
MPS does not favour a broad purposive construction and the Claimants do. I therefore need to
set out my conclusions on the correct way in which to construe section 29.
(i) Common law principles of construction: Application of anxious scrutiny to
the facts under the common law
49. In my view not much actually turns upon an invocation of broader principles of EU or
Convention law. I do not consider that there is a need for the sinews of the Court to be stiffened.
In my judgment the common law, and in particular the principles of natural justice and fairness,
would in a case such as this which involves the right to life, and the right to a fair trial, as well
as powerful countervailing issues of public interest, compel the court to apply the most intense
level of anxious scrutiny to the facts to ensure that the accused were not prejudiced. In my view
the common law leads inexorably to a purposive construction of section 29 DPA 1998 which
permits of intensive scrutiny of all relevant interests arising and which injects a proportionality
exercise into the weighing process. The common law takes account of context and adjusts
accordingly.
50. In Kennedy v Information Commissioner [2014] UKSC 20 AC 455 the Supreme Court (at
paragraphs [56], [92], [132] and [136] concluded that the strictness of a proportionality review
would not materially differ depending upon whether a case was brought under the EU law. Lord
Mance stated: "The common law no longer insists on the uniform application of the rigid test of
irrationality once thought applicable under the so-called Wednesbury principle... The nature of
judicial review in every case depends on the context" (ibid. paragraph [51]).
http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

12/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

51. In Pham v Home Secretary [2015] UKSC 19; [2015] 1 WLR 1591 the observations about the
common law in Kennedy were endorsed (at paragraphs [59], [60], [98] and [108] - [110]. Lord
Carnwath observed (ibid. paragraph [60]) that the intensity of a judicial review and the weight
to be accorded to a decision maker were context driven and that such considerations "apply with
even greater force ... where the [act in question] concerns the removal of a status as
fundamental [in law] ... as that of citizenship." In other words the more important the
fundamental right being potentially intruded upon the greater and more intensive the level of
judicial scrutiny. It is perfectly plain from both Kennedy and Pham that the common law, EU
law and the Convention can walk side by side when protecting rights.
52. The present case is not a judicial review. It is nonetheless a determination by this court of the
legality of the decision of a public body. The mere fact that the DPA 1998 mandates a different
procedure to that of judicial review cannot in my view make a difference; form cannot triumph
over substance. The key point is that this Court is determining the legality of the decision of a
public body and that the facts and issues arising engage very important fundamental rights.
(ii) The Directive: Relevant principles of interpretation
53. I should add that ultimately both parties agreed that under the common law an intensive review
of the relevant public interests arising was fully justified and that there was most unlikely to be
any real difference to outcome based upon a common law, Convention based or EU driven
approach to construction.
54. Nonetheless, I will address the main points of EU law arising. The practical relevance of this
argument arises because the MPS argues that the facts of the present case do not engage EU or
Convention law at all and since the DPA 1998 was adopted to implement the Directive that is
highly relevant to the interpretation of the DPA 1998. In particular no reliance could be placed
on EU law or the Convention to assist the Claimants.
55. The DPA 1998 was introduced in order to implement the Directive. As a measure implementing
EU law it must, so far as possible, be construed in conformity with the Directive so as to
achieve its purpose. See for a detailed summary of the relevant principles of interpretation and
its limits: R (Nutricia Ltd) v The Secretary of State for Health [2015] EWHC 2285 (Admin) at
paragraphs [114] – [120]. In Campbell v. MGN [2002] EWCA Civ 1373; [2003] QB 633
("Campbell"), Lord Phillips of Worth Matravers, MR, said at paragraph [96]:
"In interpreting the Act it is appropriate to look to the Directive for assistance. The
Act should, if possible, be interpreted in a manner that is consistent with the
Directive. Furthermore, because the Act has, in large measure, adopted the wording
of the Directive, it is not appropriate to look for the precision in the use of language
that is usually to be expected from the parliamentary draftsman. A purposive
approach to making sense of the provisions is called for.
56. In the present case, submits the MPS, even though the DPA 1998 was indeed introduced to
implement the Directive, the facts have nothing at all to do with EU law. In their written
submissions the MPS submitted that the Directive was about the completion of the internal
market and that fact provided an important backdrop against which to measure the Claimants'
application which was about criminal proceedings in Thailand which it was said was about as
far away from the internal EU market as it was possible to be. In their skeleton argument they
submitted:
"The presence of the MPS in Thailand and the production of the Report as a result,
was an activity in the area of criminal law and public security. Moreover, these
activities fell squarely outside the scope of Community law. The European
Community has no competence over the relationship and cooperation between
http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

13/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

police forces of Member States and non-member States. Whilst some inter-Member
State enforcement activity falls within the scope of Title VI (referred to in article
3(2) (police and judicial cooperation in criminal matters), it makes no provision for
interactions with non-Member states [Title V relates to the EU's common foreign
and security policy provisions]. For the avoidance of doubt although article 3(2)
refers to the scope of Community law, nothing in the subsequent Treaty on the
Functioning of the European Union, or the Treaty on European Union would
require any different answer, even if article 3(2) were to be read more broadly as
relating to the scope of Union law."
57. In relation to the Convention (and therefore the Directive which is in large measure intended to
reflect Article 8 of the Convention) Ms Proops relies upon the judgment of the Supreme Court
in R(Sandiford) v Secretary of State for the Foreign and Commonwealth Affairs [2014] UKSC
44; [2014] 1 WLR 2697 ("Sandiford") which, she submitted, showed that a state's jurisdictional
competence under the Convention was primarily territorial. I do note that this case is not
exclusively extra-territorial: the victims were British and their families are based in this
jurisdiction; the statutory authority for the MPS to engage with the Thai authorities was under a
domestic statute and was between a Minister in this jurisdiction and the MPS also in this
jurisdiction; the Report is physically in this jurisdiction; the briefing to the victim's families
occurred in this jurisdiction. Because of my conclusion that the common law affords no lesser
protection than EU law or the Convention it is not necessary for me to determine the correctness
of the argument advanced by the MPS. I will however address only one issue which concerns
the extent to which the Directive (and ergo the DPA when construed to as to achieve the
purpose of the Directive) is premised upon fundamental rights.
58. First, the Directive has multiple objectives only one (and not the most important) of which is
focused upon the internal market. Critically, the Directive is also about wide ranging
fundamental rights. This is manifest from the recitals to the Directive. Recitals 1-3 of the
Directive refer to a range of social and human rights as well as economic desiderata as
justifying the measure:
"(1) Whereas the objectives of the Community, as laid down in the Treaty, as
amended by the Treaty on European Union, include creating an ever closer union
among the peoples of Europe, fostering closer relations between the States
belonging to the Community, ensuring economic and social progress by common
action to eliminate the barriers which divide Europe, encouraging the constant
improvement of the living conditions of its peoples, preserving and strengthening
peace and liberty and promoting democracy on the basis of the fundamental rights
recognized in the constitution and laws of the Member States and in the European
Convention for the Protection of Human Rights and Fundamental Freedoms;
(2) Whereas data-processing systems are designed to serve man; whereas they
must, whatever the nationality or residence of natural persons, respect their
fundamental rights and freedoms, notably the right to privacy, and contribute to
economic and social progress, trade expansion and the well-being of individuals;
(3) Whereas the establishment and functioning of an internal market in which, in
accordance with Article 7a of the Treaty, the free movement of goods, persons,
services and capital is ensured require not only that personal data should be able to
flow freely from one Member State to another, but also that the fundamental rights
of individuals should be safeguarded …"
59. Article 1 spells out that the objective of the Directive is conceived broadly with "fundamental
rights and freedoms" of which the "right to privacy" is an illustration:
http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

