Author: Anya Proops KC

Facebook revisited – Another Norwich Pharmacal Case

Posted on | by Anya Proops KC

I posted recently about an important recent case on the subject of accessing personal data about facebook users (see my post on the Nicola Brookes case here). In my post, I said that it was understood that this may have been the first case in which an individual has been able to secure a court order requiring facebook to disclose personal data about its users. The wonders of the internet are such that I received today an email from the Cayman Islands’ Deputy Information Commissioner, Jan Liebaers, alerting me to the fact that there had in fact been an earlier judgment of the High Court making a similar order: Applause Store Productions Ltd and another v Raphael [2008] EWHC 1781 (QB). The Applause Store case was actually a libel case. The background to the case was that a fake facebook page had been set up which contained material which was defamatory of one of the claimants (MH). An issue arose in the case as to who had been responsible for setting up the fake page. It would appear from paragraph 10 of the judgment that the claimants’ solicitors, Olswang, obtained a Norwich Pharmacal order against Facebook Inc for disclosure of the registration data provided by the user responsible for creating the false material, including e-mail addresses, and the IP addresses of all computers used to access Facebook by the owner of those email addresses. Facebook Inc went on to provide Olswang with evidence, which was not contested at the hearing, showing that the profile was created on a computer using an IP address which was accepted to have been the Defendant’s and that the relevant group page was created on a computer using that same IP address on the afternoon of 20th June 2007. The remainder of the judgment concerned the question of whether the court should find that the Defendant was the individual who set up the fake facebook page and, hence, that he was responsible for defaming MH. On this issue, the judge held that the Defendant’s case was utterly implausible and that he was liable in respect of the defamation. My thanks to Jan Liebaers for the alert about this important case. Taken together the Brookes case and the Applause Store case reveal a clear appetite on the part of the judiciary to issue orders requiring facebook to provide evidence where this is necessary in order to further the interests of justice.

Anya Proops

Police Surveillance – New tribunal decision

Posted on | by Anya Proops KC

Earlier this month Robin Hopkins blogged on a recent admin court judgment applying Article 8 to the police’s act of retaining data on a protestor (see his post on the Catt case here). This week the Information Tribunal handed down a judgment concerning another aspect of police surveillance, namely the automatic number-plate recognition (ANPR) system, which is now in widespread use across Great Britain. In Mathieson v IC & Devon & Cornwall Constabulary (EA/2010/0174), Mr Mathieson, a Guardian journalist, requested disclosure from the Constabulary of the location of all the ANPR cameras within the area of the Devon & Cornwall Constabulary. The Constabulary refused disclosure on an application of ss. 24 (national security) and 31 (prevention of crime) FOIA. The Commissioner upheld the Constabulary’s refusal notice on the basis that the location information was exempt from disclosure under s. 31. Mr Mathieson appealed against the Commissioner’s decision.

At the hearing before the Tribunal, it was conceded on behalf of Mr Mathieson that, on all the evidence, both ss. 24 and 31 were engaged in respect of the location information. The key issue which the Tribunal was called upon to determine was whether the public interest balance nonetheless weighed in favour of disclosure. In summary, the Tribunal held that the use of the ANPR system by the Constabulary inevitably gave rise to serious civil liberty concerns. This was not least because the system indiscriminately recorded the number-plate of every single vehicle passing before the individual cameras, irrespective of whether the vehicles may be being used as part of a criminal enterprise or as a result of individuals innocently and lawfully going about their day to day business. However, it nonetheless went on to find that the public interest balance weighed firmly in favour of maintaining the exemptions. This was because, on all the available evidence, it was clear that revealing the location of the individual cameras within Devon and Cornwall would have enhanced the ability of criminals, including terrorists, effectively to bypass the ANPR system, thus helping them to evade detection and prosecution.

In the course of its decision, the Tribunal held that: ‘there is always likely to be a substantial public interest in maintaining the exemptions we are concerned with, in particular that provided by section 24 which relates to national security’ (§8). It also held that, whilst disclosure of the location information may only have tipped the balance slightly in favour of the criminals, not least because they may in any event have been able to identify the cameras through their own efforts, that was sufficient to result in a situation where the location information must be treated as exempt (§10).

