Shepherd v The Information Commissioner

Section 55(2) of the Data Protection Act 1998 imposed an evidential, rather than a legal, burden on a defendant. A defendant must raise, and establish an evidential basis for, one of the specified matters. The prosecution must then disprove it to the criminal standard.

Section 55(2) disapplied the offence provision where its conditions were shown. It was not framed as a defence to an otherwise complete offence. Parliament’s use of different wording from familiar reverse-onus provisions, together with the criminal context and the nature of the specified matters, supported that construction. The convictions could not stand.

The appellant was convicted at St Albans Crown Court of three offences of unlawfully obtaining personal data contrary to section 55 of the Data Protection Act 1998. He had circulated a confidential safeguarding report to 83 recipients after the local authority terminated the management organisation’s agreement and dismissed him.

He relied on the reasonable-belief and public-interest provisions in section 55(2). The trial judge held that those provisions imposed a legal burden on him. The central issue on appeal was whether section 55(2) instead imposed only an evidential burden and, if it imposed a legal burden, whether that was compatible with article 6(2) of the Convention.

1. Appeal allowed; convictions quashed. Section 55(2) of the Data Protection Act 1998 imposed only an evidential burden. The respondent did not seek to uphold the convictions if that construction were correct. The court refused a retrial.

2. Section 55(1), read with section 55(3), contained the principal ingredients of the offence: knowing or reckless disclosure of personal data without the data controller’s consent. Section 55(2) was framed differently. It provided that section 55(1) did not apply where the defendant showed one of the specified matters. Where such a matter was shown, an essential component of the offence was absent; the subsection was not a defence, exemption or qualification to an otherwise complete offence.

3. The word “shows” had to be read in its full statutory setting. It meant that the defendant must raise and establish an evidential basis for the relevant matter. The Information Commissioner then had to disprove it beyond reasonable doubt. A defendant could not merely assert the statutory words.

4. Parliament had used familiar language imposing a legal burden elsewhere in the Act, but chose atypical wording in section 55(2). A legal burden in a criminal case is exceptional and requires sufficiently clear language. The subsection also covered both objective matters and reasonable-belief matters that could be investigated before a jury without placing the prosecution at a real disadvantage. A single evidential-burden construction was required across all four subparagraphs.

5. The court therefore did not decide the Convention argument. It additionally stated, by way of guidance, that section 170(2) of the Data Protection Act 2018, which is expressly framed as a defence to be proved, imposes a legal burden. It expressed no view on article 6 compatibility.

• Court of Appeal (Criminal Division): appeal allowed; the convictions were quashed and an application for a retrial was refused ([2019] EWCA Crim 2).
• Crown Court at St Albans: the appellant was convicted on 28 March 2018 of three section 55 offences and fined.