14/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

"Article 1
Object of the Directive
1. In accordance with this Directive, Member States shall protect the fundamental
rights and freedoms of natural persons, and in particular their right to privacy with
respect to the processing of personal data.
2. Member States shall neither restrict nor prohibit the free flow of personal data
between Member States for reasons connected with the protection afforded under
paragraph 1."
60. It follows that the Directive must be construed with the broad range of fundamental rights well
in mind. These are not to be narrowly construed. I do not think that (and setting aside for the
moment the MPS's argument about the lack of a territorial nexus between the facts of the
present case and the Directive) it can be argued that in construing the Directive and therefore
implementing legislation such as the DPA 1998 one can simply ignore as irrelevant rights as
fundamental as the right to life, which is engaged in this case.
61. And even if the Directive were to be construed (artificially) with only privacy in mind that
would still lead to a broad and purposive construction. In Campbel (ibid) Lord Philips MR
stated at paragraph [73] that the legislation was to protect individuals against "prejudice"
flowing from the processing of their personal data:
"The Directive was a response to the greater ease with which data can be processed
and exchanged as a result of advances in information technology. Foremost among
its aims is the protection of individuals against prejudice as a consequence of the
processing of their personal data, including invasion of their privacy…"
(Emphasis added)
62. The 41st recital to the Directive emphasises the right of an individual to verify the accuracy of
data relating to him. The Court of Justice has linked this right of verification with the
fundamental right to a private life (under Article 8) which is materially wider than the right to
privacy. In Cases C- 141/12 & C-372/12 YS v Minister voor Immigratie (17th July 2014) the
European Court of Justice emphasised, at paragraph [44] and by reference to this recital, that:
"the protection of the fundamental right to respect for private life means ... that that person may
be certain that the personal data concerning him are correct and that they are processed in a
lawful manner". This was cited by Dingemans J with approval in Kololo v MPS [2015] EWHC
600 (QB); [2015] 1 WLR 3702 at paragraph [22]. The right to private life under Article 8 can
indeed extend to a wide range of private interests. It has in some cases before the Strasbourg
Court been linked to Articles 2 and 3: See eg MC v Bulgaria (2005) 40 EHRR 20 paragraphs
[150] – [153]) which linked the right to private life under Article 8 to the protection of a
person's physical integrity and the thoroughness of police investigations.
63. So far I have focused upon the rights of individuals against the state; but the Directive also
recognises that states have important rights which may trump the individual's rights. Article 3 of
the Directive defines the "scope" of the Directive but importantly recognises exceptions thereto
including in relation to "criminal law":
"Scope
1. This Directive shall apply to the processing of personal data wholly or partly by
automatic means, and to the processing otherwise than by automatic means of
personal data which form part of a filing system or are intended to form part of a
http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

15/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

filing system.
2. This Directive shall not apply to the processing of personal data:
- in the course of an activity which falls outside the scope of Community law, such
as those provided for by Titles V and VI of the Treaty on European Union and in
any case to processing operations concerning public security, defence, State
security (including the economic well-being of the State when the processing
operation relates to State security matters) and the activities of the State in areas of
criminal law,
- by a natural person in the course of a purely personal or household activity."
(An issue arose between the parties as to whether the reference in Article 3 to criminal law was
a reference to it simply being outside the scope of EU law ratione materiae; or whether it was
referring to a self-contained exception even if it was within the purview of EU law. In this
regard questions arose as to how Article 3 was to be construed given that since the adoption of
the Directive, EU law has evolved and assumed responsibility for certain aspects of criminal
law. I have not in this judgment however considered it necessary to examine this complex
issue).
64. Recital 13 is in the following terms:
(13) Whereas the activities referred to in Titles V and VI of the Treaty on European
Union regarding public safety, defence, State security or the activities of the State
in the area of criminal laws fall outside the scope of Community law, without
prejudice to the obligations incumbent upon Member States under Article 56 (2),
Article 57 or Article 100a of the Treaty establishing the European Community;
whereas the processing of personal data that is necessary to safeguard the economic
well-being of the State does not fall within the scope of this Directive where such
processing relates to State security matters…"
65. Finally, Article 13 provides a broad and free standing exception for criminal law enforcement
activities. The basic rights granted to citizens to obtain access to data are set out in, inter alia,
Article 6 (relating to data quality) Article 10 (information to be given to data subjects) Article
12 (the data subjects right of access to data) and Article 21 (the duty on Member States to
publicise their data production activities). Article 13 empowers Member States to introduce
domestic legislation creating exceptions in certain identified areas which includes criminal law
enforcement. In relevant part it provides:
"Article 13
Exemptions and restrictions
1. Member States may adopt legislative measures to restrict the scope of the
obligations and rights provided for in Articles 6(1), 10, 11(1), 12 and 21 when such
a restriction constitutes a necessary measure to safeguard:
(a) national security;
(b) defence;
(c) public security;
(d) the prevention, investigation, detection and prosecution of criminal offences, or
of breaches of ethics for regulated professions;…"
http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

