High Court dismisses prisoner's claim for information citing lack of locus standi and complex GDPR scope issues.

[2020] IEHC 158 THE HIGH COURT 2018 No. 1099 JR BETWEEN BRANDON CROSBIE APPLICANT

– AND – THE GOVERNOR OF MOUNTJOY PRISON RESPONDENT JUDGMENT of Ms. Justice Niamh Hyland delivered on the 13th day of March 2020

Introduction

1. The applicant was a prisoner in Mountjoy Prison (the “Prison”) in December 2018. Due to an incident on 18 December 2018, he was transferred to what is referred to by the applicant as a “padded cell”, by the respondent as a “close supervision cell” and by Rule

64 of the Prison Rules, 2007 (S.I. 252 of 2007) (“Prison Rules”) as a “special observation cell”. For the purposes of this judgment I will refer to it as a special observation cell. The applicant was held in this cell from 18.45 on 18 December 2018 until 11.00 on 23 December 2018 under Rule 64 of the Prison Rules.

2. The applicant’s mother was informed by the respondent that her son was in a special observation cell. She requested reasons for this transfer and was apparently informed she could not be told of same although there is no affidavit from her to that effect or any material exhibited to substantiate this account. She phoned Mr. Collier, solicitor, to tell him this on 22 December 2018. Mr. Collier telephoned the Prison that day and requested reasons for the transfer of the applicant to a special observation cell.

3. Mr. Collier was informed by a staff member at the Prison that this information could not be given to him due to GDPR constraints. Mr. Collier informed the staff member that this was a misinterpretation of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”) [2016] OJ L 119/1 and that the applicant’s family and solicitor were entitled to information concerning his personal welfare.

4. Mr. Collier wrote to the respondent via email on 22 December 2018 at 14.43 in the following terms:

“Dear Governor,

I confirm that I act for Brandon Crosbie, I revived [sic] a call this afternoon from his mother who is concerned to be informed by the prison that Brandon is in a padded cell. She requested reasons for this and was informed that she could not be told.

I telephoned the prison and a staff member stated that details cannot be conveyed given GDPR constrains. I advised the staff member that this is a misinterpretation of GDPR and that a family member and a prisoners [sic] solicitor are absolutely entitled to information concerning a prisoners [sic] personal welfare.

Ms Crosbie can be contacted at [phone number given]. I would be obliged if you would State [sic] your position in relation to the release of personal information concerning the welfare of Brandon Crosbie.

In order not to take you short in any way it is my view that a failure to disclose this information is an over reach by the Prison and if the information is not disclosed, I will make an application to the high court this weekend for an emergency judicial review.

Yours sincerely

Tony Collier”

5. The respondent replied to Mr. Collier through a Ms. Boshell PHEO of the Prison Service some seven minutes later at 15.00, in the following terms:

“Good afternoon

Your correspondence has been passed on to Prison Management as requested, and as advised by telephone conversation 22/12/18 non-disclosure of sensitive information due to an inability to confirm an individual over the phone enforces the GDPR process so to protect the named prisoner.

The prisoners [sic] safety and family members [sic] worries are of great concern to the Prison Service and the Governor on duty will take your enquiry as a matter of urgency.

Regards

Barbara Boshell PHEO”

6. On the same day, Mr. Collier subsequently phoned the respondent and spoke to a Chief Byrne who informed Mr. Collier that he would not give him information relating to the applicant due to GDPR constraints. Mr. Collier said that this was a misinterpretation of GDPR. Chief Byrne agreed to respond to Mr. Collier prior to 20.00 on 22 December 2018.

This did not occur. The applicant’s mother later informed Mr. Collier that she had not received any communication from the respondent. Again there was no affidavit evidence in this respect, or indeed in any respect, from the applicant’s mother.

7. Mr. Collier wrote to the respondent via email on 22 December 2018 at 17.40 acknowledging the reply from Ms. Boshell as follows:

“Dear Sirs, We acknowledge receipt of your reply and note that at the time of this email we have not received a substantive reply concerning the reason why Brandon Crosbie has been placed in a padded cell.

We also provided a telephone number for Brandon’s mother and she confirms that she has not yet received a call despite you being provided with the number at 3pm today.

Unfortunately a follow up call to Chief Byrne, was unfruitful. He informs that the staff member I was dealing with earlier is no longer on duty. This is obviously very unsatisfactory.

To be clear, the reliance on GDPR by the IPS in this situation is erroneous and the failure of the IPS to provide details concerning Brandon’s placement in a padded cell is wholly inadequate.

