Spycops Victims Use Privacy Laws in Bid to See Files

On 25^th March, the Undercover Policing Inquiry will hold its second hearing into how it is affected by the General Data Protection Regulations – GDPR.

It’s more than five years since the Inquiry was announced and we are still quibbling over legal points that require specialist barristers to be brought in. The evidence-hearing phase, arguably the most import section, has been put back yet again, probably to 2020.

From the beginning, those spied on have consistently demanded to see their Special Branch files. Only then would it be possible to understand how the undercovers infiltrated their personal lives, and in too many cases, people’s beds, or destroyed their ability to get jobs.

Sir John Mitting, the Chair of the Undercover Policing Inquiry, has replied, saying it would be too much work and would delay the inquiry further. It’s a slap in the face to all who have waited through years of wilful police delays, which Mitting has readily acquiesced to. Indeed, many find it grimly ironic that he is now talking about wasting resources given the amount squandered on police anonymity orders.

The Non-Police/State Core Participants (NPSCPs), the victims in all this, are treated as second class people. They object to police and ex-police being given access to their files while not knowing what personal content is in there, or how accurate it may be. They object to the Inquiry deciding what is and what is not important in those files and thus what the victims will get to see.

Challenging the Secrecy

From the few released Special Branch files it’s clear that political undercover police misinterpret events, they exaggerate, and they lie. People’s lives are ruined on the basis of biased or false information.

What the Inquiry proposes, is that the people whose files are at the centre of things will be the last to see that material, and even then only part of it – that is, only those bits the Inquiry decides is relevant to its work. The NPSCPs only get a say over how some of it is made public, and even then only after everyone else has had a go first. From the NPSCPs’ point of view, what Mitting is proposing will only increase the emotional stress many of them are already currently subject to.

So, last year, the NPSCPs raised the point that under the new GDPR regulations they did actually have rights over their data in the hands of the Inquiry, and such rights were over all such data, not just what the Inquiry decided was important. What matters is not what the Inquiry wishes but what are the rights protected in law.

The Inquiry clearly realised there was an issue as they quickly ordered a hearing. That took place at the end of January, and it was a bit of a shambles. Only the NPSCPs’ lawyers effectively grasped the issues, necessitating a second hearing to address the legal points that had been raised.

The rest of this article sets out the legal points which will be discussed (links to all submission documents are here). Hopefully, it will assist anyone seeking to follow the arguments on the day and give a quick reference to the various paragraphs and articles which will be cited.

Welcome to the GDPR

The GDPR has a number of articles which set out conditions for processing data, rights over that data and what exceptions to those rights and conditions which may exist. The Data Protection Act 2018 codes all this into UK law, updating previous acts. The regime is tougher and more comprehensive than previous legislation; it is also relatively new, which means interpretation of the finer points still have to be worked out in the courts. Some reliance can be placed on previous case law arising from the 1998 Data Protection Act, but it does not always apply.

There is also the issue of what sort of body the Undercover Policing Inquiry is. It is not a court but is in fact established by a piece of stand-alone legislation, the 2005 Inquiries Act. It may seem like semantics, which for the most part such discussions are, but in this case it is an important question.

So, the GDPR Articles of most relevance for the hearing of 25^th March are:

• 13: Information to be provided where personal data are collected from the data subject.
• 14: Information to be provided where personal data have not been obtained from the data subject.
• 15: Right of access by the data subject.

Several others which might play a role are Articles 16 (the right to correct), 17 (the right to be forgotten) and 18 (the right to restrict processing). These are not likely to be a focus of attention as it is accepted by core participants that to get to the truth, the Inquiry and those involved need to have access to the information gathered by the police as it was, in order to understand the abuses that went on.

A particular complication is how to share documents where more than one person is named. In some cases – such as a small, tight group where everyone knew everyone else – this is not likely to be that much an issue. However, quite a few documents name multiple people, not all of whom will know each other. In the jargon, this is called ‘third party rights’, and can be used to restrict material, for example where giving you your data may cause a third party’s data to be revealed. In this case, you both lose out.

This becomes more focused when looking at what is called ‘special category’ data. This is material considered sensitive and of a highly personal nature – family life, addresses, sexuality and so on. Even political opinions are caught here. It is a balancing exercise, but NPSCPs are aware such material is in police documents, and the prospect of further sharing of them without a chance to check over it is compounding their violation and pain. For this reason, the Inquiry is becoming part of the problem.

Exemptions from Disclosure

The files, whether personal files, intelligence reports, or others, all fall under Article 14 as the Inquiry is processing data it got from the police. Under normal conditions the Inquiry would be required to give the data subjects notice and what data it holds before it can process it, such as passing it on to retired police officers. However, there are exceptions, two of which the Inquiry seems keen to rely on.

Clause 5(b) of Article 14, ‘the paragraph 5 exemption’, says that the data controller (in this Inquiry, Mitting) is exempt from his obligations if ‘the provision of such information proves impossible or would involve a disproportionate effort’. However, it is still required to protect the data rights of the individuals.

The second is known as ‘paragraph 7(2)’, and comes from the Data Protection Act 2018. The Act states the data controller can claim an exemption from complying with the data rights where complying would ‘prejudice the proper discharge’ of the function the data is being processed for. Provided that function is ‘designed to protect members of the public against dishonesty, malpractice or other seriously improper conduct’ and is ‘of a public nature, and is exercised in the public interest’.

