Privacy International, R (On the Application Of) v The Commissioner for HM Revenue & Customs

Neutral Citation Number: [2014] EWHC 1475 (Admin) IN THE HIGH COURT OF JUSTICE QUEEN'S BENCH DIVISION ADMINISTRATIVE COURT Case No: CO/4089/2013 Royal Courts of Justice Strand, London, WC2A 2LL Date: 12/05/2014 Before : MR JUSTICE GREEN - - - - - - - - - - - - - - - - - - - - - Between : R (on the application of Privacy International) - and - The Commissioner for HM Revenue & Customs Claimant Defendant - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Mr Dan Squires and Mr Edward Craven (instructed by Bhatt Murphy) for the Claimant Mr George Peretz (instructed by General Counsel to HM Revenue and Customs) for the Defendant Hearing dates: 18th and 19th March 2014 - - - - - - - - - - - - - - - - - - - - - Judgment Mr Justice Green : A. Introduction and issue B. Relevant facts Index (1) The initial complaint by Privacy International to BIS. (2) The BIS response. 1-5 6-27 6-8 9-13 (3) The Privacy International complaint to HMRC 14-15 (4) The HMRC responses a. The Decision letter 16-27 17-18 b. The subsequent explanation of the reasons for the Decision letter c. The letters from the HMRC Strategic Export Referrals Team (SERT) d. The update from HMRC C. The position of the activists: Dr Shehabi and Mr Kersmo D. The Statutory framework (1) (2) The statutory prohibition upon disclosure. The exceptions to the prohibition – the power 19-23 24-26 28-32 33- 35-36 to disclose under section 18(2)(a) and (d) CRCA 2005. (3) The “functions” of the HMRC in relation to export control 38-47 (4) The relationship between CRCA 2005 powers of disclosure and the Freedom of Information Act 2000 48-51 (5) The margin of appreciation accorded to HMRC 52-62 E. The lawfulness of the Decision: Whether to quash and remit? 63-72 (1) Point 1: Failure to obtain evidence from the relevant operational unit within HMRC. 64-74 (2) Point 2: Failure to have regard to the actual complaint letter and accompanying dossier of evidence. (3) Point 3: The Decision letter contains an error law on its face. (4) Point 4: The ex post facto explanations for the Decision letter are not admissible to re-write the Decision. (5) Point 5: The Decision letter read in the light of the supplementary reasons still reflects an 67 error of law; it relies only upon abstract arguments and fails to involve an assessment of the surrounding facts. (6) Point 6: The update statement does not advance matters. (7) Point 7: The Decision letter responded to the request in the wrong letter. (8) Point 8: The position of HMRC generally reflects internal confusion which undermines the credibility of its response. (9) Conclusion F. Factors relevant to the exercise of discretion I: The status of affected persons (1) The issue (2) Pressure groups / NGO’s / the press (3) Victims (4) Witnesses (5) Complainants (6) Companies investigated:- (i) Forewarning the suspect (ii) Reputation (iii) Confidentiality of information G. Factors relevant to the exercise of discretion II: Securing cooperation and confidence in the system H. Factors relevant to the exercise of discretion III: The right to a No Further Action (“NFA”) decision and reasons (1) (2) (3) The issue The position in common law The position under the Framework Decision 69 71 72-73 74-131 74-76 77-81 82-115 116-120 122- 124-130 132-135 136-179 136-141 142-162 and the Council Directive (4) Article 10 ECHR I. The Invitation to invite the HMRC to issue Guidelines J. Conclusion 163-166 167-179 180-185 Judgment Approved by the court for handing down. Privacy International v HMRC A. Introduction and issue 1. 2. 3. The issue in this case concerns the powers and duties of Her Majesty’s Revenue and Customs (hereafter “HMRC”) to disclose information about its export control functions to an NGO called Privacy International. That organisation has complained about the conduct of a UK company whom it is alleged has supplied “malware” to repressive regimes (inter alia in Bahrain and Ethiopia) which has then been used for the covert surveillance of political activists. HMRC, in a decision taken on 9 th January 2012 (the “Decision letter”), stated that it had no power to provide information about its investigations to Privacy International or to any third person, including victims of foreign regimes who used the company’s products for surveillance purposes. The issue arising is whether HMRC is correct to say that it has no power or duty to provide information and as to the correctness of the specific explanations it has (subsequently) given justifying that position. An important sub-issue is whether HMRC is required to inform a complainant of the decision it takes as to whether to prosecute or take no further action in respect of a complaint, bearing in mind that in principle decisions not to prosecute may be challenged by way of judicial review and that absent a communication of the decision taken and the reasons therefor a complainant will not know whether a decision has even been taken and will thereby be precluded from seeking to challenge that decision. The principal statute of relevance to this case is the Commissioners of Revenue and Customs Act 2005 (“CRCA 2005”). The Claimant, Privacy International, was founded in 1990. It is a UK non- governmental organisation dedicated to investigation in relation to privacy at the international level. In particular it focuses upon tackling what it perceives to be the unlawful use of surveillance. Upon occasion it gives expert evidence to parliamentary and governmental committees around the world on privacy issues. It has advised and reported to, inter alia, the Council of Europe, the European Parliament, the Organisation of Economic Cooperation and Development, and the United Nations. In this case it has applied for judicial review on its own behalf but also as, in effect, the champion of the interests of two political activists whom, it is submitted, were the victims of unlawful and criminal surveillance by the security forces of Bahrain and Ethiopia. The Claimant submitted that the equipment used in Bahrain and in Ethiopia by security forces was supplied illegally to those states by Gamma International in breach of export regulations applicable to that company in the United Kingdom. Privacy International submitted complaints not only of a general nature about Gamma International but also specifically in relation to the two activists that I have referred to. In order to explain fully the context to this case it is necessary to set out in some detail the position of these two activists, which I do at section C below. The Defendant, HMRC, has the statutory duty to enforce the relevant export controls to the types of surveillance products which it is alleged were used against the two activists. The Claimant seeks to quash the Decision letter upon the basis that it reflects a serious misdirection of law since it is plain that in law HMRC has a power to disclose information including about ongoing investigations. Further, it is submitted that when the reasons now (belatedly) relied upon to justify the Decision are analysed they reveal not only an error of law about the very existence of a power permitting the provision of information but also a series of subsidiary errors relating to the relevance Judgment Approved by the court for handing down. Privacy International v HMRC 4. 5. of the criteria which should govern the exercise of the statutory discretion which the Claimant submits manifestly exists. It is only fair to record that in their written and oral submissions in the course of the litigation HMRC has adopted a far more constructive approach than is evident from the Decision letter and from other correspondence arising in this case. HMRC accepts that the Decision letter was badly drafted and might not fully reflect HMRC’s true position. HMRC accepts that it does have a power to provide information. In the course of the hearing Mr George Peretz, who appeared for the Defendant, also clarified HMRC’s position in a way which narrowed the legal gap between the parties as to the relevance of the different criteria that might need to be evaluated in a given case. Nonetheless, important and significant differences remain arising on the facts of this case. Those differences relate also to the scope and effect of the judgment of the Supreme Court in Kennedy v Charity Commission [2014] UKSC 20 (“Kennedy”) which was handed down during the course of this judicial review and which is also concerned with the principles governing the disclosure of information by public authorities. Before setting out the facts relating to this application in detail it is necessary at the outset to record an important warning in relation to those facts. I have not heard from Gamma International, the company whose products are at the heart of the complaints made by the Claimant and whose conduct is alleged to amount to a criminal offence. Gamma International was not served as an Interested Party and has not therefore served evidence or made submissions whether in writing or orally. For the avoidance of doubt, therefore, nothing I say in this judgment is to be taken as reflecting any view whatsoever on my part as to the merits of the complaints lodged by the Claimant or those upon whose behalf it acts. B. Relevant facts (1) The initial complaint by Privacy International to BIS 6. On 12th July 2012 solicitors acting for Privacy International sent a pre-action protocol letter to the Secretary of State for Business, Innovation and Skills (“BIS”) in relation to an alleged lack of progress in the implementation within the UK of export controls for surveillance equipment. At this point in time Privacy International was acting for itself and not on behalf of any natural person claiming to have been prejudiced by products manufactured and/or supplied by Gamma International. In its letter before claim it summarised the present UK legal position in relation to the Export Control Act 2002 (hereafter “ECA 2002”) and the Export Control Order 2008 (hereafter “ECO 2008”) which lay down a regime of control for military or specified “dual use” items. The letter proceeded to express concerns about a number of UK companies and their exports. It gave details about the activities of Gamma International which, it said, should be taken as illustrative of a wide scale problem and indicative of the need for the UK to take urgent action. It referred, in particular, to the “FinFisher” range of products which were marketed by Gamma International through promotional videos which had now fallen into the public domain following release by Wikileaks. 7. In relation to the FinFisher products the letter stated as follows: Judgment Approved by the court for handing down. Privacy International v HMRC “Most of the FinFisher products covertly install malicious software (malware) on a user’s computer or mobile phone without their knowledge by tricking the user into downloading fake updates from what appear to be legitimate sources such as Blackberry, iTunes or Adobe Flash. Once the updates are accepted by the user, the computer or mobile phone device is infected allowing full access to information held on it. One product, FinFly LAN, is marketed for use for surveillance of individuals staying in hotels. You will no doubt be aware that an Intelligence Note of 8 May 2012 prepared by the Internet Crime Centre (IC3) has indicated that: “(r)ecent analysis by the FBI and other government agencies demonstrates that malicious actors are targeting travellers abroad through pop up windows while establishing an internet connection in their hotel room.” One of the products, FinFly ISP, involves a server being inserted in the core internet network of an internet provider to facilitate “infection” of specific target personal computers. A similar product FinSpy Mobile, works in a similar way to infect mobile phones. The promotional video with images and text shows: • a simulation of an agent deploying “the FinFly ISP server into the Core Network” • “FinFly ISP [analysing] traffic for easy Target Identification” • “The Target [using] his private DSL or Dial-Up Account” • FinFly ISP [sending] a fake iTunes update to the Target System • That “the Target System is now infected with the FinSpy software” • That “the Headquarters has full access to the Target System” When an individual’s device is “infected”, it allows access to emails, social media messaging and Skype calls. These products also enable the entity doing the targeting to commandeer and remotely operate microphones and cameras on computers and mobile phones, thus effectively turning the targeted device into a bug which the target individual willingly and unknowingly keeps in close proximity”. 8. The pre-action protocol letter went on to express concerns about the use of Gamma International products in Egypt and Turkmenistan. It then complained that notwithstanding the grave consequences of this equipment being exported it appeared Judgment Approved by the court for handing down. Privacy International v HMRC that the Secretary of State had not considered exercising relevant statutory powers to impose export controls under the relevant statutory provisions. Insofar as the Secretary of State had failed to consider exercising such powers it was submitted that this was unlawful. Under the heading “Actions now to be taken” the letter sought confirmation that the Secretary of State would immediately be imposing export controls in relation to surveillance equipment but that if such conduct was not forthcoming then reasons should be provided as to why no controls were to be put in place. In addition, the letter sought pre-action disclosure of a range of minutes of meetings, correspondence discussion papers of a general nature relating to the export of surveillance technologies and “all minutes of meetings/correspondence with Gamma [International]”. (2) The BIS response 9. On 8th August 2012 TSol replied on behalf of BIS. A general description of the regulatory regime in relation to the export of military and dual-use technologies was provided. Further, a description of the powers of the Secretary of State under the ECA 2002 was set out. At paragraph 13 the following was stated in relation to the position of Gamma International under the relevant export regulations: “13. The Secretary of State, having carried out an assessment of the FinSpy system to which your letter specifically refers, has advised Gamma International that the system does require a licence to export to all destinations outside the EU under category 5, Part 2 (“Information Security”) of Annex 1 to the Dual-Use Regulation. This is because it is designed to use controlled cryptography and therefore falls within the scope of Annex 1 to the Dual-Use Regulation. The Secretary of State also understands that other products in the FinFisher portfolio could be controlled for export in the same way. Furthermore, it is likely that the same products would fall within the scope of the enhanced restrictions set out in the Syria Regulation and Iran Regulation if not already controlled under the Dual-Use Regulation as explained above, being “Remote infection equipment” specified in Part A of Annex V and Annex IV of the Syria and Iran Regulations respectively. Accordingly, insofar as you maintain that all of the surveillance equipment to which you refer is not the subject of export controls in the United Kingdom, the Secretary of State does not consider that to be correct”. 10. Generally, the letter stated that in the light of matters brought to the attention of the Secretary of State he proposed to continue to engage with United Kingdom companies supplying surveillance equipment in order to clarify what equipment fell within the scope of existing controls and exports and in order to ensure that he remained informed as to the state of the relevant market. The letter reiterated the Secretary of State had already concluded that the FinSpy product was subject to export control under the provisions of the dual-use Regulation. With particular regard to the possibility of the United Kingdom adopting unilateral measures it was stated that the Secretary of State was actively considering the possibility of international and/or EU level agreement to further restrictions upon the export of surveillance equipment and Judgment Approved by the court for handing down. Privacy International v HMRC 11. 12. that the view of the Secretary of State was that “…this is by some measure the better option, if regulation is required”. The letter finally confirmed that the request was being treated as a Freedom of Information Request and that a response would shortly be provided in this regard. On 9th August 2012 solicitors acting for the Claimant responded to the Treasury Solicitors. The letter noted that the Secretary of State had concluded that Gamma International systems required a licence. It then went on to pose a series of eight particular questions upon which it invited clarification. On 11th September 2012 Mr Tom Smith, Head of the Export Control Organisation at the Department for Business Innovation and Skills, responded in relation to the eight questions. For present purposes it suffices to record the answers to the questions which essentially focused upon seeking further information about the Secretary of State’s prior conclusion that products supplied by Gamma International fell within the purview of the export regulation regime. Mr Smith thus confirmed that Gamma International had submitted an enquiry in relation to whether certain of its goods or technology fell within any of the controlled lists in June 2012 and advice had been provided by the Export Control Organisation on 2nd August 2012. Mr Smith also confirmed that there had been no prior requests for advice on the part of Gamma International from the organisation. He explained that enforcement of export controls was the responsibility of HMRC and that BIS did not comment upon enforcement issues. He explained further that BIS did not issue licences retrospectively and in this regard stated: “Other than in the case of certain Open General Export Licences, where an exporter may register for use of the licence up to 30 days after the first export under that licence, an exporter must have an appropriate licence in place prior to the export of the goods. However, none of these Open General Export Licences would be appropriate for exports of the FinSpy system”. Mr Smith proceeded to confirm that Gamma International had not sought any such licences. He then stated: “In addition, if you or your client holds specific information on breaches of export controls by UK nationals or companies we would strongly encourage to report this information to the Customs Confidential Helpline…so that the appropriate action can be taken”. Finally, he confirmed that BIS did hold information relating to substantive discussions with Gamma International as part of the export licensing process but that pursuant to section 41(1) of the Freedom of Information Act it was exempt from disclosure because it was provided to the Department in confidence and that release would constitute a breach of confidence actionable in court. Mr Smith explained that in arriving at this conclusion he had taken into account whether disclosure of the information should be released in the public interest. (3) The Privacy International complaint to HMRC Judgment Approved by the court for handing down. Privacy International v HMRC 13. On 9th November 2012 the Claimant wrote to HMRC. The cover letter was in a form not dissimilar to that submitted previously to BIS. However, upon this occasion the Claimant focused its attention upon Gamma International and submitted a dossier of material in relation to the products of Gamma International. The opening substantive paragraph of the letter stated: in of surveillance equipment “We write to you at the suggestion of BIS in relation to our concerns about exports by a UK company, Gamma International, the “FinFisher/FinSpy” range to repressive regimes around the world. We believe that this equipment is being used by oppressive governments for a wide range of human rights abuses. These include not only serious breaches of the right to privacy, but also breaches of the right to free association and free expression. At the most serious end of the spectrum, we believe that Gamma’s technologies are being used to gather information on individuals who are then arrested, tortured and, in some cases, executed”. 14. 15. In addition to concerns which had hitherto been expressed to BIS about the use of Gamma International products in Egypt and Turkmenistan, the Claimant now included information in relation to the use of such products in Bahrain and Ethiopia. The letter ended with a request to HMRC to revert back, within the next 14 days, outlining whether any investigation had been conducted into potential breaches of licence requirements and if so what the result of that investigation was. Further insofar as no investigation had been conducted to date there was a request that HMRC indicate the action that it would now be taking in this regard. No immediate response to that letter was received. This prompted a chaser on the 21 st December 2012. In this letter the Claimant referred to the fact that it had been contacted by an activist in Bahrain whom, it was submitted, had been subjected to surveillance by the Bahraini authorities. The Claimant explained that Dr Ala’a Shehabi was a British-born resident of Bahrain and a democracy advocate and economist who had received emails found to have contained FinFisher malware whilst in Manama, the capital of Bahrain. The letter explained Dr Shehabi considered that the Bahraini Government had sought to invade her privacy and to interfere with the pro-democracy and human rights work that she was undertaking. Dr Shehabi had asked the Claimant to act on her behalf in requesting a progress report and in making a request for information about HMRC’s investigation. In particular the Claimant now asked for the following specific information: “We would suggest that HMRC follows the principles set out in the Code of Practice for Victims of Crime. We would therefore be grateful if you could confirm whether there will be any investigation into unlicensed exports by Gamma and, if not, the reasons for this. If there is an imminent or ongoing investigation, we would also be grateful for a progress report now and on at least a monthly basis thereafter. We would also be grateful for your confirmation that we will be informed if any person(s) are arrested, charged or summonsed, or a Judgment Approved by the court for handing down. Privacy International v HMRC decision is taken that no further action will be taken and, if the latter, the reasons for this. As you will no doubt appreciate, when victims and those with a legitimate interest in the investigation of a crime receive little or no communication of the progress of an investigation, it can be a great source of distress, disappointment and frustration. Lack of information can also make those who report crime think that their case is being neglected or not being taken seriously. (See the research report by Victim Support “Left in the dark. Why victims of crime need to be kept informed”). We are sure that this is not the impression that HMRC would want to give, and we therefore look forward to a substantive response within the next 14 days” (5) The HMRC responses 16. I turn now to consider the response of HMRC. This is set out in a series of letters between January and March 2013. For the purpose of this judgment I am treating the first in time letter from Mr Inglese dated 9th January 2013 as the Decision letter. However, there are two other responses from HMRC of direct relevance both emanating from a Mr Stuart Armstrong dated 10th January 2013 and 8th March 2013 respectively. He was the Assistant Director and Head of Customs Enforcement Policy and it was his unit within HMRC that was responsible for processing the Privacy International complaint. The position of HMRC cannot be understood save by referring to each of these letters. Finally, during the hearing Mr Peretz orally provided an update as to HMRC’s position which he later reduced to writing and I have set this out in full below at paragraph [27]. (a) The Decision letter 17. I start with the Decision letter of 9th January 2013 signed by Mr Anthony Inglese CB, General Counsel and Solicitor HMRC. It is necessary not only to set out the relevant parts of this letter but also to explain how it came about. The two operative parts of the letter contain the following: “As you may be aware, section 18 of the Commissioners for Revenue and Customs Act 2005 imposes strict controls on the disclosure of information held by HMRC. Indeed, the starting point of this legislation is that without specific legal authority officials of HMRC may not disclose any information held by HMRC in connection with its functions (which of course include enforcement of export controls) and it is a criminal offence to reveal any information from which persons (including legal persons such as companies) might be identified. Consequently HMRC cannot comment on individual cases, and in particular we will be unable to keep you or other third parties informed of the progress of any investigations. However, I can say where HMRC receives information concerning possible export licence issues we consider the facts Judgment Approved by the court for handing down. Privacy International v HMRC and take appropriate action. HMRC has policy responsibility for enforcing export controls and sanctions. We work in conjunction with the UK Border Agency to detect and investigate attempted or actual breaches of sanctions. Both HMRC and UKBA treat export controls and sanctions as a high priority for enforcement. We are therefore grateful to you for bringing these matters to our attention and providing us with relevant information”. 18. 