February 26th, 2009 by Anya Proops
On 20 February 2009, judgment was handed down in the case of Office of Communications v Information Commissioner  EWCA Civ 90. This is the first case under the Environmental Information Regulations 2004 (EIR) to be heard by the Court of Appeal. The Information Commissioner was represented by Akhlaq Choudhury of 11KBW. This is an important judgment affecting the general approach to the public interest test in determining whether information under the EIR should be disclosed. The judgment is also relevant to the application of the public interest test under FOIA. The case concerned a request made to Ofcom (the regulatory body for radio communications) for the disclosure of information as to the location of mobile phone masts, and in particular for that information to be disclosed in a format that would enable the requester to manipulate the underlying data using data-handling applications. Ofcom resisted disclosure on the basis that it would prejudice (a) public safety (by identifying mast locations to criminals) and (b) the intellectual property rights of the Mobile Network Operators (such rights being the database rights in the information). The Information Tribunal considered that there was a strong public interest in disclosure given, amongst other matters, the benefit to epidemiological research as to the effects of mobile phone mast radiation on the health of the public. The Tribunal considered that it was entitled to take that public interest into account notwithstanding the fact that such research would be likely to involve an infringement of database rights. In addressing the public interest balance, the Tribunal took the then well-established course of separately weighing the public interest in maintaining each of the exceptions relied upon against the public interest in disclosure. It did not aggregate all the public interest factors against disclosure. The Tribunal found that the public interest balance favoured disclosure.
On the general point of principle, namely the approach to be taken in weighing the public interest in maintaining the exemption against the public interest in disclosure, the Court of Appeal disagreed with the Tribunal’s approach. The Court held that the public interest in maintaining each exemption should be aggregated and weighed against the public interest in disclosure. An exemption-by-exemption approach was still permissible provided that the matter is also looked at in the round at the end of the process by considering whether the aggregate public interest in maintaining the applicable exemptions outweighs the public interest in disclosure. However, the Court upheld the Tribunal’s’ approach in taking into account a factor as supporting the public interest in disclosure even where that factor involves a breach of third party intellectual property rights. The Court held that the legislative scheme is such that it is permissible to take such factors into account as an aspect of the public interest in disclosure. The matter was remitted to the Tribunal to reconsider the public interest balance in accordance with the approach laid down by the Court.
February 26th, 2009 by Anya Proops
Jack Straw has announced that he is exercising powers under section 53 FOIA to prevent minutes of Cabinet meetings held in the period leading up to the Iraq war from being disclosed under FOIA. The announcement, which was made to Parliament on 24 February 2009, follows in the wake of the Information Tribunal’s decision in January 2009 that the minutes should be disclosed. It is understood that this is the first time the Government has used the powers of veto under section 53. Jonathan Swift of 11 KBW acted on behalf of the Cabinet Office before the Tribunal. 11 KBW’s Timothy Pitt Payne acted for the Commissioner.
Section 53(2) FOIA:
‘A decision notice or enforcement notice to which this section applies shall cease to have effect if, not later than the twentieth working day following the effective date, the accountable person in relation to that authority gives the Commissioner a certificate signed by him stating that he has on reasonable grounds formed the opinion that, in respect of the request or requests concerned, there was no failure falling within subsection (1)(b)’
February 18th, 2009 by Anya Proops
The Coroners and Justice Bill was introduced in the House of Commons on 14 January 2009. Clause 152 of the Bill provides for the Data Protection Act 1998 to be amended to include a number of new provisions on data sharing. Those provisions include a section which creates a broad general power enabling any ‘designated authority’ to make an ‘information sharing order’, which is to say an order which enables ‘any person to share information which consists of or includes personal data’ (new section 50A(1)). The relevant designated authorities’ are ‘appropriate Ministers’ (i.e. Secretaries of State, the Treasury and Ministers in charge of government departments); Scottish Ministers; Welsh Ministers and a Northern Ireland Department (new section 50A(2)). Whilst these broad powers are subject to a number of limitations including those provided for under new sections 50C, 50A(4) and 50A(6), this has not prevented concerns being expressed as to the potential risks entailed upon these new provisions. Most recently, in an interview with the Guardian (14 February 2009), the British Medical Association’s Chairman, Hamish Meldrum, confirmed that he was ‘extremely concerned’ about these new data sharing powers, not least because they would potentially enable Ministers to allow patient data to be shared not merely within the NHS but also with other ministries and even private companies. Mr Meldrum said that the trust between doctors and patients would be destroyed if the Bill became law as it stands. The new powers embodied in clause 152 of the Coroners and Justice Bill follow in the wake of the development of another significant and controversial data sharing scheme under which the medical records of everyone in England are to be uploaded onto a national database, known as the Spine.
