Remaining anonymous

Trebor16

A case where a doctor has involvement with a patient, where that doctor would have made notes about the patient and where it had gone legal and disclosure had been ordered is very very different to a PPC going to an employer and asking for details of one of their employees.

We have seen how PPC's misuse CPR 31.16 and 31.17 and we know it doesn't apply in the small claims track. You yourself have stated that quoting 31.16 and 31.17 is intended as "a cosh, pure and simple". Yet you appear to contradict this by claiming that a PPC can try and use section 35 in an attempt to find out who was driving a vehicle at a certain time.

Looking at your final comment, are you saying that the High Court gets it right every single time? Do the European Court of Human Rights give the correct judgements in all the cases that come before them? Did they get it right in the case of Francis and O'Halloran?

HO87

Trebor16 wrote: »

A case where a doctor has involvement with a patient, where that doctor would have made notes about the patient and where it had gone legal and disclosure had been ordered is very very different to a PPC going to an employer and asking for details of one of their employees.

Firstly, as the judgment details, the disclosure was not ordered (this would have been in accordance with s.35(1)) but was made in accordance with s.35(2) - as the judgment sets out at para 11 - in connection with legal proceedings or for the purpose of obtaining legal advice.

With respect the cases are entirely analogous in the sense that both entail the obtaining of personal data related to a third party from another otherwise charged by statute not to disclose it.

Trebor16 wrote: »

We have seen how PPC's misuse CPR 31.16 and 31.17 and we know it doesn't apply in the small claims track. You yourself have stated that quoting 31.16 and 31.17 is intended as "a cosh, pure and simple". Yet you appear to contradict this by claiming that a PPC can try and use section 35 in an attempt to find out who was driving a vehicle at a certain time.

CPR 31.16 and 17 do not, indeed, apply to cases on the small claims track and it is my opinion that the quoting of this in the context that PPC's and DCA's do is intended to mislead and if it isn't intended to be then that nevertheless would be the nett effect. That is not at issue.

My attempts at explaining the effect of s.35 of the Data Protection Act are a separate matter and I fail to understand how my explanations in relation to that in any way contradict my views - which are in any event a mere regurgitation of the preceding sections of the CPR itself - in relation to the CPR.

If you are suggesting that I am, in effect, taking with the one hand whilst giving away with the other then I would to an extent agree with you. However, the law is nevertheless the law and we are stuck with it. At least some of the PPC's know what the law is and what I have attempted to set out above will not be news to them.

I say again, that PPC's have no statutory authority to demand details of vehicle hirers from companies. However, like it or not, there is a statutory right they can avail themselves of in the shape of s.35.

If you revisit my earlier posts you will note that I placed some emphasis on the word "may" quite deliberately placed in the Act in relation to disclosures. If an application is made for disclosure (within the terms of s.35) then the receiving data controller is under no obligation to simply supply the requested data unless they are completely satisfied as to the following. That the application has legal standing; that the person (this is the legal person not necessarily an individual) making it is entitled to do so and that in an overall sense the advantages of disclosure outweigh those of non-disclosure. If they are not satisfied then they may refuse the application.

In addition, s.35 has no safety net built into it and if a data controller makes the decision to disclose then it is his neck on the metaphorical chopping block.

The point I had been trying to make at the outset was that whilst a PPC could make such application a rental company, for example, is under no obligation to comply. They could invite the applicant to go forth and obtain an order and there is at least one case of that happening involving Alphabet when a PPC obtained a NPO. A court order (as set out in s.35(1)) trumps s.35(2) but usefully takes the onus away from the data controller.

We should not allow ourselves to become too hung up on s.35. It is of limited use and certainly could not be used in the more domestic setting to get a mother to rat out her son, or wife to name husband.

Trebor16 wrote: »

Looking at your final comment, are you saying that the High Court gets it right every single time? Do the European Court of Human Rights give the correct judgements in all the cases that come before them? Did they get it right in the case of Francis and O'Halloran?

I am not suggesting that the High Court gets it right every time. However, as you will see the judgment in the case of Mensah was heard by a single judge. It was not appealed and there is no superceding precedent in respect of s.35(2).
The case of O'Halloran & Francis and the ECHR itself is, in many respects, a wholly different ball game. I believe it was a political decision but an understandable one for all that. I think the dissenting judgments - particularly of the Moldovan judge - make for very interesting reading.

Trebor16

HO87 wrote: »

Firstly, as the judgment details, the disclosure was not ordered (this would have been in accordance with s.35(1)) but was made in accordance with s.35(2) - as the judgment sets out at para 11 - in connection with legal proceedings or for the purpose of obtaining legal advice.

