Month: January 2011

SCOTTISH GOVERNMENT ISSUES PRIVACY GUIDANCE

Posted on | by Robin Hopkins

The Scottish Government has published its guidance document on Identity Management and Privacy Principles. The guidance is aimed at both public sector policy makers and with those involved in devising or operating systems for proving or recording identity. Key principles include:

  • For services which are used frequently and for which identification is needed, users should be required to register only once. Thereafter, unless there is a statutory requirement to prove identity, a person should generally be able to access the service by authenticating themselves using a token (such as a bus pass or library card) that proves their entitlement without revealing personal information. In other circumstances, a user name and a password may be required.
  • A Privacy Impact Assessment (PIA) or proportionate equivalent should be conducted and published prior to the implementation of a project which involves the collection of personal information.
  • Where a public body has a contract with the private sector or the third sector, the contractor must be contractually bound to adhere to best practice as outlined in the guidance.
  • The creation of centralised databases of personal information is to be avoided.
  • If a public service organisation needs to link personal information from different systems and databases (internally or between organisations), it should avoid sharing persistent identifiers. Instead, other mechanisms – such as matching – should be considered.

LOCAL AUTHORITY ORDERED TO RETAIN COURT JUDGMENT IN INDIVIDUAL’S FILE

Posted on | by Robin Hopkins

The Administrative Court’s (as yet unreported) judgment in R (on the application of N) v a Local Authority in December 2010 saw the quashing of a decision to withdraw a licence to be in contact with children. The case concerned the familiar public law principles of judicial review and human rights, but from an information law perspective, the point of interests is this: in reaching its decision to withdraw the individual’s licence, the local authority compiled information on that individual, including the allegations made against him (namely, that he was a paedophile with a history of sexual offences) as well as its meetings with the individual. Ockleton J not only overturned the local authority’s decision, but also directed it to keep a copy of the judgment with its records relating to the matter, so that its records on this individual were full and accurate. Otherwise, he ruled, the local authority’s file on this individual was potentially misleading to anyone subsequently accessing it.

CREATION VS MERE SWEAT: FOOTBALL FIXTURE LISTS AS LEGALLY PROTECTED DATABASES?

Posted on | by Robin Hopkins

In Football Dataco & Others v Yahoo! UK Ltd & Others, the Court of Appeal has referred to the ECJ questions on the interpretation of Directive 96/9 on the Legal Protection of Databases. Its principle question was: what is meant by “databases which, by reason of the selection or arrangement of their contents constitute the author’s own intellectual creation”?

The databases in question comprised football fixture lists in the English and Scottish leagues. The defendant used these without paying the claimant (an organiser of football fixtures). The claimant contended that, by arrangement of its contents, the fixture list became its “own intellectual creation”, thereby attracting the Directive’s protection. The defendant’s stance was that these lists did not attract such protection, because they were merely the fruits of “sweat of the brow” – in other words, compilation, but not creation.

The Court of Appeal observed that the ECJ’s answers to its questions had wide implications for the legal protection not only of sports fixture lists, but possibly also of TV listings, which required comparable energy and skill to compile.

Clear and Present Danger?

Posted on | by James Goudie KC

A Bill has recently been introduced in both Houses of the US Congress, in response to the Wikileaks disclosures, to amend the US Espionage Act 1917 to make it a criminal offence for any person knowingly and wilfully to disseminate, “in any manner prejudicial to the safety or interest of the United States”, any classified information “concerning the human intelligence activities of the United States”.  This proposal would appear to be constitutional with respect to US Government employees who leak such material to those who are unauthorised to receive it.  But what about the constitutionality of criminalising anyone who publishes the information after it has been leaked, especially given that the proposed new offence is not, at any rate expressly, limited to situations in which the spread of the classified information poses a “clear and present danger” of grave national harm?

The “clear and present danger” standard has been the governing principle under the First Amendment to the US Constitution since Supreme Court Justice Oliver Wendell Holmes Opinion in Schenk v United States in 1919.  The principle was stated by Supreme Court Justice Louis D. Brandeis in Whitney v California in 1927.  The founding fathers of the US “did not exalt order at the cost of liberty”, wrote Brandeis.  On the contrary, they understood that “only an emergency can justify repression.  Such must be the rule if authority is to be reconciled with freedom.  Such … is the command of the Constitution.  It is, therefore, always open to Americans to challenge a law abridging free speech and assembly by showing that there was no emergency justifying it”.

Writing in the New York Times on 3 January 2011, Geoffrey R. Stone, Professor of Law at the University of Chicago, and Chairman of the Board of the American Constitution Society, explains that the First Amendment does not compel Government transparency.  It leaves the Government autonomy to protect its own secrets.  It does not accord anyone the right to have the Government disclose information about its actions or policies.  It cedes to the Government authority to restrict the speech of its own employees.  What it does not do, however, is allow the Government to suppress the free speech of others when it has failed to keep its own secrets.

Professor Stone gives a number of reasons why it is right to give the Government limited scope for penalising the circulation of unlawfully leaked information.

