Shepherd v The Information Commissioner

The defences in section 55(2) of the Data Protection Act 1998 impose only an evidential, rather than a legal, burden of proof on a defendant.

On 28th March 2018, at St Albans Crown Court, the appellant was convicted of three counts of unlawfully obtaining personal data contrary to s.55 of the DPA 1998. The appellant was the recipient of a leaked confidential safeguarding report, commissioned by the London Borough of Islington Council, into the appellant's former employer. He disclosed it to 83 others by email. Those others included councillors, members of a safeguarding agency, and the local MP. The appellant did not dispute these facts. His defence was that he was justified in disclosing the report because of concerns surrounding the Council's use of its safeguarding powers. The appellant had previously been acquitted for sexually assaulting a 17-year-old girl and was found not to be a risk to children following an investigation by the Independent Safeguarding Authority.

The appellant relied on the defences set out in s.55(2)(b), (c), and (d), submitting that he had acted in the reasonable belief that he had a legal right to disclose the data contained in the report; that he reasonably believed the Council would have consented if it had been aware of all the circumstances; and that the disclosure was justified as being in the public interest. At trial, the appellant argued that those defences only placed an evidential burden of proof upon him. The trial judge disagreed and ruled that the defences cast a legal burden on the defendant.

The Court of Appeal carefully analysed the language of s.55 and concluded that Parliament intended to impose only an evidential burden. Mr Justice Jay, giving the judgment of the Court of Appeal, gave seven reasons in support of this conclusion. Amongst them was the fact that Parliament had deliberately avoided the use of the usual reverse onus formulation of "it is a defence to prove that…", along with the fact that a legal burden would have required the defendant actually to have to prove elements of the offence with which he was charged.

Obiter, Mr Justice Jay also stated that s.170 of the new Data Protection Act 2018 would impose a legal burden of proof on the defendant since the wording of the section was typical of other reverse onus provisions.

Held: The defences set out in s.55 of the DPA 1998 place an evidential, rather than a legal, burden of proof upon the defendant.

The appeal was allowed and the convictions quashed.