NI: Decision to publish individual RHI recipients in breach of Data Protection Act 1998
The decision of the Department for the Economy to publish the names of “natural persons” in receipt of Renewal Heat Incentive Scheme funding has been quashed by an order of certiorari, after the High Court found that the decision was in breach of the Data Protection Act 1998. The Department is, however, at liberty to publish the names of companies in receipt of RHI funding.
About this case:
- Judgment:
Two applicants made an application for judicial review of the decision, citing inter alia contraventions of the European Convention on Human Rights and the privacy policy attached to the application to the RHI Scheme; however, Mr Justice Donnell Deeny rejected these arguments and found that the decision was flawed due to the incorrect test being applied under the Data Protection Act 1998.
Background
The first applicant in the High Court was named as Mr Michael Doran, Chairman of the Renewable Heat Association of Northern Ireland and representing a number of owners or operators of accredited RHI installations.
The second applicant was described as an operator of an accredited RHI installation, “D.A.”, who spent “£300,000 in installing boilers on his premises to burn wood pellets and receive in turn the financial support provided by Government under this scheme”.
The applicants sought an order of certiorari to quash the decision publish the names and other personal data of or information concerning recipients of RHI funding, a declaration that the decision was unlawful, and an injunction prohibiting release of the information.
The applicants were granted leave to bring the proceedings on a number of overlapping grounds arising from their Order 53 statement: they claimed the benefit of Article 8 of the European Convention on Human Rights, the Data Processing Act 1998, a privacy policy attached to the application form for the Northern Ireland Renewable Heat Incentive Scheme, an argument of substantive legitimate expectation, and an argument that there was procedural unfairness in arriving at the decision in that the Minister failed to take into account relevant considerations.
Privacy Policy
Justice Deeny found that there was no binding legal contract between the recipients of RHI support payments and the Department (or Ofgem) restraining the publication of the names of recipients.
Further, “even if there was such a binding legal contract”, the Department was entitled to vary it unilaterally pursuant to Clause 25 of the website terms and conditions.
The recipients of payments did not have “a clear and unambiguous representation of permanent confidentiality of their names without condition”. Consequently, the Court found that “they had a reasonably clear expectation that their names would not be disclosed but it was subject to the Department’s power of variation at Clause 25”.
In addition, Justice Deeny was satisfied that the Department established an overriding public interest in setting aside any legitimate expectation on confidentiality on the facts established.
European Convention on Human Rights
Considering Volker und Markus Schecke GbR v Land Hessen: Eifert v Land Hessen All ER (EC) 127, Justice Deeny drew a distinction between legal persons and natural persons.
Justice Deeny was therefore satisfied that the Department was at liberty to publish the names of all limited companies and limited liability partnerships which have received support payments under the scheme.
The Department was not in breach of Article 8 of the ECHR in seeking to disclose the names of any of the recipients of support payments as they had sufficient justification to necessitate that disclosure in compliance with Article 8(2).
Data Protection Act 1998
Justice Deeny was satisfied that the department was in breach of the Data Protection Act 1998, due to the fact that it applied a test under section 10 of the Act when the correct test is to be found at Schedule 2, Condition 6(1).
Section 10 of the Act provides that an individual is entitled at any time by notice in writing to a data controller to require the data controller at the end of such period as is reasonable in the circumstances to cease, or not to begin, processing any personal data in respect of which the individual, for specified reasons would suffer or would be likely to cause substantial or substantial distress to him or to another and that that damage or distress is or would be unwarranted.
Although this might overlap with the correct test under Schedule 2, its application across the board constituted a flaw in the consideration of these issues by the Department.
The correct test in Schedule 2, Condition 6(1) reads: “The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.”
Furthermore, natural persons had not been given a sufficient opportunity to state the particular reasons why they might constitute exceptions to Condition 6(1).
The Department’s failure to comply with the Data Protection Act 1998 constituted a breach of the principles set out in Associated Provincial Picture Houses Limited v Wednesbury Corporation AER 498 in that there was a failure to take into account relevant considerations.
Consequently, the Court granted an order of certiorari to quash the Minister’s decision to publish the names of natural persons without giving them an adequate opportunity to state their objections and have those considered in accordance with Schedule 2 of the Data Protection Act 1998.