First, the mere fact that such information might “prejudice the interests of the United States” does not mean that that harm outweighs the benefit of publication. In many circumstances, it may be extremely valuable to public understanding. Consider, for example, classified information about the absence of weapons of mass destruction in Iraq. Second, the reasons that Government officials want secrecy are many and varied. They range from the compelling to the illegitimate. It is tempting for Government officials to overstate the need for secrecy, especially in times of national anxiety.  Third, a central principle of the First Amendment is that the suppression of free speech must be the Government’s last rather than its first resort in addressing a problem. The most obvious way for the Government to prevent the danger posed by the circulation of classified material is by ensuring that information that should be kept secret is not leaked in the first place. The Supreme Court in Bartnicki v Vopper in 2001 held that when an individual receives information “from a source who obtained it unlawfully,” that individual may not be punished for publicly disseminating the information “absent a need … of the highest order”. The Supreme Court explained that if the sanctions now attached to the underlying criminal act do not provide sufficient deterrence, then perhaps they should be made more severe,  but that “it would be quite remarkable to hold” that an individual can constitutionally be punished merely for publishing information because the Government failed to “deter conduct by a non-law-abiding third party”.  Professor Stone concludes that if  the Government is granted too much power to punish those who disseminate information, then one risks too great a sacrifice of public deliberation; if, on the other hand, the Government is granted too little power to control confidentiality at the source, then  one risks too great a sacrifice of secrecy. The answer is to reconcile the values of secrecy and accountability by guaranteeing both a strong authority for the Government to prohibit leaks and an expansive right for others to disseminate information to the public.

James Goudie QC

“MANIFESTLY UNREASONABLE” REQUESTS UNDER THE EIR: RELEVANCE OF COST OF COMPLIANCE AND DUTY TO ADVISE AND ASSIST

Posted on | by Robin Hopkins

Little v ICO and Welsh Assembly Government (EA/2010/0072) is the latest application of the principles in DBERR v IC and Platform (EA/2008/0096) concerning “manifestly unreasonable” requests under regulation 12(4)(b) EIR. In particular, it deals with a public authority’s reliance on that exemption based on the excessive time which would be required to comply with the request.

The Tribunal confirmed that manifest unreasonableness – whilst not a condemnatory term – did imply a higher threshold than mere unreasonableness. A certain obviousness was required. Beyond that, no more precise definition could be given, and terms such as “self-evidently” were not applicable. The cost of compliance is relevant, but only as one factor among many. A request may be manifestly unreasonable if the cost of compliance is disproportionate the importance of the issue, or if compliance would divert resources so as significantly to disrupt the public authority’s normal activities. These, however, are only examples, and each case must be decided on its own facts. On the facts of this case (which concerned information on the disposal of land owned by Forestry Commission Wales for the purposes of wind farm development) the requests were manifestly unreasonable.

Two points of general interest emerge.

First, the “cost of compliance” provision under section 12 FOIA may not be used as a yardstick for determining manifest unreasonableness under regulation 12(4) EIR. The provisions are entirely separate, and one offers no guidance on the other.

The second is that compliance with the duty to advise and assist under regulation 9 EIR is a precondition for reliance on regulation 12(4)(c) (the exemption applicable where a request is too general) – but not for reliance on manifest unreasonableness under regulation 12(4)(b). This does not mean, however, that the duty to advise and assist is irrelevant to regulation 12(4)(b). The Tribunal was clear that “a public authority should expect, in the appropriate case, to have to engage with the request, and the requester, to consider whether a more manageable and reasonable formulation of the request can be achieved, before refusing a request for being manifestly unreasonable”.

The Tribunal also observed that the preparation of a 20-page list of files which might contain the requested information was not required under regulation 9 in this case – but once such a list has been prepared, the failure to provide the requester with a copy might cast a public authority’s efforts under regulation 9 in an unfavourable light.

“PRACTICE DIRECTION FOR THE SEALING OF ROYAL WILLS” NOT HELD BY MOJ

Posted on | by Robin Hopkins

Brown v Information Commissioner and the Ministry of Justice (EA/2010/0119) concerned a request for a document which had been referred to in judgments from the High Court and Court of Appeal concerning the appellant’s unsuccessful application to view the will of the late Princess Margaret. The document had been referred to as a “practice direction for the sealing of royal wills”. The request for this document under FOIA was initially made to the Master of the Rolls, and was thereafter handled by the Ministry of Justice (which has responsibility for Her Majesty’s Courts Service).

The Tribunal agreed with the Information Commissioner and the MOJ that an adequate search had been conducted and that, on the balance of probabilities, the requested document was not held at the time of the request. It also clarified this statutory curiosity relied on by the appellant: the Master of the Rolls is not a listed public authority, but he is – under section 7 of the Public Records Act 1958 – responsible for “the records of the Chancery of England”, “including those created after the commencement of this Act”. The Tribunal has, however, explained that this is a matter of “antiquarian interest” concerning records of the courts of Chancery prior to the reorganisation of the courts in the 19th century. Requests under FOIA can, therefore, not be made to the Master of the Rolls.