Hopkins v Revenue And Customs (Rev 1)

An employer may investigate and suspend an employee in relation to serious alleged off-duty criminal conduct where the employment contract and applicable policies confer that power. Criminal offence data may lawfully be processed where the requirements of the General Data Protection Regulation and Data Protection Act 2018 are met, including an appropriate policy document where required. A request for access to information may be reasonably arguable even if it is not expressly framed as a subject access request, but requests to restrict or object to processing require the statutory grounds to be invoked. The Rehabilitation of Offenders Act 1974 protects spent convictions and related information, not arrests unconnected with convictions. A recordable conduct matter must be referred to the IOPC where the statutory conditions are met; an arrest is not itself criminal proceedings.

Dr Kathryn Hopkins, a civil servant employed by HM Revenue and Customs, was arrested in August 2018 and disclosed the arrest to her employer. HMRC suspended her on full pay and began disciplinary investigations, although she had not been charged and no disciplinary charges had been brought.

She brought claims including breach of contract, breaches of data-protection legislation, Convention rights, statutory duties, misfeasance in public office, defamation and malicious falsehood. HMRC applied to strike out the claim and sought summary judgment under CPR 3.4(2) and CPR 24.2. The central issues were whether HMRC could investigate the alleged off-duty conduct, whether its processing and disclosure of the claimant’s data were lawful, whether referral to the IOPC was required, and whether any pleaded causes of action had a realistic prospect of success.

1. Disposition. HMRC’s application succeeded under CPR 3.4(2)(a) and CPR 24.2, except for the challenge to the effectiveness and duration of the suspension under paragraph 75(b)(vii) and (viii), paragraph 75(h) insofar as relevant to that challenge, and the alleged failure to comply with the one-month time limit under GDPR Article 12(3), pleaded at paragraph 74(m). The negligence, health and safety and harassment claims were withdrawn. The defamation claim was also struck out under CPR 3.4(2)(c).
2. The employment contract and HMRC policies required disclosure of an arrest and permitted disciplinary investigation of conduct outside the workplace. In light of the serious allegations, suspension and commencement of an investigation had no realistic prospect of being shown unlawful. The investigation was preliminary; the absence of disciplinary charges did not make it unfair or prevent the claimant from responding.
3. HMRC was a data controller because it determined the purposes and means of processing the claimant’s data for its own employment and disciplinary purposes. Processing for suspension and disciplinary investigation was necessary for performance of the employment contract under GDPR Article 6(1)(b), and criminal offence data processing satisfied Article 10 through section 10(5) and paragraph 1 of Schedule 1 to the Data Protection Act 2018. HMRC had an appropriate policy document.
4. The claimant’s arrest information was criminal offence data within GDPR Article 10 and section 11(2) of the Data Protection Act 2018, but those provisions did not impose a separate obligation to acknowledge that characterisation. Internal sharing and the IOPC referral were not shown to breach the GDPR. The claimant’s letter arguably engaged GDPR Article 15, and the timeliness of HMRC’s response could not be determined summarily. Articles 18 and 21 were not arguably invoked because the relevant statutory grounds were not stated, and the processing was based on Articles 6(1)(b) and (c).
5. The Rehabilitation of Offenders Act 1974 applied to spent convictions and circumstances ancillary to them. The claimant had never been convicted, so her arrest information was not protected by sections 4 or 9 of that Act. Section 3 of the Human Rights Act 1998 could not be used to rewrite the statute.
6. Under regulations 24 and 30 of the Revenue and Customs (Complaints and Misconduct) Regulations 2010, the arrest and information supplied by the police constituted a recordable conduct matter which HMRC had to refer to the IOPC. In regulation 24(5), “proceedings” meant court proceedings; an arrest did not constitute criminal proceedings. The matter was also recordable because HMRC had recorded it.
7. The pleaded misfeasance claim omitted the essential allegations of malice or bad faith and damage. The defamation and malicious falsehood claims failed to identify the publications, meanings, recipients, falsity or malice.

First-instance decision. No prior appellate decision is stated in the judgment.