19. On its face this letter suggests that the legislation governing disclosure is strict. The author takes as his “starting point” that without specific legal authority HMRC officials may not disclose “any” information held by HMRC in connection with its functions. The letter then proceeds immediately to the conclusion that HMRC could not provide any information to the Claimant. The tenor of the letter is, in my view, clearly that there are no exceptions which could de facto or de jure, apply to authorise HMRC to disclose information. This arises from the following considerations. First, the use of the word “Consequently” in the quotation above indicates that the author moved from an analysis of the strict legal position to the end result, namely that as a result of the strict position HMRC could not comment on individual cases and would be unable to keep the complainant informed of the progress of the investigation. The author moved from the starting point to the end conclusion without any analysis of the intermediary position whereby exceptions to the strict position are acknowledged. Secondly, the letter is drafted in generic terms articulating what, on the face of the text, appear to be broad statements of principle. Thus the author states “HMRC cannot comment on individual cases”. Further it states that HMRC is unable to inform it or other third parties “of the progress of any investigations”. The use of the phrase “on individual cases” and “any investigations” is a reference to the generality of the work conducted by HMRC, and not the particular facts of the present case. Thirdly, and consistent with the second point, there is no analysis of the facts of the present case and how they interrelate with section 18(2) CRCA 2005 (as to which see section D below). (b) The subsequent explanation of the reasons for the Decision letter Bearing this in mind it is now necessary to set out the context in which the letter came about. This is described in the first Witness Statement of Mr Stuart Hathaway. He is a lawyer in the Criminal and Information Law team of the Solicitors’ Office of HMRC. In his statement he explained that he first became aware of the letter from the Claimant on 2 January 2013. The allegations concerning Gamma International were not something that the Solicitors’ Office had previously been aware of. He made enquiries to determine whether the policy or operational teams within HMRC were aware of the allegations and was informed that the Strategic Export Referrals Team (“SERT” – led by Mr Armstrong) had received information from the Claimant about these allegations. Mr Hathaway confirmed, however, that no response had been sent to the Claimant by any other unit within HMRC so he drafted an initial response. This was put before Mr Inglese upon his return to the office from leave, and he approved and signed the letter, which was sent on 9 January 2013. In paragraph 17 of his statement Mr Hathaway stated as follows: “I should note that at that stage I had not been able to make contact with the investigatory team and discuss the matter with Judgment Approved by the court for handing down. Privacy International v HMRC them. In the interest of making a prompt reply (the letter asked for a substantive reply within 14 days: I was conscious that it was already nearly three weeks since the letter had been sent and more than a week and a half since it had been received in our office) I thought it was not sensible to delay any longer before making a reply”. Mr Hathaway also explained that in drafting the response he took account of the relevant law applicable to disclosure in sections 18 and 19 CRCA 2005. He states that although he was well aware of the HMRC policy as set out in relevant Information Disclosure Guidance (“IDG”) he did not need to refer to that guidance because he considered that the legal position was “clear” and his own legal analysis consistent with that contained within the IDG. In his statement he addressed the facts and matters that he says he took into account in relation to the three categories of information sought by the Claimant in its chaser letter of 21st December 2012. The first piece of information sought by the Claimant was a confirmation whether there would be any investigation into unlicensed exports by Gamma International. In his statement Mr Hathaway simply records that the reply from Mr Inglese was that “I am able to confirm that the matters you raise are already under active review”. This is not, strictly speaking, an answer to the request since a matter may be under “review” in order to determine whether there should be any investigation at all and, as was confirmed during the hearing and is routine with all regulatory agencies, an initial filter or review of a complaint is invariable and necessary to sort out those complaints that might warrant serious consideration from those which may be frivolous or vexatious. The answer does not, therefore, indicate whether there is or is not a formal investigation. In this regard Mr Hathaway also states that at that point in time, as I set out below, Mr Stuart Armstrong, the Head of Policy for SERC, was on the point of replying and did so on 10th January. The second category or item of request sought by the Claimant was: “if there is an imminent or ongoing investigation, we would also be grateful for a progress report now and on at least a monthly basis thereafter”. Mr Hathaway recites the content of the letter from Mr Inglese and then proceeds to set out the basis upon which he arrived at the negative conclusion. I set out below paragraphs 10-15 of the Witness Statement: 20. 21. “10. In drafting this reply I took account of the following. I considered that I could not advise HMRC that such disclosure would be for the benefit of a function of HMRC as a disclosure in reliance on section 18(2)(a) (or article 43(2) of the Export Control Order 2008) requires. It did not seem to me that, having regard to the functions of HMRC as set out in the CRCA and other enactments, disclosure for the purpose of keeping a complainant or alleged victim of an infringement informed of the progress of an investigation would fall within that section. 11. Nor could I see any possibility that disclosure would in this context assist any criminal investigation by HMRC into alleged Judgment Approved by the court for handing down. Privacy International v HMRC breaches of export controls such that the ability to disclose under s.18(2)(d) would arise. 12. Indeed, as far as I could see, the risk was rather that disclosure would harm the investigation. If HMRC disclosed the information it would lose control of it, since there is no restriction on onwards disclosure of information disclosed under section 18(2)(d). PI presumably wished to be able to complain if in its opinion HMRC was not pursuing the matter with sufficient vigour – indeed, it seemed to me likely that, for reasons that are entirely legitimate, they had a mainly political campaigning motive for wishing to be kept informed of what was happening (a reason which could not in my view provide a basis for disclosure) – and I foresaw a risk that the material would not be confined to PI and Dr Shehabi. 13. That would in turn give rise to the following risks – first, that publicity would mean that potential suspects would be forewarned which might damage the investigation; second, that the suspects would be damaged, both personally and in their legitimate business activities, by making public the fact that they were suspected of criminal activity if in the event the investigation did not lead to anything. 14. That second consideration brings me on to a further issue which also in my view militated against disclosure could have been said to be for the purposes of a function of HMRC or of a criminal investigation. PI had referred to a specific company. Companies act through their directors and senior managers. To provide PI with regular updates of the investigation (e.g. “This month we have interviewed the directors of the company”) would inevitably involve disclosure of information regarding not only an identified corporate person but also individuals who in all probability PI would also be able to identify (since directors of companies are a matter of public record, and I suspected that PI already knew who they were). Information regarding the alleged commission of an offence by an individual is ‘sensitive personal data’ for the purposes of the Data Protection Act 1998 and its processing (including disclosure to others) must be properly justified in order to be fair processing. 15. It will be appreciated that the 9 January letter is not claiming that there is an absolute bar on disclosure by virtue of s.18. Manifestly that is not what the section says, since it creates a whole series of exceptions under which disclosures may be made”. 22. The Witness Statement sets out a series of essentially generic considerations: Judgment Approved by the court for handing down. Privacy International v HMRC i. The second sentence of paragraph 10 is a statement that the purpose of keeping a complainant or alleged victim of an infringement informed of the progress of an investigation did not fall within section 18(2)(a). ii. The second sentence of paragraph 12 is couched in generic terms since disclosure of information by HMRC, in all cases, entails the HMRC losing “control” of that information since there is no restriction on onward disclosure of information under section 18(2)(d). As such this would be a justification, if it were valid, for never disclosing information to anyone, about anything. iii. The third sentence of paragraph 12 operates upon a presumption that the Claimant wished to receive information for motives of political campaigning which, in Mr Hathaway’s view, could not provide the basis for disclosure. iv. In paragraph 13 Mr Hathaway refers to the risk that potential suspects would be forewarned which could damage an investigation. This is a generic consideration and is in no way said to be relevant to the position of Gamma International. Once again it is a possibility that could arise in any investigation and would also be a justification, if it were valid, for never disclosing information to anyone, about anything. It is notable that no mention is made here of the fact that it is evident from information provided by BIS that Gamma International was already in discussion with BIS (and quite possibly HMRC) and nothing that the Claimant could do would forewarn Gamma International of the legal issues which they were then addressing. v. The same applies to the other point raised in paragraph 13 namely that the suspects would be damaged personally and in the context of their legitimate business interests in the event that the investigation did not lead to anything. This is a generic consideration that, were it to be valid, would apply in all cases. vi. Paragraph 14 focuses upon the fact that the Claimant’s request concerned a “specific company” which worked through individual directors. The reason given by Mr Hathaway for rejecting this request is yet again generic, namely that to answer the request HMRC would have to divulge information about individual directors or individuals which constituted “sensitive personal data for the purposes of the Data Protection Act 1998 and its processes”. As to this Mr Hathaway simply says that any such disclosure must be “properly justified”. But he does not go on then to assess whether on the facts of this case it would be justified. 23. In relation to the third item of information requested this concerned information about: (a) arrest; (b) charge; (c) summons; or (d) no further action decisions and the reasons therefor. In relation to this Mr Hathaway states that he is “conscious” that the reply did not deal fully with this aspect of the request. In fact in his statement he deals only with the issue of arrest as to which he states: “I am conscious that the reply may not have fully dealt with this aspect of the request. Certainly, for the same reasons as are set out in relation to request (b), I did not see a proper reason for promising at that stage to confirm in relation to this particular investigation that any persons had been arrested. Judgment Approved by the court for handing down. Privacy International v HMRC Where HMRC has done this in the past, it has been so that publicity may be given to a widespread current general problem e.g. smuggling by aircrew, with a view to deterring such smuggling and encouraging public vigilance. There was at this stage no reason to think that breaches of export licensing requirements were rife, or any other reason why I could confidently predict that disclosure of any arrest would be for the purposes of an investigation or for the purposes of a function of HMRC. It therefore seemed to me to be wrong to give the commitment that HMRC were being asked to give at that stage (though of course I was not in any way ruling out the possibility that, were any arrest made, the view would at that later stage properly be taken that disclosure of that fact would serve a function of HMRC or assist the investigation”. Mr Hathaway acknowledges that he did not deal with the question of charge, summons or no further action decisions or the reasons therefor. No explanation for this omission is given. With regard to the question of arrest the suggestion that a different decision might be taken at a future point in time is oddly inconsistent with the third sentence of paragraph 10 which states in broad and sweeping terms that keeping complainants or alleged victims of an infringement informed of the progress in an investigation did not fall within section 18(2)(a) or the CRCA 2005 generally. It is also inconsistent with the Decision letter and the letter from Mr Armstrong which makes clear that HMRC would not provide updates to the Claimant. (c) The letters from the HMRC Strategic Export Referrals Team (SERT) 24. On 10th January 2013, the day following the Decision letter, HMRC sent a further letter signed by Mr Stuart Armstrong, Assistant Director, Head of Customs Enforcement Policy. He is responsible for the Strategic Export Referral Team referred to by Mr Hathaway. This letter was addressed to the Claimant and was headed “Gamma International – Unlicensed exports of surveillance equipment”. It is in the following terms: “I acknowledge receipt of your letter dated 9 November 2012 regarding the alleged unlicensed export of surveillance equipment by Gamma International to repressive regimes around the world. Your letter and enclosures have been forwarded to me for a response as I am the Head of Policy Strategic Export Controls. As with all information received regarding alleged strategic export control breaches, this will be assessed by our Criminal Investigators for consideration of further action. I can assure you that we take all credible allegations seriously and will consider carefully the material you have provided”. Mr Armstrong’s response does not address any of the requests formulated by the Claimant. It is cast in generic terms confirming only that “as with all information received” it would be assessed with a view to the possibility of further action. It is Judgment Approved by the court for handing down. Privacy International v HMRC apparent that this response was sent in ignorance of the response sent by Mr Inglese. In his second Witness Statement Mr Hathaway confirms that he was unaware, when he drafted the Decision letter, that Mr Armstrong was proposing to respond separately. He states that had he been aware it is probable that the Solicitors’ Office letter would have been no more than: “…that Mr Inglese understood that the relevant business unit would be responding shortly”. Mr Hathaway then states: “Consequently I do not regard these matters of any relevance to the view I took and they did not form any part of the decision making process. My role is to give legal advice to officers of the Department when requested to do so. I have not sought to discuss these matters with the investigation team. It is no part of my role, my team’s, or that of the Solicitor’s Office generally to supervise or otherwise intervene in the conduct of operational matters. When I drafted the letter dated 9 January 2013 I considered whether the commissioners were entitled to disclose the information sought by Privacy International and formed the view that nothing in the letter from Privacy International gave adequate grounds to indicate that an exception to our duty of confidentiality under section 18 CRCA”. 25. Mr Armstrong sent a yet further letter on 8 March 2013 to the Claimant. This was expressly sent in full knowledge of the Decision letter from Mr Inglese. Mr Armstrong states that he is writing since he is “responsible for HMRC’s enforcement of the UK’s strategic export controls”. He refers to the Decision letter and then says this: “I must reiterate that section 8 of the Commissioners for Revenue and Customs Act (CRCA) 2005 imposes strict controls on the disclosure of information held by then HMRC. Without specific legal authority, no official of HMRC may disclose information held by the department in connection with its functions – including the enforcement of strategic export controls– that might identify specify individuals or businesses. It is a criminal offence to do so. This means that HMRC cannot comment on individual case, now are we able to keep you or other third parties informed of progress of any potential enquiries”. 26. Mr Armstrong finished by emphasising that HMRC treated the enforcement of export controls as a “priority” and that he would pass “all credible allegations of breaches of those controls” to the criminal investigation team. Mr Armstrong thus construed the Decision letter as permitting of no disclosure whatsoever and justifying a stance whereby the HMRC would simply refuse to inform the Claimant or Dr Shehabi of progress. By this letter HMRC treated the Claimant and Dr Shehabi as having no different rights of access to information to any other third party. Judgment Approved by the court for handing down. Privacy International v HMRC (d) The update from HMRC 27. The final matter I would refer to is the oral update on instructions, which was then reduced to writing, provided by Mr Peretz to the Court during the hearing. It is in the following terms: “I am instructed that HMRC has been considering carefully whether any further information relation to the matters raised by Privacy International should be provided to the public at this stage. I can tell your Lordship that the view has been reached, after careful consideration, not to do so at this time. HMRC will however keep the matter under review and will provide the public with further information about these matters if and when it is appropriate to do so having regard to the considerations set out in section 18 CRCA. I should add that although HMRC have considered the evidence given by Dr Shehabi, Mr Kersmo and Professor Deibert, they do not consider that disclosure of any further information relating to these matters would be appropriate, at least at this stage”. The position therefore as at the present date, which is nearly 2 years after Privacy International first raised the matter and about 18 months after the complaint lodged by Privacy International, is that HMRC has no intention of providing any information, to anyone. This is notwithstanding that BIS felt able to disclose information which prima facie shows that the complaint is credible and serious. C. The position of the activists: Dr Shehabi and Mr Kersmo 28. I have referred already to the position of the two political activists. In this section I set out further information about the position of each. In the context of the case the facts relating to Dr Shehabi were before the HMRC when the Decision letter was issued. However, the position of Mr Kersmo was not. Nonetheless the update statement makes clear that in relation to both activists HMRC does not at least this stage and subject to review, intend to provide any information. The significance of the facts relating to the two activists arises from the dispute between the parties as to how these individuals should be categorised, and in particular whether they fell within the definition of a “victim” or otherwise and how this analysis affected the exercise of HMRC’s power (and possibly duty) to provide information about the progress of investigations to complainants. (1) Dr Shehabi 29. With regard to Dr Ala’a Shehabi she is a Bahraini/ British national. She was a formerly a political analyst with RAND Europe and an economist with the Bahrain Institute for Banking and Finance. She is a founding member of Bahrain Watch which is a group constituted by researchers and activists with personal and academic ties to Bahrain following the turmoil and unrest arising in Bahrain in February 2011. She explained in her evidence that the purpose of Bahrain Watch was to investigate and assess the government claim that they had instituted a number of human rights and democratic reforms. She explained that she came “from quite a strong opposition background in Bahrain”. Her father is a well known activist and is the leader of the Judgment Approved by the court for handing down. Privacy International v HMRC “Bahrain Freedom Movement”. In February 2011 she says that her husband – who was wholly apolitical - was arrested she believes because of his relationship with Dr Shehabi and her father “…in order to punish us”. She stated that he was tortured, tried and sentenced to three years imprisonment, late reduced on appeal to 18 months. Dr Shehabi’s work as an academic in Bahrain was brought to an end. Then in January 2012 her husband was freed without explanation. She was later arrested in April 2012. Shortly after this she received a series of unusual emails with attachments which she came to conclude contained malware designed to act as a Trojan to infect her computer. She managed to have her computer investigated and Citizens Lab, who conducted the investigation, prepared a report identifying the attachments to the Trojan emails as containing FinSpy. In relation to the HMRC complaint she says in her evidence: “I understand that Privacy International has sent a dossier including information about my case to HM Revenue and Customs (“HMRC”) over 4 months ago asking them to investigate what appears to be the unlawful exports in breach of export controls of a British company to regimes such as Bahrain that have very troubling human rights records. I have not been contacted by HMRC or any other state agency to enquire about the email that I have received. In so far as I am aware nor has Citizen Lab or anyone else who was involved in analysing the material from myself and others. I understand that [the Claimant] has sought clarification from HMRC about what is happening and has been told that no information can be provided. HMRC are refusing to tell us whether any investigation is being or will be conducted at all into possible criminal offences committed by Gamma International. I am very anxious to know what if any investigation is being done by HMRC. The absence of information nor any form of contact with me is simply fuelling thoughts that I have that for reasons that are completely unclear to me no investigation is being undertaken into the exports of Gamma International and no action is intended to be taken”. 30. I have referred already to the fact that she was identified in the letter to HMRC of 21 st December 2012: See paragraph [15] above. (2) Mr Kersmo 31. As for Mr Kersmo he approached Privacy International in April 2013 with a request that his computer be scanned for the presence of malicious software. Mr Kersmo is an Ethiopian national who has been granted asylum in the United Kingdom. He is a member of the Executive Committee of the Ginbot 7 Movement for Justice, Freedom and Democracy, an Ethiopian opposition party in exile. Mr Kersmo had earlier been arrested and detained in Ethiopia. His wife was also formerly a politician in Ethiopia. A scan was performed and it was concluded that between 1.59am 9 th June 2012 and 10.49pm 10th June 2012 FinSpy had been active on his computer. Upon examination of the computer five files were found in a location on the computer where FinFisher is known to hide and these files were identical to the five files written by FinSpy executable sent to Bahraini activists that were investigated by researchers from Judgment Approved by the court for handing down. Privacy International v HMRC Citizen Lab and reported in July 2012 in an article “Citizen Law, From Bahrain With Love: FinFisher’s Spy Kit Exposed”. Privacy International made a complaint to the National Cyber Crime Unit of the Metropolitan Police Service (“MPS”) on 27 th February 2014. This alleged that by virtue of this surveillance an offence of unlawful interception had been committed in the United Kingdom within the meaning of section 1(1) Regulation of Investigatory powers Act (“RIPA”), section 45 of the Serious Crime Act 2007 and section 8 of the Accessories and Abettors Act 1861. It was submitted that: “providing a foreign government with a tool to gain unauthorised access to computers and intercept communications via that computer qualifies as assisting in the commission of offences believing one or more will be committed within the meaning of section 45 of the Serious Crime Act 2007…”. Paragraphs 21 and 22 of the Complaint to the MPS stated: “21. If the FinFisher product is sold to repressive regimes, Gamma is providing them with the ideal tool to commit the offences of unlawful interception of communications. Gamma is aware of the fact that the relevant government will commit such an offence, and that by selling FinFisher it provides crucial assistance in carrying out this offence. This qualifies as an offence in itself on the basis of section 45 SCA. 22. In any case it is clear that Gamma provided assistance while being aware that there was a real risk that the offence would be committed, so its assistance to a government in order to obtain unauthorised access to computer and intercept communications via that computer constitutes an offence in itself on the basis of section 8 Accessories and Abetter Act 1861”. 32. On 5th March 2014 the MPS Crime Management Unit responded indicating that the crime had been assigned to a dedicated investigation officer who would be in contact shortly to discuss the details of the crime. D. The Statutory framework 33. 34. I turn now to set out and analyse the statutory framework which governs the existence and exercise of HMRC’s obligations to disclose information. The parties disagree as to the nature and scope of the power or duty of HMRC to disclose information about HMRC investigative and prosecutorial activities. In particular they disagree as to how to categorise HMRCs margin of appreciation. In this section I set out the statutory provisions which govern the issue and then address the issue of the scope of the margin of HMRCs discretion. I start by setting out HMRC’s “functions” in relation to export controls since this is the pivot governing the analysis of HMRC’s powers and duties. Specifically the functions of the HMRC are considered in relation to the matters raised by the Claimant's complaint to HMRC (i.e. an alleged infringement of Council Regulation 428/2009 ("the Dual-Use Regulation")). I am therefore not examining the situation in relation to general revenue collection. I have then considered the relationship between the CRCA and the Freedom of Information act 2000 (“FOIA”). I then assess the implications of this in relation to HMRC’s margin of appreciation. Judgment Approved by the court for handing down. Privacy International v HMRC (1) The statutory prohibition upon disclosure 35. The starting point is the prohibition on the disclosure of information by HMRC in connection with their functions contained in section 18(1) CRCA 2005: “(1) Revenue and Customs officials may not disclose information which is held by the Revenue and Customs in connection with a function of the Revenue and Customs”. 