It has long been clear that, so far as the common law is concerned, there is no neat dividing line between information which is private and that which is public. Thus, depending on the circumstances, information relating to an individual’s private life which has entered the public domain may yet engage privacy rights (see further e.g. McKennitt v Ash [2005] EWHC 303 (QB) and Green Corns v Claverley [2005] 958 (QB) and Rocknroll v News Group [2013] EWHC 24 (Ch)). However, what is the position where, notwithstanding that an injunction restrains the publication of the information domestically, the information is being extensively published and shared online elsewhere around the world?

This is the difficult issue which the English Court of Appeal was required to address in the high profile case of PJS v News Group Newspapers [2016] EWCA Civ 393. In PJS, the English Court of Appeal had granted the claimant an interim injunction restraining publication of information concerning his engagement in a particular sexual encounter, the notorious ‘celebrity threesome’. There had been no legal challenge to the granting of the injunction. However, after the injunction was granted, the story was published overseas and promptly spread like wildfire on the internet. This led to an application by NGN to discharge the injunction, on the basis that, because PJS’s identity was now so widely known, it was in effect not worth the paper it was written on. Continue reading →

So here’s the news you’ve all been waiting for: Elizabeth Denham, former Information and Privacy Commissioner, British Columbia, Canada is to be appointed as the new Information Commissioner, following the conclusion of Christopher Graham’s tenure this summer – see further the ICO announcement here. Ms Denham will be faced with some very substantial challenges in her new role, including dealing with the transition to the brave new world engendered by the General Data Protection Regulation. Panopticon wishes Ms Denham very well in her new post. It also wishes to thank Christopher Graham both for his invaluable contribution both to the development of the law relating to information rights and to the operational efficiency of the ICO. We wish him very well for the future.

Anya Proops QC

You can access the report here. The commission’s recommendations are at pages 57-58. Key recommendations to note:

• s. 35 (exemptions in respect of government policy information) 
  • s. 35(1)(a) should be replaced with an exemption ‘which will protect information which would disclose internal communications that relate to government policy’. [NB, it is not suggested in the report that this exemption should be cast as an absolute exemption. Rather this is about reframing the terminology of s. 35(1)(a)]
  • s. 35(1)(b) should be expanded to cover information relating to collective Cabinet decision-making, as well as protecting inter-ministerial communications.
  • re the public interest test, section 35 should be amended to make clear that:
    • ‘in making a public interest determination under section 35(1)(a), the public interest in maintaining the exemption is not lessened merely because a decision has been taken in the matter’.
    •  ‘in making a public interest determination under section 35, regard shall be had to the particular public interest in the maintenance of the convention of the collective responsibility of Ministers of the Crown, and the need for the free and frank exchange of views or advice for the purposes of deliberation.’
• S. 36 (prejudice to conduct of public affairs) – the requirement for the reasonable opinion of a qualified person should be removed
• the veto
  • ‘The government should legislate to put beyond doubt that it has the power to exercise a veto over the release of information under the Act’
  • ‘The government should legislate to make clear that the power to veto is to be exercised where the accountable person takes a different view of the public interest in disclosure. This should include the ability of the accountable person to form their own opinions as to as to all the facts and circumstances of the case, including the nature and extent of any potential benefits, damage and risks arising out of the communication of the information, and of the requirements of the public interest.
  • the veto ‘should be available only to overturn a decision of the IC where the accountable person takes a different view of the public interest in disclosure. Where a veto is exercised, appeal rights would fall away and a challenge to the exercise of the veto would be by way of judicial review to the High Court. The government should consider whether the amended veto should make clear that the fact that the government could choose to appeal instead of issuing a veto will not be a relevant factor in determining the lawfulness of an exercise of the veto. Until legislation can be enacted, the government should only exercise the veto to overturn a decision of the IC.
  • ‘The government should legislate to allow the veto to also be exercised even where the IC upholds a decision of a pubic authority. This would mean that the right of appeal would fall away and challenge would be instead by way of judicial review.
• limiting the scope for appeals: ‘That the government legislates to remove the right of appeal to the First-tier Tribunal against decisions of the IC made in respect of the Act. Where someone remained dissatisfied with the IC’s decision, an appeal would still lie to the Upper Tribunal. The Upper Tribunal appeal is not intended to replicate the full-merits appeal that currently exists before the IC and First-tier Tribunal, but is limited to a point of law’
• extensions of time to respond to FOIA requests – limited to an additional 20 days
• internal reviews – statutory time limit of 20 days for internal reviews
• publication obligations to be imposed on all FOIA authorities which employ more than 100 employees – to include duties to publish: (a) statistics on compliance with FOIA and (b) all requests and responses where information is provided in response to a request. Public bodies should be required to publish pay breakdown for senior employees
• code of practice – FOIA code of practice should be reviewed. Revised code should encourage public authorities to use s. 14 in an appropriate way
• ICO funding – The Government should review whether funding for the ICO is adequate.

