Shepherd v The Information Commissioner [2019] EWCA Crim 2
- Summary
- Citing
- Cited By
Shepherd v The Information Commissioner [2019] EWCA Crim 2 concerned an appeal by Mr Paul Shepherd against conviction in St Albans Crown Court on 28 March 2018 for three counts of unlawfully obtaining personal data contrary to section 55 of the Data Protection Act 1998. The Court of Appeal allowed the appeal, holding that section 55(2) imposed only an evidential burden of proof.
Mr Shepherd had worked for almost ten years as a development coordinator for Bemerton Village Management Organisation in Islington. In August 2015 the London Borough of Islington terminated its agreement with the organisation and assumed management functions, dismissing Mr Shepherd and another individual. The Council had concerns about safeguarding of children and vulnerable young people, partly connected to Mr Shepherd’s earlier acquittal on a charge of sexually assaulting a 17‑year-old girl. The Council commissioned a safeguarding investigation by its Local Authority Designated Officer, Ms Jo Moses, who prepared a confidential report. Mr Shepherd was a main subject. The report was leaked to him and in January 2016 he disclosed it by email to 83 recipients, including councillors, members of a safeguarding agency and the local Member of Parliament. He contended that he was justified in doing so because of serious concerns about the Council’s use of safeguarding powers and suspicions about its true motivation. He had been investigated by the Independent Safeguarding Authority in 2012 and it had concluded he was not a risk to children.
Count 1 of the indictment alleged that personal data concerning an “unnamed female” who was the complainant in his earlier criminal trial had been disclosed. Counts 2 and 3 related to personal data of two of his colleagues. The prosecution case was that these individuals were the data subjects within the meaning of the Act. It was an agreed fact that the Council did not know and never did know the identity of the unnamed female, and at least on one reading there was insufficient information in the report to identify her.
Mr Shepherd relied at trial on the defences in section 55(2)(b), (c) and (d), namely that he acted in the reasonable belief that he had the legal right to disclose the data, that he acted in the reasonable belief that he would have had the consent of the Council if it had known of all the circumstances, and that in the circumstances the disclosure was justified as being in the public interest. His case was that the report contained data relating primarily to him and his close colleagues, that the recipients were those entitled to view it in any event, that it had already been sufficiently anonymised, and that disclosure was in the public interest given concerns about the Council’s conduct, practices and motivations. He denied disclosing personal data of the unnamed female in count 1 on the basis that there was no means of identifying her from the report or the email.
The judge rejected a submission of no case to answer on count 1, ruling in a brief decision that there was an arguable case on the footing that this was personal data as defined because the report had been circulated to 83 people. On the issue of burden of proof the judge ruled that as a matter of plain language the statutory wording did not define the limits of the offence but carved out an exception, so that the offence was committed unless the defendant showed he fell within the exception provided by the defences. He held that this was a regulatory statute operating in a sphere not truly criminal and that the ingredients of the defence were substantially within the defendant’s knowledge so that he should assume the burden of proving them. His summing‑up was adapted from written directions given by Mr Justice Green in an earlier case where it had been common ground that section 55(2) imposed a legal burden. No separate complaint was made about the summing‑up.
On appeal Miss Collins submitted that on ordinary principles of statutory construction section 55(2) did not impose a legal burden. She drew attention to its somewhat unusual wording (“subsection (1) does not apply to a person who shows”) in contrast with other provisions in the Act which clearly conferred a legal burden by applying what she called an archetypal formula, namely “it is a defence to prove that” in section 47(3) or “it shall be a defence for a person charged with an offence to show that” in sections 21(3) and 24(5). She referred to the different wording in the Data Protection Act 2018. She submitted that the statutory purpose did not require imposition of a legal burden because several of the conditions in section 55(2) related to objective matters independent of a defendant. In the alternative she submitted that if the position were uncertain the ambiguity should be resolved in the defendant’s favour. In oral argument she explained that section 55(2) was addressed to the world at large whereas the provisions conferring a legal burden were directed to those who carried out functions or owed obligations under the statutory scheme, such as data controllers or those served with enforcement notices, so that the policy of the law was more onerous in those cases. As to the need to read down the subsection to ensure Convention compliance, Miss Collins referred to the list of considerations and factors identified in the trilogy of House of Lords decisions in Lambert, Johnstone and Sheldrake. Given that the court accepted her submissions on statutory construction it was unnecessary to dwell on the arguments bearing on necessity and proportionality, but in summary she contended that the matters in section 55(2) were not peculiarly in the knowledge of a defendant, that the governing EU Directive showed criminal sanctions were not required still less sanctions bolstered by a reverse burden, that section 55(2) was premised on objective fault which the criminal law generally regards with reserve, that it was wrong to regard the scope of the Act as a regulated sphere because it had a broad and general application, and that it was wrong to treat the target of the Act as conduct not truly criminal given the unlimited fine on indictment and the discouragement of routine upholding of reverse burdens in less serious cases lest this chip away at a fundamental principle of criminal law.