36. This prohibition is buttressed by section 19 which renders wrongful disclosure a criminal offence. (2) The exceptions to the prohibition – the power to disclose under section 18(2)(a) and (d) 37. However the prohibition is not absolute and pursuant to section 18(2)(a) and (d) CRCA 2005 it: “ does not apply to a disclosure: (a) which- is made for the purposes of a function of the Revenue (i) and Customs, and does not contravene any restriction imposed by the (ii) Commissioners, … (d) which is made of the purposes of a criminal investigation or criminal proceedings (whether or not within the United Kingdom ) relating to a matter in respect of which the Revenue and Customs have functions…”. (3) The “functions” of the HMRC in relation to export control 38. An identification of the “function” or “functions” of HMRC is thus essential to an understanding of the breadth of the power of HMRC to disclose information whether generally under both section 18(2)(a) or in relation to a specific criminal investigation or proceedings under section 18(2)(d). 39. The expression “function” is defined in section 51 (Interpretation) in the following way: “(2) (a) ‘function’ means a power or duty (including a power or duty that is ancillary to another power or duty) and (b) a reference to the functions of the Commissioners or of officers of Revenue and Customs is a reference to the functions conferred Judgment Approved by the court for handing down. Privacy International v HMRC (i) by or by virtue of this Act, or (ii) by or by virtue of any enactment passed or made after the commencement of this Act…”. 40. 41. The functions of the HMRC in relation to the matters raised by the Claimant's complaint concern an alleged infringement of “the Dual-Use Regulation”. The infringement alleged by the Claimant would, if proved, be an offence under Article 35 of the Export Control Order 2008 ("ECO"). Article 41 ECO applies certain provisions of the Customs and Excise Management Act 1979 ("CEMA") to offences under the ECO and, in particular, contraventions of the Dual-Use Regulation: i) ii) iii) iv) Article 41(1) provides that certain provisions of CEMA relating to "assigned matters" apply to investigations by HMRC of possible breaches of the Dual- Use Regulation; Article 41(2) provides that, in relation to such matters, HMRC have the powers they have under section 77A of CEMA (to require the provision of information under compulsion); Article 41(3) gives HMRC officials the power of arrest in relation to such matters that they have powers under section 138 of CEMA; and Article 41(4) applies provisions of CEMA dealing with criminal proceedings brought by HMRC or by the Director of Revenue and Customs Prosecutions. 42. As noted above HMRC has extensive information collection powers under section 77A CEMA, which is in the following terms: “ (1) Every person who is concerned (in whatever capacity) in the importation or exportation of goods for which for that purpose an entry is required by regulation 5 of the Customs Controls on Importation of Goods Regulations 1991 or an entry or specification is required by or under this Act shall—” (a) Furnish to the Commissioners, within such time and in such form as they may reasonably require, such information relating to the goods or to the importation or exportation as the Commissioners may reasonably specify; and (b) If so required by an officer, produce or cause to be produced for inspection by the officer— (i) At the principal place of business of the person upon whom the demand is made or at such other place as the officer may reasonably require, and (ii) At such time as the officer may reasonably require, Judgment Approved by the court for handing down. Privacy International v HMRC any documents relating to the goods or to the importation or exportation. (2) Where, by virtue of subsection (1) above, an officer has power to require the production of any documents from any such person as is referred to in that subsection, he shall have the like power to require production of the documents concerned from any other person who appears to the officer to be in possession of them; but where any such other person claims a lien on any document produced by him, the production shall be without prejudice to the lien. (3) An officer may take copies of, or make extracts from, any document produced under subsection (1) or subsection (2) above. (4) If it appears to him to be necessary to do so, an officer may, at a reasonable time and for a reasonable period, remove any document produced under subsection (1) or subsection (2) above and shall, on request, provide a receipt for any document so removed; and where a lien is claimed on a document produced under subsection (2) above, the removal of the document under this subsection shall not be regarded as breaking the lien. (5) Where a document removed by an officer under subsection (4) above is reasonably required for the proper conduct of a business, the officer shall, as soon as practicable, provide a copy of the document, free of charge, to the person by whom it was produced or caused to be produced. (6) Where any documents removed under the powers conferred by this section are lost or damaged, the Commissioners shall be liable to compensate their owner for any expenses reasonably incurred by him in replacing or repairing the documents. (7) If any person fails to comply with a requirement under this section, he shall be liable on summary conviction to a penalty of level 3 on the standard scale. 43. In broad terms the ECO confers upon HMRC broad powers of investigation and prosecution in relation to potential contraventions of the Dual-Use Regulation. In addition The Police and Criminal Evidence Act 1984 (“PACE”) s 114(2)(a) provides that: “ … the Treasury may by order direct that any provision of … [PACE] which relates to investigations of offences conducted by police officers or to persons detained by the police shall apply, subject to such modifications as the order may specify, to investigations conducted by [HMRC] officers or to persons detained by [HMRC] officers”. Judgment Approved by the court for handing down. Privacy International v HMRC 44. The order currently in force made pursuant to PACE s 114(2) is the Police and Criminal Evidence Act 1984 (Application to Revenue and Customs) Order 2007 (“the PACE Order 2007”). The PACE Order 2007 extends to HMRC many of the powers conferred on the police by PACE (with some modifications) including: powers to search, to seize material, to arrest and detain suspects etc in relation to offences HMRC investigate. It also confers upon HMRC the obligation to comply with the relevant PACE Codes of Practice regulating the exercise of those police powers. 45. CRCA 2005 s 51(2) provides that a: “… function of [HMRC] means any power or duty (including a power or duty that is ancillary to another power or duty) conferred… by or by virtue of any enactment passed or made after the commencement of this Act”. 46. 47. 48. Pursuant to PACE Order 2007, as well as ECO 2008, HMRC officers have most of the same powers as do the police in relation to crimes they are responsible for investigating. They therefore have essentially the same “function” as the police in relation to investigation and law enforcement in those areas. One matter of some significance to HMRC arises from the above. It follows from this analysis that there is no discrete or freestanding function of the HMRC to provide information to third parties. This was a point that HMRC particularly wished (rightly) to emphasise. Section 18(2)(a) and (d) makes the provision of information contingent upon a connection with the specific functions arising under those sub-paragraphs. (4) The relationship between CRCA 2005 powers of disclosure and the Freedom of Information Act 2000 Finally, in relation to the statutory framework the Defendant has relied upon the fact that the Freedom of Information Act 2000 (“FOIA”) has been dis-applied to certain categories of information which will come into the possession of HMRC. In particular the Defendant prayed in aid section 23 CRCA 2005. This provides that revenue and customs information relating to a person the disclosure of which is prohibited by section 18)(1) CRCA 2005 is exempt information by virtue of section 44(1) FOIA: “23. Freedom of information (1) Revenue and customs information relating to a person, the disclosure of which is prohibited by section 18(1), is exempt information by virtue of section 44(1)(a) of the Freedom of Information Act 2000 (c. 36) (prohibitions on disclosure) if its disclosure— (a) would specify the identity of the person to whom the information relates, or (b) would enable the identity of such a person to be deduced. (2) Except as specified in subsection (1), information the disclosure of which is prohibited by section 18(1) is not exempt Judgment Approved by the court for handing down. Privacy International v HMRC information for the purposes of section 44(1)(a) of the Freedom of Information Act 2000. (3) In subsection (1) “revenue and customs information relating to a person” has the same meaning as in section 19”. 49. According to section 19(1) CRCA 2005 “revenue and customs information relating to a person” means: “ …information about, acquired as a result of, or held in connection with the exercise of a function of the Revenue and Customs (within the meaning given by section 18(4)©) in respect of the person; but it does not ilcude information about internal administrative arrangements of Her Majesty’s Revenue and Customs (whether relating to Commissioners, officers or others”. 50. Section 44(1)(a) FOIA provides: Information is exempt information if its disclosure “1. (otherwise than under this Act) by the public authority holding it—” (a) is prohibited by or under any enactment”. 51. 52. The effect of this is that “revenue and customs information relating to a person” is absolutely exempt from disclosure under FOIA: see section 2(3)(h). However, it is not exempt from disclosure under section 18(2) CRCA if and in so far as it meets the test therein. In other words whether or not disclosure is to be made is governed by the CRCA 2005 not FOIA. (5) The margin of appreciation accorded to HMRC I turn now to consider the question of the scope of HMRC’s margin of appreciation or discretion. During the oral hearing a considerable amount of debate was focused upon the breadth of the power on the part of the HMRC to disclose information in a case such as the present. 53. Mr Peretz submitted that it was in effect a narrow power and he referred to the prohibitive starting point in section 18(1) CRCA 2005 and the fact that the prohibition was backed by criminal sanctions. He also argued that this was reinforced by the fact that FOIA was inapplicable to information covered by section 18 and which identifies or is capable of identifying a person. In relation to the judgment of the Supreme Court in Kennedy the Defendant accepted that “there is a common law presumption of openness”. However, it was argued that one could not simply transpose the enthusiasm of the Supreme Court in Kennedy for transparency in relation to the Charity Commission to the very different functions of HMRC. Parliament (in the guise of section 1(B)(2)4 Charities Act 1993) had imposed upon the Charity Commission express statutory duties to have regard to the principle of accountability and transparency in relation to regulatory activities and HMRC had no corresponding duty or function. Judgment Approved by the court for handing down. Privacy International v HMRC 54. Mr Squires took a different stance. He submitted that the power to disclose in section 18(2) CRCA 2005 was in fact quite broad. He pointed out that under section 9 CRCA 2005 the Commissioners were entitled to do anything that they thought “necessary or expedient in connection with the exercise of their functions or incidental or conducive to the exercise of their powers”. He also pointed out that the scope of the power was substantially affected by a wide range of different relevant considerations which would differ from case to case and that it was therefore artificial to suggest that one took a narrow starting point. He submitted that the inapplicability of FOIA was no more than a recognition that it was section 18(2) CRCA 2005 that governed disclosure not FOIA and that therefore the breadth of section 18(2) had to be examined according to its own light, and not in the reflected (and dim) light of FOIA. He also drew attention to the judgments in Kennedy which recognised the existence in common law of a principle of openness. In addition he pointed out that the stance adopted by HMRC in the present case was the very opposite to that it adopted in the case of Ingenious Media Holdings (see below) and in effect he suggested that the HMRC’s position was guided by expediency not principle. 55. Some guidance as to the scope of the margin of appreciation or discretion of HMRC under section 18 is found in the judgment of the High Court in Ingenious Media Holdings plc v HMRC [2013] EWHC 3258 (Admin) per Sales J. This case concerned HMRC’s revenue collection functions which are quite different to the functions in issue in this case. It is nonetheless informative in a general sense. This was an application for judicial review of a decision of HMRC, acting by Mr Hartnett, the Permanent Secretary for Tax at the relevant time, to disclose revenue related information relating to Ingenious Media and a Mr McKenna in an "off the record" briefing with two journalists from The Times newspaper on 14th June 2012. The journalists, Alexi Mostrous and Fay Schlesinger, published articles in The Times on 21st June 2012 regarding tax avoidance schemes, including film investment schemes, in which they named Ingenious Media and Mr McKenna, among others, as the promoters of such schemes. In their articles, Mr Mostrous and Ms Schlesinger drew upon and quoted statements (some of which were less than flattering) made by Mr Hartnett in the briefing regarding the Claimants. The Claimants sought declaratory relief that the disclosures made by Mr Hartnett were unlawful. On that occasion HMRC sought to justify the briefings given by the Permanent Secretary upon the basis that HMRC had a clear power to disclose information pursuant to section 18(2) CRCA 2005 and that in the exercise of that power it had a broad discretion and evaluative margin of appreciation. It submitted that providing information to journalists about investigations and particular types of schemes that it objected to and, moreover, as to the sorts of persons who were promoting such schemes was within their functions under section 18(2)(a). I shall return to this judgment later in relation to the analysis of some of the different components which it is said by the Claimant must go into the balancing exercise which HMRC is bound to undertake. For present purposes I focus upon the observations of the Judge about the margin of discretion conferred upon HMRC under section 18 in tax cases. He considered this issue from the perspective of HMRC’s revenue collecting functions (not its supervisory and enforcement powers in relation to export controls) and he expressed his views upon the margin of appreciation in the context of addressing submissions about the impact of Article 8 of the Convention: Judgment Approved by the court for handing down. Privacy International v HMRC “64. Mr Eadie made the further submission that any interference with rights under Article 8(1) was objectively justified under Article 8(2), in that the disclosures were made for the legitimate objectives of promoting the economic well- being of the country (ensuring proper, efficient and cost- effective collection of tax) and for the protection of the rights and freedoms of others (to ensure the fair distribution of the tax burden across all tax payers); and were proportionate and necessary in a democratic society. Mr Eadie submitted that in assessing the proportionality of the disclosures made, I should accord HMRC a wide margin of appreciation, on the grounds that the area of tax is a subject of economic and social policy in relation to which such a margin of appreciation is regularly allowed for public authorities: see e.g. James v United Kingdom (1986) 8 EHRR 123, esp. at para. [46]; National and Provincial Building Society v United Kingdom (1997) 25 EHRR 127 at paras. [79]-[80]. He also again emphasised the limited nature of the disclosures made by Mr Hartnett and the fact that he understood that they were being made to only two people for very limited purposes, in an "off the record" briefing. 65. I do not agree that the margin of appreciation for HMRC in relation to judgments regarding disclosure of confidential information regarding the tax affairs of an individual is as wide as Mr Eadie suggested. Although the background of tax policy and the need for well- informed practical judgments on the ground by experienced officials about how best to promote the effective collection of tax are factors which tend to expand the ambit of the margin of appreciation which is applicable in this context, the countervailing factors to which I have referred at para. [50] above increase the weight to be given to the interests of the individual in striking the fair balance required by the ECHR, and tend to reduce the margin of appreciation to be applied. Also, the disclosures made were not direct expressions of national policy in setting levels of taxation and so forth, unlike the sort of measures in issue in the authorities referred to above. Balancing these factors leads me to conclude that the relevant margin of appreciation is neither particularly wide nor especially narrow, but in the middle ground”. 56. The “countervailing features” referred to in the quotation above and said to come from paragraph [50] of the same Judgment focused upon the strength of the public interest in the tax affairs of individuals being kept secret: “50. The rationality standard is a flexible one, which varies in the width of the discretion allowed to a decision-maker Judgment Approved by the court for handing down. Privacy International v HMRC according to the strength of the public interest and the strength of the interests of any individual affected by the decision to be taken: R v Secretary of State for Defence, ex p. Smith [1996] QB 517; R (Bancoult) v Secretary of State for Foreign and Commonwealth Affairs [2008] UKHL 61; [2009] 1 AC 453. The basic statutory rule under which HMRC operate is that set out in section 18(1) of the 2005 Act, requiring them to maintain confidentiality of information about a taxpayer's affairs. That reflects a very longstanding tradition and strong public expectation of the standards to be expected of the tax authorities, particularly in relation to information which taxpayers provide to the authorities about themselves. It also reflects a strong policy interest associated with the fair and efficient collection of taxes, namely to encourage taxpayers to be frank and open with HMRC about their affairs - undeterred by fear that the information they disclose might be released to the public - so that HMRC can make a proper and accurate assessment of the tax due from them. These features of the context in which HMRC operate tend, in my view, to narrow the scope of the discretion to be allowed to HMRC under the rationality standard in disclosing information about taxpayers outside HMRC or other responsible public bodies. Thus, for example, it would have been a matter for grave concern and close scrutiny by the court if Mr Hartnett had given the journalists (even in an "off the record" briefing) access to the full tax files of Mr McKenna and Ingenious Media, with all the private information which they had supplied to HMRC about themselves, even if he did think that such a course might help in some way with the collection of tax”. 57. The Judge thus recognised that the concept of rationality was a flexible and context dependant one. Significantly, even where the decision to disclose information arose in the case of the tax affairs of individuals where there was a strong public interest in the preservation of confidentiality (and where the disclosure of information about a tax payer could engage Article 8 of the Convention - see ibid paragraph [63]) this still did not lead to a wide margin of appreciation; rather the Judge considered that it was “neither particularly wide nor especially narrow, but in the middle ground”. 58. The Judge endorsed HMRC’s submissions that disclosure to journalists was justified on the basis of four principal policy considerations which applied in the field of tax and revenue collection, which can be summarised as: i. The maintenance of good and cooperative relations with the press: This included ensuring that the public were well informed on matters of controversy relating to the tax system: “The efficient and effective collection of tax which is due is a matter of obvious public interest and concern. Coverage in the press about such matters is vital as a way of informing public debate about them, which is strongly in the public interest in a well-functioning Judgment Approved by the court for handing down. Privacy International v HMRC democracy. HMRC have limited resources to devote to the many aspects of their tax collection work, and it is legitimate and appropriate for them to seek to maintain relations with the press and through them with the public to inform public debate about the tax regime and the use of HMRC's resources” (ibid paragraph [44]). ii. Maintaining confidence in the tax system: This embraced the correction of false information and the suppression of false perceptions that the Revenue engaged in “cosy” deals with tax payers: “It is also relevant to the exercise of HMRC's functions to provide proper and accurate information to correct mis-apprehensions or captious criticism regarding the exercise of their functions (such as any misplaced suggestion that they had engaged in unduly lenient "cosy deals" with certain taxpayers), in order to maintain public confidence in the tax system. If such confidence were undermined, the efficient collection of taxes could be jeopardised, as disaffected taxpayers might withhold co-operation from the tax authorities” (ibid paragraph [44]). iii. Encouraging the provision of information by taxpayers and the press: This included providing information to the press in order to encourage the press to be forthcoming with HMRC: “[The Permanent Secretary’s] wish to encourage the journalists to share information with HMRC about tax avoidance, which could be of direct assistance to HMRC in relation to their tax collection functions by helping to inform them about where to focus their attention and investigations, was a further legitimate basis for that decision. He could rationally and lawfully take the view that the journalists would be unlikely to assist HMRC in this way unless HMRC for their part demonstrated a degree of measured frankness about the topics under discussion in return” (ibid paragraph [45]). iv. Deterrence: This included providing information to convey to the public HMRC’s negative views about particular types of tax scheme given that this was important to deterrence: “HMRC had an interest to challenge and investigate the true reasons of taxpayers for participation in such schemes, which had already been manifested by HMRC before the briefing. It was fair and appropriate for HMRC to seek to convey the message to the public that taxpayers who participated in such schemes could Judgment Approved by the court for handing down. Privacy International v HMRC expect to have such participation rigorously scrutinised by HMRC, and thereby seek to deter taxpayers who did not have substantial and genuine commercial reasons apart from simply seeking to avoid tax from participating in the schemes in the first place” (ibid paragraph [46]). 59. 60. 