As discussed on the phone, we have instructions from Brandon’s mother to seek the intervention of the high court if the requested information is not provided by 8pm tonight.

Yours sincerely,

Tony Collier”

8. On 23 December 2018, the applicant was transferred from the special observation cell to the challenging behavioural unit at 11:00. The applicant attempted to ring Mr. Collier on

23 December 2018 and 24 December 2018 without success. Assistant Governor Flynn attempted to phone the applicant’s mother three times on the 24 December 2018 without success.

9. Assistant Governor Flynn wrote to Mr. Collier via email on 24 December 2018 at 12.34 informing Mr. Collier of these efforts to make contact with the applicant’s mother. This email was not responded to by Mr. Collier although it appears there is some question mark as to whether Mr. Collier received this email or not.

10. Mr. Collier then sought leave to bring judicial review proceedings ex parte on 24 December 2018 and obtained some but not all of the reliefs sought. Following the grant of ex parte leave (described below) on 24 December 2018, Mr. Collier and the applicant spoke via telephone on 27 December 2018 at 12.20. A visit between the applicant and his mother was facilitated between 11.00-11.30 on the 28 December 2018.

11. The applicant only swore an affidavit verifying the Statement of Grounds on 11 January 2019 and there is no evidence indicating that he was aware of the leave application on 24 December 2018 or that he authorised same.

12. In summary, at the time the ex parte leave application was made before Pilkington J. on

24 December 2018: a. the applicant’s solicitor had not made a request to visit the applicant at the Prison;

b. the applicant’s solicitor had not provided any signed authorisation from the applicant permitting the provision of the information about the applicant to his solicitor;

c. the applicant’s solicitor had not provided evidence of his identity to the respondent;

d. Assistant Governor Paul Flynn had made three unsuccessful attempts to contact the applicant’s mother;

e. an email had been sent to Mr. Collier informing him of the attempts to contact the applicant’s mother (although as I noted previously there is some question mark as to whether he received same);

f. the applicant was no longer in the special observation cell (having been moved at 11:00 on 23 December 2018);

g. the applicant had made a call (or attempted call) to Mr. Collier on the evening of 23 December 2018 (lasting 23 seconds);

h. the applicant had made a call (or attempted call) to Mr. Collier on the morning of the 24 December 2018 (lasting 28 seconds); and i. the applicant had also been allowed to make a private phone call (despite his P.19 sanction) on the 24 December. He utilised this phone call to call his girlfriend.

Order Granting Leave and Course of Proceedings

13. By Order of Pilkington J. the applicant was refused leave for certain reliefs but was granted leave to apply, inter alia, for the following reliefs:

2. an order of mandamus compelling the respondent to inform the applicant’s solicitor of reasons for the applicant being subject to confinement in a special observation cell and of the proposed duration of the same; and

6. a Declaration that the provisions of the GDPR and of implementing legislation in the State do not prevent the respondent from informing the applicant’s solicitor of the reasons for the applicant being subjected to confinement in a special observation cell and of the proposed duration of the same.

14. Following the (limited) grant of leave, a return date was set for 27 December 2018. The Assistant Governor of Mountjoy Prison, Paul Flynn, swore an affidavit on 8 January 2019 and a Statement of Opposition was filed on 11 January 2019.

15. A verifying affidavit was sworn by the applicant on 11 January 2019 whereby he simply verified that the Statement of Grounds insofar as it related to his own actions was true and that he believed that part of it relating to other persons was true. No other evidence was provided by the applicant in these proceedings. It was served on the respondent on 3 July 2019. No explanation was provided for this delay in service. More substantively, the applicant has at no stage in these proceedings given his account of the events of late December, including whether he understands why he was detained or for what period, why he did not inquire as to same while in the special observation cell, whether he wishes to challenge his detention and if so, on what grounds, or whether he believes his rights were infringed and if so, how.

16. Mr. Stephen Kelly, the data protection administrator of the Irish Prison Service, swore an affidavit on 11 October 2019 setting out the data protection policies of the Irish Prison Service. He exhibited a direction given to all prison staff on 25 May 2018 – the date upon which the GDPR came into force throughout the European Union - regarding the disclosure of personal information to prisoners and avers that a notice to that effect to all visitors was posted in the waiting areas of the Prison. This was headed up “Important Notice to all Visitors” and stated, inter alia:

“Please note that from 25th May 2018, no personal information relating to a person in custody can be provided by Irish Prison Service staff to any individuals, be they family, friends, partners, next of kin or any other third party.