More detailed analysis will no doubt follow in due course

Anya Proops QC

So there we have it: FOIA is working well and does not need to be substantially reformed. These are the overall conclusions of the FOIA review commission, as confirmed today by Cabinet Office Minister Matt Hancock (see the BBC report here). This outcome will come as a surprise (and a huge relief) to many who had believed that the commission would follow the Blair line and conclude that the FOIA genie needed to be put firmly back in its bottle. So apparently a triumphant outcome for those in favour of the transparency agenda, but a sorry day for those who, like Mr Blair, believe that FOIA has had and continues to have a ruinous effect on government.

The full report is due to be published shortly. It will be interesting to see whether, despite Mr Hancock’s announcement, there are some proposed changes which may yet have a rather hobbling effect on the FOIA regime. For example, it is not presently clear whether the report may effectively invite the Government to press ahead with a fees regime for FOIA tribunal cases. That said some media reports are already suggesting that, in response to the report, the Government has ruled out introducing a fees and has also opted not to shore up the veto regime, which was so extensively undermined in Evans v Information Commissioner (see here).

Of course, FOIA is itself a highly politicised football and it is hard to imagine that reining in a legislative regime designed to put power in the hands of the people would have been anything other than a fairly politically toxic proposition for the Government. Certainly, the deep opposition to such a proposition voiced by Labour politicians, such as Tom Watson MP, not to mention Conservative politicians such as David Davis MP, can hardly have reassured the Government that introducing restrictions on the FOIA regime would have been a political walk in the park.

An interesting question which many will now be pondering is whether the conclusions of the commission may actually add grist to the mill of those who are campaigning for an extension of the FOIA regime. For example, one wonders whether in the months to come we shall see a renewed focus on opening up the FOIA regime so that it applies to privatised public functions (see this further Guardian report on Tom Watson MP’s comments on this issue). One thing is for sure however, there will be further discussion both of the commission’s report and its aftermath on Panopticon.

Anya Proops QC

The Northern Irish courts have this week reached an important judgment in a case involving the hosting of unlawful content on youtube. Readers are referred to this helpful Inforrm post on the judgment by Olswang’s Ashley Hurst and Emma Cross.

Anya Proops QC

The question of how data protection rights cash out within the online environment is without doubt one of the more difficult questions which data privacy practitioners have to tackle. One major area of contention is the extent to which data protection legislation applies to ostensibly anonymous, impersonal online data. This is an issue which our own Court of Appeal considered last year in the case of Vidal-Hall v Google. In that case, the Court of Appeal readily accepted that there was at the very least a serious issue to be tried on the question of whether tracking data used by Google to track the browsing activities of Google users amounted to ‘personal data’. This was despite the fact that Google did not generally know the name of the user in question: its tracking operation entailed the tracking of individual devices, rather than named individuals. According to the Court, there was a serious issue to be tried the question of whether the tracking data amounted to ‘personal data’, particularly in view of the way in which Google’s appeared effectively to individuate end users through the use of cookie technology.

What then of IP addresses? Can they too amount to personal data, despite the fact that they may not per se themselves yield any specific name or other traditional identifier? This is the issue which the CJEU will be addressing in the forthcoming case of: Breyer (Case C-582/14), due to be heard by the CJEU on 25 February 2016. Whilst of course nothing would give me greater pleasure than to wax lyrical on the particular technical arguments which lie behind this case, I feel I must defer to this easy-to-follow analysis on EU Law Radar. But I will just point out that as long ago as 2007 the Article 29 EU Working Party was prepared to express the view that the definition of ‘personal data’ in the Data Protection Directive was wide enough to encompass IP addresses (see its Opinion 4/2007). Given the current direction of travel within Europe in terms of giving online data privacy legislation some bite, it would not be altogether surprising if the CJEU took the same view.

Anya Proops