16/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

66. The Directive thus in two places provides exceptions of exemptions for "the activities of the
State in areas of criminal law" (Articles 3), and "the prevention, investigation, detection and
prosecution of criminal offences" (Article 13).
67. I should also mention the recent judgment of the Supreme Court in R(Catt) v Association of
Chief Officers of England & Wales [2015] UKSC 9; [2015] AC 1065 ("Catt"). This is
significant because it makes clear that there are important policy considerations on both sides of
the public interest equation when it comes to balancing police interest with those of individuals.
Lord Sumption held, in relation to the DPA 1998, that it provided a comprehensive scheme of
enforcement and regulation which reflected, not just EU law, but also the Convention:
"8. The exercise of these powers is subject to an intensive regime of statutory and
administrative regulation. The principal element of this regime is the Data
Protection Act 1998. The Act was passed to give effect to Directive 95/46/EC on
the protection of individuals with regard to the processing of personal data… a
harmonisation measure designed to produce a common European framework of
regulation ensuring a "high level of protection" satisfying (among other standards)
article 8 of the Convention: see recitals 10 and 11. On ordinary principles of
statutory construction the Act will as far as possible be interpreted in a manner
consistent with that objective."
68. Later in paragraph [12] Lord Sumption stated:
"12. The Data Protection Act is a statute of general application. It is not specifically
directed to data obtained or stored by the police. But it lays down principles which
are germane and directly applicable to police information, and contains a
framework for their enforcement on the police among others through the
Information Commissioner and the courts. It deals directly in section 29 and in
Schedule 2, paragraph 5 with the application of the principles to law enforcement.
The Data Protection Principles themselves constitute a comprehensive code
corresponding to the requirements of the EU Directive and the Convention."
69. Where does all of this lead to? It leads simply to the conclusion that when construing the DPA
1998 (whether through common law or European eyes) decision makers and courts must have
regard to all relevant fundamental rights that arise when balancing the interest of the State and
those of the individual. There are no artificial limits to be placed on the exercise.
(iii) DPA 1998
70. I turn now to the DPA 1998. Section 1(1) DPA defines "personal data" as
""personal data" means data which relate to a living individual who can be
identified—
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely
to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of
the intentions of the data controller or any other person in respect of the
individual…"
71. Section 2 makes clear that there can be a subset of "personal data" comprising "Sensitive
http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

17/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

personal data" which may be confidential because it consists of information as to "...the
commission or alleged commission [of a person] of any offence" or "... any proceedings for any
offence committed or alleged to have been committed by [that person]". Mr Facenna pointed
out that simply because information held by the police related to crime was not a reason for it to
be treated as sacrosanct and immune from disclosure.
72. Section 7 DPA sets out the basic provision governing the rights of data subjects to access of
personal data:
"Right of access to personal data.E+W+S+N.I.
(1) Subject to the following provisions of this section and to sections 8, 9 and 9A,
an individual is entitled (a) to be informed by any data controller whether personal data of
which that individual is the data subject are being processed by or on
behalf of that data controller,
(b) if that is the case, to be given by the data controller a description of
—
(i) the personal data of which that individual is the data
subject,
(ii) the purposes for which they are being or are to be
processed, and
(iii) the recipients or classes of recipients to whom they
are or may be disclosed,
(c) to have communicated to him in an intelligible form—
(i) the information constituting any personal data of which
that individual is the data subject, and
(ii) any information available to the data controller as to
the source of those data, and
(d) where the processing by automatic means of personal data of which
that individual is the data subject for the purpose of evaluating matters
relating to him such as, for example, his performance at work, his
creditworthiness, his reliability or his conduct, has constituted or is
likely to constitute the sole basis for any decision significantly
affecting him, to be informed by the data controller of the logic
involved in that decision-taking.
(2) A data controller is not obliged to supply any information under subsection (1)
unless he has received—
(a) a request in writing, and
(b) except in prescribed cases, such fee (not exceeding the prescribed
maximum) as he may require.
(3) Where a data controller—
http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

18/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

(a) reasonably requires further information in order to satisfy himself
as to the identity of the person making a request under this section and
to locate the information which that person seeks, and
(b) has informed him of that requirement,
the data controller is not obliged to comply with the request unless he
is supplied with that further information.
(4) Where a data controller cannot comply with the request without disclosing
information relating to another individual who can be identified from that
information, he is not obliged to comply with the request unless—
(a) the other individual has consented to the disclosure of the
information to the person making the request, or
(b) it is reasonable in all the circumstances to comply with the request
without the consent of the other individual.
(5) In subsection (4) the reference to information relating to another individual
includes a reference to information identifying that individual as the source of the
information sought by the request; and that subsection is not to be construed as
excusing a data controller from communicating so much of the information sought
by the request as can be communicated without disclosing the identity of the other
individual concerned, whether by the omission of names or other identifying
particulars or otherwise.
(6) In determining for the purposes of subsection (4)(b) whether it is reasonable in
all the circumstances to comply with the request without the consent of the other
individual concerned, regard shall be had, in particular, to—
(a) any duty of confidentiality owed to the other individual,
(b) any steps taken by the data controller with a view to seeking the
consent of the other individual,
(c) whether the other individual is capable of giving consent, and
(d) any express refusal of consent by the other individual.
(7) An individual making a request under this section may, in such cases as may be
prescribed, specify that his request is limited to personal data of any prescribed
description.
(8) Subject to subsection (4), a data controller shall comply with a request under
this section promptly and in any event before the end of the prescribed period
beginning with the relevant day.
(9) If a court is satisfied on the application of any person who has made a request
under the foregoing provisions of this section that the data controller in question
has failed to comply with the request in contravention of those provisions, the court
may order him to comply with the request.
(10) In this section—
"prescribed" means prescribed by the Secretary of State by regulations;
http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

19/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

"the prescribed maximum" means such amount as may be prescribed;
"the prescribed period" means forty days or such other period as may be prescribed;
"the relevant day", in relation to a request under this section, means the day on
which the data controller receives the request or, if later, the first day on which the
data controller has both the required fee and the information referred to in
subsection (3).
(11) Different amounts or periods may be prescribed under this section in relation
to different cases.
73. It will be noted that the jurisdiction of the High Court to rule on the correctness of decisions
taken under the DPA 1998 by bodies such as the MPS is created under section 7(9).
74. It will also be noted that the DPA 1998 does not create two separate exceptions based upon
Articles 3 and 13 of the Directive but combines those provisions into a single exception found
in section 29. Article 13 of the Directive does not compel Member states to introduce
exceptions; it introduces a power ("may") exercisable where "necessary to … safeguard", inter
alia, criminal law enforcement. Section 29 provides, so far as relevant to the present case:
"29 Crime and taxation.E+W+S+N.I.
(1) Personal data processed for any of the following purposes—
(a) the prevention or detection of crime,
(b) the apprehension or prosecution of offenders, or
(c) the assessment or collection of any tax or duty or of any imposition
of a similar nature,
are exempt from the first data protection principle (except to the extent to which it
requires compliance with the conditions in Schedules 2 and 3) and section 7 in any
case to the extent to which the application of those provisions to the data would be
likely to prejudice any of the matters mentioned in this subsection.
(2) Personal data which—
(a) are processed for the purpose of discharging statutory functions,
and
(b) consist of information obtained for such a purpose from a person
who had it in his possession for any of the purposes mentioned in
subsection (1),
are exempt from the subject information provisions to the same extent as personal
data processed for any of the purposes mentioned in that subsection.
(3) Personal data are exempt from the non-disclosure provisions in any case in
which—
(a) the disclosure is for any of the purposes mentioned in subsection
(1), and
(b) the application of those provisions in relation to the disclosure
http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

