Chowdhury v Secretary of State for the Home Office & Ors

Where personal data held by security and intelligence agencies is operational data processed in the performance of their statutory functions, national-security exemption certificates may conclusively establish that subject-access rights do not apply. The court cannot go behind such certificates or reconsider whether national security required the exemption. Challenges to the certificates must be brought before the Upper Tribunal on judicial-review principles. A neither-confirm-nor-deny response does not imply that data is held: the approach would be defeated if such a response could be treated as confirmation. A claim seeking access to exempt data has no real prospect of success and may be summarily dismissed.

The claimant brought proceedings under the Data Protection Act 1998 and the Data Protection Act 2018, seeking disclosure of personal data allegedly processed by MI5, MI6 and GCHQ in response to subject-access requests. She also sought compensation and related interim and procedural orders.

The defendants applied for strike out under Civil Procedure Rules 1998, rule 3.4(2)(a), and summary judgment under rule 24.2. They relied on ministerial national-security exemption certificates under the 1998 Act and 2018 Act. The central issue was whether the claimant had any enforceable right to the requested data despite those certificates.

1. Summary judgment. The defendants’ application was granted and the claim was dismissed under Civil Procedure Rules 1998, rule 24.2. The claim was hopeless and had no real prospect of success.
2. The information sought concerned possible surveillance and interception. If such data existed, it was operational data processed in the performance of the statutory functions of the security and intelligence agencies. It therefore fell within the descriptions in the relevant exemption certificates.
3. Under ss. 27 and 28 of the Data Protection Act 1998, the certificates were conclusive evidence that exemption from the subject-access provisions was required for safeguarding national security. The exemptions were absolute and unqualified. The claimant had no right under s. 7(1), and no compensation claim under s. 13 could arise from refusal to disclose exempt data.
4. The equivalent provisions of the Data Protection Act 2018 produced the same result. Sections 110 and 111 made the certificates conclusive evidence that exemption from s. 94 was required for operational data. The court could not go behind the certificates. The proper route to challenge them was an appeal to the Upper Tribunal on judicial-review principles.
5. The claimant’s interpretation of the legislation and certificates was untenable. The certificate proviso concerning cases where neither-confirm-nor-deny treatment was unnecessary did not apply: the agencies had not determined that such treatment was unnecessary.
6. A neither-confirm-nor-deny response was not evidence that the agencies held the requested data. The response was equally appropriate where no data was held, because disclosure of the answer would undermine the purpose of the approach.
7. The claimant’s outstanding applications fell away once the claim was dismissed.

The judgment does not state any prior appellate decision. The claim was transferred from the County Court to the High Court.