Lin & Anor v Commissioner of Police for the Metropolis

The crime and taxation exemption from subject access under section 29 of the Data Protection Act 1998 is qualified. The data controller must establish, with significant and weighty evidence, both a qualifying law-enforcement purpose and a sufficient likelihood of prejudice. The court must conduct an item-specific proportionality assessment.

Family liaison may form part of the prevention or detection of crime and the apprehension or prosecution of offenders. Potential harm to future international police co-operation may justify withholding data. Its weight must nevertheless be balanced against the data subject’s interests. The required scrutiny is especially intense where life and fair-trial rights are engaged.

Two defendants facing capital murder charges in Thailand sought access under section 7(9) of the Data Protection Act 1998 to their personal data in a confidential Metropolitan Police report. The report summarised an observational review of the Thai investigation undertaken to reassure the victims’ families.

The Commissioner accepted that the report contained some personal data but relied on the crime and taxation exemption in section 29. The court had to decide whether family-liaison processing served a qualifying law-enforcement purpose and whether disclosure was likely to prejudice that purpose. It inspected the disputed information under section 15(2) without disclosing it to the claimants.

1. The application was dismissed. The Metropolitan Police had lawfully relied upon section 29 of the Data Protection Act 1998. The personal data had been processed for a qualifying purpose, and the demonstrated interests against disclosure outweighed its value to the claimants.

2. Section 29 creates a qualified exemption. Its language, read purposively and consistently with the underlying fundamental rights, requires a proportionality assessment. The data controller bears the burden of justifying the exemption with significant and weighty grounds and evidence. “Likely” requires a very significant and weighty chance of prejudice, although prejudice need not be more probable than not.

3. Processing undertaken for family liaison can fall within the prevention or detection of crime and the apprehension or prosecution of offenders. Modern criminal justice includes protection of victims and their families. Supporting families may also sustain confidence in law-enforcement bodies and encourage victims and witnesses to assist investigations.

4. The court had to scrutinise the refusal anxiously and intensively because the claimants faced the death penalty and relied upon fair-trial and right-to-life interests. The court accorded the police no material margin of discretion. The balance had to be undertaken separately for each item of personal data; confidentiality could not justify a blanket refusal.

5. The possible chilling effect upon future co-operation with foreign authorities was a legitimate and weighty law-enforcement consideration. The assessment could include effects beyond the particular prosecution. Disclosure of even a small quantity of data might impair the ability of British police to obtain confidential co-operation abroad. Avoiding inappropriate interference with a foreign criminal process was also a serious consideration.

6. A data subject may properly seek personal data for use in defending criminal proceedings. The observations in Durant v Financial Services Authority [2003] EWCA Civ 1746 concerning attempts to use subject access as a substitute for civil disclosure did not govern a capital case in which the data arose directly from the relevant criminal investigation.

7. After inspecting every item cautiously and with the claimants’ interests in mind, the court found no materially exculpatory data and nothing of real value to their defence. The data was largely brief, neutral, inculpatory, already known, or a summary of underlying material likely to have been addressed at trial. The police interests therefore prevailed.