The judgment of the Court of Appeal in Edmondson & Ors v R [2013] EWCA Crim 1026 is the latest instalment in the proceedings arising out of the police investigation into allegations of phone hacking at the News of the World. (The ‘Ors’ include Rebekah Brooks and Andy Coulson.) This particular appeal concerned a ruling on a point of law made by Fulford LJ in a preparatory hearing in May.
The appellants are charged with conspiring to intercept communications contrary to s 1(1)(b) of the Regulation of Investigatory Powers Act 2000 (‘RIPA’). Under s 1(1)(b), it is an offence intentionally to intercept, without lawful authority, any communication in the course of its transmission by means of a public telecommunication system. Section 2(2) provides:
‘For the purposes of this Act, but subject to the following provisions of this section, a person intercepts a communication in the course of its transmission by means of a telecommunication system if, and only if, he—
(a) so modifies or interferes with the system, or its operation,
(b) so monitors transmissions made by means of the system, or
(c) so monitors transmissions made by wireless telegraphy to or from apparatus comprised in the system,
as to make some or all of the contents of the communication available, while being transmitted, to a person other than the sender or intended recipient of the communication.’
Section 2(7) extends the circumstances in which a communication is treated as being transmitted. It provides:
‘For the purposes of this section the times while a communication is being transmitted by means of a telecommunication system shall be taken to include any time when the system by means of which the communication is being, or has been, transmitted is used for storing it in a manner that enables the intended recipient to collect it or otherwise to have access to it.’
The appeal was about the application of s 2(7) to voicemails. The appellants had argued before Fulford LJ (who gave a preliminary ruling on a point which was then endorsed by the trial judge, Saunders J) that s 2(7) is limited to transient storage of communications prior to first access or collection by the intended recipient. On this view, transmission of a communication finally comes to an end when the intended recipient first collects the communication or otherwise accesses it. So, listening to a voicemail that has not yet been listened to by the intended recipient would be an interception contrary to s 1(1)(b), but listening to a voicemail that has already been listened to would not.
No dice, said Fulford LJ, finding that there was nothing in the language of s 2(7) to limit its effect in the way that the appellants argued. His lordship considered the words ‘collect’ and ‘access’ in s 2(7), and approved a submission on behalf of the Crown that ‘collect’ suggests picking something up and taking it somewhere else (downloading, in the context of electronic communications) whereas ‘accessing’ a voicemail simply means listening to it, and that voicemails are ‘accessed’ rather than ‘collected’. On this basis, there is no reason for drawing any distinction between the first occasion on which the recipient listens to a voicemail and any subsequent occasion – every such occasion involves ‘accessing’ the voicemail, and for as long as the voicemail is stored for the purpose of enabling this access s 2(7) continues to apply.
The Court of Appeal dismissed the appeal, agreeing with Fulford LJ’s conclusions on the effect of s 2(7). Bad news for those who get their kicks listening to others’ voicemails – it is not the thrilling game of roulette they may have supposed. But it is his lordship’s comments on e-mail that may raise a few eyebrows.
Although the case involved voicemails rather than e-mails, Fulford LJ drew a distinction between voicemails and e-mails. E-mails, his lordship said, are ‘collected’ in that they are downloaded from the internet service provider’s server to the computer of the subscriber. This may come as a surprise to many who have used e-mail in, say, the past decade. The arrangement to which Fulford LJ referred describes retrieval of e-mails using POP (Post Office Protocol), but not web-based services such as Gmail, Outlook.com and the multitude of ISP-branded offerings. Users of these services tend not to download e-mails locally (although this is often supported), but rather leave their e-mails on the server and access them via a web browser. One consequence of the Court of Appeal’s judgment is that e-mails sent to users of these services are treated as being perpetually in the course of transmission under s 2(7), up to the point when they are finally deleted. Indeed, on the Court’s interpretation, an e-mail is treated as still being transmitted even if the recipient moves it from his inbox to another mailbox folder, since the mail server is still storing the e-mail in a manner that enables the recipient to have access to it.
The ICO may wish to revisit its Employment Practices Code in light of the Court of Appeal’s judgment. The Code provides guidance on, amongst other things, monitoring in the workplace, and in particular when interception of e-mails will be lawful under the Lawful Business Practice Regulations (‘LBP Regulations’). (Enterprise e-mail systems will be either public or private telecommunication systems; unlawful interception of e-mails in the latter will generally be the subject of a private right of action, rather than an offence, when carried out by the employer. Section 2(7) applies to both public and private systems.) On this subject, the Code essentially sets out the view put forward by the appellants:
‘Interception occurs when, in the course of its transmission, the contents of a communication are made available to someone other than the sender or the intended recipient. It does not include access to stored e-mails that have been opened.’ (Employment Practices Code, page 70)
‘Examples where interception may take place include a supervisor listening in to calls, a business opening e-mails stored on a server before they have been opened by the intended recipient … Examples that do not involve interception include a business accessing a stored collection of e-mails that have been received and deleted by the intended recipient, and a business accessing a stored collection of sent e-mails.’ (Employment Practices Code Supplementary Guidance, page 60)
This view is clearly not tenable in light of the Court of Appeal’s judgment (if it ever was). The majority of enterprise e-mail systems are based around either on-premises deployments of Microsoft Exchange Server (or similar), or cloud-based e-mail services. In both cases, e-mails are stored in the employee’s mailbox on the server (although users may download local copies for offline access), so accessing employees’ e-mails will constitute interception even if those e-mails have been read. Of course, interception may still be lawful if carried out carefully in accordance with the LBP Regulations; however, the Code suggests that the LBP Regulations can be ignored altogether when reading e-mails that have already been opened (because this is not an interception), and it is difficult to see how that view can be reconciled with the Court of Appeal’s judgment.
Joel Harrison is an associate in the Technology & Outsourcing group of Milbank, Tweed, Hadley & McCloy LLP, and is based in the firm’s London office.