61. A further and important point arising related to the nexus between the “function” of HMRC and the type of content of the information disseminated. As to this the Claimants in Ingenious Media submitted that the particular information which had been disclosed bore no sensible relation to the functions which HMRC submitted that it was serving. The Judge rejected this submission. He said that in this regard HMRC had an “evaluative judgment” to perform and that it was justified in concluding that it would be assisted by the Permanent Secretary disseminating in an “off the record” interview various pieces of information about the two Claimants and about the sorts of tax schemes that they devised in particular (see ibid paragraph [61]). At paragraph [39] Sales J asked whether there was a “rational connection” between the function and the disclosure: “In my view there was a rational connection between the function of HMRC to collect tax in an efficient and cost-effective way and the disclosures made by Mr Hartnett in the course of the briefing, and his decision to make the limited revelations that he did was based on a judgment which fell well within the lawful parameters of section 18(2)(b)”. The irony of the Ingenious Holdings case as applied in the present case is that in that case the HMRC was arguing for a broad power to disclose information based upon a relatively loose nexus between the information disclosed and the functions of the HMRC and in circumstances where they could be indiscrete and in fact disparaging about both a company (Ingenious Holdings) and an individual who promoted tax avoidance schemes. In the present case however HMRC has moved to the absolute other end of the spectrum and in the Decision letter and in subsequent correspondence denied that it has any power at all to disclose information and has adopted a narrow approach towards disclosure which ostensibly contradicts its own arguments in Ingenious Media. As was recognised in Ingenious Media the scope of the margin of appreciation is context dependant. This point was recognised most recently in the judgment of the Supreme Court in Kennedy per Lord Mance at paragraphs [48]-[56]. In this particular case I do not consider that the margin of discretion can be uniformly categorised. As is evident from the analysis of relevant factors below in some circumstances it might be materially or even very substantially circumscribed in other cases it might be relatively broad. I am not convinced that it is wise, to seek to categorise the margin in quantitative terms (wide, middling, narrow). As I explain below the extent of HMRC’s margin of discretion will vary according to the facts of each case. In some cases it might be quite wide; whilst in others it might be narrow. The outcome might differ depending upon the status of the person seeking information and the type and nature of information sought. It might also be temporally contingent in that a wide-ranging request for detailed information at the outset of an investigation (for instance when HMRC needed to preserve secrecy lest disclosure forewarned a person who was likely to destroy evidence) might be much easier to refuse than a modest request made later on. Judgment Approved by the court for handing down. Privacy International v HMRC 62. Some indication of the balance to be struck between disclosure and non-disclosure can be seen from the tenor of the judgments in Kennedy. In that case the Supreme Court was concerned with inquiries conducted by the Charity Commission and their relationship with judicial or quasi judicial proceedings. It was, as Mr Peretz correctly pointed out, in this particular context that the Court emphasised the high importance attached to open justice and to transparency. The present case involves legal process but at a much earlier stage. Investigations conducted by HMRC are equivalent to police investigation which might or might not lead to a prosecution. They are operations which are necessary precursors to court proceedings. This has to be borne in mind when considering the implications of Kennedy. Different considerations apply. When matters come to court there is a powerful presumption that they should be conducted in public and this necessarily impacts upon the availability of documents used in those proceedings. However, before the proceedings come to court, whilst investigations are ongoing, the position is not so clear cut. The police will necessarily need to keep some facts secret: the fact that they intend to conduct a search of a premises; when that will be; the address, etc. Months later, when the prosecution is underway, those same facts may well have lost any vestige of confidentiality or secrecy they ever had. They will be facts referred to quite openly in Court. Nonetheless, I do not consider that the judgments in Kennedy lack all relevance. The Supreme Court was at pains to point out that the common law treated openness as very important and, with all the ecessary provisos and caveats, that message can in some measure carry through into section 18(2) CRCA 2005. In Kennedy Lord Mance, who gave the leading judgment for the majority, introduced his judgment with the following message which goes well beyond the narrow confines of the Charity Commission: “1. Information is the key to sound decision-making, to accountability and development; it underpins democracy and assists in combatting poverty, oppression, corruption, prejudice and inefficiency. Administrators, judges, arbitrators, and persons conducting inquiries and investigations depend upon it; likewise the press, NGOs and individuals concerned to report on issues of public interest. Unwillingness to disclose information may arise through habits of secrecy or reasons of self-protection. But information can be genuinely private, confidential or sensitive, and these interests merit respect in their own right and, in the case of those who depend on information to fulfil their functions, because this may not otherwise be forthcoming. These competing considerations, and the balance between them, lie behind the issues on this appeal”. E. The lawfulness of the Decision: Whether to quash and remit? 63. I turn now to the issue of the lawfulness of the Decision. I address this before considering the disagreement between the parties as to the relevance to the exercise of discretion of certain individual considerations. I have concluded that the Decision was taken unlawfully and must be quashed and remitted to be taken again. This is for the following eight reasons. (1) Point 1: Failure to obtain evidence from the relevant operational unit within HMRC. Judgment Approved by the court for handing down. Privacy International v HMRC 64. 65. 66. The Decision was taken without there having been any recourse to the operational unit with actual responsibility for the assessment of the complaint dossier: See paragraph [19] above. The reason given by Mr Hathaway for this was that he felt that there was a pressing need to send a response to the Claimant given that Privacy International had asked for an answer within 14 days and that particular period of time had elapsed. However, this cannot be a good reason for failing to conduct the necessary investigations needed to prepare an answer to the letter. All that was required was a short holding letter to Privacy International explaining that because of the Xmas vacation it had not been possible to respond within the 14 days but that enquiries were being made and a response would be sent shortly. This was not a case where time was of the essence. It is in my judgment quite impossible to see how the Defendant could make any sort of an assessment about whether it was proper to provide information without the decision maker taking advice or guidance from the responsible operational unit that was processing the complaint. The failure to obtain this information was irrational. (2) Point 2: Failure to have regard to the actual complaint letter and accompanying dossier of evidence. The failure to obtain evidence from the relative operational unit was compounded by a further equally fundamental failing. The Decision letter was also prepared without any reference to the submissions and evidence contained within the complaint itself. Mr Hathaway set out in his statement that for reasons that remain unexplained he did not see the letter sent by Privacy International of 9th November 2012 and the accompanying dossier of evidence and information. He only saw the chasing letter of 21st December 2012. Once again it is very hard indeed to see how the Defendant could make a rational or considered judgment without any reference whatsoever to the actual complaint and the facts and matters referred to therein. The letter of 21 st December 2012 to which Mr Hathaway says he was responding specifically cross refers to the letter of 9th November 2012 so that the existence of that letter was known to Mr Hathaway. Yet the Decision he drafted purports to be a response to the concerns of Privacy International and Dr Shehebi but was prepared without any knowledge of the facts. Accordingly the Decision was taken without any regard being had to either the complaint or to the views of those responsible for processing it within HMRC. This was doubly irrational. (3) Point 3: The Decision letter contains an error of law on its face. The Decision letter is drafted as an outright refusal and reflects a mistaken view of the law. The view set out in the Decision letter assumes that there is no power in section 18 CRCA 2005 to provide the information requested. This error was perpetuated in the two subsequent responses from Mr Stuart Armstrong. There is in my judgment no doubt but that in relation to HMRC’s responsibility towards export control it adopted the stance that it was prohibited from answering any request. This in my judgment was obviously wrong and is inconsistent with the plain language of the CRCA 2005 and the judgment in Ingenious Media and the position adopted by HMRC itself in that case. Indeed, in oral argument Mr Peretz, for the Defendant, accepted that section 18(2) conferred a power on the HMRC to disclose information and also that the circumstances that would govern the exercise of the power were both fact and context dependant. This is in sharp contrast with the terms of the Decision letter. As I have already pointed out the position in law of HMRC evolved over the course of the Judgment Approved by the court for handing down. Privacy International v HMRC 67. proceedings. But Mr Peretz urged me to assess this case upon the basis of the position as of the time the Decision was adopted ie in January 2013 and as of that date, and as reflected in the Decision letter, the Defendant took an uncompromising stance which on its face is simply inconsistent with the legislation. (4) Point 4: The ex post facto explanations for the Decision letter should not be treated as admissible to re-write the letter In this case HMRC has sought to elucidate on the reasoning set out in the Decision letter by the witness statements of Mr Hathaway and has further sought to provide the update to the Court. This highlights a quite separate problem which is that the Courts adopt a wary stance towards attempts by decision makers to adduce evidence to supplement and elucidate upon reasons given in a disputed decision. In the present case there are a number of reasons why the letter should be examined in its own light and without reference to new elucidatory evidence. The first point is that the Court permits new reasoning to elucidate decisions in rare circumstances: See eg R v Westminster City Council ex parte Ermakov [1996] 2 All ER 302 page 315g- 316g. In that case the Court of Appeal accepted that in certain circumstances the Court could admit evidence to elucidate or exceptionally correct or add to reasons but should be “very cautious” about doing so. Illustrations of where new evidence might be allowed included the correction of errors or where the language used in an impugned decision might lack clarity. However, the Court was hostile to the receipt of new evidence “which indicates that the real reasons were wholly different” from the actual reasoning. In Alletta Nash v Chelsea College of Art and Design [2001] EWHC 538 (Admin) Mr Justice Stanley Burnton (as he then was) considered the position in relation to cases where (as in the present case) there is no express statutory duty to give reasons. He identified five (to some degree overlapping) factors which needed to be assessed which focused upon (and I reformulate to meet the facts of the present case): (i) the consistency of the subsequent reasons with the original reasons; (ii) whether the new reasons were in fact the reasons of the actual decision maker; (iii) whether there was a risk that the later reasons had been composed as a retrospective justification for the earlier decision; (iv) the extent of the delay before the new reasons were advanced; and (v) whether the new reasons were advanced following the commencement of proceedings in which case they needed to be treated “especially carefully” (reasons given during correspondence should be treated “more tolerantly”). In the present case, and based upon the analysis set out above: the new reasons are inconsistent with those in the Decision letter and other emanations from HMRC; they are not the reasons set out in the Decision letter; there is a long delay between the Decision letter and the witness statement and in this respect it must be recorded that the Defendant did not respond at all to the Claimants’ pre action protocol letter (which Mr Peretz candidly accepted was a “cock up”); there is a real risk that the new reasons represent an attempt to justify what is now recognised as an inadequate Decision letter. Mr Peretz argued that, when construing the Decision letter, it should be taken as “obvious” that Mr Hathaway would have been aware of the exceptions to the prohibition on disclosure (since issues of disclosure were part of his job) and that the Decision letter should be read accordingly. But whilst that might be true it would set a very dangerous precedent if a decision that was (manifestly) wrong in law on its face could nonetheless be treated as valid upon the basis that the draftsman (who was not even the signatory or author of the Decision letter) was to be presumed to have known the correct position because some 12 months later he explained in a witness Judgment Approved by the court for handing down. Privacy International v HMRC statement that in fact he was thoroughly versed in the correct legal position. In any event it is necessary to take account of the letters from Mr Armstrong and in particular that dated 8th March 2013 (referred to at paragraph [25] above) in which Mr Armstrong, this time some 2 months after the Decision letter, “reiterates” what he understood to be the thrust of Mr Inglese’s position as set out in the Decision letter viz.: Section 18 imposes “strict controls” and “this means that HMRC cannot comment on individual cases, nor are we able to keep you or other third parties informed of progress of any potential enquiries”. I infer from this that Mr Armstrong understood the Decision letter (emanating as it did from the General Counsel) to prohibit in absolute terms any disclosure to the Claimants’ or indeed to anyone. This was accordingly the institutional view at the time. It is not therefore surprising that this is also how the Claimant construed the letter. In these circumstances it would in my judgment be quite wrong to construe the Decision letter other than by reference to its face value. Mr Peretz cited, by way of response to this, the judgment of the Court of Appeal in Office of Fair Trading v IBA Health [2004] EWCA Civ 142 in a section from the judgment of Carnwath LJ on the inadequacy of reasons. I did not however obtain much assistance from this. It concerned a decision of the OFT in a merger case under the Enterprise Act 2002 which was subject to a duty to give reasons imposed by statute. The observations of the Court in this respect concerned the placing, on an appeal, of material before the Court which was not explicitly referred to in the challenged decision. Lord Justice Carnwath concluded that it was proper on the facts of the case for the OFT to add new material in furtherance of its duty as a public authority to come to court with “all the cards face upwards on the table” (see Judgment paragraph [105]). Lord Justice Carnwath did add this (at paragraph [106]): “While in some areas of the law the Court may need to be “circumspect” to ensure that this is not used as a means of concealing or altering the true grounds of the decision, that does not arise in this case”. See also Timmins & A W Lymn v Gedling Borough Council [2014] EWHC 654 (Admin) paragraph [109] – [114] where general elucidatory evidence was not taken into account in a planning law judicial review. In the present case HMRC has not sought to place substantive material before the Court of the sort being referred to in IBA Health. On the contrary the statement of Mr Hathaway seeks to rewrite wholesale the Decision. The present case is, with respect to Mr Peretz, far removed from IBA Health. (5) Point 5: The Decision letter read in the light of the supplementary reasons still reflects an error of law; it sets out only abstract arguments and does not involve an assessment of the surrounding facts 68. Even if the Decision was to be permitted to be refashioned according to the witness statement of Mr Hathaway, it would still reveal a serious error of law. As a more or less inevitable consequence of the first and second failures identified above, the reasons given by Mr Hathaway in his statement are all generic and none actually grapple with the facts of the case. The reasons also fail to distinguish between different types of applicant for information or between different types of requests and they fail to balance the public interest in disclosure with the actual impact of disclosure on the investigation or upon the company being investigated. Accordingly, even if I were of the view that the Decision could be supplemented or corrected by the evidence in the witness statement I would have been bound to have concluded that the Decision (now as refashioned by the new evidence) still reflected an error of law because it relied upon abstract reasoning divorced from the actual Judgment Approved by the court for handing down. Privacy International v HMRC evidence and hence operated upon the premise that the actual facts were an irrelevance. The evaluative exercise which is called for under section 18(2) CRCA 2005 is one based not in abstractions but, on the contrary, is anchored in real life. In any given case HMRC will need to evaluate a possibly wide range of specific facts. These might include, in a case such as the present: the precise nature and status of the person seeking the information; the specific type of request being made; the actual sensitivity of the information in its possession which is being asked for; the actual risk to an investigation if individual items of information are disclosed to the applicant; whether disclosure might in actual fact warn Gamma International that it was or might be a “suspect” and so if the likely impact on the actual investigation; whether Privacy International would agree to receive information on a confidential basis (which it does in practice), etc. There are numerous specific factors which might need to be taken into consideration but by failing to do the ground work HMRC disabled itself from forming any sort of a proper view. (6) Point 6: The update statement does not advance matters. As for the update statement (see paragraph [27] above) this was a statement generated in the course of argument. In oral submissions in response to requests for clarification from me, Mr Peretz made two things clear. First, that the facts and matters contained in Mr Hathaway’s first statement were the only matter of which he was aware at the time that he drafted that statement. But secondly that the facts and matters set out in that statement were no longer the only matters arising in relation to this case ie that there were other factors now in play. The update statement is however a bland document and it does not spell out the sorts of consideration which are presently being considered by HMRC; Mr Peretz moreover categorised it as a “neither confirm nor deny” statement. It is about as straight a forensic bat as it is possible to find and as such it provides no information on questions such as: whether HMRC has even now embarked upon any investigation; and if so, as to the stage reached; or even whether the file has been passed to the CPS or in fact has been closed and if so whether the advice of the CPS was obtained first. There is no witness statement explaining the basis upon which the update was made or who gave the instructions for its preparation. It does not even address the sorts of matters that Mr Hathaway referred to in his statement and there is no indication that there has been any form of assessment of the underlying evidence. To be fair, the update statement was not referred to the Court by Mr Peretz as a belated justification for the Decision. Ultimately it does not materially advance the analysis in this case. (7) Point 7: The Decision letter responded to the request in the wrong letter. Because of the second error above Mr Hathaway prepared a response which was ignorant of the actual request made in the complaint. Mr Peretz submitted that the Decision was reasonable in that it responded to the information request contained in the letter of 21st December 2012 and that since this was a limited request it was reasonable to respond in a limited manner. But, this argument does not withstand scrutiny for essentially two reasons. First, the letter of 9th November 2012, which was the core request, contained not only a request for specific pieces of information about the stages of the investigation it also asked for the results of the investigations to date. It cannot be a justification for providing a limited response to say that this was all the “chaser” called for, when the substantive complaint sought a substantive response. 69. 70. Judgment Approved by the court for handing down. Privacy International v HMRC 71. 72. But secondly, and in any event, the Decision letter did not even provide a comprehensive response to the requests in the chaser letter: See paragraph [23] above. (8) Point 8: The position of HMRC generally reflects internal confusion which undermines the credibility of its response. I also cannot ignore the letter of 10 January 2013 sent by Mr Armstrong (see paragraph [24] above). It emanates from Customs Enforcement Policy, which is the operational unit within HMRC responsible for processing the complaint. It purports to be a response to the letter of 9th November 2012 and, as such, is based upon the actual evidence. The letter from Mr Armstrong was sent without Customs Enforcement Policy obtaining legal advice (else of course Mr Hathaway would have known about it). The letter does not even attempt to begin to engage with the Claimant’s concerns. It is also inconsistent in a significant respect with the letter from Mr Inglese. The latter states: “I am able to confirm that the matters you raise are already under active review” (my emphasis). But Mr Armstrong does not say that the matters are “already” under “active” review. He says that the matter “will be assessed by our Criminal Investigators for consideration of further action”, which suggests that the matter had, at that point in time, yet to be placed under any form of consideration. This in my view is also relevant in my decision to quash the Decision. The whole episode reflects confusion between left and right hands. I can in such circumstances have no confidence that HMRC has properly addressed itself to the serious complaints advanced to it by the Claimant. (9) Conclusion For all of these reasons I have concluded that the Decision must be taken again. In this regard, and to the credit of the Defendant, whilst attempting (albeit lightly) to justify the impugned decision, in argument Mr Peretz put forward a vastly more considered and refined analysis of the HMRC’s position than is evident from the letters emanating from HMRC to the Claimants and in the witness statement evidence. This was supported by two sets of written submissions following the hearing. This reflected an acceptance that the issues arising in the case are novel and complex and that it was important for the HMRC to set out its considered position rather than simply seek to defend the position recorded in earlier documents. It was for this reason that a good deal of the argument and debate focused upon, first, the framework for analysis of the scope of the HMRC’s powers or duties to disclose information and, secondly, upon the considerations that were relevant to the exercise of any such power as might exist and the weight to be accorded to such factors in the evaluative process. 73. In the next section I therefore turn to an assessment of the relevance and weight of the individual considerations said to arise on the facts of the present case. This is an exercise that focuses upon the relevance, as a matter of principle, of different considerations in the exercise of HMRC’s powers in relation to export control. F. Factors relevant to the exercise of discretion I: The status of affected persons (1) The issue Judgment Approved by the court for handing down. Privacy International v HMRC 74. 75. 76. 77. The first issue that I address is the dispute between the parties as to the weight that should be attached to the respective positions of natural and legal persons who might seek information from the HMRC, and to the position of natural or legal persons who might be subject to investigation by HMRC. I do this in relation to HMRCs responsibilities vis-a-vis export control and not therefore for tax, though HMRCs position with regard to tax does shed at least some light by way of guidance on the position HMRC should adopt in relation to export control. In the Decision letter and in the subsequent letters from HMRC to the Claimant no distinction is drawn between different categories of complainant; they are all treated as having no right to receive information. This was particularly evident in the letter of 8th March 2013 (see paragraph [25] above) which was said to reiterate the position adopted in the Decision letter and adopted the stance that no distinctions would be drawn between any applicant for information. Upon this basis HMRC would not differentiate, for instance, between persons such as Mr Kersmo or Dr Shehabi and a casual enquiry from the press or even from a simply curious member of the public. They all get nothing. In my view the law shows that different persons have different interests and the status of each person seeking information is a matter to which HMRC must direct itself. In the exercise of its discretion in the area of export control HMRC must take into account the nature and status of both the persons seeking information and of persons (natural and legal) who are the subject of complaints or investigations. These various actors may be many and various but would include: pressure groups, NGOs and the press; victims of crime; witnesses; general complainants; and exporters of goods and services subject to regulation and their directors and employees. In this case all of these categories are potentially engaged upon the facts. In the text below I consider the sorts of considerations which would arise in relation to these different categories of person. (2) Pressure groups/NGO’s/the press The position of HMRC in the Decision letter that legitimate NGOs can submit dossiers by way of complaint but thereafter are entitled to no information by way of update is not a rational one. Pressure groups share many similarities with the press. They can act as guardians of the public conscience. As with the press their very existence and the pressure they bring to bear on particular issues and upon those who are responsible for governance of those issues, is one of the significant checks and balances in a democratic society. They have, therefore, a significant role to play. In Kennedy at paragraph [1] Lord Mance introduced his judgment with the paragraph cited at paragraph [62] above in which he extolled the importance of openness in government and during which he made express reference to the importance of the press and NGOs: “Information is the key to sound decision-making, to accountability and development; it underpins democracy and assists in combatting poverty, oppression, corruption, prejudice and inefficiency. Administrators, judges, arbitrators, and persons conducting inquiries and investigations depend upon it; likewise the press, NGOs and individuals concerned to report on issues of public interest”. Judgment Approved by the court for handing down. Privacy International v HMRC (Emphasis added) The role that NGOs play in enforcing legal rights in court is an acknowledged and important one. They have locus for instance to challenge in the public interest the decisions of public prosecutorial authorities not to prosecute: See paragraph [148] below. In relation to victims of crime the EU Council Directive on the role of victims of crime in criminal proceedings (discussed fully below at paragraphs 87 and 105 et seq) expressly contemplates that non-governmental organisations will play a significant role. Recital 62 to the Council Directive states: “Member States should encourage and work closely with civil society organisations, including recognised and active non- governmental organisations working with victims of crime, in particular in policymaking initiatives, information and awareness-raising campaigns, research and education programmes and in training, as well as in monitoring and evaluating the impact of measures to support and protect victims of crime. For victims of crime to receive the proper degree of assistance, support and protection, public services should work in a coordinated manner and should be involved at all administrative levels — at Union level, and at national, regional and local level. Victims should be assisted in finding and addressing the competent authorities in order to avoid repeat referrals. Member States should consider developing ‘sole points of access’ or ‘one-stop shops’, that address victims' multiple needs when involved in criminal proceedings, including the need to receive information, assistance, support, protection and compensation”. 