JUDICIAL DATA PROTECTION PANEL

JUDICIAL DATA PROCESSING COMPLAINTS

HANDLING POLICY

Version 2 May 2020: Review date May 2021

1. Introduction

The Judicial Data Protection Panel (Panel) was established in May 2018. This policy sets out the
standards and procedures it will apply when dealing with complaints concerning the processing of
personal data by the courts, tribunals and individuals acting in a judicial capacity.

The Panel is supported by the Judicial Office, an Office of the Ministry of Justice, staffed by civil
servants who provide support to the Judiciary of England and Wales. The Judicial Office, and
particularly the Judicial Office Data Privacy Officer, support the Panel in considering and responding
to complaints submitted to the Panel.

2. Application

The Panel has jurisdiction to consider complaints concerning the following courts and tribunals (Courts
and Tribunals in Scope)

• the Court of Appeal in England and Wales;

• the High Court in England and Wales;
• the Crown Court;
• the Court of Protection;
• the Family Court;
• the County Court in England and Wales;
• Magistrates’ courts;
• the Upper Tribunal;
• the First-tier Tribunal;
• the Employment Appeal Tribunal;
• the Employment Tribunal;
• Coroner’s courts;
• Judge Advocates-General;
• the Investigatory Powers Tribunal

It also has jurisdiction to deal with complaints concerning individuals acting in a judicial capacity in the
Courts and Tribunals in Scope i.e., judges, Tribunal members, jurors, justices’ clerks and members of
Her Majesty’s Courts and Tribunal Service authorised to exercise judicial functions.

Version 2 May 2020: Review date May 2021

3. Complaints that can be dealt with by the Panel

The Panel can deal with two types of complaints:

(i) Complaints over which the Panel has exclusive jurisdiction

There are two categories of complaint over which the Panel has exclusive jurisdiction.
‘Exclusive jurisdiction’ means that these categories of complaint cannot be referred to the
Information Commissioner’s Office (ICO). That is because of the limit placed on the ICO’s
supervisory powers by article 55(3) of the General Data Protection Regulation (GDPR) and
section 117 of the Data Protection Act 2018 (DPA 2018).

• The first category of complaints is those concerning the processing of personal data
by the Courts and Tribunals in Scope 1 when they are acting judicially.

• The second category of complaints is those concerning the processing of personal

data by individuals when they are acting in a judicial capacity.

The most common types of situation where a court, tribunal or individual will be acting in
a judicial capacity are when they are making judicial decisions in respect of legal
proceedings such as giving case management directions, making court orders, hearing
proceedings, writing or handing down judgments or orders.

(ii) Complaints over which the Panel does not have jurisdiction

These are complaints concerning the processing of personal data by individual judicial
office holders (judges and tribunal members) in the course of their appointment when
they are not acting in a judicial capacity. These complaints may be raised with the ICO.
The Panel can, however, seek to investigate and try to resolve any such complaints before
a formal complaint is made to the ICO.

1
See 2 above.

Version 2 May 2020: Review date May 2021

These types of complaint may arise when a data subject has sought to exercise their rights in relation
to personal data processed by a court, tribunal or a judge, tribunal member or individual and the
request has been refused or rejected. They may arise when a data subject has, for instance:

• asked for confirmation that their personal data has been processed;
• asked for access to a copy of their personal data;
• informed the court, tribunal or judge or other individual exercising judicial functions
that they have withdrawn their consent to process their personal data;
• asked for their personal data to be corrected (rectified), erased or for restrictions to
be placed on how it is processed;
• challenged or objected to their personal data being processed;
• objected to their personal data being used in automated decision-making or profiling;
• asked for their personal data to be transferred to a third party in a structured,
commonly used and machine-readable format (in certain circumstances).

4. Complaints that cannot be dealt with by the Panel

The Panel cannot deal with complaints concerning

• the Freedom of Information Act 2000

• the processing of the personal data by courts or tribunals when they are not acting
in a judicial capacity.

If your complaint concerns either of these matters you should contact Her Majesty’s Courts and
Tribunals Service who may be able to consider your complaint. You may also contact the Information
Commissioner at: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF. Further information on the protection of data can also be found on the Information
Commissioner’s Office website https://ico.org.uk/for-organisations/guide-to-data-protection

5. Complaints that are not capable of rectification by the Panel

There are two types of data subject request that are often made to, and refused by, courts, tribunals
and individuals.

Version 2 May 2020: Review date May 2021

 • The first is that a copy of personal data processed by a court, tribunal or individual acting in a
judicial capacity be provided to the individual whose personal data it is. The basis on which
such requests are made is the right of access under article 15 GDPR or section 45 DPA 2018.
Such information is typically contained in judicial notes, notebooks, or electronic documents.

