Cooper v National Crime Agency

Factual and Procedural Background

These appeals arise from the dismissal of the Appellant by the Respondent, a law enforcement agency succeeding a former organisation. The Appellant was employed initially as an intelligence officer and later as a continuous improvement officer. The dismissal followed an incident outside a public house in which the Appellant was arrested and charged with being drunk and disorderly and assault on a police officer. The Respondent dismissed the Appellant on grounds of serious breach of its Code of Conduct.

The first appeal challenges a decision of the Employment Appeal Tribunal ("EAT") which partly dismissed and partly allowed the Appellant's appeal against an Employment Tribunal ("ET") decision dismissing his unfair dismissal claim. The EAT remitted the case to the ET for further consideration on a specific procedural point, which the Respondent cross-appeals.

The second appeal arises from a County Court judgment dismissing the Appellant's claim against the Respondent for unlawful processing of sensitive personal data under the Data Protection Act 1998 ("DPA"). The claim concerned the Respondent's use of materials received from a police force relating to the incident. The County Court held that the Respondent had lawful justifications for processing the data under the DPA.

The background includes the Appellant's prior service in the Royal Navy, his employment contract with the Respondent, which imposed obligations to maintain high professional standards and comply with policies including disciplinary and data protection provisions, and the statutory and policy framework governing the Respondent's disciplinary procedures and data handling. The incident on 7 April 2012 involved the Appellant's behaviour leading to arrest and charges. The Respondent investigated using materials provided by the police, conducted disciplinary proceedings, and dismissed the Appellant for gross misconduct. The Appellant appealed internally, then brought claims in the ET and County Court.

Legal Issues Presented

1. Whether the Employment Tribunal properly considered the Appellant's claim under the Data Protection Act in the context of his unfair dismissal claim.
2. Whether it was fair and reasonable for the Respondent to proceed with disciplinary proceedings before the conclusion of the criminal proceedings against the Appellant, especially given the risk of information-sharing between the Respondent and the police.
3. Whether the Respondent lawfully processed the Appellant's sensitive personal data under the Data Protection Act 1998, including compliance with the first and second data protection principles and relevant statutory conditions.
4. Whether the Respondent's disclosure of the Appellant's personal data back to the police breached the Data Protection Act.
5. Whether the County Court judge erred in his findings on causation between the alleged breaches of the Data Protection Act and the Appellant's claimed losses.

Arguments of the Parties

Appellant's Arguments

• The Respondent breached the Data Protection Act by improperly receiving and using sensitive personal data provided by the police without consent or lawful justification.
• The disciplinary proceedings were unfair because they proceeded while the Appellant was unwell and before the criminal proceedings concluded, risking prejudice due to information-sharing between the Respondent and the police.
• The Respondent unlawfully disclosed the Appellant's personal data back to the police during the disciplinary process.
• The County Court erred in its interpretation and application of the first and second data protection principles, and in its causation analysis.

Respondent's Arguments

• The Respondent was entitled and legally required to investigate the incident, and its processing of the Appellant's personal data was justified under multiple conditions in Schedules 2 and 3 of the Data Protection Act, including consent given in the employment contract and compliance with statutory obligations.
• The disciplinary proceedings were fair and within a reasonable range of responses, and the refusal to postpone them pending the criminal trial was justified.
• The Respondent's information-sharing with the police was routine, lawful, and required by policy and statute, and did not breach the Data Protection Act.
• The County Court's findings on causation were correct; even without the disputed data, the Respondent would have proceeded with disciplinary action based on other available information.

Table of Precedents Cited

Precedent	Rule or Principle Cited For	Application by the Court
Harris v Courage (Eastern) Ltd [1982] ICR 530, CA	Reasonableness of employer proceeding with disciplinary action despite ongoing criminal proceedings	The Employment Tribunal applied this authority to hold that whether it is reasonable to proceed depends on the facts; dismissal can be fair even if criminal proceedings are pending.
Laverty v Police Service for Northern Ireland [2015] NICA 75	Lawfulness of processing personal data of police officers for disciplinary purposes under the DPA	The court found the processing justified and lawful under relevant DPA conditions; this case was closely analogous and supported the Respondent's position.
Hussain v Sandwell Metropolitan Borough Council [2017] EWHC 1641	Interpretation of "necessary" in the Data Protection Act conditions as reasonable necessity	The County Court followed this approach, adopting a proportionality test rather than strict necessity.
Corporate Officer of the House of Commons v Information Commissioner [2008] EWHC 1084 (Admin)	Meaning of "necessary" in data protection context; proportionality and margin of appreciation	Supported the interpretation of necessity as reasonable necessity with proportionality.
South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55	Clarification that "necessary" means reasonably necessary and part of proportionality test in data protection law	The court adopted this interpretation and applied it to the facts, rejecting a strict interpretation.
R (Commissioner of Police of the Metropolis) v Independent Police Complaints Commission [2015] EWCA Civ 1248	Public interest in maintaining confidence in police disciplinary procedures	Supported the view that disciplinary functions exercised by the Respondent were functions of a public nature in the public interest.

Court's Reasoning and Analysis

The court analysed the interplay between the employment contract, statutory provisions, and the Data Protection Act in the context of the disciplinary proceedings and data processing. It emphasised the Respondent's legitimate interest in maintaining high standards of conduct among its staff, both on and off duty, to promote public confidence and security.

The court accepted that the Respondent was entitled to process the Appellant's sensitive personal data received from the police for purposes of investigation and disciplinary proceedings. This processing was justified under multiple conditions in Schedules 2 and 3 of the DPA, including explicit consent given by the Appellant in his employment contract, necessity for performance of the contract, compliance with legal obligations, exercise of statutory functions, and legitimate interests pursued by the Respondent.

The court applied a reasonable necessity standard to the interpretation of statutory conditions, following established case law. It rejected the Appellant's narrower interpretation of consent and found that the employment contract clearly contemplated processing of personal data supplied by third parties such as the police.

Regarding the fairness of the disciplinary process, the court found that the Respondent acted within a range of reasonable responses by proceeding with disciplinary hearings before the conclusion of criminal proceedings, taking into account the Appellant's conduct and the need to avoid undue delay. The court acknowledged the risk of information-sharing between the Respondent and the police but found no error in the original tribunal's assessment of this issue, except for a procedural concern that led to remitting part of the case for further consideration.

On the Data Protection Act claims, the court held that the Respondent was the relevant data controller and that the second data protection principle applies to the Respondent's purposes, not the original purposes of the police. The court rejected the Appellant's claim that the Respondent's disclosure of data back to the police breached the DPA, noting the lack of particularised pleading and the statutory and policy basis for such disclosures.

Finally, the court upheld the County Court's causation findings, agreeing that the Respondent would have proceeded with disciplinary action regardless of the disputed data processing because the Appellant had self-reported and other evidence would have been obtained.

Holding and Implications

The court's final decision was to DISPOSE OF the Appellant's appeals against the Employment Appeal Tribunal and County Court judgments, and to dismiss the Respondent's cross-appeal against the remittal order by the Employment Appeal Tribunal.

The direct effect is that the Appellant's claim for unfair dismissal remains subject to further consideration on the limited procedural point remitted to the Employment Tribunal. The Respondent's processing of the Appellant's sensitive personal data in disciplinary proceedings was lawful under the Data Protection Act, and the disciplinary and appeal panels acted within a reasonable range of responses. No new legal precedent was established beyond the application of existing principles to the facts of this case.