78. Guidance as to the position of pressure groups viz a viz HMRC by reference to the analogous position of the press can be found in the judgment of Sales J in the Ingenious Media Holdings (ibid). I have summarised the facts at paragraph [55] above. The case concerned a decision by HMRC to volunteer information to the press about certain types of scheme that it found objectionable and as to the identity of certain types of promoter whose activities HMRC also objected to. HMRC defended itself by explaining the important of its functions of being able to disseminate information to the press. With specific regard to the position of the press Sales J stated as follows: “44. In general, it is legitimate for HMRC to seek to maintain good and cooperative relationships with the press. The efficient and effective collection of tax which is due is a matter of obvious public interest and concern. Coverage in the press about such matters is vital as a way of informing public debate about them, which is strongly in the public interest in a well- functioning democracy. HMRC have limited resources to devote to the many aspects of their tax collection work, and it is legitimate and appropriate for them to seek to maintain relations with the press and through them with the public to inform public debate about the tax regime and the use of HMRC’s resources. It is also relevant to the exercise of Judgment Approved by the court for handing down. Privacy International v HMRC HMRC’s functions to provide proper and accurate information to correct mis-apprehensions or captious criticism regarding the exercise of their functions (such as any misplaced suggestion that they had engaged in unduly lenient “cosy deals” with certain tax payers), in order to maintain public confidence in the tax system. If such confidence were undermined, the efficient collection of taxes could be jeopardised, as disaffected tax payers might withhold cooperation from the tax authorities. These considerations provided good objective grounds for [the Permanent Secretary’s] decision to participate in the briefing and to seek to foster the spirit of cooperation with the journalists to which I have referred. 45. [The Permanent Secretary’s] wish to encourage the journalists to share information with HMRC about tax avoidance, which could be of direct assistance to HMRC in relation to their tax collection functions by helping to inform them about where to focus their attention and investigations, was a further legitimate basis for that decision. He could rationally and lawfully take the view that the journalists would be unlikely to assist HMRC in this way unless HMRC for their part demonstrated a degree of measured frankness about the topics under discussion in return. 46. In addition, I consider that [the Permanent Secretary] could lawfully and rationally take the view he did regarding cooperation and sharing information with the journalists at the briefing so as to encourage them to understand and convey to the public the negative attitude which HMRC had to participation by taxpayers in film investment schemes. HMRC and [the Permanent Secretary] were lawfully entitled to take the view that loss of tax revenue as a result of participation in film investment schemes was detrimental to the due and proper collection of taxes and that it would be desirable to seek to deter members of the public from being too ready to participate in such schemes. There was a significant question mark in relation to such schemes whether participants in them were motivated by genuine commercial calculations rather by a predominant desire to use them to avoid paying tax which would otherwise be due from them. HMRC had an interest to challenge and investigate the true reasons of tax payers for participation in such schemes, which had already been manifested by HMRC before the briefing. It was fair and appropriate for HMRC to seek to convey the message to the public that tax payers who participated in such schemes could expect to have such participation vigorously scrutinised by HMRC, and thereby seek to deter taxpayers who did not have substantial and genuine commercial reasons apart from simply seeking to avoid tax from participating in the schemes in the first place”. Judgment Approved by the court for handing down. Privacy International v HMRC 79. 80. 81. 82. 83. The rationale which justifies the provision of information by HMRC to the press applies in large measure to disclosure of information to pressure groups and other NGOs, such as Privacy International. Such bodies, like the press, hold Government to account, campaign on issues of public importance, act as focal points for complaints and pursue injustices. In Ingenious Media the Judge endorsed submissions by Counsel for HMRC that disseminations to the press served important interests which were part of HMRC’s functions (see paragraph [58] above). The Judge rejected a submission on behalf of the Claimant that it was improper for HMRC to disclose information of the type in issue prior to any definitive judgment of a court holding that the schemes in issue were unlawful. On the contrary the Court concluded that it was a legitimate part of HMRC’s function to express its attitude “in relation to… questionable areas of operation of the tax code” (ibid paragraph [47]). The Judge observed that dissemination of information of this sort facilitated HMRC which had limited resources. But he also recognised that dissemination of information to stimulate public debate was “strongly in the public interest in a well-functioning democracy” (ibid paragraph [44]). All of these above considerations can apply, in an appropriate case, to an NGO such as the Claimant which campaigns for a particular point of view and disseminates that perspective through its electronic and paper disseminations. For the HMRC, Mr Peretz acknowledged the importance of providing information into the public domain in order to maintain and foster confidence in the operations of the HMRC in relation to export controls. Of course, both the nature and the extent of the information provided to the press and/or NGOs may depend upon the circumstances of a given case. I would add two final points on this issue. First, Privacy International explained that it regularly receives information under conditions of confidentiality and adheres to limitations imposed upon it. This is, or at least may be, a relevant consideration that HMRC must address itself to. In the present case because HMRC misdirected itself, it did not address the question whether it should be prepared to divulge information to Privacy International under conditions of confidentiality. It is notable that in Ingenious Media the Permanent Secretary was prepared to enter into “off the record” discussions with the press and trusted them (as it turned out misguidedly). But this serves only to show that there is no rooted objection within HMRC which could justify refusing to take into account the possibility that a disclosure might be possible under conditions of agreed confidentiality. Secondly, it should be an obvious point, but the decision to disclose or not to disclose will rarely be absolute subject only to a binary “yes/no” response. HMRC will always have to consider whether, even if they object to providing the specific information requested, there may not be room to provide other or lesser information. (3) Victims The next issue concerns the status of Dr Shehabi and Mr Kersmo as “victims”. The position in the Decision letter, and indeed in the update statement, is that neither will be provided any information. HMRC has not attached any added significance to the position of Dr Shehabi or Mr Kersmo as “victims”; on the contrary the blanket approach adopted by HMRC did not differentiate between any particular category of person to whom information might be Judgment Approved by the court for handing down. Privacy International v HMRC 84. 85. 86. 87. provided. In this particular case HMRC rejects the Claimant’s case which is that Dr Shehabi and Mr Kersmo are “victims” and that this conclusion triggers a prima facie duty to provide information to them about the complaints made on their behalf by Privacy International. The issue of the extent of victims’ rights is hence a live one in this case and it is also an issue of wider public concern and interest. It is fair to say that for HMRC this debate has, hitherto, had little day to day resonance. This is because for the overwhelming preponderance of its case load there is no discernible “victim” of an offence, at least in the traditional sense. A taxpayer who has deliberately under-declared or who has fraudulently failed to declare at all, deprives the State of funds and indirectly impoverishes the public purse. Society is a “victim” but only in the broadest sense. However, it would not be right to state that towards the outer regions of HMRC’s work, for instance in relation to export control, the same is always true. Here there are individuals who are affected in a far more proximate and immediate way by conduct which is under the regulatory supervision of HMRC and which is alleged to be criminal. By way of example HMRC has responsibility for enforcing the Torture Regulation (Council Regulation (EC) No. 1236/2005) the aim and object of which is to regulate, including curtailing, the export to third countries of products which could be used for “torture and other cruel inhuman or degrading treatment or punishment” (cf recital 9 and Articles 1 and 2). The Torture Regulation accordingly identifies as the subject of its attentions, ratione personae, exporters of such products. But the category of person designed to be protected are victims of torture or inhuman or degrading treatment (a concept well understood under Article 3 of the Convention). A violation of the Torture Regulation may mean that equipment is sold which is then used to torture an individual. In the context of the Torture Regulation a person who is tortured or subjected to inhuman or degrading treatment in a third country by virtue of a breach of regulations enforced by the HMRC is, manifestly, in an entirely different position relative to the victimless crimes committed by a taxpayer who fraudulently conceals taxable income. The question of who is a “victim” is relevant in that if the complainant is a “victim” within the specific definition attributed to that term under two pieces of EU legislation then there may prima facie be a duty upon HMRC (and not just a power) to disclose various categories of information to them about the progress of an investigation, and, to provide a reasoned decision if the complaint that the victim makes is rejected. In the present case debate centred upon whether Dr Shehabi or Mr Kersmo constituted “victims” within the meaning of either (a) Council Framework Decision of 15 th March 2001 on the Standing of Victims in Criminal Proceedings (OJ L 82/3, 22 nd March 2001); or (b) Directive 2012/29/EU of the European Parliament and of the Council of 25th October 2012 Establishing Minimum Standards on the Rights, Support and Protection of Victims of Crime, and Replacing Council Framework Decision 2001/220/JHA (OJ L 315/57, 14th November 2012). In this judgment I refer to these instruments as, “the Framework Decision” and “the Council Directive” respectively. The relevance of the debate between the parties is that if either Dr Shehabi or Mr Kersmo fell within the definition of “victim” then HMRC would be required, in law, to provide to them certain information and rights set out in the Framework Decision or the Council Directive. As such HMRC would, once the Council directive is Judgment Approved by the court for handing down. Privacy International v HMRC 88. 89. 90. 91. required to be implemented, prima facie be duty bound to respond; it would not simply have a power so to do. So far as the relationship between the two instruments is concerned the 2001 Framework Decision is to be replaced by the 2012 Council Directive. However, Member States are only required to implement the Council Directive by 16th November 2015. In the United Kingdom the position is that the Government is in the process of considering what measures are required to be taken to implement the Council Directive; but it has not finally done so yet. However, the CPS has already sought to implement the Council Directive in the form of a “Code of Practice for Victims of Crime” (October 2013). This was presented to Parliament pursuant to section 33 of the Domestic Violence, Crime and Victims Act 2004. Footnote 1 to the Code expressly states that the Code is intended to implement certain provisions of the Council Directive. Accordingly, whilst it might be true that the Government has yet to complete its implementation exercise at least part of the Directive has already been implemented and is treated as being already in force in the United Kingdom. In the text below I set out the nature and extent of the rights arising under these two instruments. As to the status in law of a Framework Decision it was common ground between the parties that it is not treated as an act which has legal force by virtue of the European Communities Act 1972. The legal status of framework decisions was considered by the Supreme Court in Ministry of Justice, Republic of Lithuania v Bucnys [2013] UKSC 71. It is not necessary to set out the facts of that case. In his judgment Lord Mance pointed out (ibid paragraph [20]) that although the provisions of a framework decision fell out with the scope of the European Communities Act 1972 viewed: “… as an international measure having direct effect only at an international level, the United Kingdom must still have contemplated that it would be interpreted uniformly and according to accepted European legal principles.” Lord Mance drew attention to the recitals to the framework decision in issue as being relevant guidance as to the substantive measures of the instrument. The Framework Decision was adopted to implement the conclusions of the European Council meeting in Tampere in October 1999 which stipulated that “minimum standards should be drawn up on the protection of the victims of crimes, in particular on crime victims access to justice…” (cf recital 3). The recitals to the Framework Decision emphasise that the protection to be provided was not confined to attending to a victim’s interests only during the course of criminal proceedings but also covered measures to assist victims before and after such proceedings (cf recital 6). Recital 8 to the Framework Decision identified the issues to be harmonised: “The rules and practices as regards to the standing and main rights and victims to be approximated with particular regard to the right to be treated with respect for their dignity, the right to provide and receive information, the right to understand and be understood, the right to be protected at the various stages of procedure and the right to have allowance made for the disadvantages of living in a different Member State from the one in which the crime was committed”. Judgment Approved by the court for handing down. Privacy International v HMRC 92. Article 1 defines “victim” in a way which focuses upon the directness of the causal link between the criminal conduct and the harm sustained: “(a) “victim” shall mean a natural person who has suffered harm, including physical or mental injury, emotional suffering or economic loss, directly caused by acts or omissions that are in violation of the criminal law of a Member State”. (emphasis added) 93. Article 1(d) defines “proceedings” in the following way: “(d) “proceedings” shall be broadly construed to include, in addition to criminal proceedings, all contacts of victims as such with any authority, public service or victim support organisation in connection with their case, before, during, or after criminal process.” 94. Article 2 entitled “Respect and recognition” provides as follows: “1. Each Member State shall ensure that victims have a real and appropriate role in its criminal legal system. It shall continue to make every effort to ensure that victims are treated with due respect with the dignity of the individual during proceedings and shall recognise the rights and legitimate interests of victims with particular reference to criminal proceedings. 2. Each Member State shall ensure that victims who are particularly vulnerable can benefit from specific treatment best suited to their circumstances”. 95. 96. Article 4 is entitled “Right to receive information”. It identifies two broad categories of information that victims have a right to. Article 4(1) imposes an obligation upon Member States to “ensure” that victims have access as from their first contact with law enforcement agencies to information of relevance for the protection of their interests. The Framework Decision proceeds to identify a range of categories of information that a victim is entitled to including, inter alia, the type of services or organisations to which they can turn for support, the type of support which they can obtain, where and how they can report an offence, procedures following such a report and their role in connection with such procedures, how and under what conditions they may obtain protection, to what extent and upon what terms they have access to legal advice or legal aid or any other sort of advice, requirements for them to be entitled to compensation. The logic behind the duty to provide such information is all readily understandable especially the context of ordinary, routine, crimes. 97. Article 4(2) is in the following terms and concerns the much more specific right to a decision about the outcome of a complaint: “2. Each Member State shall ensure that victims who have expressed a wish to this effect are kept informed of: (a) the Judgment Approved by the court for handing down. Privacy International v HMRC 98. 99. outcome of their complaint…” There is nothing in the Framework Decision which accords to the recipient of information about “outcome” a right to challenge a decision not to prosecute. This, however, is a right found in the Council Directive (see below). I turn now to consider whether Dr Shehabi and Mr Kersmo are “victims” within the meaning of the Framework Decision. If they are then the United Kingdom, which of course would include HMRC, must even before full implementation of the Council Directive, interpret relevant legislation in the light of the principles in the Framework Decision and this would include section 18(2) CRCS: See the principle of interpretation at paragraph [90] above. There seems little doubt that Dr Shehabi is a victim of something, somewhere. HMRC submits that she was subjected to surveillance in Bahrain by the Bahraini authorities where such surveillance might or might not be a crime. The Defendant does not therefore accept that she is a “victim” in the sense used in the Framework Decision because any harm she sustained was not “directly caused” by the alleged breach of export regulations by Gamma International. Mr Peretz pointed out that the insertion of the word “directly” into the definition of “victim” in Article 1(a), was deliberate designed to limit the scope and effect of the Framework Decision. He submitted that the limitation was justified upon the basis that the Framework Decision was an instrument setting out minimum standards and guarantees. In relation to a “victim” so defined each Member State assumed extensive (and invariably costly) obligations and it was for this reason that the rights and obligations were limited to persons who had suffered harm “directly” caused by acts or omissions that are in violation of the criminal law of a Member State. He submitted that the Framework Decision by introducing the phrase “directly” recognised that there may well be categories of person who may loosely be defined as “victims” because they were indirectly harmed by a criminal act but the Framework Decision, for sound and pragmatic reasons, simply drew a line between direct and indirect victims. This was, he submitted, perfectly understandable in the context of an instrument designed to safeguard “minimum standards”. 100. There can in my view be no doubt that the concept of direct causality was inserted intentionally into the legislation. It is notable that equivalent phraseology is found in other language versions of the Framework Decision. For example in the Italian version one finds the expression “danni materiali causati direttamente”; in the French version one finds the expression “directement cause par des actes”; and, in the Spanish version one finds the expression “directamente causado”. 101. Mr Squires, for the Claimant, submitted that the issue of who was a victim, at least in the context of the present case, had to be viewed in two different ways. First, he submitted that a person in the position of Dr Shehabi was, when the Decision was construed purposively, precisely the sort of person who was to be categorised as a victim in the context of the Export control functions of the HMRC and the Dual-Use Regulation. Standing back from the Framework Decision, and construing it purposively, he submitted that it would be absurd not to recognise that Dr Shehabi as a “victim” in the sense used within the legislation. Secondly, but on this occasion with particular regard to the position of Mr Kersmo, Mr Squires repositioned the focus of his analysis onto other legislative measures which, it was submitted, engaged Gamma Judgment Approved by the court for handing down. Privacy International v HMRC 102. 103. 104. International in liability as a secondary party and which created a direct link between harm caused to Mr Kersmo in the United Kingdom and criminality by Gamma International. In particular he drew attention to the fact that complaints had been made to the police under section 1 of the Regulation of Investigatory Powers Act 2000, section 45 of the Serious Crime Act 2007 and section 8 of the Accessories and Abettors Act 1861. The complaints alleged that Gamma International had, indeed, committed offences in the United Kingdom which were directly linked to the surveillance performed on Mr Kersmo who was thereby, in actual fact, the direct victim of an offence: See paragraphs [31] above. This is by no means an easy question to answer. The arguments are in my view finely balanced. For reasons that I set out elsewhere the answer to the question is not, necessarily, pivotal to the outcome of this case. However, on balance I prefer the submissions of Mr Peretz. This is for the following two principal reasons. First, the clear statement in the Framework Decision that it amounts to the creation of minimum safeguards only is significant and provides an explanation why the legislature would introduce a directness of causality limitation into the measure. The Council Directive does not purport to set out an exhaustive definition of “victim” in national or international law. It was an attempt to introduce a lowest common denominator as between the Member States. The conclusion that the definition is not all embracing of the notion of “victim” is accordingly perfectly explicable. The Framework Decision does not lay down an exhaustive code and accordingly a person who does not qualify as a “victim” within the meaning of the limited definition therein is not thereafter to be precluded from being a “victim” in some different domestic or international law sense. For instance the concept of victim under the Convention includes both direct and indirect victims: see ECHR Practical Guide on Admissibility Criteria (2011) Section B paragraphs [23]-[31]. It does not, therefore, prevent other arguments being advanced which lead to the conclusion that a person who is not strictly a “victim” as defined under EU law would still have to be accorded a position of significance by the HMRC when it came to determine whether to provide information to them. In other words the analysis of a complainant as a “victim” within the meaning of the Framework Decision may be of assistance to the issue arising but is not dispositive. Secondly, Mr Squire’s argument about purpose is ostensibly attractive. It gains some traction from the principle that the Framework Decision must be interpreted by reference to its “aims” and with a view to ensuring fulfilment of “fundamental rights” (see eg Case C-105/03 Maria Pupino paragraphs [56] – [59]). However, this has not led the Court of Justice to construe the Framework Decision so broadly that it collides with the natural meaning of the words. In Case C-467/05 Dell’Orto [2007] ECR I- 5557 paragraphs [51]-[54] the Court declined to define “victims” as including legal persons in addition to natural persons. The Court said that to construe the measure broadly would contradict the express terms of the Decision. The difficulty with Mr Squires submissions is that it fails to grapple with the point that the limitation inherent in the phrase “directly” was deliberately introduced to curtail the reach of the measure and this was achieved by limiting causality. It is clear that the question of the directness of the connection between the victim and the crime was before the Council when it adopted the Directive. This can for instance been seen from the Opinion of the European Economic and Social Committee (the “ECOSOC”) (7th December 2011) Judgment Approved by the court for handing down. Privacy International v HMRC 105. which Opinion is referred to as part of the travaux in the Council Directive itself (cf footnote 1). This refers in paragraphs 4.3.1 – 4.3.3 to perceived problems associated with the perceived narrowness of the definition of “victim” eg that it precluded legal persons and did not embrace a sufficiently wide range of persons who supported victims beyond the immediate family. Political activists might, as a category or class, be the sorts of person whom the Directive was intended to protect. But this did not prevent the scope of the measure being limited by reference to direct causality of harm. Put another way references to broad purpose do not definitively determine the answer to the question: What is the scope of the measure? I turn now to consider the position under the Council Directive and whether the conclusion differs in the new regime. The Council Directive is intended to replace the Framework Decision and it is based upon very much the same considerations. It was introduced however because experience with the Framework Decision was found not to be satisfactory. A report from the Commission pursuant to Article 18 of the Framework Decision (20th April 2009; COM(2009) 166 final) found that many Member States had not transposed the Decision and that the level of protection accorded to victims was inconsistent. Most Member States implemented through soft law measures (codes of practice etc). The Report notes that a “wide” definition of victim was given by the United Kingdom. Generally, the Commission said that its review had shown that Member States routinely purported already to respect the principles in the Framework Decision but that in practice it found many inconsistencies and omissions. The Council Directive is different to the Framework Decision in that it elaborates upon the right to receive information about the outcome of a complaint and introduces a right to challenge an adverse decision. It also recognises the need for that right to be made real and effective by the provision of reasons. 