20/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

would be likely to prejudice any of the matters mentioned in that
subsection.
(4) Personal data in respect of which the data controller is a relevant authority and
which—
(a)consist of a classification applied to the data subject as part of a
system of risk assessment which is operated by that authority for either
of the following purposes—
(i) the assessment or collection of any tax or duty or any
imposition of a similar nature, or
(ii) the prevention or detection of crime, or apprehension
or prosecution of offenders, where the offence concerned
involves any unlawful claim for any payment out of, or
any unlawful application of, public funds, and
(b) are processed for either of those purposes,
are exempt from section 7 to the extent to which the exemption is required in the
interests of the operation of the system.
(5) In subsection (4) — "public funds" includes funds provided by any EU
institution; "relevant authority" means—
(a) a government department,
(b) a local authority, or
(c) any other authority administering housing benefit or council tax
benefit.
75. Limits are imposed upon persons collecting data. The collection and retention process must
accord with certain overarching principles set out in Schedule 1 to the Act. These are not in
dispute in the present case. I refer to them to observe that one governing principle is fairness (cf
Principle 1). A further point of relevance is Principle 8 which prohibits the transference of
personal data to a country or territory outside of the EU unless that territory ensures an adequate
level of protection for the rights and freedoms of data subjects in relation to the processing of
personal data.
76. Section 29 permits derogation from the disclosure obligation in section 7 in defined
circumstances. As I have already set out the MPS accepts that the Report prepared by DCI
Lyons contains personal data. The question for the High Court is whether the MPS is entitled to
withhold that personal data from the Claimants because the personal data was "processed" for
the purpose of "(a) the prevention or detection of crime, (b) the apprehension or prosecution of
offenders"? If the answer to this is in the affirmative then a secondary question arises which is
whether granting access would be "likely to prejudice any of the matters mentioned in this
subsection". Even if the subject matter of the personal data is within the confines of an
exempted subject matter withholding that data from the relevant person is only permitted "to the
extent" that disclosure would cause the prejudice to the interests referred to in the section.
77. Protection is thus not absolute. It is a qualified protection. This conclusion accords with the
language of Article 13 of the Directive which introduces a necessity test and permits a refusal to
grant access only where the refusal is "necessary" to "safeguard" the purpose.
http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

21/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

78. Although section 29 DPA 1998 and Article 13 use different language they are in my view
consistent. They require a balancing exercise to be performed between the individual's right to
access and the data processor's right to refuse. In my judgment this calls for a classic
proportionality balancing exercise to be performed.
79. It was submitted by Ms Proops, for the MPS, that in fact section 29 did not call for a
proportionality balancing exercise. She submitted (boldly) that provided that the MPS could
show a legitimate reason for withholding disclosure then the weight and importance of the
personal data and the impact of its non-disclosure on the individual was immaterial. In response
to my question whether in the view of the MPS there would be any difference in the outcome
where the personal data was (a) the applicant's date of birth or (b) information which could
exculpate completely a defendant in a death penalty case, she said that it would made no
difference; provided the MPS had a valid reasons for withholding then that was the end of the
matter.
80. This argument is not sustainable. If it were correct then it would in effect reduce to nought the
relevant individual's right to privacy or any other right including the even more fundamental
right to life. The argument is inconsistent with (inter alia): (a) the Directive and the plain
reference to the fundamental rights of the individual concerned; (b) the raison d'etre of the DPA
1998 as a protector of an individual's fundamental rights; (c) the view taken by the Court of
Justice that derogations from the individual's fundamental rights had to be construed narrowly
and in this regard see by way of illustration Case C-473/12 IPI v Englebert et ors [2014] 2
CMLR 9 at paragraph [39] where the Court emphasised that derogations from the fundamental
right to privacy "... must apply only insofar as is strictly necessary" ...this being the traditional
language of the Court of Justice when it is referring to a proportionality exercise); (d) the
judgment of Mr Justice Munby in Lord at paragraph [99]: see below at paragraph [84] and with
his explanation that because of the importance of the policy of protecting individual rights the
burden of proof lay on the State to justify derogation to a high standard of proof; and (e) the
judgment of Lord Sumption in Catt at paragraph [8].
D. Issues: Analysis and conclusions
81. In the light of the analysis above I turn now to identify the issues and then to an assessment of
the merits of the case.
82. There is a preliminary issue to address, namely the burden and standard of proof (issue I).
83. There are then two substantive issues to be determined. First, was the personal data in the
Report "processed" for purposes of (a) the prevention or detection of crime or (b) the
apprehension or prosecution of offenders (Issue II)? Secondly, would granting access be likely
to prejudice any of those matters (Issue III)?
(i) Issue I: Who has the burden of proof of proving both the right to invoke the
exemption? What is the standard of proof?
84. These issues were considered by Munby J (as then was) in R(Lord) v Secretary of State of the
Home Department [2003] EWHC 2073 (Admin) ("Lord"). The judge held that because of the
importance attached to the rights of the individual it was the data controller who had the burden
of proof to establish the right to refuse access and that the standard of proof was a relatively
high one. At paragraphs [99] and [100] the judge, relying upon the Directive as a source of
interpretative inspiration, stated:
"99. I accept that "likely" in section 29(1) does not mean more probable than not.
But on the other hand, it must connote a significantly greater degree of probability
than merely "more than fanciful". A "real risk" is not enough. I cannot accept that
http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

