Marie Baker
judge of the Supreme Court of Ireland, and assigned judge for the purpose of Irish data protection legislation
Article 23 of the General Data Protection Regulation (“GDPR”) gives Member States the power to introduce provisions to protect the independence of the judiciary, provided such provisions are proportionate and necessary and respect the essence of the fundamental rights and freedoms of the data subject.[1]
The Irish Data Protection Act 2018 has brought into focus two principles regarded as central to our legal and constitutional order: the independence of the judiciary and the principle that justice be administered in public, what is called “open justice”.
The Data Protection Act restricts the rights of data subjects in a number of ways, although the legislation is careful to ensure that the rights of the data subjects are not eliminated. Two provisions exist to protect the independence of the judiciary and the proper and open administration of justice. These are contained in ss. 157 (supervisory authority) and 158 (restrictions on rights) of the Data Protection Act.
The assigned judge: Remedies for breach: Section 157
Section 157 of the Data Protection Act removes from the general jurisdiction of the Data Protection Commissioner (“DPC”) the supervision of data-processing by the courts when they are “acting in their judicial capacity”. That supervisory power is replaced by vesting in a single judge[2] called “the assigned judge” the power of supervisory authority in a number of respects as follows:
- The assigned judge handles and investigates complaints in relation to data processing operations of the courts;
- The assigned judge must ensure compliance with data protection law by judges and by the courts;
- The assigned judge is required to promote awareness among judges of data law generally.
The assigned judge has more limited powers than the DPC, and may not impose a fine or any other sanction for breach. But the assigned judge can direct a judge to change his or her practice and direct the alteration and modification of the record of the court, often but not always found in court records or in published judgments.
If the data derives from an activity outside that limited scope the complaint is made to the DPC.
Acting in a judicial capacity
This limited or different regime applies only and insofar as the control or processing of data occurs while a court or a judge is acting in a judicial capacity. What is meant by a “judicial capacity” is not defined in the legislation, and it is probably easier to understand the concept by reference to what it does not mean. It would seem clear that a judge or a court is not acting in a judicial capacity when involved in extrajudicial activities such as giving lectures, taking a role in any regulatory body within the Bar Council or the Courts Service Board, etc.
The publication of court listings and of judgments, and the ordinary conduct of a trial is within the definition.
To date there has not been much difficulty in ascertaining in a given complaint whether it concerns activity within the definition. Most complainants seem to have a general appreciation of the area of competence of the assigned judge, many do make parallel complaints to the DPC, some complaints contain elements that belong within the competence of the assigned judge, and others are within the area regulated by the DPC. An example is a complaint regarding an alleged breach of data protection in the publication of a written judgment, which is within the competence of the assigned judge, and an entry on an online platform such as Wikipedia of information regarding the contents or legal importance of the judgment itself which more properly belongs to the DPC.
A dialogue has opened up between the DPC and the assigned judge to consider how to deal with overlapping complaints.
Protection of judicial independence: Section 158
With judicial independence in mind, s. 158 of the Data Protection Act, which is stated in general terms, has limited or restricted the rights of data subjects and the corresponding obligations of controllers for any activity performed by the judiciary for the following: namely in relation to access, information regarding processing, the obligation to notify as to the identity of the controller, rectification, erasure (“right to be forgotten”), accuracy, portability, the right to object to automated processing (all found in arts. 12 to 22 of the GDPR). The restrictions contained in s. 158 of the Data Protection Act apply only if they are necessary and proportionate to safeguard the independence of the judiciary.
The Data Protection Act gave power to a panel of judges to make rules for the “effective application” of the restrictions, and rules have been promulgated which regulate and restrict data rights in regard to data processing by courts acting in their judicial capacity. The Data Protection Act 2018 (Section 158(3)) Rules 2018 (“the Rules”) have been issued and came into effect on 1st August, 2018.
As a result there is no obligation in Irish law on a judge who is a controller of data to notify a data breach to a data subject. It is regarded as good practice, however, that a judge, or court official acting as processor on behalf of the judge, who becomes aware of a potential data breach, notify the assigned judge when the breach might result in “a high risk to the rights and freedoms of natural persons”, if only to seek reassurance or guidance as to proper future practice. Much of the work of the assigned judge concerns these types of notifications from judges who make, or who fear they might have made, an error in the publication of sensitive data, for example, by the publication in a written judgment of the names of parties to a matrimonial dispute. Such publication is separately controlled by statute but may also involve a breach of data protection rights.
The practical effect of the Rules is that a data subject is to make a data access request through the process which has been created by the rules of court, essentially an originating motion grounded on affidavit.