106. In its recitals it sets out at great length the importance which is attached to the protection and support of victims, including the provision of information to such persons. 107. Article 6(1)(a) of the Council Directive stipulates that Member States “shall ensure” that victims receive information about “…any decision not to proceed with or to end an investigation or not to prosecute the offender. This is for the purpose of enabling challenges to that decision to occur”: see Article 11. Recital 26 explains that one critical function of the provision of information is to facilitate challenges to decisions not to prosecute: “26. When providing information, sufficient detail should be given to ensure that victims are treated in a respectful manner and to enable them to make informed decisions about their participation and proceedings. In this respect, information allowing the victim to know about the current status of any proceedings is particularly important. This is equally relevant for information to enable a victim to decide whether to request a review of a decision not to prosecute. Unless otherwise required, it should be possible to provide the information communicated to the victim orally or in writing, including through electronic means”. Judgment Approved by the court for handing down. Privacy International v HMRC 108. Recital 28 recognises that the provision of information may not be an unqualified right. This in large measure is deigned to control the flow of information whilst a trial is ongoing, but it does seems to go beyond the trial stage: “28. Member States should not be obliged to provide information where disclosure of that information could affect the proper handling of a case or harm a given case or person, or if they consider it contrary to the essential interests of their security”. 109. Recital 29 provides: “29. Competent authorities should ensure that victims receive updated contact details for communication about their case unless the victim has expressed a wish not to receive such information”. 110. Recitals 43 and 44 (reflected substantively in Article 11) concern the right of a victim to seek a review of a decision not to prosecute. It is drafted broadly because in different Member States the forum in which such challenges may be mounted can be very different: “43. The right to a review of a decision not to prosecute should be understood as referring to decisions taken by prosecutors and investigative judges or law enforcement authorities such as police officers, but not of the decisions taken by the court. Any reviews of a decision not to prosecute should be carried out by a different person or authority to that which made the original decision, unless the initial decision not to prosecute was taken by the highest prosecuting authority, against who’s decision no review can be made, in which case the review may be carried out by that same authority. A right to a review to a decision not to prosecute does not concern special procedures, such as proceedings against members of parliament or government, in relation to the exercise of their official position. 44. A decision ending criminal proceedings should include situations where a prosecutor decides to withdraw charges or discontinue proceedings”. 111. Article 2(1)(a) provides a definition of “victim” which whilst retaining the “directness” limitation upon “victim” from the Framework Decision nonetheless extends the definition: “(a) victim means: i) a natural person who has suffered harm, including physical, mental or emotional harm or economic loss which was directly caused by a criminal offence; Judgment Approved by the court for handing down. Privacy International v HMRC ii) family members of a person whose death was directly cause by a criminal offence and who have suffered harm as a result of that person’s death”. 112. 113. It will be seen that the definition of “victim” retains the requirement of direct causality first introduced in the Framework Decision. However, it now extends the concept to include family members of a person whose death was “directly caused” by a criminal offence. It inferentially excludes, however, from the definition of “victim” family members of a person who sustained only non-fatal injuries directly caused by a criminal offence and who have suffered harm as a result of that person’s injuries. The definition of “victim” thus now extends to certain persons who are at least one step removed from the immediate victim of the actual criminal conduct. The position of a person such as Dr Shehabi in relation to Gamma International appears to fall betwixt and between the two categories of victim contained in Article 2(1)(a). On one view Gamma International is one step removed from the perpetrator of a criminal act upon Dr Shehabi in Bahrain. On the other hand Dr Shehabi appears to be more proximate to the notion of “victim” than a family member of a person whose death was caused by a criminal act. She is closer or more proximate to the concept of a “victim” because she has personally been subjected to what could be illegal activity using products supplied by Gamma International. Is the position under the Council Directive different to that under the Framework Decision? It could be argued, with some persuasive force, that the purpose of the extension of the definition of “victim” from the Framework Decision, was to bring within the definition those who suffered harm but who were one step removed from the criminality. On balance, and again recognising that the answer is not at all clear cut, I consider that the extension of the concept of “victim” to family members of a bereaved was a very specific and limited extension to the concept of “victim” which otherwise remains unchanged. The ECOSOC Opinion (referred to in paragraph [104] above) suggests that the extension was for narrow political reasons. To the extent that the Council Directive goes beyond the direct victim of criminal conduct it has done so in a strictly limited and circumscribed manner – the exception proves the rule. 114. How does all of this affect persons in the position of Dr Shehabi and Mr Kersmo? The answer to this is not something that I can definitively rule upon in this case. The Claimant in its complaint to the MPS on behalf of Mr Kersmo has adopted a more refined approach to causality than that it adopted in relation to Dr Shehabi earlier on in the course of the proceedings. The Claimant has now introduced a legal analysis which seeks to make Gamma International criminally liable on a basis which is wider and far more direct than that set out solely in the relevant export regulations. In so doing it seeks to create a closer nexus between the offence and the harm suffered by Dr Shehabi and Mr Kersmo. 115. HMRC has not, because it previously misdirected itself in law, grappled with the implications of the Framework Decision or the Council Directive to date. Nor has it properly addressed the new legal arguments which Privacy International has advanced in the context of the complaint to the MPS. HMRC will have to engage in a much closer analysis of this issue when it comes to re-take the decision. (4) Witnesses Judgment Approved by the court for handing down. Privacy International v HMRC 116. I turn now to consider the position of Privacy International’s claim that even if they are not victims Dr Shehabi and Mr Kersmo are witnesses who, as such, acquire rights of access to information. The MOJ in December 2013 issued “The Witness Charter – Standards of care for witnesses in the criminal justice system”. The Charter is not legally binding. But it is endorsed by the CPS who are responsible for prosecuting criminal cases investigated by HMRC. Hence criminal prosecutions falling within the export control regime fall to be prosecuted by the CPS who will seek to treat witnesses in a manner consistent with the Charter. It is also to be applied by the “Police” who are defined as “…all law enforcement agencies where applicable” and HMRC investigators may fall within this extended definition. The Charter sets out a series of Standards that witnesses are entitled to expect. 117. One elementary component of the Charter is that the CPS will inform a witness of how the case is progressing. The CPS will (according to Standard 2 – which concerns “Reporting a crime or incident”): “…explain how they are going to deal with the matter; give an indication as to how long this will take”. Standard 5 (which concerns “after a statement is given”) states: “The police will keep you regularly updated on progress during the investigation of a serious criminal offence. If the crime is less serious, the police will provide you with contact details so you can find out what stage the investigation has reached. You will be informed upon the conclusion of the investigation (eg charge, caution). If you have given a statement to a defence lawyer, you can ask them about the progress of the case to date”. 118. 119. The Charter does not explicitly apply to HMRC but, as noted, it applies to the CPS who are responsible for prosecuting criminal cases investigated by HMRC and defines “police” as “all enforcement agencies”. Nothing was put before the Court in the present case to suggest that where HMRC did have a case where there was a witness that it should not then expect to behave in a commensurate manner to that of the CPS or police, subject to the end constraints of section 18 CRCA. In this case it is possible that HMRC might well need to treat Dr Shehabi and Mr Kersmo as witnesses. According to a Statement by the Secretary of State in Parliament in 2000 decisions to permit the export of products may be affected by a series of criterion which include: “The respect for human rights and fundamental freedoms in the country of destination”. The statement continued that the Government would not “…issue an export licence if there is a clear risk that the proposed export might be used for internal repression”. A victim of repression might be a witness to the fact that the repression was conducted using products subject to HMRCs export control. The evidence given by such persons may well be relevant to a process of investigation leading up to a decision whether or not to prosecute. 120. Once again HMRC will have to address itself to the position of witnesses when it comes to reassess the decision. It is not possible at this stage to go further than to explain how and why the status of a person as a witness might well be a relevant consideration. (5) Complainants Judgment Approved by the court for handing down. Privacy International v HMRC 121. 122. 123. Even if a person is a disinterested complainant, with no personal interest in a case, their status as such might still warrant some recognition. The point was advanced by HMRC in Ingenious Media that given limited resources HMRC had to rely in part upon complaints. The HMRC website has a discrete section entitled “Reporting Tax evasion” which promotes its confidential hot line “…for you to report somebody who is not paying their fair share of tax.” In Ingenious Media one way of encouraging complaints was to disseminate information to them. A disinterested complainant might not be accorded the self-same rights as a victim, or witness or a person in a position comparable to the activists in the present case but that does not mean that they are necessarily denied all rights. (6) Companies investigated Last, but most certainly not least, there is the position to consider of those who are subjected to investigation. In the present case there are suggestions in Mr Hathaway’s witness statement that amongst the considerations that he says were relevant were: (i) that disclosure might forewarn a “suspect” (in casu Gamma International); (ii) that disclosure might cause reputational harm; and (iii), that disclosure should not occur because it might contain personal and confidential matters. I will address each of these separately. (i) Forewarning the suspect To adopt a blanket prohibition upon disclosure for this reason is misconceived. There may well be cases where, because HMRC cannot control the onward dissemination of information that it provides to a third party, the provision of any information might risk forewarning a suspect. However, no thought was given in the present case to whether Gamma International was already aware of the complaint (which in fact seems highly probable) or whether even if it was unaware, disclosure should nonetheless be given because it would not impact upon HMRC’s enquiries in any event. Gamma International is a large international company with an established reputation in supplying governments around the world. No evidence was put before me to suggest that it would not cooperate with regulatory investigations in an entirely proper manner. No consideration was apparently given by HMRC as to whether Gamma International was the sort of company who would take steps to suppress or conceal information. The problem with forewarning suspects only normally arises where a suspect is thereby enabled to suppress or conceal information or otherwise act in a manner which risks jeopardising an investigation. However, in the present case BIS had already informed Privacy International that Gamma International had been in contact with it as of June 2012 and BIS was prepared to inform the Claimant of a range of matters which, prima facie, were inculpatory and relevant to the Claimant’s complaint: See the facts set out at paragraphs [9]-[12] above. (ii) Reputation 124. In this case the HMRC treated as a sufficient generic reason to withhold information that it could impact upon the reputation of individuals or companies. To adopt this stance was unlawful. The mere fact that there might be some reputational impact could be a matter to be placed in the weighing scales but it would be exceptional that it could ever be the trumping consideration. Even if there is some reputational harm Judgment Approved by the court for handing down. Privacy International v HMRC that still has to be balanced against other interests, including the public interest in transparency and disclosure. 125. In Ingenious Media some of the disseminations made by the Permanent Secretary were of a highly subjective and personal nature about the individuals concerned. In relation to the Second Claimant, Mr McKenna, the Permanent Secretary described him as: “a vain man, he is a former Deloitte partner, he’s a clever guy, he’s made a fortune, he’s a banker and all of that but actually he’s a big risk for us so we would like to recover lots of tax relief that he’s generated for himself and other people. Are we winning? I would say beginning to…”. The Permanent Secretary also made the following observation which was anything but flattering about the Claimants: “I think we’ll clean up on film schemes over the next few years. You may end up laughing at that statement because maybe we’ll lose it in the courts, litigation’s a hell a of a risk, but you won’t find anybody here at all, even the most pro- wealthy people, and I’m not sure we’ve got any, who thinks film schemes are anything other than scams for scumbags”. 126. 127. 128. 129. Information was in this way disseminated to journalists which, self-evidently, risked impacting negatively upon the reputation of the two Claimants. Yet HMRC rigorously defended these disseminations upon public interest grounds downplaying issues as to reputation. Reputation apparently attracted nominal, if any, weight in the weighing exercise which HMRC was concerned with in that particular case. This illustrates both how and why reputation is by no means a show stopper. In R (Corner House Research) v Director of the Serious Fraud Office [2008] UKHL 60; [2009] 1 AC 756 (analysed at paragraphs 142 et seq below) disclosure of information undoubtedly adversely affected the reputation of BAE but this was not argued as having material relevance. In Kennedy (ibid) the reputation of Mr George Galloway MP was also very much at the heart of the debate; but the fact that disclosure might harm his reputation did not warrant or attract any material sympathy. It is also of some significance that in many other regulatory regimes, regulators routinely announce the existence of investigations into particular companies or individuals. This is, of course, normal in the case of criminal investigations. The provision of information about an investigation into a named person or company is, frequently, accompanied by a warning that the mere fact of an investigation (or even an arrest) does not mean that the person or company in question is necessarily in breach of the relevant law. In this case HMRC has not, considered whether in relation to Gamma International specifically, there is any sensible possible reputational issue arising. This particular case is now in the public domain. It is already an issue of some public significance. BIS has confirmed to Privacy International a good deal of information about Gamma International. Prima facie, it is hard to see how or why reputational issues are of any Judgment Approved by the court for handing down. Privacy International v HMRC great materiality. When BIS wrote to the Claimant about Gamma International there was no suggestion that the Claimant could not use that information as it saw fit, irrespective of whether that harmed the reputation of the company. 130. Yet again this is something HMRC will have to address when the matter is remitted. 131. (iii) Confidentiality of information Two issues arise here. First, there is the question of non-disclosure of specific items of information said to be confidential. Secondly, there is the question whether the simple fact of an investigation should be treated as confidential and kept secret because to disclose even that fact could adversely affect the business prospects of the company concerned abroad and in due course undermine confidence in the system. The broader question of disclosure to enhance confidence in the system also arises in this case as a relevant and discrete mater and is addressed below (See Section G below). To date it has only been suggested in the most abstract of ways that confidentiality issues could arise in responding to the requests for information made by the complainant. The Decision letter was not based upon the risk of disclosing confidential information or upon the impact of such disclosures on confidence in the system. The subsequent explanation by Mr Hathaway was couched in the most general of terms. No evidence has been put before the Court to suggest that there is any real or specific issue about confidence in this particular case and indeed BIS disclosed to Privacy International inculpatory information about Gamma International’s position. BIS did not impose any restriction upon how the information it disclosed could be re-disseminated. The high water mark of the Defendant’s argument sought to link confidentiality with reputational harm and confidence in the system of export control and was designed to lead to the conclusion that even the very fact of an investigation should be kept secret. HMRC submitted: - - - - A decision not to prosecute involved a third party (the subject of the investigation) with legitimate interests in the confidentiality of its affairs and in the protection of its reputation; Reputational damage could be serious for an exporter for whom the mere suspicion of breach of export control could result in blacklisting by foreign governments in major export markets As such there was a risk, the extent of which would vary from case to case, that disclosure by HMRC of the fact of an investigation could cause such commercial or reputational damage that public confidence in HMRC's enforcement of tax or export control rules was reduced. In such cases, HMRC was required to take account of that risk in determining whether or not disclosure was made for the purpose of its functions and could not disclose where it reasonably concluded that disclosure would on balance harm its ability to discharge its functions. The simple fact of an investigation could therefore be confidential. This Judgment Approved by the court for handing down. Privacy International v HMRC - extended even to the fact that an investigation had terminated and there would be no prosecution. A complainant's right of access to a court to challenge a no further action (“NFA”) decision was in tension with other important principles and interests, and Parliament has dealt with that tension in terms that leave no room for the Claimant's submission that HMRC must take the approach that informing the complainant outweighs every other consideration short of a serious threat to life. The tenor of HMRCs submission is that in the field of export control concerns about exporter’s economic interests and reputation may be viewed as weighing very heavily, or possibly decisively, in the evaluative scales and that therefore it was necessary to treat even the fact of an investigation as confidential. In the absence of facts against which the submission can be measured it is not possible to express other than some broad observations about this position. First, I note that HMRC accepts that each case must be viewed on its own facts; which is correct. Secondly, in principle I accept that there may be circumstances beyond a threat to life which might justify not providing a NFA decision and/or reasons. Thirdly, the case of R (Corner House Research) v Director of the Serious Fraud Office [2008] UKHL 60 suggests that these might be limited (see paragraphs [148] – [154] below for analysis) and puts into context the argument that the simple fact of an investigation should be treated as confidential because it might have negative repercussions on the export prospects of a company. Fourthly, at first blush the asserted link between making disclosure of the fact of an investigation and a risk to confidence in the system seems tenuous. It is hard to see why the fact that a company is being investigated for alleged breach of expert controls is materially different to an investigation into say alleged corruption or bribery where the SFO routinely announces whether it is opening an investigation and sometimes provide summaries about the facts of a case. Fifthly, this issue is at its most acute in the case of a decision to close an investigation (and hence not to report it to the CPS for them to decide whether to charge and prosecute the suspect). If the CPS decides to prosecute then the matter falls into the public domain and justice is performed in public. If, however, the decision is not taken to report to the CPS then HMRC has not explained why this should be confidential and would risk harming confidence in the system if that fact were disclosed. If it is a good decision then disclosure should enhance confidence in the rigour and objectivity of HMRC’s investigative processes. If, however, it is a flawed and bad decision then a person with a proper locus should not be denied an opportunity to seek judicial review. Finally, and more generally, it is important to stress that even in investigations where confidentiality arises not every item of information about a complainant or about an investigation will be confidential. Even if some items are confidential this does not prevent HMRC disclosing other non-confidential information. And it is very far from clear that the information actually sought in this case will affect confidentially at all. This is exactly the approach that BIS adopted. It provided such information as it was able; and withheld the other parts which it concluded were confidential: See paragraph [12] above. G. Factors relevant to the exercise of discretion II: Securing cooperation and confidence in the system. Judgment Approved by the court for handing down. Privacy International v HMRC 132. I turn now to consider more generally the issue of confidence in the system of export control. Because of the manner in which HMRC sought to link this issue to confidentiality I have addressed this in part in relation to the specific question of confidentiality (see above). However, it is of wider significance as Mr Peretz acknowledged in argument. There is no doubt but that one relevant consideration which might guide disclosure is the need to maintain confidence in the system of export control. This is necessary because HMRC must not only encourage complainants who are more likely to assist if they are confident in the HMRC responding appropriately to complaints, but they must also encourage cooperation with those subject to the regulatory regime from whom cooperation is to be expected. This is therefore a consideration which cuts both ways. In written argument submitted after the oral hearing Mr Peretz made the following point about confidence: “HMRC accept in principle, by analogy with the reasoning set out by Sales J in Ingenious Media, that the maintenance of public confidence in the system of export control assists their ability, under CEMA as applied by article 41 of the ECO, to investigate allegations of potential infringements of export control rules: if such confidence were undermined, such investigations could be hindered, for example because public co-operation was withheld from HMRC. As a result, disclosure that assists in maintaining such public confidence is capable of falling within article 43(2)(a) of the ECO or section 18(2)(a) of the CRCA. However, as HMRC have maintained consistently in evidence to the Public Accounts Committee, effective tax collection depends on individuals and businesses believing that information that HMRC hold in connection with their functions will be appropriately protected. The same point applies in relation to export control. So a particular disclosure that increased confidence in the system of export control but, in HMRC's assessment in the circumstances of the case, had the wider and more serious impact of undermining confidence that HMRC would keep sensitive information confidential, would not - overall - benefit HMRC's ability to investigate alleged infringements of any matter for which they are responsible: such a disclosure would not, therefore, fall within section 18(2) (a) of the CRCA or article 43(2)(a) of the ECO. As canvassed in oral argument, a number of other factors may also be relevant to that assessment, in any particular case”. 