Notably, a separate question was raised during the course of the appeal as to whether the information captured by the ANPR system amounted to ‘personal data’ in the hands of the Constabulary. Mr Mathieson and the Commissioner submitted that it did. The Constabulary disputed this conclusion. Ultimately, the Tribunal took the view that it did not need to resolve this dispute for the purposes of determining the appeal.

I am limited in what I can say about this case, having appeared on behalf of the Commissioner. However, it is clear from the judgment that there is an abiding issue as to the legality of the ANPR system and, in particular, whether it unjustifiably interferes with the right to privacy under Article 8 and/or with the data subject’s rights under the DPA. Whilst this is a nettle which the Tribunal itself considered it did not need to grasp in the circumstances of the Mathieson appeal, there can be little doubt but that it is a nettle which will be subject to judicial examination in the future.

Anya Proops

Information Law in the Facebook Age

Posted on | by Anya Proops KC

Facebook has now been in existence for some eight years. Its active users exceed 900 million. However, we are still very much in the early days of understanding how information law applies to information, including personal data, which is stored and shared on Facebook. In this context, it is worth noting two recent judicial decisions which bring into sharp focus the way in which information on Facebook may be both used and misused.

The first case involved a claim brought in the High Court by Nicola Brookes. Ms Brookes had been subject to extremely serious abuse on Facebook after she posted a comment online supporting a contestant on the X-Factor. The abuse included the setting up of a fake Facebook page which purported to be in her name and which resulted in Ms Brookes being falsely accused of being a paedophile and drug-user. Ms Brookes’ abusers of course operated anonymously so there was no way for Ms Brookes to identify them merely by use of the site. Having then apparently failed to obtain details of the identity of the abusers directly from Facebook, Ms Brookes was obliged to apply to the court for a Norwich Pharmacal order requiring Facebook to disclose the names, email addresses and IP addresses of the people who had launched the abusive messages. It is understood that this may be the first case in which an individual has been able to secure a court order requiring Facebook to disclose personal data about its users. No doubt, this judgment (which it seems has yet to be reported) sends out an important message to those individuals who would wish to engage in anonymous cyber-bullying. However, query just how much reassurance the judgment gives to those who realistically are not in a position to incur the considerable costs entailed on engaging in the type of litigation which Ms Brookes was obliged to undertake.

The second case involved the application of s. 40 FOIA (the personal data exemption) to the names of a number of Youth Councillors, including a number of Youth Councillors who were minors, in circumstances where it was discovered after the Commissioner issued his decision notice that many of the names could be found by accessing an effectively public-facing Facebook page: Morley v IC & Surrey Heath Borough Council (EA/2011/0173).

The background to the Morley case was as follows: in 2010, the Council approved a planning application to allow for the creation of a recreation park within its area; as part of the planning process the Council unofficially consulted the Surrey Heath Youth Council; the Youth Council is funded by Surrey County Council and comprises youth councillors who are all aged between 13 and 19; after the planning application was approved, Mr Morley, who objected to the development, requested disclosure of the names of the members of the Youth Council who had been consulted by the Council; that request was refused by the Council on the basis that the names amounted to personal data which were exempt from disclosure under s. 40. It appears that after the Council refused Mr Morley’s request, Mr Morely discovered that the Youth Council had a Facebook page and, further, that information on that page included the names of various Youth Council members along with their photographs. Mr Morley’s position was that all the names should be released on the basis that there is a strong need for the planning process to be fully transparent and that this principle applied equally to those who are unofficially consulted and, indeed, irrespective of whether they may have been minors at the time they were consulted or, further, at the time of the request. He further submitted that there was in any event no proper justification for withholding the names of those Youth Councillors who had voluntarily agreed to place their data on a Facebook page which was open and accessible to anyone who registered with Facebook. The Commissioner and the Council argued before the Tribunal that all of the names should be withheld, not least because it could not be assumed that the individual Youth Councillors listed on the Facebook page had been listed at the time of the request.