Open justice
It is fundamental to the Irish constitutional order and indeed in Great Britain in our written[3] and unwritten[4] constitutions, that justice cannot be done in a “star chamber”. The expression comes from the use in medieval decoration of gold stars on a blue background on the ceilings of palaces and churches, as can still be seen, for example, at the Scrovegni Chapel in Padua, Italy.[5] There was a room built in 1347[6] in the old palace of Edward the Confessor at Westminster which was similarly decorated[7] and which hosted, from 1347 to 1641, what was in essence a special sitting of the Privy Council[8] set up to ensure the fair enforcement of laws against the English upper class and as a court of equity. The Court became notorious later in its history as arbitrary and political such that it was abolished by Act of Parliament.
Ireland had its own Star Chamber. In 1571, Elizabeth I established a court of special jurisdiction to deal with cases of riot, other offences against public order, and all crimes which threatened the security of the Crown,[9] which was later named the Court of Castle Chamber, from the room explicitly built in Dublin Castle which hosted the court. It became notorious as well in the latter part of its existence for imposing savage penalties and also had a reputation for being largely ineffective.
These courts were far from the open administration of justice to which our constitutional order aspires, and the principle is now so well enshrined in Irish law that there is considerable reluctance and concern about any suggestion that the names of parties or other identifying features be anonymised or pseudonymised in published judgments. This is an area that I expect will become more central to the discussion regarding data protection in the coming years.
The principle of open justice is, of course, known to the civil law countries[10] and to European law[11] and ECHR jurisprudence[12].
But there is some concern in our courts that a wave of anonymization may grow stronger across Europe in the light of GDPR.[13]
The long-standing practice of the Court of Justice has been to replace the names of asylum seekers, children and other individuals in sensitive litigation with initials, while using the actual names of natural persons in other contexts. Then, in late June, 2018 the Court announced that this long-standing policy was to be partially reversed: since 1 July, the default position is that, where preliminary references are made under Art. 267 TFEU in cases to which individuals are party, their names will be replaced by initials which do not correspond to their actual initials.[14]
In Irish law there are many examples of when a person’s identity or identifying features are required by statute not to be made public. Examples include family law proceedings and those relating to children, e.g. childcare or adoption cases. In the criminal side there is an entitlement of the person accused of rape to have his or her identity protected until a conviction is entered. After conviction, if publication of the name of the perpetrator is likely to identify a victim, the name remains undisclosed, unless the victim chooses otherwise. In passing it might be noted that the victims of sexual crime often now choose to identify themselves for the purposes of exposing the criminal to public scrutiny.
The concept of publicity of justice, or “open justice”, is strictly connected with judicial independence: As Neuberger MR observed in Al-Rawi v Security Services, “a judge observed is a democratically accountable judge.[15]
Courts as organs of State and protectors of democracy can be said to operate as a control on arbitrary power by government agencies. Confidence in the administration of justice is regarded as a core principle without which society is likely to become fragmented.
The political writings of Jeremy Bentham were one of the earliest modern[16] expositions of the importance of open justice as a means of providing the public with information about and to enable scrutiny of the laws, the judges, the players in the process and the application of law.
Open courts educate the public and discipline the judges and the organs of state, and ensure the equal treatment of all persons, and the participation of members of the public in the orderly resolution of disputes.[17]
So, public scrutiny, public participation and public understanding, a “buying into” the structures of the administration of justice and a corresponding respect are seen as essential in the constitutional and national order.
Open justice serves the principle of judicial independence as it ensures judges are accountable and therefore that justice is not administered in arbitrary or unlawful ways.[18] In Ireland, any derogation from the principle of open justice must comply with the provisions of the Constitution which itself mandates justice to be administered in public and that only law can provide otherwise. Thus in Re R Ltd[19] the Irish Supreme Court held that publicity is an indispensable aspect of the administration of justice.
The Supreme Court in Gilchrist v Sunday Newspapers Ltd[20] stated that the effect of the preference accorded to the principle of open justice “has been understood as imposing an almost blanket rule which precluded even minor adjustments of the obligation such as permitting a litigant to use a pseudonym, or initials, or directions that parties not be identified.”[21]
O’Donnell J. stated that the starting point must be that “that court must be resolutely sceptical of any claim to depart from any aspect of a full hearing in public” and that even though the court is satisfied that the circumstances warrant a departure from the principle of open justice, “the court must consider if any lesser steps are possible such as providing for witnesses not to be identified by name, or otherwise identified or for the provision of a redacted transcript for any portion of the hearing conducted in camera.”[22]
In Roe v. Blood Transfusion Board,[23] which was followed by MacCracken J. in Re Ansbacher (Cayman) Ltd. [2002] 2 IR 517[24], Laffoy J. held that:
“The plaintiff’s stated objective in seeking to prosecute these proceedings under a fictitious name is to keep her identity out of the public domain. In my view, in the context of the underlying rationale of Article 34.1, the public disclosure of the true identities of parties to civil litigation is essential if justice is to be administered in public. In a situation in which the true identity of a plaintiff in a civil action is known to the parties to the action and to the court, but is concealed from the public, members of the general public cannot see for themselves that justice is done.”[25]
On the other hand a less restrictive provision is thought generally to have improved public knowledge and the publication of reports of child care hearings and in some cases has led to a call for change in, for example the roles of guardians ad litem, now finding way into legislation.