22/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

the important rights intended to be conferred by section 7 are intended to be set at
nought by something which measures up only to the minimal requirement of being
real, tangible or identifiable rather than merely fanciful. Something much more
significant and weighty than that is required. After all, the Directive, to which I
must have regard in interpreting section 29(1), permits restrictions on the data
subject's right of access to information about himself only (to quote the language of
recital (43)) "in so far as they are necessary to safeguard" or (to quote the language
of Article 13(1)) "constitute a necessary measure to safeguard" the prevention and
detection of crime (emphasis added). The test of necessity is a strict one. The
interference with the rights conferred on the data subject must be proportionate to
the reality as well as to the potential gravity of the public interests involved. It is
for those who seek to assert the exemption in section 29(1) to bring themselves
within it, and, moreover, to do so convincingly, not by mere assertion but by
evidence that establishes the necessity contemplated by the Directive.
100. In my judgment "likely" in section 29(1) connotes a degree of probability
where there is a very significant and weighty chance of prejudice to the identified
public interests. The degree of risk must be such that there "may very well" be
prejudice to those interests, even if the risk falls short of being more probable than
not. "
85. The burden of proof is thus upon the MPS in this case to show its entitlement to refuse access
and it must do this with significant and weighty grounds and evidence.
(ii) Issue II: Was the personal data in the MPS report "processed" for purposes
of (a) the prevention or detection of crime or (b) the apprehension or prosecution
of offenders?
86. Mr Facenna submitted that the personal data was not subject to the exceptions in section 29
because a purpose of family liaison was not a purpose for which exemption from disclosure
could be claimed.
87. I do not accept this argument. The pursuit of an investigation for the purpose of family liaison is
within the scope of section 29. Of course the paradigm case is where the foreign engagement is
for the purpose of collecting evidence to be used in this jurisdiction as part of a criminal
investigation or for advising and assisting in a foreign prosecution. However, modern thinking
is to accept that the criminal justice system is not exclusively about pursuing and punishing the
guilty; it is also about protecting the victims and this can include their families. There are
numerous illustrations of this.
88. First, in murder (and of course in other) cases impact statements are routinely accepted from the
families and form part of the evidential basis for sentencing.
89. Secondly, at the EU level, legislation has been adopted which explicitly recognises the position
and standing of victims' families in criminal proceedings: see eg Directive 2012/29/EU of the
European Parliament and of the Council of 25 October 2012 establishing minimum standards
on the rights, support and protection of victims of crime, and replacing Council Framework
Decision 2001/220/JHA ("the Victims Rights Directive"). Under that directive a victim is
defined to include: "family members of a person whose death was directly caused by a criminal
offence and who have suffered harm as a result of that person's death" (cf Article 2(1)(a)(ii)). I
would add that under Article 3 of Protocol No 21 on the position of the United Kingdom and
Ireland in respect of the Area of Freedom, Security and Justice, annexed to the TEU and to the
TFEU, the United Kingdom has notified its wish to take part in the adoption and application of
the Victims Rights Directive.
http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

23/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

90. Thirdly, the rights of families are recognised as an important interest worthy of protection in
cases where a person is under the control or custody of the State and dies. The rights of the
family to participate in subsequent investigations (for example inquiries and inquests) into how
a death occurred is recognised under Article 2 of the Convention on the right to life: See R
(Letts) v Lord Chancellor [2015] EWHC 402 (Admin) and the cases cited therein. The
following was stated at paragraph [59]:
"The right or legitimate interest of the next-of-kin to involvement in the procedure
is viewed as a concomitant of the imperative for there to be an element of public
scrutiny of the investigation in order to secure accountability. This in turn is an
ingredient of the overriding need to maintain public confidence in the adherence of
the State to the rule of law and to prevent any appearance of collusion in or
tolerance of unlawful acts. It necessarily follows that the right of the individual to
participate, which triggers the consequential obligation upon the State to consider
whether legal aid is needed, is an integral part of the Article 2 duty."
91. In R (Amin) v Home Secretary [2003] UKHL 51; [2004] 1 AC 653 ("Amin"), Lord Bingham
identified five different purposes behind the duty to investigate a death in custody and he
emphasised the rights of relatives in that of the deceased process. One of the purposes behind
the right of families to participate was to ensure " that suspicion of deliberate wrongdoing (if
unjustified) is allayed":
"31. The state's duty to investigate is secondary to the duties not to take life
unlawfully and to protect life, in the sense that it only arises where a death has
occurred or life-threatening injuries have occurred …. It can fairly be described as
procedural. But in any case where a death has occurred in custody it is not a minor
or unimportant duty. In this country … effect has been given to that duty for
centuries by requiring such deaths to be publicly investigated before an
independent judicial tribunal with an opportunity for relatives of the deceased to
participate. The purposes of such an investigation are clear: to ensure so far as
possible that the full facts are brought to light; that culpable and discreditable
conduct is exposed and brought to public notice; that suspicion of deliberate
wrongdoing (if unjustified) is allayed; that dangerous practices and procedures are
rectified; and that those who have lost their relative may at least have the
satisfaction of knowing that lessons learned from his death may save the lives of
others".
(Emphasis added)
92. Fourthly, the Directive envisages in Article 3 exceptions to the disclosure obligation in "areas
of criminal law". The personal data in the Report is most certainly in the "area of criminal law"
since it describes a criminal investigation. The reassuring of the families of the victims of a
murder is also in the "area of criminal law". In my view Article 3 is valid as a source of
guidance to the interpretation of Article 13, and in due course, the DPA 1998. It is a reason to
give to the language of the exception in section 29 a broad construction.
93. Fifthly, a general policy of treating families well is increasingly recognised as integral to a
policy of engendering trust in prosecution authorities which, in turn, is critical in creating a
climate where victims and witnesses will come forward to the police and assist in enquiries.
Looking after families is thus an increasingly important component of the broad creation of a
policy of facilitating the effectiveness of police operations.
94. In my view construing section 29 purposively by reference to these considerations leads to the
conclusion that the MPS, when it compiled the Report, was processing data for a legitimate
purpose under section 29 DPA 1998.
http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

24/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

(iii) Issue III: Would granting access be likely to prejudice any of those
purposes?
95. I turn now to the weighing, proportionality, exercise.
96. I should start by setting out some general observations about the approach I adopt to this.
97. First, it is apparent from section 7(9) DPA 1998 that my first task is to determine whether the
MPS acted unlawfully. If I so find then I must form my own judgment about the issues:
98. Secondly, it has been observed that when a court exercises its own judgment under section 7(9)
that power is "general and untrammelled": Kololo (ibid) paragraphs [24] and [32] citing Munby
J in Lord (ibid) at paragraph [160]. Ms Proops submitted that if I found an error on the part of
the MPS then I had a broad and unfettered discretion which was not limited by the strictures of
the Act. For instance if I found that processing personal data for family liaison reasons was not
a legitimate purpose I could still, in the exercise of my discretion, permit the MPS to refuse
access despite this being outside of the scope of the exemption in section 29. The effect of this
submission was that if the MPS acted unlawfully under the DPA 1998 I could simply overlook
that unlawfulness and apply a broad discretion ignoring the strictures of the Act. As such the
MPS would obtain the benefit of a broader discretion to be exercised in its favour specifically
by virtue of its prima facie unlawful refusal. In my judgment section 7(9) cannot support that
construction. If Parliament had intended to confer such a broad residual discretion on the court
then, in my view, it would have used far more specific language in section 7(9) than in fact it
did. In any event I do not understand the observations in the authorities referred to above to
suggest that if I find that the MPS has erred that I should simply make up and then apply
whatever test I see fit. If I find an error on the part of the MPS such that I must form my own
view then I should do in accordance with the principles set out in the DPA 1998 and taking
account of the relevant background principles in the Directive and the Convention. My
discretion is unfettered by the decision that has gone before, and which I find unlawful, but I
cannot depart from Parliament's intent.
99. Thirdly, it will be apparent from the tenor of this judgment that I consider that in applying the
weighing / proportionality test, I must take fully into consideration that this is a death penalty
case. It follows that on the specific facts of this case I should apply an "anxious" and intensive
review of the evidence and the approach adopted by the MPS in arriving at its refusal decision. I
shall accord the MPS no material margin of appreciation or discretion. It of course follows that
in another case where the interests at stake are less acute the intensity of the approach adopted
by the Court might be different.
100. With these general observations in mind I turn to the factors advanced by the parties as relevant
to the weighing exercise.
101. The starting point – the Claimant's prima facie right to the personal data: The starting
point is that the Claimant's are entitled in law to the data unless the MPS can meet its burden
and standard of proof by persuading the Court that there is a fully justified reason for
withholding the personal data. This presumption in favour of disclosure should be viewed as a
strong and weighty factor. The fact that the courts have placed the burden of proof on the data
processor and raised the standard of proof is also a reflection that the default position is one of
disclosure. The numerous references to fundamental rights of individuals as the basis for this
legislation underscore the proposition that the right of access is a strong right.
102. The intrinsic strength of the MPS's legitimate objectives: The next question is whether the
MPS has legitimate objectives which it can raise relating to law enforcement to be set against
the individual's strong right of access. I have set out above that I accept that the MPS is entitled,
under section 29, to advance the various general policy arguments about criminal law
http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