February 10th, 2009 by Anya Proops
The High Court today handed down an important judgment on the application of the legal professional privilege exemption in section 42 FOIA ( EWHC 164 (QB)). The case concerned an application for disclosure of information held by the DTI (subsequently the Department of Business and Regulatory Reform). The requested information related to the Government’s decision to include a provision in the Part Time Workers (Prevention of Less Favourable Treatment) Regulations 2000 which expressly excluded daily fee paid judicial office holders from the ambit of the Regulations. The request was made by Mr O’Brien QC, who himself sat as a daily fee paid judicial office holder. DBERR refused disclosure of the requested information on the basis that certain of the information was exempt under section 35 FOIA (policy information) whereas other information was exempt under section 42 (FOIA) (legally privileged information). Reliance was also placed on section 36 FOIA (prejudice to effective conduct of public affairs). The Commissioner rejected Mr O’Brien’s complaint about DBERR’s refusal decision, save that he did order that the content of one of the disputed documents be disclosed. The Tribunal upheld Mr O’Brien’s appeal against the Commissioner’s decision. It held that whilst the exemptions afforded under sections 35 and 42 were engaged in respect of the disputed information, on an application of the public interest test, the public interest weighed in favour of the information being disclosed (EA/2008/0011).
DBERR, which was named as an additional party before the Tribunal, appealed the decision to the High Court. The Commissioner participated in the appeal, not on the basis that he was formally supporting or resisting the appeal, but rather because: (a) he had some ‘concerns’ about the way in which the Tribunal had reached its conclusions in this case; and (b) he considered it important to draw the court’s attention to these concerns, not least because of the precedent-setting effect of the Tribunal’s decision. At the heart of the appeal before the High Court was the question whether the Tribunal had lawfully applied the section 2(2)(b) public interest test to the dipsuted information.
Wyn Williams J upheld the appeal in part. He found that the Tribunal’s application of the public interest test to information falling within the ambit of section 35 could not be impugned. However, he concluded that the Tribunal’s application of the public interest test to the information falling within the ambit of section 42 was fatally flawed. He reached this conclusion in particular on the basis that: (a) in accordance with a long line of Tribunal decisions starting with Bellamy v ICO, it was clear that there was a strong public interest in maintaining the confidentiality of legally privileged information which was effectively built into the section 42 exemption; and (b) the Tribunal’s reasons did not clearly demonstrate that it had taken this strong public interest into account when weighing the public interest balance. The importance of the judgment lies in the fact that it constitutes an authoritative judgment on how legally privileged information should be dealt with under FOIA.
The judgment is also significant in that: (1) it criticises the Tribunal for having failed to state clearly which of the disputed information fell within section 35 and which fell within section 42 (the Tribunal had simply found that the information fell within section 35 ‘and/or’ section 42); and (2) it confirms that, when dealing with the application of the public interest test where a number of exemptions are engaged, the Tribunal should ensure that it does not simply bundle all the public interest test considerations together but instead conducts discrete analyses of the public interests relevant to particular exemptions.
February 6th, 2009 by Anya Proops
The House of Lords Constitutional Committee has today published an important report on the use of surveillance within society. The report, entitled ‘Surveillance: Citizen and State’, considers the constitutional implications that changes in the use of government surveillance and data collection have upon the privacy of citizens and their relationship with the State. The introduction to the Report states as follows:
’13. We regard a commitment to the freedom of the individual as paramount. It is a precondition of the functioning of our existing constitutional framework. We also believe that privacy and the principle of restraint in the use of surveillance and data collection powers are central to individual freedom, and should be taken into account and adhered to at all times by the executive, government agencies, and public bodies. There is a danger that the growing use of surveillance by government and private organisations in the UK could constitute a serious threat to these principles and commitments. 14. Mass surveillance has the potential to erode privacy. As privacy is an essential pre-requisite to the exercise of individual freedom, its erosion weakens the constitutional foundations on which democracy and good governance have traditionally been based in this country. Central to this inquiry is the question of whether surveillance, which has substantially increased over recent years, represents a threat to these foundations, and to what extent surveillance should be permissible within the current constitutional framework of the UK.’