Miss Spearing for the Information Commissioner contended that the issue of statutory construction had been determined against the appellant by this court in R v S and by the House of Lords in Johnstone. There was no material difference between language such as “it is a defence for a person charged with an offence to show that” in section 92(5) of the Trade Marks Act 1994 and the wording of section 55(2). To the extent that the appellant’s case drew on any distinction between the constituent elements of the offence itself and matters germane to the statutory defences the real question had to be one of substance rather than technicality. Miss Spearing did not accept the distinction sought to be drawn between data controllers and the general public, observing that the appellant was in control of the data at the material time, took a deliberate decision to disseminate the report and must have appreciated that private matters were being divulged. She submitted that the difference between section 47 and section 55 was that the former was concerned with what she called instructive action to specified individuals. As for the need to read down the provision she drew attention to R (Catt) v Association of Chief Officers and the observations of Lord Sumption that the Act and the Directive had the objective of providing a high level of protection of personal data and the right to privacy. In support of her submission that the reverse legal burden was both justifiable and proportionate she relied cumulatively on the high level of protection mandated by the Directive requiring a regime whereby individuals may contravene the provisions without attracting moral obloquy, the intensive regime of statutory and administrative regulation created by the Act, the fact that the subject matter of section 55(2) was evidence within a defendant’s knowledge susceptible to straightforward proof by him, the fact that the maximum sentence was a fine, and the contention that the 2018 Act clarified the position rather than fundamentally changing it.
Mr Justice Jay, giving the judgment of the court, held that there was no decided case which directly assisted on the correct approach to section 55(2) and that limited assistance was derived from jurisprudence decided in different statutory contexts. The court gained no assistance from an analysis of the recitals to the Directive. While the policy at EU level was to afford a high degree of protection to personal data this factor could not sufficiently discriminate between legal and evidential burdens in a criminal context not expressly envisaged by the Directive. The court noted the views of two academic commentators that section 55(2) imposed merely an evidential burden but observed that they did not appear specifically to have addressed the contrary arguments.
The court held that the correct construction of section 55(2) must turn primarily on a close linguistic analysis of the provision. This was a criminal statute which must be narrowly interpreted in the interests of a defendant, and the fact that the consequences may not be at the higher range of seriousness did not dilute this principle, the full contours of which were expounded in R v S. The language of section 55(2) had not been replicated in any other statutory provision to the court’s knowledge and basic internet searches had drawn a nil return. The wording could be described as something of a hybrid which did not clearly and obviously fall within any familiar compartment. The principal ingredients of the offence were contained in section 55(1) read with subsection (3). The wording of section 55(2) was key. As a matter of ordinary language the offence was not constituted, because subsection (1) was disapplied, in a situation where the defendant showed any of matters (a) to (d). This was not expressed in terms of a defence or of an exemption or qualification but rather as a situation where an essential component of the offence did not exist if any of those matters was shown.
A number of matters followed. First, if the provision did not create a defence to what would otherwise be the fully constituted offence, it was much less likely that Parliament intended to impose a legal burden of proof on the defendant. Such a burden was more readily applicable to defences properly so called because it could not be rightly incumbent on a defendant to prove part of the offence with which he was charged. Secondly, Parliament had selected the wording of section 55(2) and thereby abjured the familiar or classic wording which was used elsewhere in the same statute. Thirdly, the matters set out in subparagraphs (a) to (d) were not always constituent elements of the offence but only came into play if a defendant raised them. Put in this way it was much more likely that Parliament intended to impose an evidential burden. The word “shows” in this context was to be treated as a synonym for “raises”, indicating that it was for the defendant to raise a specified matter and then for the Information Commissioner to disprove it to the criminal standard. Fourthly, the verb “shows” taken in isolation would usually be taken as a synonym for “proves”, but the whole of the relevant clause had to be considered. Fifthly, it was relevant, albeit not determinative, that this was not an archetypal regulatory offence involving strict liability. Mens rea was an essential element, which suggested that Parliament did not have it in mind to impose criminal consequences unless a defendant proved to the probabilistic standard facts and matters which in the main could be judged objectively. Sixthly, the important distinction drawn between constituent elements of the offence on the one hand and the ingredients of a defence on the other had not been undermined by the speeches of Lords Steyn and Hutton in Lambert; those paragraphs were directed to the issue of proportionality, not statutory construction. Seventhly, there was a strong policy reason disfavouring legal burdens, namely the risk that an accused may be convicted where a reasonable doubt may exist.
