Cooper v National Crime Agency

Processing sensitive personal data is lawful where the controller satisfies at least one condition in each of Schedules 2 and 3 to the Data Protection Act 1998 and observes overarching fairness. Processing is “necessary” when it is reasonably necessary and proportionate. It need not be indispensable.

Consent is assessed objectively. Consent expressed in a contract extends to the processing permitted by the contract on its proper construction. Under the second data protection principle, compatibility is assessed by reference to the purposes for which the defendant data controller obtained the data, rather than an earlier controller’s purposes.

Domestic disciplinary proceedings are not “legal proceedings”. A limited exemption for establishing, exercising or defending legal rights applies to disclosure, but does not generally exempt a controller’s internal use of data.

The appellant was dismissed by a law enforcement agency following an investigation into his off-duty conduct. The investigation and disciplinary panels used sensitive personal data supplied by a police force. He brought an unfair dismissal claim before the Employment Tribunal and a separate County Court claim alleging unlawful processing under the Data Protection Act 1998.

The Employment Appeal Tribunal upheld the rejection of his data-protection argument but remitted the unfair dismissal claim. It was uncertain whether the Employment Tribunal had considered the risk that statements made during disciplinary proceedings might be passed to the police for use in pending criminal proceedings. The employer cross-appealed against that remittal.

The County Court dismissed the data-protection claim, holding that several conditions in Schedules 2 and 3 were satisfied and that causation was not established. The central issues were the lawfulness, necessity and fairness of the processing, the scope of the second data protection principle and the fairness of proceeding with disciplinary action while criminal proceedings remained pending.

1. All appeals and the cross-appeal were dismissed. The County Court correctly dismissed the data-protection claim. The Employment Appeal Tribunal correctly rejected the employee’s appeal on the data-protection aspect of unfair dismissal and correctly remitted the remaining fairness issue to the Employment Tribunal: [2019] EWCA Civ 16, paras [84], [141]-[145].

2. The requirement that processing be “necessary” means reasonably, rather than absolutely or strictly, necessary. It forms part of a proportionality assessment. The controller had an urgent need to investigate the conduct, assess security and reputational risks, preserve evidence and decide whether disciplinary or external action was required. Waiting for a criminal trial was not an adequate alternative: paras [89]-[96].

3. The processing satisfied multiple conditions in Schedule 2 to the Data Protection Act 1998. The employee had objectively consented through his employment contract. Processing was also necessary for contractual performance, compliance with legal obligations, the exercise of statutory and public functions, and the employer’s legitimate interests: paras [98]-[115]. A public body does not cease to exercise statutory functions merely because it performs them through contracts: paras [105]-[108].

4. Several Schedule 3 conditions were also satisfied. The employee had given explicit consent. Processing was necessary for employment-related legal rights and obligations, for establishing and exercising legal rights, and for statutory functions: paras [116]-[122]. The County Court erred in treating domestic disciplinary proceedings as “legal proceedings” under paragraph 6(a). That expression means proceedings before a court or tribunal of law. The error was immaterial because other Schedule 3 conditions applied: paras [119]-[120].

5. The second data protection principle refers to the purposes for which the defendant controller obtained the data. It does not ordinarily import the purposes for which an earlier controller originally gathered them. Protection against incompatible onward use may instead arise through the balancing exercise in Schedule 2 paragraph 6(1): paras [128]-[132].

6. The section 35(2) exemption applied because disclosure was necessary for establishing, exercising or defending legal rights. Its effect was limited to disclosure. It did not provide a distinct defence for internal use of the data by investigators or disciplinary panels: paras [125]-[127].

7. The disciplinary appeal panel made reasonable inquiries into the provenance and use of the police material. The employer was entitled to assess fairness using the information and allegations actually placed before it: paras [140]-[141]. Nevertheless, the Employment Tribunal had not demonstrably considered the specific risk that information supplied in the disciplinary process might be passed to the police. Remittal on that issue was therefore required: paras [142]-[144].

• Court of Appeal (Civil Division): In [2019] EWCA Civ 16, dismissed the appeals against the County Court judgment and the Employment Appeal Tribunal decision. It also dismissed the employer’s cross-appeal, leaving the Employment Appeal Tribunal’s remittal order in force.
• Employment Appeal Tribunal: Partly dismissed and partly allowed the employee’s appeal. It upheld the rejection of his data-protection argument but remitted the unfair dismissal claim so that the Employment Tribunal could consider the risk of information from the disciplinary proceedings being passed to the police.
• County Court at Central London: Dismissed the claim for compensation under the Data Protection Act 1998. It held that several Schedule 2 and Schedule 3 conditions applied, that the processing was fair and compatible with the second data protection principle, and that causation was not established.
• Employment Tribunal: Dismissed the unfair dismissal claim. It held that the employer conducted a reasonable investigation and that dismissal fell within the range of reasonable responses.