25/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

enforcement referred to in paragraphs [11] – [16] above. The follow-on question is how heavily
these should weigh in the proportionality scales. If they were valid but of little weight then it
would not take much, in a death penalty case, to persuade me that these objectives could be
outweighed. I address below each of the policy purposes identified by the MPS.
103. Family liaison: I have no doubt but that protecting the interests of families is an important
consideration. Nonetheless, in a death penalty case if there was (say) personal data which could,
when verified, potentially benefit the accused then it is hard to see how or why the families
could or would object to the accused having a fair trial and being able to deploy genuinely
relevant evidence. I have set out at paragraph [32] above the statement issued on behalf of the
families by the FCO in which the families state that they wish all relevant evidence to be placed
before the Thai court and reviewed fairly. I cannot imagine for one moment that the parents of
Hannah and David would wish to see the wrong persons found guilty or subjected to an unfair
trial. This is thus an important objective but the weight it attracts will depend upon the
particular importance of the personal data to the accused especially in the context of the
criminal proceedings.
104. Chilling effect: I turn now to the argument based upon the chilling effect of disclosure. I accept
that this is, in law, a valid consideration for the MPS to take into account and raise. This is so
even though the purpose does not relate to the proceedings in issue but to other future and
unidentified proceedings.
105. An issue arising in Lord (ibid) was whether data could be withheld from disclosure on the basis
of wider public interest considerations which went beyond the case in issue. The Judge held that
it was for the data controller to show that the statutory objective was likely to be prejudiced in
the case in which the issue arose (paragraph [94]). But importantly he held further (at paragraph
[122]), in an observation of direct significance to the present case, that the focus of attention
was not just on the facts of the instant case but could also take account of the impact on other
cases:
"122. Moreover, I can accept that, although section 29(1) requires that the issue of
whether disclosure is likely to prejudice the prevention or detection of crime has to
be determined in relation to the particular and individual case in which disclosure is
being sought, this does not mean that one can simply ignore the consequential
effect that disclosure in the particular case may have in others."
106. In my judgment this observation must be correct. Nothing in the Directive provides support for
a conclusion that the exemption can only be invoked if the data controller can establish that
disclosure would be prejudicial in the narrow confines of the instant case. The rationale behind
non-disclosure must go wider. Article 13 of the Directive is concerned with the generic
activities of prevention, investigation, detection and prosecution of criminal offences and
Article 3 refers even more broadly to "areas of criminal law". Disclosure which is prejudicial to
these tasks should, under the Directive, be capable of being immune from disclosure. If the
disclosure would not prejudice the instant case but would set a precedent which would cause
prejudice more broadly, for instance by discouraging cooperation in the future with third
parties, then that is also a matter which, in my judgment, falls within the legitimate scope of the
protection as a purpose which can in principle be invoked to justify a refusal in the instant case.
107. The chilling effect argument is in my judgment a powerful argument for the MPS to deploy and
I see considerable force in the points made. I accept the evidence of the MPS witnesses on this.
The evidence is given by officers of the highest order who have considerable personal
experience of the issue. I accept their judgment and opinion as to the risks that release of the
Report would give rise to and in particular, their position on: the considerable benefit to the
public interest (in relation to crime enforcement and public security) generally in the MPS (and
other relevant police authorities) being able to engage with foreign authorities; the high
http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

26/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

importance that is attached by foreign authorities to confidentiality; and the risk that not being
able to give strong assurances as to confidentiality would pose to the ability of the MPS and
others to enter into meaningful working relationship with such overseas authorities. This is thus
in my view a weighty factor in favour of non-disclosure.
108. How strong a factor is this? The MPS adopts a very rigorous approach on this point. It accept
that in theory no public interest that it advances can be wholly invincible and can never be
trumped; but it does submit that the public interest considerations raised are so compelling and
powerful that it can conceive of few, if any, circumstances where that public interest it could
even be surpassed in importance by a countervailing interest raised by an individual. I asked the
parties for their views on a hypothetical situation: A foreign prosecutor fails to disclose to a
defendant a key piece of evidence of great value to the defendant in a criminal case. This item is
however recorded in an MPS report and amounts to personal data. The report explains that there
is compelling evidence that the foreign forensic scientists employed by the police abroad have
mixed up DNA samples. It also records that the prosecution are nonetheless seeking to rely in
court upon the wrong DNA evidence to inculpate the accused. This entry might be pivotal to the
defence and might quite literally represent a matter of life or death. In those circumstances does
the Court sacrifice the accused for the wider principle of comity and trust between authorities?
Ms Proops for the MPS submitted that such was the power and force of the public interest
objectives the MPS advanced that even in such extreme circumstances the public interest would
still trump the private interest. Though as observed she accepted that in theory it was not open
to the MPS to adopt a blanket approach refusing access come what may. Mr Facenna submitted
that this position on the part of the MPS was absurd and showed simply that the MPS in truth
wished to adopt a stonewall, blanket policy, of non-disclosure which was a position he
submitted was itself unlawful as the deliberate fettering of a statutory discretion. The parties
thus agree that there is in law no such thing as a universal right to refuse access; but they
disagree strongly as to how and where to draw the line. I do not intend to express even a
tentative view on this particular problem. Were it to arise in a future case (and it does not arise
here) it would require very much closer scrutiny than has been possible in this case.
109. I can, in the context of this case, conclude by saying that I accept that the chilling effect policy
consideration is a strong point in favour of the MPS but I can leave to another day how it would
be resolved in the acute hypothetical illustration referred to.
110. There is a further point which concerns the risks associated with the disclosure of only small
amounts of personal data. It is common ground between the parties (and I view I also share) that
I must apply the balancing proportionality test to each item of personal data. There is no one
cap that fits all. A good deal of the MPS's core concerns related to disclosure of the Report as a
whole. However, there is no prospect of the Report being disclosed: the issue is whether some
or all of the personal data contained within in the Report would be disclosed. The position of
the MPS is however that the disclosure of even a small portion of the Report would have a
serious chilling effect because even a minor release could be seen by foreign counterparties as
reflecting a more systemic risk that the ability to enter into confidentiality arrangements would
be subject to override by the Courts. I accept broadly the evidence of the MPS on this.
However, this is of course already a risk and the MPS accepts, as it must, that it has no right to
ignore the law. Evidence was put before this court from the MPS (by DSU Sweeney) which
makes clear that the MPS already take account of domestic law when discussing and
negotiating conditions with foreign authorities. DSU Sweeney said in relation to conditions
sought to be imposed by foreign authorities as a pre-requisite of engagement: "Such conditions
will usually be agreed to by the MPS unless they fall foul of UK legal principles or are
otherwise considered to be appropriate in the circumstances, in which case the deployment may
not be undertaken". Overall, the risk of a chilling effect may be one of scale and degree; but I
do accept that there may be a real risk to the public interest of the disclosure of even small
amounts of data. In other words it is not necessarily an answer for an applicant to say http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