The extent to which the Inquiry can rely on these two exemptions are central points for the Inquiry’s hearing on March 25^th.

Both the Inquiry and, unsurprisingly, the police say they can rely on them, and furthermore they are ‘blanket exemptions’ which cover all cases. So if and when the Inquiry decides they are available to it to use, then it’s effectively game over. The Information Commissioner’s submissions say that the Inquiry can rely on them, but they are not blanket exemptions.

Victims Claim Their Rights

The NPSCPs say it is far more nuanced than that, and even where the exemptions apply, it is only on a case-by-case basis, and does not excuse the Inquiry from all its rights. There are measures it can and should be taking which will alert people to the fact that they may be named in documents – for example through their presence at a certain meeting, or role in a group.

The NPSCPs are also emphatic that they should be seeing their information much earlier on in the process so that they can make representation over sensitive material that might be in the files (and finally get to see what has been said about them).

The Inquiry is arguing that NPSCPs should only see their files only after all the other redactions have been made in terms of national security, protection of police tactics and so on, and that early disclosure to the NPSCPs will delay getting statements back from the undercovers and their managers. This is where it is supposedly disproportionate and would cause delays.

NPSCPs say this is not good enough; it is the Inquiry’s fault for letting the police cause delays for the last three years and now this is being thrown back in in the victim’s faces. It is granting privileges to the police that it doesn’t give to those who were inappropriately spied upon, and implies the latter can be treated with less concern for their rights.

The NPSCPs also do not accept that the work that will have to be done in providing disclosure to them first is disproportionate. Looking at the greater volume of material handled by other public inquiries which also require extensive redactions, it is clear the Inquiry is overstating the impact. Nor does the Undercover Policing Inquiry make the effort to actually justify its claims. The Inquiry simply relies on broad statements with very little supporting material.

The NPSCPs want the Inquiry to succeed, so they accept compromises have to be made; but they want to be respected also. To this end they have accepted a curtailment of their rights and put forward pragmatic proposals that would have some impact on the Inquiry, but bring them into it in a way that will help the Inquiry in the long run. The core of what they propose is a re-arrangement of the order of things, not anything new.

The Judicial Exemption

There is a second route where the Inquiry can argue it is given an exemption from complying with its obligations under the GDPR. If it can successfully be argued that the Chair is not acting in a “judicial capacity” in ’judicial proceedings” then the Inquiry can say it is exempt. Simple, eh?

Well, this is where the lawyers earn their money and it all goes down the technical hill from there. It’s not that straightforward as “judicial proceedings” is not explicitly defined and the meaning of the term itself relies on a lot of case law rather than legal statute. Nor does the Inquiries Act make it clear what the case is.

So, while on the surface the Chair does appear to be acting in a judicial capacity, there are various problems. For instance, an Inquiry is not necessarily judge-led, and unlike other tribunals, it only makes recommendations and deliberately doesn’t have the power to consider liabilities. The key point is that while the Chair will report to the Home Secretary (and may make referrals to other bodies), he does not have the power to make binding decisions and has no powers of enforcement.

Any Rulings are made under the Inquiries Act and are not necessarily court derived, even though they can be judicially reviewed. But then, many decisions not just court ones can be judicially reviewed. And so on.

The good news is that the Information Commissioner agrees with the NPSCPs on this and they have put that in their submissions (see below).

The Submissions to the Inquiry

With the exception of one or two, most of the police / state submissions for the new hearing continue the bare-bones approach that lead to the January debacle. Despite the many thousands of pounds being spent on this, it is clear that barristers are prepared to rely on broad-stroke assertions that make little effort to unpick the arguments. Naturally such an approach suits the police who want to ensure as little as possible reaches light of day.

All brush any sense of nuance under the carpet; their willingness to trust it all to Mitting is indicative of how on side their they clearly consider him to be. Thus there is no attempt to actually consider the non-blanket approach, to reason through the wider obligations presented by the GDPR, which the law requires.

Even where there are exemptions allowed, data rights do not vanish like that; they still exist and so have to be properly considered. That means paying attention to the nuance to develop a working framework that meets everyone’s needs, not just the side of the abusers.

And let us remember, it was the Metropolitan Police who admitted that its officers were engaged in human rights abuses.

Victimising the Victims

The NPSCPs accept the situation is far from ideal but are willing to work with the Inquiry to find a way forward. In not asserting their rights entirely, there needs to be a quid pro quo. Unfortunately, the Inquiry is more determined than ever to keep the victims at arm’s length from the process, treating them as an irritant with little to contribute.

The NPSCPs argument is that it should be the opposite, that the Inquiry is causing itself these problems by this attitude. If instead, it sought to work properly with NPSCPs it could have avoided reaching this point in the first place.

As once core participant told us:

“We have practical and pragmatic solutions that would prevent further pain and contribute to the process, while recognising our legal rights. In sticking to the hypocritical mantra that it would only delay the process, that the police have absolute right to see everything but we only get scraps, Mitting places himself firmly on the side of the police. His farce is our pain”.

---

If you can, please support the crowdjustice fundraiser for women targeted by spycops to take their cases to the Investigatory Powers Tribunal and the UN.