• The second is that a judgment or court order that contains personal data be corrected because
it is said to contain incorrect personal data. The basis on which these requests are made is the
right to rectification contained in article 16 GDPR or section 46 DPA 2018.

In both situations the personal data will have been processed by a court, tribunal and judge acting in
a judicial capacity. Parliament has decided that personal data processed in these situations is exempt
from the right of access and from the right of rectification provided for by the GDPR. The exemption
is set out in article 23(1)(f) GDPR and section 15(2)(b) and Schedule 2, part 2, para.6; Schedule 2, part
2, para.14(2) DPA 2018. The reason for the exemption is to secure the constitutional principles of
judicial independence and of the rule of law.

Similarly, if these rights are exercised under sections 45 or 46 DPA 2018 they are restricted. The right
of access is restricted by section 45(4) DPA 2018 and the right to rectification by section 48(3) DPA
2018.

Accordingly, a court, tribunal or individual that has processed such personal data whilst acting in a
judicial capacity can properly refuse to provide access to or a copy of such data and refuse to correct
such data under data protection law.

Where a complaint is made to the Panel concerning a refusal to provide access to or a copy of such
personal data or to correct it, it will not be investigated as the refusal will be within the scope of the
statutory exemptions.

6. What to do if you are unsure whether to raise your complaint with the Panel

If you are unsure whether a complaint should be referred to either the Panel or the Information
Commissioner, you can contact either and they will be able to advise you.

Version 2 May 2020: Review date May 2021

7. Submitting your complaint

You should submit your complaint in writing. The complaint should contain the following information:

• Your name and contact details;

• If you are complaining on behalf of someone else, such as a relative: their details; details of
your relationship with them; and, signed confirmation you have their permission or the
authority to act for them;
• the nature of the complaint and any documents relating to the complaint; and
• if the complaint concerns a data subject request that you have previously made about data
processing by a court, tribunal or individual acting in a judicial capacity, details of that request
and the response to it.

You should submit your request either by email to: Judicial Data Protection Panel at
JODataPrivacyOfficer@judiciary.uk.

You may also submit it in writing to: Judicial Data Protection Panel, C/O Judicial Office Data Privacy
Officer, Judicial Office, 11th floor Thomas More Building, Royal Courts of Justice, Strand London, WC2A
2LL.

8. Receipt and Verification of Complaints

Upon receipt your complaint will be referred to the Judicial Office Data Privacy Officer who, on behalf
of the Panel, will:

• log receipt of the complaint and give it a case reference number;

• acknowledge receipt, indicating a timescale within which you will be given a substantive
response;
• establish whether the complaint is a valid one, i.e., one that comes within the Panel’s remit;
and

Version 2 May 2020: Review date May 2021

 • if necessary, seek further information from you to clarify the nature of the complaint or to
verify your identity or your authority to complain on behalf of someone else.

9. Investigating and Responding to Complaints

The Panel aims to provide substantive responses within 30 days of receipt of a complaint. Where this
is not possible it will let you know and provide you with an estimate time within which you can expect
to receive a substantive response.

The Judicial Data Privacy Officer will determine whether they or another member of the Judicial Office
will investigate your complaint. Depending on the nature of the complaint, the Judicial Office Data
Privacy Officer, who is authorised to act on behalf of the Panel, may decide the outcome of your
complaint. Complex complaints will be referred to a member of the Panel for investigation and
decision.

The Panel has no direct powers to impose sanctions. If your complaint is upheld and raises matters of
sufficient concern it will be referred to the Senior Presiding Judge or relevant Chamber President and
the Judicial Conduct Investigations Office. The Panel’s conclusions will in any event be passed to the
Court, Tribunal or individual it concerns.

A copy of the substantive response to your complaint will be kept on file for the Panel by the Judicial
Office for six years following the conclusion of the complaint.

10. Privacy Policy

Your complaint and the response to it will be processed consistently with the Judicial Office’s Data
Protection Policy and data protection law. Information on how the Judicial Office, on behalf of the
Panel, processes personal data concerning your complaint is contained in the Judicial Office’s Privacy
Notice, which can be obtained from JODataPrivacyOfficer@judiciary.uk or by writing to: Judicial Data
Protection Panel, C/O Judicial Office Data Privacy Officer, Judicial Office, 11th floor Thomas More
Building, Royal Courts of Justice, Strand London, WC2A 2LL.

Version 2 May 2020: Review date May 2021