133. There are a number of points to make. First, HMRC recognises that public confidence must reside not only in those subject to the system but also in third parties who might be able to assist HMRC in performing its function (such as complainants). I agree. Secondly, in relation to tax collection it is important that those who submit information must be confident that the information will remain confidential. As a general proposition this also should be uncontroversial but if it is being relied upon as a generic justification for non-disclosure in all cases it may go too far. Thirdly, it is suggested that this same consideration applies to export control. If HMRC’s Judgment Approved by the court for handing down. Privacy International v HMRC submission here is that because it can argue that it is permissible always or invariably to withhold information in the tax arena that the same can be applied, mutatis mutandis, to the export control arena, then I disagree. It is by no means clear that the considerations that apply to tax cases necessarily apply in the same way to export control. There is far less reliance upon individual companies or persons being required to disgorge highly sensitive financial or personal data in the export control area. And HMRC has extensive powers to compel the production of information under section 77A CEMA 1979 (see paragraphs [40] and [41] above) backed by criminal sanction so that voluntary cooperation, whilst desirable, is not essential. In the present case the system (and I simplify) operates upon the basis of the exporter determining whether its product falls within the lists of products subject to control and then obtaining the necessary export clearances. I have no doubt that there may well be technical assessments which HMRC must make of products in order to determine whether they are dual use, for instance and they will need to receive information about sales destinations etc. There may be information which HMRC relies upon which assists them in monitoring sales to overseas prohibited destinations. A variety of sensitive information might arise. In general terms I am sceptical that a stance adopted in relation to tax can simply be translated, without more, to the system of export controls. 134. What does this add up to? It ultimately means that HMRC must examine each case on its merits. It must not start with the preconception that nothing can be disclosed for generic and abstract policy reasons. A decision to disclose may not be a binary “yes” / “no” decision; the right answer might frequently be a partial “yes”. So for example if the request is simply for an update in an investigation it might be possible to answer this in a helpful way without disclosing any confidential information and thereby undermining confidence. 135. In short maintaining confidence in the system is a relevant consideration but, as with other factors, it needs to be assessed on a case by case basis and the countervailing importance of disclosure cannot be viewed as of nominal weight as case law demonstrates. H. Factors relevant to the exercise of discretion III: The right to a No Further Action (“NFA”) decision and reasons (1) The issue 136. I turn now to a separate issue which concerns the right to communication of the decision taken whether to prosecute or not. The Claimant submits that if either actually or constructively (ie HMRC deciding to allow the file to lie fallow without it being closed) HMRC has terminated the case and thereby, in effect, rejected the complaint then it is entitled in law to know this. The basis for the argument, as it evolved in the course of the hearing, is put in three different ways: i. First that as a matter of common law (taking due account of Article 6 of the European Convention on Human Rights) in principle a person in the position of Dr Shehabi or Mr Kersmo (and indeed the Claimant) has a right to challenge by way of judicial review a decision not to prosecute. If, in the exercise of its powers, HMRC could routinely refuse to inform a complainant as to the outcome of the complaint then that right to apply for judicial review would be Judgment Approved by the court for handing down. Privacy International v HMRC rendered nugatory. The result would offend the right to access to a court recognised under the common law and under Article 6 of the Convention. ii. Secondly, it is contended that qua “victim” under the relevant EU legislation on victims rights a person has a right to both general information about investigations and also a reasoned decision if there is to be no prosecution. Hence, HMRC (and/or the CPS once it has assumed responsibility for deciding whether to prosecute) is under a duty to provide information; there being no power not to do so. iii. Thirdly, pursuant to Article 10 of the European Convention on Human Rights the Claimant is entitled to receive and/or be provided with information and in so far as section 18 CRCA is deployed to restrict the communication of this information it is, prima facie, in violation of Article 10(1) and would have to be justified under Article 10(2) (which it cannot be on the facts of this case, as set out in the Decision letter). So far as the present facts are concerned HMRC has not indicated what stage its investigation has in fact reached. The update statement (see paragraph [27] above) gave nothing away whatsoever. The CPS is responsible for prosecuting violations of criminal law for which HMRC is statutorily responsible. Decisions to prosecute, or not, are hence taken by the CPS. However, that is not to say that a file might not be closed by HMRC without it ever being placed before a CPS prosecutor and if the CPS decides not to prosecute a HMRC case, clearly that will be known to HMRC. In the present case, because of the dearth of information, it is therefore at least theoretically possible that the file has already been closed. Indeed, the Claimant speculated that because nothing visible has happened in approaching 2 years HMRC had been subject to behind the scenes pressure to close the file from either the company concerned, or a foreign government, or even other governmental agencies within the United Kingdom and, as such, it should be compelled to explain its position and if a decision to close the file had been taken it should be communicated to the Claimant along with the reasons therefor. I emphasise that the Claimant’s position is speculation. There is no evidence before me supporting that speculation. For his part Mr Peretz, on behalf of HMRC, was at pains to emphasise that it strongly valued its independence and was culturally resistant to external pressures (economic or otherwise) – it was not to be “nobbled”. He explicitly accepted that HMRC expected to be accountable to the courts and that this was, in its view, an important component of maintaining public confidence in the system of tax collection and export controls that HMRC was responsible for. Further, he accepted that being accountable to the courts was important in deterring breaches of the law. Put another way: being seen to be accountable to the courts reinforced its position of independence from improper external pressure. Nonetheless, HMRC has been unforthcoming in providing any form of clarification as to the position in this case. 137. 138. 139. 140. In response to a (hypothetical) question from me as to what HMRC’s position would be were it to unearth serious or embarrassing errors on its own part, Mr Peretz acknowledged that, in such a case, being accountable to a court was important to maintaining long term confidence in HMRC and in demonstrating its willingness to Judgment Approved by the court for handing down. Privacy International v HMRC learn from its mistakes. He accepted that it would not inspire confidence in HMRC if it were seen to attempt to hide mistakes or conceal errors. If there was error Mr Peretz stated that there would then be “powerful arguments” in favour of disclosure. On the other side of the balance he emphasised that HMRC had a broad discretion in the evaluative exercise to be conducted under section 18 CRCA. He gave, by way of illustration only, cases where it might be proper to withhold information because to do otherwise would expose a difficulty or lacuna in legislation which could then stimulate a proliferation of tax avoidance schemes. In the present circumstances I cannot wholly exclude the possibility that there are highly unusual complications to this case which HMRC properly wishes to conceal, at least at the present time. I have therefore limited my analysis to disputes between the parties which relate to the relevance and importance of the factors which HMRC will have to take into consideration when the decision is retaken and which flowed out of the unlawful Decision letter. I am not in a position to apply those criteria to the facts. It will be for HMRC subsequently to evaluate these considerations in the context of the facts as they present themselves at the time of the reconsideration. (2) The position in common law The starting point is the common law right to challenge NFA decisions. I use the expression “NFA” to include all decisions in substance not to progress a complaint and this would include actual or constructive decisions not to proceed. The right of access to a court has long been established as a right in the very forefront of constitutional rights: see eg the cases cited at Clayton & Tomlinson, “The Law of Human Rights” (2nd edition), paragraph 11.44. An aspect of access to a court is the right to know that the adverse decision (to be challenged) has in fact been taken. Two well-known authorities provide an indication as to the importance attached to the common law right to be informed of adverse decisions. These are: R v SSHD ex parte Anufrijeva [2003] UKHL 36 (“Anufrijeva”); and, R (Corner House Research) v Director of the Serious Fraud Office [2008] UKHL 60; [2009] 1 AC 756 (“Corner House”). The judgment in Anufrijeva concerned the practice of the Home Office to take decisions in asylum cases which were recorded only on internal files and to then rely upon that internal, and non-notified, decision to justify the withdraw of income support benefits to the failed asylum seeker. Lord Steyn (with whom Lord Hoffmann, Lord Millet and Lord Scott agreed) was scathing of an approach pursuant to which non-disclosure of the decision to the affected person was routine. He stated: 141. 142. 143. 144. “24 … In oral argument before the House counsel stated that the Secretary of State did not condone delay in notification of a decision on asylum. These were weasel words. There was no unintended lapse. The practice of not notifying asylum seekers of the fact of withdrawal of income support was consistently and deliberately adopted. There simply is no rational explanation for such a policy. Having abandoned this practice the Secretary of State still seeks to justify it as lawful. It provides a peep into contemporary standards of public Judgment Approved by the court for handing down. Privacy International v HMRC administration. Transparency is not its hallmark. It is not an encouraging picture. 25. The Court of Appeal observed about the interpretation of the regulation (para 30): ". . . once an asylum seeker knows that her application has been refused, and that she is not to be given leave to enter the country on any other basis, and has the reasons for those decisions, she can reasonably be expected to make a choice: either to accept the decision and leave or to stay and fight but without recourse to state benefits. But she cannot reasonably be expected to make that choice before she knows of the decisions and the reasons for them. There is nothing in the material before us to suggest that it is consistent with the declared purpose of the regulation to expect her to do so." I would respectfully endorse this observation. 26. The arguments for the Home Secretary ignore fundamental principles of our law. Notice of a decision is required before it can have the character of a determination with legal effect because the individual concerned must be in a position to challenge the decision in the courts if he or she wishes to do so. This is not a technical rule. It is simply an application of the right of access to justice. That is a fundamental and constitutional principle of our legal system: Raymond v Honey [1983] 1 AC 1, 10G per Lord Wilberforce; R v Secretary of State for the Home Department, Ex p Leech, [1994] QB 198, 209D; R v Secretary of State for the Home Department, Ex p Simms [2000] 2 AC 115. 27. What then is the relevance of this dimension for the present case? The answer is provided by Lord Hoffmann's elegant explanation of the principle of legality in the Simms case. He said, at p 131 E-G: "Parliamentary sovereignty means that Parliament can, if it chooses, legislate contrary to fundamental principles of human rights. The Human Rights Act 1998 will not detract from this power. The constraints upon its exercise by Parliament are ultimately political, not legal. But the principle of legality means that Parliament must squarely confront what it is doing and accept the political cost. Fundamental rights cannot be overridden by general or ambiguous words. This is because there is too great a risk that the full implications of their unqualified meaning may have passed unnoticed in the democratic process. In the Judgment Approved by the court for handing down. Privacy International v HMRC absence of express language or necessary implication to the contrary, the courts therefore presume that even the most general words were intended to be subject to the basic rights of the individual. In this way the courts of the United Kingdom, though acknowledging the sovereignty of Parliament, apply principles of constitutionality little different from those which exist in countries where the power of the legislature is expressly limited by a constitutional document". This principle may find its primary application in respect of cases under the European Convention on Human Rights. But the Convention is not an exhaustive statement of fundamental rights under our system of law. Lord Hoffmann's dictum applies to fundamental rights beyond the four corners of the Convention. It is engaged in the present case. 28. This view is reinforced by the constitutional principle requiring the rule of law to be observed. That principle too requires that a constitutional state must accord to individuals the right to know of a decision before their rights can be adversely affected. The antithesis of such a state was described by Kafka: a state where the rights of individuals are overridden by hole in the corner decisions or knocks on doors in the early hours. That is not our system. I accept, of course, that there must be exceptions to this approach, notably in the criminal field, e.g. arrests and search warrants, where notification is not possible. But it is difficult to visualise a rational argument which could even arguably justify putting the present case in the exceptional category. If this analysis is right, it also engages the principle of construction explained by Lord Hoffmann in Simms.” 145. This judgment articulates a powerful right of access to justice and makes clear that obstacles placed in the way of the exercise of such an important and fundamental right will be scrutinised with care by the Courts. The core objection in that case was to a policy where decisions which affected a citizen could be kept secret. There were however two possible limitations to the right of access which might be relevant to the present case. First, on the facts of the case the practice of failing to notify a decision was in relation to persons who were directly affected by decisions which resulted in loss of income support. Secondly, it was recognised (cf paragraph 28) that the obligation to notify a decision might not be absolute. I now consider how these two caveats might operate in the context of export controls operated by HMRC. 146. As to the first, in the present case there is a right on the part of persons with proper locus to seek judicial review of decisions of prosecutorial authorities not to prosecute. That is a very different type of right to the financial right to income support of the failed asylum seeker in Anufrijeva but it is a right nonetheless and an undeniably important right. Case law has repeatedly emphasised that the decision to prosecute (or not) will be quashed only exceptionally. However, there is a consistent body of case law which shows that if the decision to prosecute is seriously flawed it will Judgment Approved by the court for handing down. Privacy International v HMRC nonetheless be set aside: eg where serious evidence has been overlooked (eg R (on the application of Joseph) v DPP [2001] Crim LR 489); where the decision has been taken pursuant to an unlawful policy (R v DPP ex parte C [1995] 1 Cr. ARP R 136); or where the decision was arrived at as a consequence of fraud, corruption or bad faith (R v DPP ex parte Kebilene [2000] 2 AC 362). 147. The right in principle to seek judicial review becomes essentially academic in the absence of a decision notifying the interested person of the outcome of a complaint. CPS guidance on judicial review of prosecutorial decisions (2009) recognises the existence of the right and its concomitant, the importance of providing proper reasons: “It is essential to ensure that the reasons for decisions, and in particular public interest considerations giving rise to decisions, are documented. This record can be used if necessary, to demonstrate that the decision to prosecute was taken only a full and proper review of the case, Interested parties could also be informed of the reasons for decisions”. 148. Corner House is one example of a pressure group exercising its right to challenge a highly sensitive decision not to prosecute. The claimants in Corner House were Corner House Research and Campaign Against the Arms Trade and had locus to challenge the decision not to prosecute. HMRC accepted in these proceedings that Privacy International had locus to seek judicial review of its decision and it has also acknowledged in post-hearing written submissions that persons in the position of Dr Shehabi and Mr Kersmo would, equally, have locus. This acceptance was correct: in my view Dr Shehabi and Mr Kersmo, who are both much closer to the “action” than is Privacy International, would have locus to challenge a decision not to prosecute. Whether that claim would succeed is of course an entirely different matter. But the issue here is whether they have a right because, if so, then for that right to be rendered nugatory by a refusal to inform risks falling foul of the constitutional right of access to a court. Accordingly, the difference in the interest of the applicant in Anufrijeva and the interests of the Claimant and the activists in the present case is one of form not substance. The first limitation in Anufrijeva does not apply in this case. 149. As to the second limitation referred to in paragraph [145] above, in my view there may be occasions where a decision not to notify a person affected by a complaint of the outcome might be justifiable. An indication of both the strength of the duty to notify NFA decision but also of the possibility of exceptions is found in Corner House. In 2004 the Director of the SFO commenced an investigation into allegations of corruption against BAE. One aspect of the investigation concerned an arms contract between the Government and the Kingdom of Saudi Arabia for which BAE was the main contractor. During the investigation BAE represented to the SFO that disclosure of information required by a statutory notice served upon it would adversely affect relations between the UK and Saudi Arabia and jeopardise the arms contract. Following a variety of communications and meetings the Director of the SFO concluded that he had a duty to pursue the investigation. Subsequently an explicit threat was made by the Saudi authorities that if the investigations continued Saudi Arabia would withdraw from the existing bilateral counter-terrorism cooperation arrangements with the UK, withdraw cooperation from the UK in relation to its strategic objectives in the Middle East and end the negotiations then in train for the procurement of Typhoon aircraft. In the light of this the Director of the SFO Judgment Approved by the court for handing down. Privacy International v HMRC decided that the investigation should be discontinued. In arriving at this decision, the Director obtained the advice of the Attorney General and a so-called “Shawcross” exercise was conducted pursuant to which the Attorney General sought the views of certain ministers. Having taken advice the Director concluded that continuing with the investigation would risk serious harm to UK national and international security. He decided therefore that the most controversial aspects of the investigation should be discontinued. Importantly he announced his decision in a press release the same day which stated: “The Director of the Serious Fraud Office has decided to discontinue the investigation into the affairs of BAE Systems plc as far as they related to the Al Yamamah defence contract with the Government of Saudi Arabia. The decision has been taken following representations that had been made both to the Attorney General and the Director of the SFO concerning the need to safeguard national and international security. It has been necessary to balance the need to maintain the rule of law against the wider public interest. No weight has been given to commercial interest or to the national economic interest”. 150. The Attorney General also made a statement in Parliament the same day. He referred to the strong public interest in upholding and enforcing the criminal law, in particular against international corruption, and also to the views of the Prime Minister and Foreign and Defence Secretaries as to the public interest considerations raised by the investigation. They had, he explained to Parliament: “… expressed the clear view that continuation of the investigation would cause serious damage to UK/Saudi security, intelligence and diplomatic cooperation which is likely to have seriously negative consequences for the United Kingdom public interest in terms of both national security and our highest priority foreign policy in the Middle East. The heads of our security and intelligence agencies and our ambassador to Saudi Arabia shared this assessment”. 151. It is notable that in Corner House the Director of the SFO felt it important to confirm publically that private and public commercial interests and the wider national economic interest were not treated as sufficient grounds to justify non-prosecution and these were expressly disavowed when giving reason for not proceeding with the prosecution. In the Divisional Court, in a judgment delivered by Lord Justice Moses, there was consideration of a variety of illustrations, hypothetical and otherwise, which it was contended might justify a decision not to prosecute. One such example concerned the case of Leila Khalid in 1970. She was a member of the Palestine Liberation Organisation and had been in custody following her attempt to highjack an aeroplane. The PLO threatened to kill Swiss and German hostages unless she was released. The Attorney General at the time accepted the advice the prosecution would increase the danger to the lives of those hostages and ordered her release. Lord Justice Moses (ibid page 784 paragraphs [80]-[82]) acknowledged that the law recognised the defence of duress and in some circumstances a justification of necessity. However, he concluded that to preserve the integrity and independence of the exercise of independent judgement demanded of the Director of the SFO necessitated resistance Judgment Approved by the court for handing down. Privacy International v HMRC to the pressure exerted by means of a specific threat. He concluded that the court had a responsibility to secure the rule of law and that the Director of the SFO had failed to satisfy the court that he had done all that could reasonably be done to resist the threats. 