Judgment Approved by the court for handing down
R (Bridges) v CCSWP and SSHD
matter come before her through the enforcement provisions under Part 6 of and
Schedule 13 to the DPA 2018 - is not dissimilar to the approach courts already
take when considering claims of failures to comply with the public-sector
equality duty under section 149(1) of the Equality Act 2010. Although the
respective obligations are not identical, both require prior consideration of
matters relevant to a proposed course of conduct, and an exercise of judgement
on the part of the decision-maker as to the steps that should be taken to guard
against possible adverse consequences of the action proposed.
146.
On a complaint about a failure to comply with section 64 DPA 2018, it is for
the Court to decide whether the data controller has discharged that obligation.
What is required is compliance itself, i.e. not simply an attempt to comply that
falls within a range of reasonable conduct. However, when determining
whether the steps taken by the data controller meet the requirements of section
64, the Court will not necessarily substitute its own view for that of the data
controller on all matters. The notion of an assessment brings with it a
requirement to exercise reasonable judgement based on reasonable enquiry and
consideration. If it is apparent that a data controller has approached its task on
a footing that is demonstrably false, or in a manner that is clearly lacking, then
the conclusion should be that there has been a failure to meet section 64
obligation. However, when conscientious assessment has been brought to
bear, any attempt by a court to second-guess that assessment will overstep the
mark. In the context of the public-sector equality duty, in his judgment in R
(Unison) v Lord Chancellor [2016] ICR 1, Underhill LJ made this observation,
at paragraph 106:
“… to the extent that views are expressed on matters requiring
assessment or evaluation the court should go no further in its
review than to identify whether the essential questions have been
conscientiously considered and that any conclusions reached are
not irrational. Inessential errors or misjudgements cannot
constitute evidence of the breach of the duty.”
147.
In our view, a like approach is required for the purposes of the impact
assessment obligation under section 64 DPA 2018. When considering whether
or not a data controller has complied with the section 64 obligation, a Court
will have regard to the guidance that has been issued by the Information
Commissioner in respect of Data Protection Impact Assessments. However, it
is important to have well in mind that that guidance is non-statutory, i.e. it is
not issued under the auspices of section 127 DPA 2018. Weight should, of
course, attach to opinions expressed by the Information Commissioner in her
guidance, but they should not cause anyone to lose sight of either (a) the
obligations in section 64 as they have been expressly formulated, or (b) the
appropriate standard of review of a data controller’s impact assessment
exercise.
148.
We consider that the impact assessment prepared by SWP in this case meets
the requirement of section 64 DPA 2018. There is a clear narrative that
explains the proposed processing. This refers to the concerns raised in respect
of intrusions into privacy of members of the public when AFR Locate is used.