…

In the event the information being requested is urgent, it is advised that you contact the prisoner’s solicitor who can deal with the request with the written permission of the prisoner involved.”

17. Mr. Kelly also exhibited a further notice entitled “Important Notice to all Solicitors”

referring to the coming into effect of the GDPR and stating, inter alia:

“Please note that from 25 May 2018, no personal information relating to a person in custody can be provided by Irish Prison Service to a member of the legal profession unless a signed consent form from your client has been provided by you/your firm to the Irish Prison Service.

While we appreciate that this may pose difficulties, as this is a legal obligation on the Irish Prison Service, this provision will be implemented without exception.”

18. Finally, Mr. Kelly exhibited an email of 20 June 2018 identifying that the “Important Notice to all Solicitors” referred to above was being replaced with a “Revised Notice to all Solicitors” which provided as follows:

“The Irish Prison Service has reviewed its procedures and will now issue copies of client’s warrants and charge sheets on receipt of a written request from the solicitor concerned.

All other information requires the signed consent of the prisoner.”

19. A supplemental affidavit was sworn by Mr. Flynn on 10 October 2019 providing some considerable detail about the assault by the applicant on another prisoner on 18 December 2018, his placement in the special observation cell, his time in that cell, his transfer into the challenging behavioural unit on 23 December 2018 and the attempts by Mr. Flynn to contact the applicant’s mother.

20. Unusually, no replying affidavit was filed by Mr. Crosbie in response to any of the three affidavits filed on behalf of the respondent. I must therefore treat the evidence contained therein as uncontroverted.

21. The matter came on for hearing on 28 January 2020.

The Applicant’s Arguments

22. The core of applicant’s case is that there was an unlawful refusal to provide his solicitor with the information requested, with the consequence that he could not challenge, in a timely fashion, the legality of the Governor’s direction to transfer the applicant to the special observation cell. It is asserted that this failure had the potential to interfere with the applicant’s constitutional right of access to justice, one of the unenumerated rights under Article 40.3 of the Constitution. According to this argument, the fact that the applicant himself might have been aware of the reasons for the transfer was insufficient to vindicate his rights, as he might not identify breaches in the way his lawyer could.

Therefore, the only effective way for the applicant to have his constitutional rights vindicated was for the respondent to provide his legal representatives with the information sought. I observe that this argument is made in circumstances where, as noted above, there is no substantive affidavit from the applicant, there was no request by the applicant to have such information furnished to his solicitor, there is no evidence he was aware of the institution of the proceedings on 24 December 2018 and there is no explanation from him as to how his rights have been breached.

23. The applicant focuses heavily on the reason for the refusal to provide the information, i.e.

that GDPR did not permit the provision of same. He asserts that the GDPR does not apply in this case as the factual matrix is outside the scope of the GDPR having regard to Article 2(2) of the GDPR.

24. Article 2(2) of the GDPR provides that the Regulation does not apply to the processing of personal data:

(a) in the course of an activity which falls outside the scope of Union law;

…

(d) by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security”

25. The applicant says that the respondent did not invoke any of the provisions of the Data Protection Act 2018 (“Act of 2018”). He separately submits that the Act mandates the provision of information sought by the applicant’s solicitor. The applicant relies on s.41 of the Act of 2018 which sets out the requirements for the processing of personal data for purposes other than the purpose for which the data is collected. Permissible purposes include those collected for the purposes set out in paragraph (a) or (b) of s.47, being:

“The processing of special categories of personal data shall be lawful where the processing—

(a) is necessary for the purposes of providing or obtaining legal advice or for the purposes of, or in connection with, legal claims, prospective legal claims, legal proceedings or prospective legal proceedings, or

(b) is otherwise necessary for the purposes of establishing, exercising or defending legal rights”.

Section 2 defines “special categories of personal data”, other than in Part 5, as being:

(a) personal data revealing—

(i) the racial or ethnic origin of the data subject,

(ii) the political opinions or the religious or philosophical beliefs of the data subject, or

(iii) whether the data subject is a member of a trade union,

(b) genetic data,

(c) biometric data for the purposes of uniquely identifying an individual,

(d) data concerning health, or

(e) personal data concerning an individual’s sex life or sexual orientation.

26. The applicant did not identify why the data or information sought by his solicitor fell into any of these special categories. The information sought in respect of the reasons for detention and the proposed duration of same do not prima facie appear to fall into any of the special categories.