152. On appeal the House of Lords disagreed with this assessment. Lord Bingham pointed out that it was accepted that the decisions of the Director were not immune from the review of the courts but authority showed that it would be in only exceptional cases the court would interfere with decisions of the independent prosecutor and investigator: See per Lord Bingham paragraph [30]. He proceeded to state that the discretion conferred upon the Director was not unfettered: “He must seek to exercise his powers to promote the statutory purpose for which he has given them. He must direct himself correctly in law. He must act lawfully. He must do his best to exercise an objective judgement on the relevant material available to him. He must exercise his powers in good faith, uninfluenced by any ulterior motive, predilection or prejudice. In the present case, the claimants have not sought to impugn the Director’s good faith and honesty in any way”. 153. With specific regard to the external pressures imposed upon the Director, and his decision to discontinue with the prosecution, Lord Bingham concluded that the Director acted lawfully: “35. The evidence makes plain that the decision to discontinue the investigation was taken with extreme reluctance. As the Director put it in his second witness statement: ‘11. Investigation of prosecution of serious crime is a major public interest that the SFO exists to promote. My job is to investigate and prosecute crime. The Al Yamamah investigation was a major investigation. The idea of discontinuing the investigation went against my every instinct as a prosecutor…’ The Attorney General on 13 December 2006 was said to be “extremely unhappy” the implications of dropping the investigation at that stage. What determined the decision was the Director’s judgment that public interest in saving British lives outweighed the public interest in pursuing BAE to conviction. It was a courageous decision, since the Director could have avoided making it by disingenuously adopting the Attorney General’s view (with which he did not agree) that the case was evidentially weak. Had he anticipated the same consequences and made the same decision in the absence of an explicit Saudi threat it would seem the Divisional Court would have upheld the decision, since it regarded the threat as “the essential point” in the case”. Judgment Approved by the court for handing down. Privacy International v HMRC 154. The judgment in Corner House was not concerned with the logically, a priori, issue whether the decision to drop the prosecution could be kept secret. It was concerned with the substantive legality of the decision itself. It was not however said that the decision to discontinue was a secret or was to be treated as such simply because it was premised upon highly controversial and sensitive issues, including of a security nature. Indeed, following a very lengthy and anxious scrutiny of the facts by the law officers and ministers, both the Director of the SFO and the Attorney General made public statements announcing the decision and setting out succinct reasons for it. The judgment is not therefore support for the proposition that a NFA decision should not be promulgated and communicated to a complainant even in difficult and sensitive cases. 155. An extension of the reasoning in Corner House might however indicate that a decision not to even issue an NFA decision could be justified, for example if a third party threatened that it would kill hostages if a prosecution proceeded and if the fact of discontinuance were to be made public. I am not suggesting that it will always take facts which are as extreme as those referred to above to warrant a decision not to notify the NFA decision. But the case law does suggest that there would need to be some fairly unusual circumstances to warrant such a decision. 156. It is right to record that the Council Directive also alludes to possible limitations upon the provision of information in recital 28: See paragraph [108] above. Curiously, there is no express corresponding caveat in the body of the Directive itself. The nearest that one finds to a substantive reflection of recital 28 is in Article 4(2) which is in relation to the right of victims to receive information of a broad category (and which does not include NFA information). It relates primarily to the post-charge, prosecution, stage of a case. Article 4(2) provides: “The extent or detail of information referred to in paragraph 1 may vary depending on the specific needs and personal circumstances of the victim and the type or nature of the crime. Additional details may also be provided at later stages depending on the needs of the victim and the relevant, at each stage of the proceedings, of such details”. 157. There is however no reference in Article 4(2) to security or other considerations, as set out in recital 28. 158. A further caveat to the obligation to provide information, of greater possible relevance to the case, is found in Article 6(3). I have set this out at paragraph [164] below. In that provision the obligation to provide a NFA decision (in respect of a decision not to proceed with or bring to a close an investigation or not to prosecute an offender) appears to excuse the decision maker from providing reasons which are “confidential”. However nothing in Article 6 permits the decision maker to refrain for issuing the NFA decision itself. 159. In the course of oral argument both Mr Squires and Mr Peretz sought to find words which could encapsulate or describe the extent of the obligation on the HMRC to provide a reasoned decision. HMRC was reluctant to explore, as a hypothetical exercise, the scope of the exceptions. The Claimant wished to narrow the non- disclosure daylight to the maximum degree. Mr Squires suggested that it would be Judgment Approved by the court for handing down. Privacy International v HMRC “wholly exceptional” not to provide such a decision. Mr Peretz cavilled at both “exceptional” and “wholly”. He was prepared to go so far as to say that there is a “strong argument for informing people of a NFA decision as a means of maintaining confidence in the system”. He accepted that disclosure is a “key part of securing accessibility to a court and this is critical to confidence” in the HMRC and its functions. He also accepted that the argument in favour of disclosure was “pretty powerful”. Ultimately I am not convinced that attempts to attach a descriptive label add anything to the law. There is common ground as to the importance of the right of access to a court and the fact that in the absence of the provision of a reasoned NFA decision the right may be rendered nugatory. There was common ground that there may be exceptions to the obligation. In my view the case law largely speaks for itself and is not embellished by adjectival glosses. There is a further matter which warrants brief mention. There was debate as to whether, in an organisation which deals with a vast number of complaints (predominantly in relation to tax) annually, the HMRC should have to respond to every frivolous or vexatious complaint made to it with a NFA decision. I can see the force of HMRC’s point. I am cautious however in addressing matters which do not form part of the factual matrix in the present case. Here the complaints made are concerned with export controls not tax, and are serious and credible and supported with evidence. I am cautious about expressing a view about whether a species of de minimis rule applies in relation to export control because there was no evidence before the Court as to the scale or nature of the issue and there may be room for real divergence of views as to what is a frivolous and vexatious case. Finally, in my view a decision not to issue a decision is, in my view a decisional act which is in principle capable of being subjected to judicial review. A decision maker cannot get around an obligation to provide a NFA decision by simply leaving a file dormant and unattended. See the references to the judgments of the Supreme Court in Kennedy: per Lord Toulson (with whom Lords Neuberger and Clarke agreed) at paragraphs [126]-[128] and [132] and Lord Sumption at paragraph [157]. In short, at common law there are cogent reasons in favour of decisions not to prosecute being notified to affected persons together with reasons and this would apply to the activists whose cases are before HMRC at present. I am not in this judgment addressing the position of the CPS. But many cases may be closed without a CPS review; so the issue is very far from being academic. (3) The position under the Framework Decision and the Council Directive I have already addressed these measures in the context of defining a “victim” at paragraphs [82]-[105] above. I can therefore deal briefly with the specific sub-issue of access to NFA decisions. On the basis of the Framework Decision and the Council Directive if a person is properly to be categorised as a “victim” then that person prima facie has a right to a NFA decision together with reasons under the terms of EU law. This is to facilitate a right of review. 160. 161. 162. 163. 164. Article 6 of the Council Directive provides: “Right to receive information about their case Judgment Approved by the court for handing down. Privacy International v HMRC 1. Member States shall ensure that victims are notified without unnecessary delay of their right to receive the following information about the criminal proceedings instituted as a result of the complaint with regard to a criminal offence suffered by the victim and that, upon request, they receive such information: (a) any decision not to proceed with or to end an investigation or not to prosecute the offender; (b) the time and place of the trial, and the nature of the charges against the offender. 2. Member States shall ensure that, in accordance with their role in the relevant criminal justice system, victims are notified without unnecessary delay of their right to receive the following information about the criminal proceedings instituted as a result of the complaint with regard to a criminal offence suffered by them and that, upon request, they receive such information: (a) any final judgment in a trial; (b) information enabling the victim to know about the state of the criminal proceedings, unless in exceptional cases the proper handling of the case may be adversely affected by such notification. 3. Information provided for under paragraph 1(a) and paragraph 2(a) shall include reasons or a brief summary of reasons for the decision concerned, except in the case of a jury decision or a decision where the reasons are confidential in which cases the reasons are not provided as a matter of national law”. 165. Article 6 thus compels disclosure without unnecessary delay of NFA decisions. This is not a power to disclose; it is a duty (hence the opening phrase in Article 6: “Member States shall ensure…”) subject to two caveats. The first caveat is under Article 6(2)(b) which permits, in exceptional circumstances, information to be withheld where to disclose may adversely affect the “proper handling” of a case. The second caveat arises under Article 6(3) provide exceptions from the duty to give reasons where these reasons are confidential. But this applies to reasons for the decision not to the substantive NFA decision itself. In this jurisdiction if an unreasoned, negative, NFA decision was communicated and challenged the Court would nonetheless have sufficient power to determine the legality and admissibility of the actual reasoning. 166. In the present case HMRC, in the Decision letter and subsequently, did not address itself to whether Dr Shehabi or Mr Kersmo were “victims” and hence acquired rights under EU law. The analysis which occurred in Court about this issue was essentially in a vacuum. HMRC will have to address this in far greater detail when the decision is retaken. That analysis will necessarily involve addressing the arguments raised by Judgment Approved by the court for handing down. Privacy International v HMRC Privacy International in its complaint to the MPS. It is however beyond the scope of this judgment to express a conclusion upon that issue. Although it was referred to as important context and factual background in this case, it was not the subject of sufficiently detailed argument for me to form any clear view either way. (4) Article 10 ECHR 167. The third and final basis upon which the Claimant seeks to justify the disclosure of information is Article 10 of the Convention. This provides: “Article 10 – Freedom of expression 1. Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. This article shall not prevent States from requiring the licensing of broadcasting, television or cinema enterprises. 2. The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary”. 168. Mr Squires submitted that Article 10 was sufficiently broad to embrace the receipt of information from public authorities. In particular he submitted that it was capable of being engaged in two different ways. First, it imposed upon public authorities an obligation to provide information to third parties. Secondly, it embraced the situation whereby the State interfered with the ability of another state entity to provide information (that it wished to provide) to third parties. 169. As to the first argument Mr Squires was forced to concede in the light of the Supreme Court judgment in Kennedy (ibid) that the first route was not open to him. In that case the Court endorsed the prior ruling of the Court of Appeal that Article 10 did not impose a positive “freedom of information” obligation upon public authorities to provide access to documents held by the authority and which the authority did not wish to disclose (ibid per Lord Mance at [57]-[99] esp. [90]-[96]; per Lord Toulson [144]-[148] and Lord Sumption at [154]; Lords Neuberger and Clarke agreed with Lords Mance, Toulson and Sumption). This coincided with Mr Peretz’s submission and I agree that this line of argument is not at present open to the Court to adopt. I do not need to address it further. 170. As to the second argument Mr Squires cited Leander v Sweden (1987) 9 EHRR 433 at paragraph [74] where the Court stated: Judgment Approved by the court for handing down. Privacy International v HMRC “The Court observes that the right to freedom to receive information basically prohibits a Government from restricting a person from receiving information that others wish or my be willing to impact to him, Article 10 does not, in circumstances such as those of the present case confer on the individual a right of case to a register containing information on his personal position, nor does it embody an obligation on the Government to impart such information to the individual”. (Emphasis added) 171. The principle so described involves a restriction imposed upon “others” by the “Government” limiting the ability to disseminate information. The Court of Appeal in Kennedy [2012] 1 WLR 3524 described a “… well-established line of decisions of the [ECtHR] that it is an infringement of article 10 for a state to restrict a person from receiving information that others wish or may wish to impart to that person” (ibid paragraph[13]). That line of authority, which stretches back to Leander v Sweden (ibid), was not questioned in the Supreme Court. 172. In his skeleton argument Mr Squires submitted: “The Claimant is not seeking access to documents that HMRC holds. It simply wishes to be informed by HMRC whether an investigation is taking place and if not why not. HMRC’s position is that even if it would be desirable for it to provide that information, and it would wish to impart it, it is prohibited from doing so by CRCA 2005 s 18. The case therefore falls squarely within the …. “well established “ principle referred to in Kennedy and Leander, namely that a restriction on receiving information which others may wish to impart engages Art 10”. 173. The “others” in the quotation from Kennedy, it is argued, include HMRC which is restricted by Government, via section 18 CRCA 2005, from imparting information that HMRC might otherwise wish to impart. Mr Squires argued by way of illustration and elaboration of this point that it was inconceivable that the Strasbourg Court would find that the following hypothetical situation fell outside of the scope of Article 10(1): State X introduces legislation which prohibits teachers, who are state employees, from teaching that the earth was round. He submitted that here the State would be interfering with the right of teachers (the “others”) to impart information to pupils and the right of pupils to receive information. He did not say that this would necessarily involve a violation of Article 10 but only that such a restriction was capable in principle of falling within Article 10(1) (even though this was in one sense the state restricting itself) and would therefore have to be justified under Article 10(2). 174. It was accepted that there was no authority that was precisely on point. Mr Peretz submitted that Article 10(1) did not in principle apply to a case such as the present since the “others” referred to are intended to catch only private parties. Article 10(1) was, he submitted, concerned with interference imposed by the state on disseminations as between private parties, not with restriction intra-state. Judgment Approved by the court for handing down. Privacy International v HMRC 175. 176. The Claimant’s argument about Article 10 was advanced in the light of the Decision letter which took a black and white approach to disclosure. However, given the development in the Defendant’s case much of the force of the point falls away. HMRC no longer says that section 18 is a bar upon acting in a way that it might wish to. HMRC submits that it has a discretion which it must exercise in a proper way. Accordingly, a central factual premise underlying the Claimant’s argument falls away. It is not necessary for me to decide this point because in view of the findings I have made earlier about the scope of section 18 and HMRCs recognition that it has the right to disseminate information under that section, there would only be daylight between section 18 and Article 10 if properly interpreted section 18 imposed limitations upon HMRCs ability to disclose information which left material daylight with Article 10. In my view the common law principles which govern the operation of section 18 are capable of addressing the situation adequately. For reasons I have set out above I consider that the common law provides a comprehensive set of principles which are capable of striking the balance and I cannot identify any real daylight between the common law as it applies to section 18 and Article 10. 177. Having said this I would add one observation about an aspect of the dispute between Mr Squires and Mr Peretz concerning the scope of Article 10(1) which concerns whether Article 10 applies at all to a situation whereby Government restricts another arm of the State from disclosing information. In my view the key to the point lies in identifying the “state” (as in the quotation from Leander v Sweden) or “public authority (to use the language from Article 10(1) itself). The point can be tested by using Mr Squires teacher example. If the teacher is the “state” or a “public authority” then any restriction imposed upon that teacher by the Government is an intra-“state” interference and the State is not restricting how some “other” person can impart information. If however the teacher is not the “state” or a “public authority” (simply by virtue of being employed by the State) then the State is imposing a restriction upon some “other” person (the teacher) as to how he or she should be allowed impart knowledge and learning to pupils, and this could in principle fall within Article 10(1). Although there is no authority directly on point under Article 10 there is another principle which provides some possible illumination. The Strasbourg Court has in the context of admissibility addressed the jurisdiction ratione personae of the Convention. For the Convention to apply at all there has to be some alleged violation by a Contracting State, or infringing conduct which is some way can be attributed to the State. In the Court’s “Practical Guide to Admissibility Criteria” (2011) (“the Admissibility Guide”) paragraph 151 the Court states: “Compatibility ratione personae requires the alleged violation of the Convention to have been committed by a Contracting State or to be in some away attributable to it”. 178. For the purposes of establishing jurisdiction the Court must therefore be satisfied that the defendant is a “State”. In this regard it has been held, for instance, that not every State-owned company amounts to the “State”. If it enjoys sufficient institutional and operational independence from the State then the latter will be absolved from responsibility under the Convention for the State owned company’s acts and omissions: See the authorities cited in the Admissibility Guide at paragraph [154]. If one applies a test of “sufficiency of institutional and operational independence” to the teacher illustration then it is quite possible to argue that the teacher is sufficiently Judgment Approved by the court for handing down. Privacy International v HMRC distant from the “State” to be treated as severable from the State and that the State is not therefore responsible for the teachers conduct. This would suggest that the teacher is an “other” to use the Article 10 rubric from Leander and Kennedy. However, the same conclusion might well not apply if the test were applied to HMRC. Although HMRC has some statutory autonomy it is nonetheless at the very epicentre of the “State” and a serious argument can be advanced therefore that it is non-severable from the rest of the State. If this be right then a restriction imposed upon HMRC in relation to disclosure is not a restriction imposed by the State upon an “other”. 179. At the end of the day this is not a matter I feel it is sensible to express a definitive view upon. Given the marked change in HMRCs position the practical relevance of the point has largely fallen away. In my view it suffices to conclude in relation to Article 10 that, as in Kennedy, it is essentially otiose. The case should be resolved principally upon the basis of common law and/or (to the extent it applies) EU law. I. The invitation to invite the HMRC to issue Guidelines 180. Mr Squires parting shot in this case was to invite me to invite or require the HMRC to issue guidelines. He submitted that the overall perception which arose from this case and from Ingenious Media, was that HMRC’s position was developed in a reactive way and that given the ever growing acknowledgement of the need for transparent government there was a real need for HMRC to address itself in a deliberate manner to the issue of disclosure and then to make public its position in the form of guidance. 181. Mr Peretz, very politely, said that were I to make such an invitation HMRC would “consider” it. He certainly did not consider that I should require HMRC to provide guidance. 182. In fact the Court does have the power in some circumstances to make such an order. In R (Purdy) v DPP [2009] UKHL 45, [2010] 1 AC 345 the House of Lords considered the law relating to euthanasia. Their Lordships ultimately allowed an appeal and made as part of their order a requirement that the DPP produce guidelines on the criteria that would be applied to prosecutions in such cases. Lord Hope stated as follows: “54. The Code will normally provide sufficient guidance to Crown Prosecutors and to the public as to how decisions should or are likely to be taken whether or not, in a given case, it will be in the public interest to prosecute. This is a valuable safeguard for the vulnerable, as it enables the prosecutor to take into account the whole background of the case. In most cases its application will ensure predictability and consistency of decision-taking, and people will know where they stand. But that cannot be said of cases where the offence in contemplation is aiding or abetting the suicide of a person who is terminally ill or severely and incurably disabled, who wishes to be helped to travel to a country where assisted suicide is lawful and who, having the capacity to take such a decision, does so freely and with a full understanding of the consequences. There is already an obvious gulf between what section 2(1) says and the way Judgment Approved by the court for handing down. Privacy International v HMRC that the subsection is being applied in practice in compassionate cases of that kind. 55. The cases that have been referred to the Director are few, but they will undoubtedly grow in number. Decisions in this area of the law are, of course, highly sensitive to the facts of each case. They are also likely to be controversial. But I would not regard these as reasons for excusing the Director from the obligation to clarify what his position is as to the factors that he regards as relevant for and against prosecution in this very special and carefully defined class of case. How he goes about this task must be a matter for him, as also must be the ultimate decision as to whether or not to prosecute. But, as the definition which I have given may show, it ought to be possible to confine the class that requires special treatment to a very narrow band of cases with the result that the Code will continue to apply to all those cases that fall outside it. 56. I would therefore allow the appeal and require the Director to promulgate an offence-specific policy identifying the facts and circumstances which he will take into account in deciding, in a case such as that which Ms Purdy’s case exemplifies, whether or not to consent to a prosecution under section 2(1) of the 1961 Act”. 183. Lord Phillips endorsed the result, viz., that the DPP should be “required” to issue guidelines (paragraph [1]), as did Lady Hale (paragraph [69]), Lord Brown (paragraph [88]) and Lord Neuberger (paragraph [106]). 184. I have decided to decline the invitation, even to proffer an invitation. 185. I can see that there might be practical benefit in the provision of guidance. The present case does convey the impression that HMRC lacks a consistent and considered position in this area and that its policy has been dictated more by the exigencies, course and speed of litigation than by premeditation. However, there have only been two cases which have grappled with this issue: the present case and Ingenious Media in different areas of HMRCs work. This is not an especially solid platform upon which to intervene. Furthermore, HMRC will probably have to consult with the CPS and their views on the issues arising are not before the Court. This, in my view, is a matter for HMRC to consider for itself without, certainly at this stage, external interference. J. Conclusion 186. For all of the above reasons this application for judicial review succeeds. The Decision of the Defendant is quashed and it is remitted to the Defendant to be re- taken. 70