By a majority decision, the Tribunal concluded that s. 40 was not engaged with respect to the Youth Councillors who were listed on the Facebook page but that it was engaged in respect of the other Youth Councillors. With respect to those Youth Councillors who were listed on Facebook, the Tribunal held as follows:

’77. … their decision to put their names and photographs into the public domain considerably diminishes the strength of the respondent’s arguments for why disclosure of their names would not be fair. In particular, arguments that they may not have expected that the information would be disclosed, that they have not consented to their names being disclosed, and that disclosure would cause them distress, rapidly fall away, in our view, where the Youth Councilors have themselves chosen to make the information available in a widely used and easily accessible social networking site, without placing any restrictions on access. In our view, it cannot be said to be unfair to disclose the names of the Youth Councillors whose names appear on Facebook’.

With respect to the argument that the names should still be withheld because it could not be assumed that the individuals in question were listed on Facebook at the time of the request, the tribunal said this:

’80. However, while we acknowledge the problems identified by the Council and Commissioner, FOIA does not require a public authority to comply with a request only when the information it holds precisely matches what the requester has asked for. A requester will often have the disadvantage of not knowing exactly what the public authority holds. What the public authority must do in this situation is to engage with the requester, pursuant to its obligations under section 16 (obligation to provide advice and assistance), to explore whether the information it does hold, even if imperfect, can satisfy the request. The Council has not done this. We do not criticise it. We are mindful that the Council was not aware of the Facebook page at the time that it refused the request, and in any event has taken the position that the information is exempt. However, the mismatch between what the Appellant has requested and what the Council can provide is not itself a reason for refusing to disclose the information under section 40(2), nor is it a basis on which disclosure can be said to be unfair’.

With respect, it is not entirely clear how these points answer the argument which the Commissioner and the Council was advancing. But perhaps the more important point emerging from this decision is that it suggests that individuals, even where they are minors, must have a substantially lower expectation of privacy in respect of their personal data in circumstances where they opt to place that data on an effectively unrestricted Facebook page.

Anya Proops

MINISTERIAL VETO STRIKES AGAIN – MINISTER’S STATEMENT PUBLISHED

Posted on | by Anya Proops KC

On Tuesday, I blogged about the decision of the Secretary of State for Health to veto the order requiring disclosure of the transition risk register in the NHS risk registers case. Today the Secretary of State published his statement as to the reasons for the imposition of the veto. You can read the statement here: https://www.dh.gov.uk/health/2012/05/statement-transition-register/. The statement is notable not least because it suggests that, in the Government’s view, there is a very strong public interest in avoiding the disclosure of risk registers, which are used as a tool across government, particularly where the advice they contain ‘is required at highly sensitive times on highly sensitive issues’. The statement also reveals that, so far as the Government is concerned, despite being concerned with policy implementation rather than policy development, transition risk registers may yet retain a high degree of sensitivity, particularly where they are being used against a backdrop of shifting policy priorities. Finally, it is worth noting that one of the factors which apparently influenced the decision to issue the veto is the fact that the publication of the transition risk register would have acted as ‘a serious distraction from progressing the [NHS reform] proposals’. This is something which is likely to be leapt on by opponents to the reform proposals, many of whom take the view that the Government is deliberately seeking to avoid disclosure of the registers because it is concerned that they will reveal fundamental flaws in the proposals.

