When my central heating boiler stopped working the other day I was expecting exorbitant costs, cold nights huddled around a hot water bottle and possibly a few hours holding on the phone to British Gas. I was not expecting an encounter with the Data Protection Act.

It happened when I was arranging an appointment with a gas boiler ‘engineer’. I was asked for my mobile telephone number so that the engineer could call me if he couldn’t find the house. I duly supplied it. At the conclusion of the call I asked the woman from British Gas if she could read my mobile telephone number back to me to check she had written it down right. “I am sorry” she replied “we can’t give out mobile telephone numbers because of data protection”. I pointed out that I had just given the number to her, but no amount of reason would prevail. The most she would do was read back the last three numbers.

This is by no means my only experience of the irrational effects of data protection laws. Many readers of this blog will have similar tales. But such experiences must not be dismissed as lighthearted examples of corporate idiocy. They are symptoms of a genuine underlying problem that can have consequences far more serious than a boiler engineer failing to turn up for an appointment.

The British Government no less than British Gas is apt to invoke data protection as a reason for not supplying information in obviously sensible circumstances. When the All Party Parliamentary Group on Extraordinary Rendition requested data about the transfer of British-captured insurgents from British forces to Afghan authorities and third nations (but not the names of the individuals concerned), as part of a project to review compliance with diplomatic assurances, the Group was met with a refusal based on the Data Protection Act. The refusal was particularly unfortunate given that the request was made to further the interests of the individuals on whose behalf the British government was invoking data protection concerns.

Yet more extraordinary was that until the morning of a hearing before the Upper Tribunal the Ministry of Defence was asserting that disclosure could not be made without the ‘explicit consent’ of each individual detainee or former detainee because the information sought was ‘sensitive personal data’ on the ground that it would be possible to infer the religious beliefs of those captured from the information: they would almost certainly be Muslim.

Then there is the case of Mr Rahmatullah. Mr Rahmatullah was captured by British forces in Iraq and handed-over to the Americans before being unlawfully rendered to Bagram airbase detention facility, where he remains. The legal charity Reprieve sought to identify him after it was discovered a British captured detainee was held at Bagram, in order to commence habeas corpus proceedings in the US. But the UK Government refused to provide his name or details because, in the absence of him having given his consent, it would breach his rights under the Data Protection Act. And so he languished in incommunicado detention. Fortunately his identity was eventually worked-out by a combination of luck and good detective work by Reprieve. [1]

Even when cases do get on foot, data protection can rear its head to make rights enforcement more difficult. It is recurring problem in litigation against both public authorities and companies that disclosable material will be redacted on ‘data protection grounds’. Moreover, in Smith [2008] EWHC 694 (Admin), Collins J depreciated the practice of public authorities in inquest proceedings to “routinely redact” the names of “any person” shown in documents which “makes it very difficult and sometimes impossible for interested parties to make preparations to deal with the evidence of a particular witness or to understand how that witness fits in to the whole picture.” He went on to note that such redaction is “taken to absurd lengths” such as by the redaction of correspondence with the family or their representatives.

The reasons for this state of affairs are more complicated than that the data protection laws are too tightly drawn. The problems also stem from the fact that the law itself is Byzantine.

Lawyers are accustomed to experiencing a sinking feeling when data protection rears its head in a case; and the first strategy is usually to try and find a way of not having to address it. The Data Protection Act is one of the most poorly drafted pieces of legislation on the statute book. It has tied the UK Courts up in knots. The consequence of the House of Lords’ judgment in Common Services Agency v IC [2008] UKHL 47, for example, is that the disclosure of information about individuals under the Freedom of Information Act constitutes processing personal data and is prima facie unlawful even if the documents are redacted so that no individual is identifiable from the information disclosed (the reason for this being that the disclosing public authority could—obviously—identify the persons from the disclosed redacted material by matching it up with the original material, which in fairness to the House of Lord is, literally, what the legislation says).

In the All Party Parliamentary Group on Extraordinary Rendition case ([2011] UKUT 153) the Upper Tribunal simply refused to follow the majority of the House of Lords in Common Services Agency on the basis that it just couldn’t possibly be right and it wasn’t absolutely on point. In a subsequent case, the High Court preferred to give such close scrutiny to the leading speech in the House of Lords that it was found to mean precisely the opposite of what it actually says: R (Dept of Health) v IC    [2011] EWHC 1430 (Admin). These cases prompt one to reflect that if our highest Courts cannot make head or tail of the data protection laws then the British Government and British Gas ought perhaps to be more lightly censured.

Another problem is that the exceptions permitting processing of personal data are open-textured so that organizations cannot be sure when they are on the right side of the line. Taken together with the risk of criminal sanctions (which always leads to robust corporate compliance) and one has a recipe for irrationality and over-protection.

Let us not forget that data protection laws are supposed to enhance our human rights. They are presented as bulwarks against the surveillance society, by which I mean the ever-greater ability of companies and governments to monitor and analyse information about us.

Such is the status of data protection that the Lisbon Treaty elevated the right of data protection in the EU to the status of treaty right embedded in the EU Charter of Fundamental Rights and Freedoms.

It is thus a perverse effect of data protection laws that they often have opposite effects: negating freedom of information and reducing accountable government.

The EU Commission is currently re-drafting EU data protection laws with the aim of increasing the protection currently afforded to personal data. The restrictions on lawful processing (including disclosure) will become even more tightly framed.

It is proposed to narrow further Article 7(f) of the Data Protection Directive allowing disclosure where “necessary” for the “legitimate the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed” by removing reference to third parties (such as the All Party Parliamentary Group on Extraordinary Rendition or Reprieve). Restrictions are also proposed to the provision allowing processing in the public interest, which will only be lawful where the controller is exercising functions prescribed in legislation (draft Regulation Article 6(1)(e), (f), (3)). The exception relating to disclosure “necessary” to protection the “vital interests” of the data subject is retained but this has been interpreted very narrowly to mean life and death situations such as use of medical records after a life-threatening accident. It is not given any wider compass in the proposals. The upshot will be that work of human rights groups and human rights lawyers working to protect the interests of data subjects will be made even more difficult.

The Information Commissioner has drawn attention to some of these problems in its initial analysis of the Commission’s proposals (February 2012). The IC has stated that the terms of the draft Regulation may,  “stand in the way of processing that is desirable, unobjectionable and helpful to citizens.” And the IC has called for “explicit recognition in the Regulation that processing may take place where it is clearly in the data subject’s interests and does not override his or her fundamental rights and freedoms.” It is to be hoped that such well-founded criticisms will be addressed.

In the current climate of concern about the surveillance society it is important to appreciate that the side effects of the over protection of personal data are not confined to farcical exchanges with public utilities companies: data over-protection can undermine the effective protection of human rights.

 Tom Hickman is a barrister at Blackstone Chambers.