27/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

disclosure relates only to a small amount of personal data.
111. Need to avoid interfering in a foreign trial. The MPS has also raised the point that disclosure
might risk undermining the Thai proceedings. The Report was not given to the Thai authorities.
The MPS team was conscious that they should in no way become part of the evidence chain
(see paragraph [10] above). If I acceded to the application I would in effect be giving disclosure
according to a set of rules which may be inconsistent with Thai rules on disclosure in criminal
cases. As such I could be taking a step which might risk interfering with the criminal law
procedure of a foreign sovereign state. That state has its own rules of disclosure; they might
very well not be the same as apply in this jurisdiction and there is in fact evidence in this case
that in some significant ways they are not the same: for instance I understand that there is no
right on the part of the defence to access unused material, and there are different rules as to the
prosecution's duty of disclosure of material they propose to rely upon in court. But that does not
mean that this court should assume a stance of procedural superiority. It is significant that in
this case no evidence has be put before me that the judge in the actual trial is acting improperly
or unfairly or that the accused have been unable to avail themselves of all the rights normally
open to defendants in Thai criminal proceedings. This somewhat broad consideration against
disclosure is underscored by practical considerations. If I order disclosure of the personal data I
would risk giving a sliver of the Report which might be misleading because it is taken out of
context. It is clear from my reading of the Disputed Information that on some occasions the
items of personal data in and of themselves do not have a clear self-contained logic to them.
The references may be stray matters included as part of a wider issue which is being discussed
in the Report. I can well understand why both the MPS and RTP would wish to avoid a
situation where personal data was released and then used but the wider context (the relevant
part of the Report) was not in evidence. Quite how far this all goes is however unclear. I have
not had detailed evidence placed before me of the Thai court procedures or as to the state of
play in the trial. If I ordered disclosure that does not necessarily mean that the judge would rule
that data to be admissible. At the end of the day I consider this to be a serious policy
consideration which the MPS is entitled to rely upon.
112. The right for the Claimants to use personal data as part of a defence: There was some
debate as to the right of the Claimants to use the personal data for a purpose such as their rights
of defence. In my view the Claimants have a perfectly proper right to seek access to the
personal data for the purpose of using it subsequently in their defence in criminal proceedings.
The DPA is about fundamental rights. The right to a fair trial and the right to life are
fundamental rights. The right of access is a fundamental right and it does not lose that character
simply because the data, once obtained, is then used to protect a further fundamental right.
Reference was made in argument to Durant v Financial Services Authority [2003] EWCA Civ
1746; [2004] FSR 28 ("Durant") where the Court of Appeal was concerned with an application
under the DPA 1998 by a Mr Durant to the FSA for access to personal data about him held on
the FSA's computers. At paragraph 31 Auld LJ criticised the applicant for making an
application which was perceived to be in support of a litigation strategy:
"In short, Mr. Durant does not get to first base in his claim against the FSA because
most of the further information he sought, whether in computerised form or in
manual files, is not his "personal data" within the definition in section 1(1). It is
information about his complaints and the objects of them, Barclays Bank and the
FSA respectively. His claim is a misguided attempt to use the machinery of the Act
as a proxy for third party discovery with a view to litigation or further
investigation, an exercise, moreover, seemingly unrestricted by considerations of
relevance."
(Emphasis added)
113. At paragraph [27] Lord Justice Auld disassociated the right of access from any purported right
http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

28/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

to participate in legal proceedings:
"In conformity with the 1981 Convention and the Directive, the purpose of section
7, in entitling an individual to have access to information in the form of his
"personal data" is to enable him to check whether the data controller's processing of
it unlawfully infringes his privacy and, if so, to take such steps as the Act provides,
for example in sections 10 to 14, to protect it. It is not an automatic key to any
information, readily accessible or not, of matters in which he may be named or
involved. Nor is to assist him, for example, to obtain discovery of documents that
may assist him in litigation or complaints against third parties. As a matter of
practicality and given the focus of the Act on ready accessibility of the information
- whether from a computerised or comparably sophisticated non-computerised
system - it is likely in most cases that only information that names or directly refers
to him will qualify. In this respect, a narrow interpretation of "personal data" goes
hand in hand with a narrow meaning of "a relevant filing system", and for the same
reasons (see paragraphs 46-51 below). But ready accessibility, though important, is
not the starting point.
114. It is right to observe that Lord Justice Auld was referring to an altogether different context
where a person seeks access to data to facilitate that person bringing civil proceedings. In the
present case the nexus between the application for access, the personal data and the criminal
proceedings is very close to the point of being indistinguishable. The Claimants are facing a
capital charge in Thailand. The personal data was collected in the specific context of criminal
proceedings and, furthermore, refers to evidence in the case, including that against the accused.
There is a powerful connection therefore between the personal data and extant criminal
proceedings. As such I do not see how the observations of Lord Justice Auld can have
application in the present case. In other words the fact that the application in the High Court is
couched in terms of the use to which the data might be put in the criminal proceedings in
Thailand does not mean in my view that it is being sought for an improper purpose.
115. Observations on the importance of the personal data references in the Report: In my view
this case ultimately turns upon the intrinsic relevance of the personal data to the defence in the
criminal proceedings when set against the interests of the MPS in non-disclosure. The crux of
the matter is to take each individual item of personal data and determine whether it is such that
it could in any realistic sense provide support for the defence. If a particular piece of personal
data does have this quality then it must be balanced against the interests of the MPS. Such a
piece of data will attract considerable weight in the scales but there are yet weighty counter
points to be placed on the other side of the scales. A delicate balancing exercise then ensues.
116. In the text below I set out my conclusions on the weight to be attached to the personal data in
the Report. I am unable in this judgment to describe in any detail the personal data that is in
issue. I think however that in actual fact an alert reader could readily deduce from the
description that I have been able to give of the Report what the personal data therein related to.
117. The approach that I have taken is as follows. I have reviewed ("inspected") each item of
personal data in the Report very carefully and I have focused upon the possible value that the
item in question could have for the accused in the trial. I have adopted a cautious, pro-accused,
view. I have already explained that I am materially hampered in this exercise because the
Claimants have not put before me an account of the evidence already tendered in the Thai
proceedings, or any indication of what their defence is or might be to the murder charge against
them. Nonetheless, it is fairly obvious what the prosecution case is and as I understand matters
that case has now very largely been advanced in court and the defence has seen the evidence
against the accused and has had a chance to cross examine upon it. On my reading of the Report
I have, I therefore consider, a good idea of how the prosecution evidence will have been
organised and presented and I believe that I can form a fair view of how the personal data will
http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

