Court of Appeal quashes convictions for unlawfully obtaining personal data

The Court of Appeal has quashed the conviction of a defendant for unlawfully obtaining personal data.

At issue in Shepherd v The Information Commissioner [2019] EWCA Crim 2 was whether s.55 (2) of the Data Protection Act 1998 imposes a legal or evidential burden of proof on a defendant.

“Although similar issues have arisen in other statutory contexts, this is the first occasion on which the point has arisen in this court,” Mr Justice Jay noted.

Although the 1998 Act has been repealed by the Data Protection Act 2018 ("the DPA 2018"), the court was asked by the Information Commissioner to provide guidance on the new provisions.

Paul Shepherd was in March 2018 convicted of three counts of unlawfully obtaining personal data contrary to section 55 of the DPA 1998. He was fined £600 and ordered to pay the victim surcharge of £60 and prosecution costs of £3,500.

He had been development co-ordinator for Bemerton Village Management Organisation (BVMO) in Islington.

In August 2015 the council terminated its management agreement with BVMO and Shepherd and another worker were sacked.

“The background was that the council had concerns about BVMO's safeguarding of children and vulnerable young people within its area: it was continuing to employ the appellant who had been tried and acquitted eight years previously for sexually assaulting a 17-year old girl with whom he had a brief relationship,” the judgment noted.

Islington commissioned a safeguarding investigation, a move Shepherd contended was taken to improve its negotiating position with BVMO. Its report was leaked to him in January 2016 and he disclosed it to 83 people.

Jay J said the prosecution case was that personal data contained in the safeguarding report related to two of Shepherd’s colleagues and an ‘unnamed female’ and that these three were thus data subjects.

The defence made was that Shepherd acted in the reasonable belief that he had the right in law to disclose the data in the report and that he would have had the consent of the council if the latter had known of all the circumstances.

Jay J said that s.55(2) “imposes no more than an evidential burden” and its correct construction of “must turn primarily on a close linguistic analysis of the provision”.

He added: “This is a criminal statute which must be narrowly interpreted in the interests of a defendant, and the fact that the consequences may not be at the higher range of seriousness does not dilute this principle.”