27. Moreover, there is an inherent contradiction in the applicant’s arguments in this respect.

On the one hand he asserts that the GDPR does not apply: on the other he seeks to invoke ss. 41 and 47 of the Act of 2018, both of which implement the GDPR. If the former assertion is correct, he cannot invoke those sections. On the other hand, if he seeks to invoke those sections, then he must accept the GDPR applies to his situation.

The Respondent’s Arguments

28. The respondent argues that the applicant has no locus standi to bring the within proceedings, being issued by his solicitor in the absence of any instructions, complaint or authority from the applicant. It further pleads that the application for an order of mandamus is moot and was moot when leave was sought on 24 December 2018 given that the applicant was no longer in the special observation cell and that the applicant, at all material times, knew the reasons for his placement in the cell and could have informed his solicitor of the reason for same. At latest, Mr. Collier became aware of these reasons on 27 December 2018 when he and the applicant had a phone call.

29. The respondent also argues that the applicant has not demonstrated that any of his interests have been adversely affected by the matters complained of and that the order of mandamus relating to the disclosure of information to Mr. Collier does not relate directly to the applicant himself. The respondent argues that a question arises as to whether this case affects the applicant at all, as no evidence has been put forward that the applicant’s rights or entitlements were affected.

30. In relation to the request for a declaration that the GDPR and Data Protection Act 2018 do not prevent the respondent from informing the applicant’s solicitor of the reasons for the applicant being held in the special observation cell, the respondent argues that the applicant does not have locus standi to seek that declaration, and that the issue does not arise on the facts of the present case. It is further submitted that the respondent was required to follow the data protection policy of the Department of Justice as referred to in the affidavit of Mr. Kelly and that this policy is a fair and proportionate response.

31. In respect of the criticism that the respondent wrongly relied upon the GDPR to justify a refusal of information, the respondent notes the applicant has not pointed to any provision which expressly provides for an absolute entitlement to the applicant’s personal information. The respondent maintains that the Irish Prison Service falls within the scope of the GDPR, noting that the transfer of the applicant to the special observation cell was an internal operational prison matter which could not be understood as referring to the execution of “criminal penalties” within the meaning of Article 2(2)(d) of the GDPR.

Accordingly, it processes data as a data controller.

32. The respondent also submits that the Irish Prison Service takes seriously its commitment to ensure the secure gathering, processing, disclosure and retention of personal data, given the acutely sensitive and personal information it holds about prisoners and does not disclose it to unauthorised third parties or to those whose identify has not been confirmed. The prison staff have been made aware that personal information of prisoners cannot be disclosed unless (a) the identity of the person seeking the information is verified and (b) an authority is signed by the prisoner allowing his or her personal information to be shared with the named individual.

Discussion

33. The relief sought by way of mandamus is a simple one: that the respondent should inform the applicant’s solicitor of the reasons for the applicant being subject to confinement in a special observation cell and the duration of same. Although the Statement of Grounds makes reference to the necessity for the provision of other information about the circumstances of the applicant’s detention, that is not part of the relief sought and I can only consider the question of mootness by reference to the relief sought. That application is now undoubtedly moot. The applicant was placed in a special observation cell because, as described in the Assistant Governor’s affidavit of 8 January 2019, he seriously assaulted another inmate on 18 December 2018 and was put in the cell to prevent him causing imminent injury to himself or others and other less restrictive methods of control were in the opinion of the Governor, inadequate in the circumstances in accordance with Rule 64 of the Prison Rules. The duration of same was from 18 December to 23 December.

34. Therefore, at the very latest, this information was known by 8 January 2019. However, the reason and duration for same was undoubtedly known by 27 December 2018 when Mr. Collier spoke by phone to the applicant. Mr. Collier does not refer to his conversation with his client on that date. Moreover, had the applicant or his solicitor provided a general consent signed by the applicant to the respondent to allow for the provision of personal information to his solicitor, the information could have been communicated to Mr. Collier once he had satisfied the prison staff of his identity. Mr. Collier could have sought a visit with his client on 22 December 2018, when he first contacted the prison, as he was entitled to do under Rule 38 of the Prison Rules . Again, he does not explain why this course was not taken prior to the application for leave. Equally, had Mr. Collier been in a position to answer his phone on the evening of 23 December and on the morning of 24 December when the applicant called him (the first call lasting 23 seconds and the second lasting 28 seconds), he would have been in a position to seek and obtain the information sought.