29/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

fit into that case. This means that I can form a view as to whether it is likely to be helpful to the
accused were it to be disclosed to them.
118. The principles that I have applied to the items of personal data in the Report are as follows.
119. Data harmful to accused: I have been able relatively easily to identify items of personal data
which would not be helpful to the accused. I am assuming in any event that inculpatory
evidence has already been adduced to the court as part of the prosecution case and, in the
unlikely event that it has not, then that omission will have caused no prejudice to the accused. I
am therefore concerned essentially with evidence which might be adverse to the prosecution
and helpful to the accused. Therefore, I take the position that where I conclude that the personal
data in the report is adverse to the accused then I consider that the policy arguments of the MPS
outweigh the Claimants interest in disclosure.
120. Data neutral to accused: If the data is neutral then in my view the legitimate objectives
identified by the MPS will trump the disclosure obligation; this is not a case where one would
say: "the personal data is neutral and therefore why not disclose it". In fact one would say the
opposite. The sort of data which might fall into this category would include data references
along the lines of: "X is in custody", or "this is a photograph of the accused" or "the accused
lives at Y", or, "these are the main steps in the court procedure to date in relation to the
suspects", etc.
121. Summaries of other evidence: I also identified whether the items of personal data were a
summary of other evidence collected by the police. In fact a high percentage of the personal
data references reflect summaries of other evidence. This is not at all surprising given the
limited observer role played by the MPS. They were not collecting evidence; they were
recording in summary form the evidence collected by the RTP. Thai criminal procedure governs
the access given to the accused. Although I do not know for certain (because this evidence has
not been put before me) I surmise that the underlying evidence that forms the basis of the
personal data will have been tendered in court so will be in the possession, in a form permitted
by Thai law, of the accused and their lawyers
122. Level of detail: I have also formed a view as to the level of detail inherent in the personal data.
Generally speaking the more general the item of information the less valuable it is going to be
as part of the defence of the accused.
123. Personal data placed in the public domain by the FCO on behalf of the families and deployed
adversely to the Claimants in Thailand: The Claimants submit that the personal data has already
caused them prejudice because the FCO, on behalf of the families, has stated publically that the
evidence was "powerful and convincing" and the Thai authorities have referred in public in
Thailand to this as strong support from the families and/or UK Government for the prosecution
case. It is said that this risks prejudicing the trial in Thailand. I attach some weight to this. But it
is not compelling. First, the FCO did not disclose personal data; they (at its highest) provided a
very high level statement about the strength of the evidence generally. Secondly, there has also
been extensive press media critical of the Thai authorities, especially in the light of the
allegations by the accused that they had been tortured and were subject to unfair procedures –
the media coverage was not therefore one way traffic. Thirdly, and importantly, the trial is
presided over by a judge about whom no complaint has been made to me in these proceedings.
Any adverse comment in the Thai press can, I am bound to assume, be addressed by the judge
applying normal, objective, standards.
124. Observations on the personal data: With these general considerations in mind I would make the
following observations about the items of personal data in the Report:
a) The references are frequently brief, descriptive, and broad brush.
http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

30/31

 2/9/2016

Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (25 August 2015)

b) There are some exceptions to this where personal data is compiled in tabular
form. But even here it is not much more than a series of terse statements in
abbreviated form eg a summary of the main points in the chronology leading up to
a suspect's arrest. In such cases whether the items are viewed in isolation or as part
of a wider picture (the table as a whole) it is all information that the accused will
already be aware of.
c) A good deal of the personal data relates to the observations of the MPS on
documents or video recordings that they were permitted to read and review. As
such since (as I understand matters) the accused will have had access during the
trial to the same material then the references in the Report would, at this stage, add
nothing to the sum of knowledge held by the defence team on these matters.
d) To the extent that the personal data refers to such matters as whether the accused
had access to legal representation during interviews and/or translators these are
matters within the knowledge of the accused and their lawyers in Thailand even if,
as is said in the evidence before me in this case, there is a dispute about such
matters.
e) The personal data is not, as I have already observed, analytical and does not
perform an evaluation of the prosecution evidence or case.
f) I have not identified any material exculpatory personal data in the Report.
125. Conclusion: My ultimate conclusion is that there is nothing in the personal data which would be
of any real value to the Claimants. I have not identified any particular piece of information to
which I would attribute any really substantial weight to be set against the MPS's objectives. As
such I accept that the objections to disclosure raised by the MPS to defeat the application are
valid and, on the facts of the case, suffice to outweigh the claimants' otherwise strong interest in
access.
126. In coming to this end result I nonetheless feel very considerable unease. I sit at a long distance
from the seat of the trial and I do not have a true "hands on" feel for the way the evidence has
been tendered in the trial to date or how the accused might structure their defences. I have not
been assisted by the lack of evidence about the Thai proceedings or as to the evidence that has
in fact been tendered by the prosecution or as to the main lines of the defence. I have had to
work these out for myself doing, as the parties put it, "the best I could". This has not been a
comfortable process.
E. Conclusion
127. For the above reasons the application does not succeed. The MPS did not err in its application
of section 29 DPA 1998.
128. There has been no need for me to exercise an independent judgment under section 7(9) DPA
1998. Had I done so in view of my conclusions about (i) the strength of the MPS's legitimate
objectives and (ii) the intrinsic value of the personal data to the accused, I would not in any
event have arrived at a different decision.
BAILII: Copyright Policy   Disclaimers   Privacy Policy   Feedback   Donate to BAILII
URL: http://www.bailii.org/ew/cases/EWHC/QB/2015/2484.html

http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/QB/2015/2484.html&query=zaw+and+lin&method=boolean

31/31