THE MINISTERIAL VETO STRIKES AGAIN – BUT THIS TIME NOT IN RESPECT OF CABINET MINUTES

Posted on | by Anya Proops KC
In early April 2012, I posted on the Tribunal’s decision in the NHS risk registers case (you can see my post here and also Robin Hopkins’ follow up post here). In summary, the Tribunal concluded that the ‘transition risk register’ ought to have been disclosed but the ‘strategic risk register’ was lawfully withheld on an application of s. 35 FOIA. Today, the Government has announced that it is exercising its power of veto in respect of the order to disclose the ‘transition risk register’. Apart from the fact that the veto obviously represents an important twist in the NHS risk registers case, what is interesting about the veto decision is that it potentially represents a sea-change in the Government’s thinking on the use of the veto. To date, the veto has been used in only three cases, all of which involved requests for disclosure of Cabinet minutes. What is striking about today’s announcement is that the veto is being applied, not in respect of Cabinet minutes, but rather in respect of a risk assessment document which was prepared in respect of the Government’s controversial plans to reform the NHS. Notably, the statement made by the Secretary of State for Health, Andrew Lansley, confirms that the decision to issue the veto was influenced by the need to ensure that there was a ‘safe space where officials are able to give ministers full and frank advice in developing policies and programmes’ (see further this link to the statement). This compares with the emphasis on providing a ‘safe space’ for cabinet ministers which was highlighted in the context of the previous vetoes. The important question which the use of the veto in the risk registers case effectively poses is whether we are going to see a more prolific use of the powers of veto in the future. If we are, that may well have important political ramifications for the Coalition Government as well as generally recasting the FOIA landscape. See further my posts on the first two vetoes which you can find here and also my 2009 paper which considered the use of the veto which you can find here. The Commissioner has stated that he will report to Parliament on the use of the veto next week.

PROTECTING CONFIDENTIAL INFORMATION UNDER FOIA – NEW FTT DECISION

Posted on | by Anya Proops KC

The FTT has recently handed down a decision which considers in some detail the operation of s. 41(2) FOIA (exemption in respect of confidential information): Moss v IC & Home Office (EA/2011/0081). In Moss, a request was made for disclosure of a particular report prepared by IBM and provided to the Home Office. The report was compiled in circumstances where IBM was seeking to tender for provision to the Identity and Passport Service (IPS) of a biometric recognition system and was, as part of this process, considering which biometric software provider to partner with. The report sought to test the suitability of various biometric software providers and their products with a view to establishing which provider should be treated as the preferred provider in the context of the tender. IBM decided to provide the report to the IPS in order to build confidence in the solution that it was offering to the IPS as part of the tender process. The report was provided to the IPS in circumstances where there were various agreements in place which, whilst recognising the IPS’ obligations under FOIA, effectively obliged the IPS to treat the information it received from tenderers as confidential. Mr Moss submitted a request to the Home Office for disclosure of the report. The Home Office refused to disclose the report, relying on a number of exemptions including s. 41(2). The Commissioner concluded that the refusal was lawful on an application of s. 41(2). On appeal to the tribunal, Mr Moss sought to argue that the Commissioner had misapplied s. 41(2). In a lengthy judgment, a majority of the tribunal upheld the Commissioner’s decision. However, the minority held that the report ought to have been disclosed, subject to redactions to protect in particular the commercial interests of the software providers. The majority judgment is notable not least because of its emphatic approval of the test for breach of confidence adopted by Megarry J in Coco v Clark [1968] FSR 415. Other aspects of the majority judgment which are worthy of note include the majority’s conclusion that the public interest defence will not be available in respect of a potential claim for breach of confidence merely because the public has an interest in seeing the information in question (see in particular paras. 84 et seq).

Interestingly, both the majority and the minority touched on issues relating to the application of Article 10 in their respective judgments. The majority alluded to Article 10 in the context of highlighting the ways in which the Article 10 right to freedom of expression may bolster a prospective public interest defence against a claim for breach of confidence. (The existence of such a defence is relevant to the question whether, for the purposes of s. 41(2), disclosure of confidential information would give rise to an ‘actionable breach of confidence’). The minority, by way of contrast, alluded to the Article 10 right to receive information, which had recently been considered in the Sugar and Kennedy cases (in the Supreme Court and Court of Appeal respectively). The minority queried whether and to what extent the recent jurisprudence on the Article 10 right to receive information ought to be shaping the analysis of the public interest defence under s. 41(2). See further my earlier post on the Kennedy judgment here.

Anya Proops