35. The Supreme Court has dealt with mootness in a series of cases, including Goold v.

Collins [2004] IESC 38, O’Brien v. Personal Injuries Assessment Board (No. 2) [2007] 1 IR 328, Lofinmakin & Ors. v. The Minister for Justice, Equality and Law Reform & Ors.

[2013] 4 IR 274 and O’Brien v. Moriarty [2016] IESC 36. In short, a case will be classified as moot where there is no longer any legal dispute between the parties or where the

decision will not have the effect of resolving some controversy affecting or potentially affecting their rights. In this case, there is no longer a live issue to be determined in respect of the reasons to be provided. The purpose of the proceedings (insofar as leave was granted) was to obtain the requisite information; that purpose is now quite spent as the information was provided some considerable time ago and could likely have been provided prior to the grant of leave if Mr. Collier had taken the appropriate action as identified above. The application for an order of mandamus is therefore moot.

36. It follows from the above that the application for a Declaration that the provisions of the GDPR and implementing legislation do not prevent the respondent from informing the applicant’s solicitor of the reasons for confinement and the proposed duration of same is equally moot. If there is no entitlement to obtain the reasons, there is equally no entitlement to have a court consider whether the purported reason for refusal was a valid one. A conclusion by this Court that the reason was invalid would be to rule on a matter in the abstract, since it would not result in an obligation to provide the information sought for the reasons set out above.

37. Moreover, I conclude that the applicant also lacks standing to seek the relief sought in these proceedings. The applicant would only have standing to test the legality of the refusal if his rights were affected by the refusal. Counsel for the applicant says that his rights are affected, as he has a constitutional right of access to the court and without information as to the reason for his detention and the duration of same he cannot vindicate this right. It is argued that Mr. Collier was obliged to bring the application on the applicant’s behalf to vindicate his rights of access to the court, despite the absence of a request for same from the applicant or authorisation from the applicant. Although the applicant presumably himself knew the reason for his detention in the special observation cell, it is said that this is insufficient because the applicant would not necessarily be in a position to understand whether his rights had been infringed and that his legal representative was therefore separately entitled to this information on his behalf (despite no request being made by the applicant at any stage for any information relating to his detention in the special observation cell) in order to decide whether to challenge the legality of his detention.

38. It is notable that, at no stage after the information the subject of these proceedings was provided, were these proceedings amended to challenge the legality of the applicant’s detention. This decision is therefore only concerned with whether the information sought in the order for mandamus – i.e. the reason for and duration of, the detention in the special observation cell - ought to have been provided and not with the legality of the detention.

39. I do not accept that the applicant’s right of access to information, necessary to vindicate constitutional rights, was adversely affected by the refusal to give out information over the phone to Mr. Collier about the applicant’s detention. First, the applicant may already have known the information sought and if he did not know it, could have obtained it.

Given the limited nature of the information sought, I do not accept that he would not have been able to interpret same to vindicate his constitutional rights and that his rights could only be vindicated by his lawyer obtaining the information in question. Second, Mr.

Collier himself could have obtained the information simply by producing a signed authorisation by the client and ensuring by appropriate means that the prison staff were satisfied as to his identity. I have quoted above the data protection policy of the Department of Justice. That policy clearly imposed a requirement on solicitors seeking any information in respect of prisoners (save for warrants and charge sheets) to provide a signed consent form from their client. It is common case that Mr. Collier did not provide this general written consent. There is no averment from Mr. Collier saying that he was not aware of that requirement and I therefore proceed on the assumption he was so aware.

He does not explain why he did not comply with the policy. He does not explain whether he had such an authorisation in his possession. He does not identify any impediment to him taking steps to either identify himself adequately to staff at the Prison or to obtain a signed authorisation. There is no suggestion by him that this could not have been achieved while his client was in the special observation cell. Further, in the email of Ms.

Boshell of 22 December 2018 to Mr. Collier, she made it clear that sensitive information could not be provided due to an inability to confirm an individual over the phone. Mr.

Collier did not provide evidence of his identity in writing, such as a copy of a driving licence or passport, or even a letter on headed notepaper and nor did he seek to arrange an appointment to meet his client in prison. Instead he sent an email at 17.40 that evening threatening High Court proceedings if the information sought was not provided by

20.00 that evening.

