Privacy and GDPR

Procedural Hearing 13: Privacy and the GDPR, heard on 31 January & 25 March 2019

During the course of the Undercover Policing Inquiry, the law around data protection changed, with the Data Protection Act 2018 encoding the General Data Protection Regulation (GDPR).

The Inquiry also had begun to receive in bulk Special Demonstration Squad intelligence reports, which contained the details of many people including those of core participants. This gave rise to the question of how this personal data should be handled within the Inquiry, and how the workings of the Inquiry impacted on the privacy rights of the individuals in the reports. 

Under the GDPR, as well as there being a right of privacy around personal and family life, there were other ‘protected characteristics’ such as political affiliation and sexuality, which were regularly reported on by the SDS.

These issues were raised in the first instance by the non-state core participants, who took the lead on responding. The Inquiry Chair, Sir John Mitting, thought the issues serious enough they warranted a specific hearing.

In particular, the Chair wanted guidance on how the new regulations would affect the Restriction Protocol would need to be amended, and:

how is effect to be given to the privacy and data protection rights of thousands of individuals who are named in intelligence reports produced by Special Demonstration Squad undercover officers, without undermining the public interest in as much as possible of the Inquiry being conducted in public?

The first hearing on the issue was held on 31 January 2019. Legal arguments presented were of  highly technical in nature, with at times in-depth discussion about the precise meaning of the statutes, often focusing on how words such as ‘necessary’ should be interpreted in light of the Inquiry, or the judicial status of the Inquiry Chair in such proceedings. Solutions were also floated and partially explored, such as ‘confidentiality rings’.

The hearing threw up the issue as to whether the Inquiry could apply a blanket approach to the processing of the personal data it held, or whether it was required to work on a case-by-case basis. It also looked at the degree to which exemptions written into the GDPR could apply. Mitting decided that further discussion on this point of law was required, leading to further written submissions and a second day’s hearing on the issue, which was held on 25 March 2019.

As a consequence of the hearings, the Inquiry modified its Restriction Protocol, whereby those in receipt of material from the Inquiry (usually under disclosure or Rule 9 requests for witness statements) would be subjected to Restriction Orders preventing onward dissemination of the material. However, in the material provided to witnesses, names and identifying information would not necessarily be redacted.

Mitting wrote in his statement on this issue:

The practical consequence is that only those who will accept the process described (i.e. the receipt of material subject to a restriction order) will receive any significant disclosure. It will also mean, in the first instance, that a person who does receive disclosure under a restriction order will not be able to talk to others affected by the same deployment/s about the content of the documents disclosed to them.

Those affected by a deployment may wish to exchange views with others named in the same documents about their content. For this to occur, a high measure of cooperation between those affected and the Inquiry will be required. The Inquiry will do its best to facilitate such cooperation by taking the steps set out below, but is bound to do so within the confines of restriction orders to protect public and private interests and its own need to obtain the best evidence from those able to provide it.

Speakers list

Day 1

Day 2