Chapter 5 of the Report considers the role of surveillance regulators. With respect to the Information Commissioner, the Report stated that ‘given the impressive work that is currently being done by the Commissioner’s Office, there is a pressing need to strengthen his regulatory hand’. The Report focusses on recent innovations to strengthen the Commissioner’s regulatory role, including: (a) Government approval for the Commissioner to be placed under a statutory duty to produce a data-sharing code of practice which would be approved by Parliament; (b) the Government’s decision to provide a statutory basis for the Information Commissioner to carry out inspections without consent of public sector organisations which process personal information systems; and (c) the introduction of the Criminal Justice and Immigration Act 2008, which will, when it comes into force, empower the Commissioner to impose monetary penalties on data controllers (in the public or private sector) for breaching the data protection principles knowingly or recklessly in ways that are serious and likely to cause substantial damage or distress. However, the Committee also made a number of recommendations aimed at enhancing the Commissioner’s powers still further (see chapters 5 and 9). Thus, it recommended:
- that the Government instruct departments to consult the Information Commissioner at the earliest stages of policy development, so as to ensure that his views on privacy and data protection are properly taken into account;
- that the Government reconsider the question whether the Commissioner should be given powers to carry out inspections of private sector bodies without consent (his powers being limited under the Criminal Justice and Immigration Act 2008 to public sector bodies);
- that the Government consider expanding the remit of the Information Commissioner to include responsibility for monitoring the effects of government and private surveillance practices on the rights of the public at large under Article 8 of the European Convention on Human Rights;
- that the Government should be required, by statute, to consult the Information Commissioner on bills or statutory instruments which involve surveillance or processing powers;
- that, in conjunction with the Information Commissioner, the Goverment should undertake a review of the law governing the consent of individuals to the use of their personal data;
- that the Government should commit to a plan of action, agreed with the Commissioner, to raise public awareness of the issues surrounding the use of surveillance.
Other notable recommendations in the report include:
- Privacy Impact Assessments – The Government should amend the provisions of the DPA 1998 to make it mandatory for Government departments to produce and make available an independent, publicly available, full and detailed Privacy Impact Assessment (PIA) prior to the adoption of any new surveillance, data collection or processing scheme, including new arrangements for data sharing. That the Information Commissioner or other independent authorities should have a role in scrutinising and approving any PIA;
- DNA Profiles – DNA profiles should only be retained on the National DNA Database (NDNAD) where it can be shown that such retention is justified or deserved. The Committee confirmed that it expected the Government to comply fully, and as soon as possible, with the judgment of the European Court of Human Rights in the case of S. and Marper v. the United Kingdom, and to ensure that the DNA profiles of people arrested for, or charged with, a recordable offence but not subsequently convicted are not retained on the NDNAD for an unlimited period of time.
- CCTV – The Home Office should commission an independent appraisal of the existing research evidence on the effectiveness of CCTV in preventing, detecting and investigating crime. The Government should propose a statutory regime for the use of CCTV by both the public and private sectors, introduce codes of practice that are legally binding on all CCTV schemes and establish a system of complaints and remedies. This system should be overseen by the Office of Surveillance Commissioners in conjunction with the Information Commissioner’s Office.
- Controlling Access to Personal Data – The Government should introduce regulations aimed at: (a) requiring the encryption of personal data to be mandatory in some circumstances and (b) ensuring that organisations avoid connecting to the internet computers which contain large amounts of personal information.
- RIPA – The current administrative procedures contained in RIPA should be reviewed, including the system of authorisations. Government consultations on proposed changes to the Regulation of Investigatory Powers Act 2000 should include consideration of consider whether local authorities, rather than the police, are the appropriate bodies to exercise powers under RIPA. If it is concluded that they are the appropriate bodies, such powers should only be available for the investigation of serious criminal offences which would attract a custodial sentence of at least two years. The Government should take steps to ensure that these powers are only exercised where strictly necessary, and in an appropriate and proportionate manner. The Government should also examine the feasibility of rationalising the inspection system and the activities of the three RIPA Commissioners. (This recommendation was made in light of concerns expressed by the Committee that the current arrangement whereby three different offices oversee the operation of RIPA may result in inefficiencies and disjointed inspection).
- Legislative Scrutiny – The Government should give high priority to post-legislative scrutiny of key statutes involving surveillance and data processing powers, including those passed more than three years ago. The statutes should be considered as part of a whole, rather than in isolation. This post-legislative role could be carried out effectively by a new Joint Committee on surveillance and data powers.
- Article 8 – Instructions for Surveillance Bodies – The Government should instruct government agencies and private organisations involved in surveillance and data use on how the rights contained in Article 8 of the European Convention on Human Rights are to be implemented. The Government should provide clear and publicly available guidance as to the legal meanings of necessity and proportionality. A complaints procedure should be established by the Government and , where appropriate, legal aid should be made available for Article 8 claims.
- Judicial Oversight – The Government should consider introducing a system of judicial oversight for surveillance carried out by public authorities, and that individuals who have been made the subject of surveillance be informed of that surveillance, when completed, where no investigation might be prejudiced as a result. Compensation should be available to those subject to unlawful surveillance by the police, intelligence services, or other public bodies acting under the powers conferred by RIPA.
- ID Systems – The Government’s development of identification systems should give priority to ‘citizen-oriented considerations’.
- More Effective Leadership – The role of data protection minister should be enhanced and its profile elevated because of the need for more effective central leadership.
- Culture Change – The Committee supported the recommendations made in the Thomas-Walport Data Sharing Review Report for changes in organisational cultures, leadership, accountability, transparency, training and awareness, and it welcomed the Government’s acceptance of them.
- Public Procurement – The Government should review its procurement processes so as to incorporate design solutions that include privacy-enhancing technologies in new or planned data gathering and processing systems.