I am not aware of any specific authority dealing with the balance between the right to data protection and the open justice principle. The case law of the CJEU has focused on the principle of confidentiality of personal data. But other fundamental rights might come into play when the balancing exercise is done, for example the right to freedom of expression[26] and the right to use one’s own family name.[27]
The current practice in dealing with complaints to the assigned judge is to protect this principle to the fullest extent possible.
____________________________
[1] “[…] Member State law […] may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard: […] (f) the protection of judicial independence and judicial proceedings”.
[2] The UK legislation created a panel of three judges
[3] In Ireland the principle is expressly outlined in Article 34 Bunreacht na hÉireann:
“Justice […], save in such special and limited cases as may be prescribed by law, shall be administered in public.”
[4] In the UK, open justice is a constitutional principle that stretches back to the fall of the Stuart dynasty, per Reed L.J. in In re BBC [2015] AC 588, 600 and was explicitly recognised as such in Scott v Scott [1913] AC 417 and now in statute, in s. 1 of the Constitutional Reform Act 2005.
[5] www.cappelladegliscrovegni.it/index.php/en/
[6] Edward P. Cheyney, The Court of Star Chamber, The American Historical Review, Vol. 18, No. 4 (Jul 1913), p. 727. The room has not survived as it was destroyed in the course of the works which built present-day Palace of Westminster.
[7] Lord Denning, Landmarks in the Law (1984), p 61–62.
[8] Edward P. Cheyney, The Court of Star Chamber, The American Historical Review, Vol. 18, No. 4 (Jul 1913), p. 728. The Star Chamber’s activity has been critically assessed by legal historians in a somewhat less negative way.
[9] Crawford, Jon G., A Star Chamber Court in Ireland – The Court of Castle Chamber 1571–1641 (Four Courts Press, Dublin 2005) p. 196.
[10] Although not expressly enshrined in the German and Italian Constitutions, it has been outlined as unenumerated constitutional right by the respective Constitutional Courts of these countries in
[11] Art 47(2) of the Charter of Nice states that “[e]veryone is entitled to a […] public hearing” for cases involving questions of rights and freedoms granted under EU law. corresponds to Article 6(1) of the ECHR.
[12] Art 6(1) of the ECHR is somewhat even more detailed. See below.
ECtHR’s jurisprudence is vaster than that of the CJEU on the fair trial right in relation to public hearing requirement: see for example, ECtHR, Hirvisaari v. Finland, No. 49684/99, 27 September 2001, para 32.
[13] The European Case Law Identifier (ECLI) and a minimum set of uniform metadata for case law is an example. The aim of the database is to provide a unified system of identification of all published decisions of Member States as well as metadata which indicate the legal basis of the decision
[14] https://curia.europa.eu/jcms/upload/docs/application/pdf/2018-06/cp180096en.pdf
[15] Al-Rawi v Security Services [2010] EWCA 482, [2012] 1 AC 531, at 543, as cited by Ryder, Securing Open Justice, https://www.judiciary.uk/wp-content/uploads/2018/02/ryder-spt-open-justice-luxembourg-feb-2018.pdf, p. 4.
[16] We do not forget the Roman res publica of course
[17] See Lord Diplock in Home Office v. Harman [1983] AC 280, whose statement on the disciplinary function of open justice is often referenced:
“…the reason for the rule is to discipline the judiciary – to keep the judges themselves up to the mark – the form that it takes [is] that justice is to be administered in open court where anyone present may listen to and report what was said.” (p.303)
[18] Ryder, Securing Open Justice, https://www.judiciary.uk/wp-content/uploads/2018/02/ryder-spt-open-justice-luxembourg-feb-2018.pdf, pp. 4-5.
[19] [1989] IR 126
[20] [2017] IESC 18
[21] Para 37
[22] Para 35.
[23] Roe v The Blood Transfusion Service Board [1996] 3 IR 67
[24] In re Ansbacher (Cayman) Ltd. [2002] 2 IR 517.
[25] Roe v. Blood Transfusion Board, para 71.
[26] Which is enshrined in article 10 of the Charter of Nice.
[27] Which falls within the scope of article 7 of the Charter of Nice.