BIG BROTHER WATCH AND OTHERS v. THE UNITED KINGDOM JUDGMENT
67
7.7. The exemption to subject access rights possible under section 29 does not
automatically apply to the disclosure of the existence of notices given under RIPA. In
the event that a CSP receives a subject access request where the fact of a disclosure
under RIPA might itself be disclosed, the CSP concerned must carefully consider
whether in the particular case disclosure of the fact of the notice would be likely to
prejudice the prevention or detection of crime.
7.8. Where a CSP is uncertain whether disclosure of the fact of a notice would be
likely to prejudice an investigation or operation, it should approach the SPoC of the
public authority which gave the notice – and do so in good time to respond to the
subject access request. The SPoC can make enquiries within the public authority to
determine whether disclosure of the fact of the notice would likely be prejudicial to
the matters in section 29.
7.9. Where a CSP withholds a piece of information in reliance on the exemption in
section 28 or 29 of the DPA, it is not obliged to inform an individual that any
information has been withheld. It can simply leave out that piece of information and
make no reference to it when responding to the individual who has made the subject
access request.
7.10. CSPs should keep a record of the steps they have taken in determining
whether disclosure of the fact of a notice would prejudice the apprehension or
detection of offenders. This might be useful in the event of the data controller having
to respond to enquiries made subsequently by the Information Commissioner, the
courts and, in the event of prejudice, the police. Under section 42 of the DPA an
individual may request that the Information Commissioner assesses whether a subject
access request has been handled in compliance with the DPA.
Acquisition of communication data on behalf of overseas authorities
7.11. While the majority of public authorities which obtain communications data
under RIPA have no need to disclose that data to any authority outside the United
Kingdom, there can be occasions when it is necessary, appropriate and lawful to do so
in matters of international co‑operation.
7.12. There are two methods by which communications data, whether obtained
under RIPA or not, can be acquired and disclosed to overseas public authorities:
judicial co‑operation; or
non‑judicial co‑operation.
Neither method compels United Kingdom public authorities to disclose data to
overseas authorities. Data can only be disclosed when a United Kingdom public
authority is satisfied that it is in the public interest to do so and all relevant conditions
imposed by domestic legislation have been fulfilled.
Judicial co-operation
7.13. A central authority in the United Kingdom may receive a request for mutual
legal assistance (MLA) which includes a request for communications data from an
overseas court exercising criminal jurisdiction, an overseas prosecuting authority, or
any other overseas authority that appears to have a function of making requests for
MLA. This MLA request must be made in connection with criminal proceedings or a
criminal investigation being carried on outside the United Kingdom, and the request
for communications data included must be capable of satisfying the requirements of
Part I Chapter II of RIPA.