The court accepted Miss Collins’ explanation for the difference between section 55(2) and sections 21(3), 24(5) and 47(3). To be added was section 56(3) which shared the unusual terminology of section 55(2) and was concerned with purely objective factors which did not depend on the defendant’s state of mind. The fact that the legislature had chosen one form of words on three occasions and a different formulation on two was a strong indicator that the intention of Parliament was to achieve different legal results. An examination of subparagraphs (a) to (d) showed that two did not depend on the defendant’s state of mind at all, whereas the other two required consideration of his reasonable belief. In the latter two instances the defendant must of course show that he did believe the facts set out, but beyond that the issue was of the reasonableness of that belief, matters which could readily be investigated before a jury without placing the prosecution at any disadvantage. Despite slight differences across the subparagraphs a consistent approach was required. It would be surprising if in a case where only subparagraph (d) were relied on the defendant would have to prove that he acted in the public interest.
The court held that approaching the question of statutory construction as it had done without reference to authority led to the clear conclusion that section 55(2) imposed no more than an evidential burden, and that relevant jurisprudence did not lead to a different conclusion but tended to support the conclusion reached. In R v Davies this court had rejected the submission that section 40 of the Health and Safety at Work Act 1974 conferred only an evidential burden, in the context of an offence of strict liability where the language creating the defence was clear. In rejecting the argument that the provision should be read down the court held that it was relevant that the appellant, an employer, had chosen to operate in a regulated sphere of activity. In the present case it could not fairly be said that Mr Shepherd had made that choice. He was not a data controller nor was he someone who was the target of instructive action. He was closer to being the employee mentioned in Davies to whom no reverse onus applied under the 1974 Act. Lord Sumption’s observations in Catt about the intensive regulatory regime imposed by the Act could not be disputed, but the appellant had not chosen to operate in this regulated sphere and could not be taken to have accepted the regulatory controls which accompanied that activity.
In R v S the issue was whether section 92(5) of the Trade Marks Act 1994 imposed a legal burden which was justifiable. That subsection provided that it was a defence for a person charged to show that he believed on reasonable grounds that the use of the sign in the manner used was not an infringement. This was in the context of an offence of strict liability. Mr Justice Davis giving the judgment of the court concluded that section 92(5) on its true construction did impose a legal burden because amongst other reasons the language of the statute was clear and the verb “shows” in that context had to be interpreted as synonymous with “proves”. In the instant case the verb “shows” did not appear in isolation but was located in the unorthodox wording of section 55(2). The Trade Marks Act 1994 also occupied a regulatory arena which was closer to the sort of regulatory sphere considered in Davies. People undertaking commercial activities would tend to know the limitations and restrictions that applied, and it was entirely reasonable for ignorance of these to be established by them on the balance of probabilities. The court in R v S was able to distinguish its previous decision in R v Johnstone where the contrary argument was not raised. The prosecution did argue the point when Johnstone reached the House of Lords, where the reasoning of R v S was unanimously affirmed. Lord Nicholls said he entertained no doubt that unless the interpretation was incompatible with article 6(2), section 92(5) should be interpreted as imposing on the accused the burden of proving the relevant facts on the balance of probability, and that the contrary interpretation involved substantial rewriting of the subsection. The stark difference between the wording of
R v S [2003] 1 Cr. App. R. 602
Lambert [2001] UKHL 37; [2001] 2 Cr App R 28, [2002] 2 AC 545
Johnstone [2003] UKHL 28, [2003] 3 All ER 884, [2003] 1 WLR 1736
Sheldrake v Director of Public Prosecutions [2004] UKHL 43, [2005] 1 AC 264
DPP v Wright [2010] QB 224
R (Catt) v Association of Chief Officers of England & Wales [2015] AC 1065
Davies v Health and Safety Executive [2002] EWCA Crim 2949, [2003] ICR 586
MK and Persida Gega [2018] EWCA Crim 667; [2018] 2 Cr.App.R. 14