The disclosure I was referring to was what was mentioned in paragraph 3, in relation to the first action taken between Jones and Mensah, not what was ordered by the High Court.

HO87 wrote:

With respect the cases are entirely analogous in the sense that both entail the obtaining of personal data related to a third party from another otherwise charged by statute not to disclose it.

I see little that is analogous with a request for information made by a PPC with the Mensah v Jones Case. Jones was Mensah's GP and therefore Jones would have had to maintain notes about Mensah. A professional relationship existed with Jones having to maintain accurate records in relation to his dealings with Mensah and it would be necessary for Jones to be able to refer to those records.

HO87 wrote:

If you revisit my earlier posts you will note that I placed some emphasis on the word "may" quite deliberately placed in the Act in relation to disclosures. If an application is made for disclosure (within the terms of s.35) then the receiving data controller is under no obligation to simply supply the requested data unless they are completely satisfied as to the following. That the application has legal standing; that the person (this is the legal person not necessarily an individual) making it is entitled to do so and that in an overall sense the advantages of disclosure outweigh those of non-disclosure. If they are not satisfied then they may refuse the application.

I contend that such an application by a PPC would be an abuse of section 35 and I cannot see any circumstances where approaching an employer of an individual to ask them who was driving one of their cars would be a lawful disclosure of personal data.

HO87 wrote:

The point I had been trying to make at the outset was that whilst a PPC could make such application a rental company, for example, is under no obligation to comply. They could invite the applicant to go forth and obtain an order and there is at least one case of that happening involving Alphabet when a PPC obtained a NPO. A court order (as set out in s.35(1)) trumps s.35(2) but usefully takes the onus away from the data controller.

But Alphabet only obtained the information by getting a NPO, not through section 35 of the DPA.

HO87 wrote:

We should not allow ourselves to become too hung up on s.35. It is of limited use and certainly could not be used in the more domestic setting to get a mother to rat out her son, or wife to name husband.

But you seem to be making a big deal of it, and now you are saying "let's not get hung up on it".

HO87 wrote:

I am not suggesting that the High Court gets it right every time. However, as you will see the judgment in the case of Mensah was heard by a single judge. It was not appealed and there is no superceding precedent in respect of s.35(2).
The case of O'Halloran & Francis and the ECHR itself is, in many respects, a wholly different ball game. I believe it was a political decision but an understandable one for all that. I think the dissenting judgments - particularly of the Moldovan judge - make for very interesting reading.

Your comment about the actions of the court in the Mensah case suggested otherwise.

HO87

Trebor16 wrote: »

The disclosure I was referring to was what was mentioned in paragraph 3, in relation to the first action taken between Jones and Mensah, not what was ordered by the High Court.

Para 3 forms part of the narrative section of the judgment and relates to the self same disclosure that is ruled as lawful at para. 11 and, to reiterate, that disclosure was not subject of a court order but was made within the terms of s.35(2).

Trebor16 wrote: »

I see little that is analogous with a request for information made by a PPC with the Mensah v Jones Case. Jones was Mensah's GP and therefore Jones would have had to maintain notes about Mensah. A professional relationship existed with Jones having to maintain accurate records in relation to his dealings with Mensah and it would be necessary for Jones to be able to refer to those records.

The Data Protection Act relates in exactly the same way in respect of the disclosure/non-disclosure of personal data in either case which is the analogy I was drawing. You have quite rightly hit upon the fact that someone should quite properly be able to refer to records (whose ever they may be) that might assist them to defend or pursue an action. It is that same common law right that was embodied in the DPA in s.35(2) in relation to personal data covered by the Act.

Trebor16 wrote: »

I contend that such an application by a PPC would be an abuse of section 35 and I cannot see any circumstances where approaching an employer of an individual to ask them who was driving one of their cars would be a lawful disclosure of personal data.

Which is exactly the point I have been at pains to make from the outset.

Trebor16 wrote: »

But Alphabet only obtained the information by getting a NPO, not through section 35 of the DPA.

Precisely. Their initial application for access to the records was rejected by Alphabet. As a consequence the PPC obtained the NPO and once the order was served the data controller at Alphabet was able make the disclosure by virtue of the exemption set out in s.35(1).

Trebor16 wrote: »

But you seem to be making a big deal of it, and now you are saying "let's not get hung up on it".

If endeavouring to shine something of a light is making a big deal of something then I apologise.

Trebor16 wrote: »

Your comment about the actions of the court in the Mensah case suggested otherwise.

The fact that I agree with a single judgment is hardly viable evidence of my personal acceptance of all such judgments.