40. In short, no efforts were made by Mr. Collier to obtain the information through the avenues open to him and nor has he explained in affidavit evidence why he chose not to avail of those avenues. Equally, I have already identified the lack of any evidence from the applicant supporting the assertion that his rights were affected. In all the circumstances, I do not consider that the refusal of the prison staff to give out information in relation to the applicant to Mr. Collier over the phone, without proof of identify or an authorisation, adversely affected the applicant’s rights or undermined his right of access to the court. Accordingly, I find that neither Mr. Collier on behalf of the applicant, nor the applicant himself, have standing to advance the claim now brought, either in respect of the order for mandamus or for declaratory relief.

Observations on GDPR Claim

41. Finally, I note that where a matter has been fully argued, even in the teeth of a finding of mootness/lack of standing, it may in certain cases be appropriate to go on and consider the substantive relief sought for the sake of completeness. However, this is not one of those cases. In this case, the substantive question raised by the second relief for which leave is granted is whether the GDPR applies to activities of the prison service. That is a complex issue and was not fully argued in this case. Counsel for the applicant asserted that, because the activity in question fell outside the scope of Union law, and because it related to the “execution of criminal penalties”, the GDPR did not apply and that therefore the reliance by the Department of Justice upon the GDPR to justify refusal was misplaced.

42. In response, counsel for the respondent said that the information at issue in this case did not constitute the processing of personal data for the execution of criminal penalties and that the activities were within the scope of EU law. He further referred to Directive 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on free movement of such data, and repealing Council Framework Decision 2008/977/JHA (“Law Enforcement Directive”) [2016] OJ L 119/89, implemented by the Data Protection Act 2018. He asserted that any reference to the GDPR by the prison service while engaging with Mr.

Collier also encompassed a reference to the Law Enforcement Directive and that, if the respondent was wrong in its contention that the GDPR applied, the Law Enforcement Directive applied to information held by the prison service and restricted the provision of information by the prison staff in the same way. Article 1 of the Law Enforcement Directive provides that it lays down the rules relating to the protection of natural persons with regard to the processing of personal data, inter alia, for execution of criminal penalties. However, Article 2(3)(a) provides that the Directive does not apply to the processing of personal data in the course of an activity which falls outside the scope of Union law.

43. The question of the application of the Law Enforcement Directive was only briefly addressed in oral submissions and neither set of written submissions addressed it. Nor did either set of submissions, either written or oral, address the question of the scope of application of either the GDPR or the Law Enforcement Directive in the course of an activity falling outside EU law, save for a bald assertion by the applicant that the factual matrix in this case was outside the scope of Union law.

44. However, the issue of the scope of application of the GDPR/Law Enforcement Directive is a complex one generally (see in this respect for example the commentary in Rosemary Jay, Guide to the General Data Protection Regulation: A Companion to Data Protection Law and Practice (4th ed., Sweet & Maxwell, 2017) at para. 4-006-4-021) and their scope in justice and security matters is even more involved, because of the nature of the shared competence in this area between the EU and the Member States (see Article 4 of the Treaty on the Functioning of the European Union (“TFEU”) [2012] OJ C 326/47, which provides for the sharing of competence between the Union and the Member States where the Treaties confer on the Union a particular competence, and notes that shared competence between the Union and the Member States applies, inter alia, in the area of freedom, security and justice; and see Article 4 of the Treaty on European Union [2012] OJ C 326/1 which provides, inter alia, competences not conferred upon the Union in the Treaties remain with the Member States and that Union shall respect essential State functions, including ensuring the territorial integrity of the State, maintaining law and order and safeguarding national security). The area of policy and criminal justice formerly comprised the EU’s Third Pillar prior to the Treaty of Lisbon [2007] OJ C 306/1. However, after the Lisbon Treaty it was brought within the Treaties and now is one of various areas of justice and home affairs that sit in Title V of the TFEU.

45. None of these issues were raised before me but in my view any decision on the scope of the application of the GDPR and the Law Enforcement Directive to the activities of prison authorities could not be decided without consideration of same. Similarly, further argument and case law would be required to interpret the reference to the term “execution of criminal penalties”, found in both the GDPR and the Law Enforcement Directive, in the context of this case.

46. Having regard to the complexity of the issues, and the lack of any detailed submissions on same, it seems to me that it would be unwise to give any view on the applicability of the GDPR or Law Enforcement Directive to information held by prison authorities either generally or in the circumstances of this case. Those thorny questions remain to be decided in a case where – unlike the present - the applicant has locus standi and the reliefs sought are not moot.

47. In conclusion, for the reasons set out in this judgment, I refuse the reliefs sought by the applicant.