Employment lawyers have tended to see data protection as an employee weapon; in particular the strategic fishing expedition subject access request as a precursor to High Court or Tribunal claims. But there is at least one angle from which the DPA can be used as a weapon of attack by employers against former employees. Where an employee leaves their employer and takes a client list with him, not only will he be in breach of the usual restrictive covenants he is likely to have, but he may also have committed a criminal offence under section 55 DPA. Continue reading →

Remember how the whole point of the Schrems litigation was that the Irish Data Protection Commissioner wasn’t doing enough (/anything) to query the protections available for data subjects in the US under the Safe Harbor scheme? Well, with the zeal of the convert – or alternatively, on the basis of once bitten, twice shy – the Irish DPC has now announced that its new-found energy encompasses a desire to call into question the compatibility of US data transfers under the approved Standard Contract Clauses, in the light of the Schrems judgment.

Continue reading →

A few transparency-related updates for readers, which will have a potential impact on (a) the engagement of exemptions under FOIA and the EIR, and (b) the public interest balance. As the Government insists on more openness about certain types of information, including its own, so the withholding of similar information will be harder to justify. There is also now a confirmation that a revised Code of Practice under section 45 FOIA is on its way. Continue reading →

There has long been considerable public concern over the restraint techniques used in young offender institutions and secure training centres. In Willow v Information Commissioner & Ministry of Justice [2016] UKUT 157 (AAC), the Upper Tribunal had to consider the public interest balance as it applied to section 31(1)(f) FOIA, i.e. information prejudicial to the maintenance of security and good order in prisons or other institutions in which people are detained. The request had been for the physical restraint training manual, and the FTT had upheld the application of the exemption.

Much of the judgment is concerned with a reasons challenge of fairly limited wider interest, although Judge Markus stressed that the balancing exercise involves weighing the risk of actual harm and the real chance of benefits, taking account of consequences which are realistic possibilities, and that where the ‘likely to prejudice’ limb was being run concrete evidence was likely to be in short supply. So far, so orthodox, and the reasons/lack of evidence challenge was really a re-run of arguments which failed in the FTT.

More unusual was the centrality to the arguments of the UN Convention on the Rights of the Child. Everyone accepted that the interests of children were part of the balance, but the Respondents (not unfairly) pointed out, that was what the whole case was about, and those interests did not all point one way. However, the argument for the requestor went beyond that, suggesting that article 3(1) of the Convention required particularly close focus on those interests and that FOIA should be construed so far as possible in accordance with that provision.

Judge Markus was having none of this. The Convention is an unincorporated treaty, and she carefully analysed the case law to explain that the authorities did not require unambiguous legislation to be construed consistently with an unincorporated provision, particularly where no ECHR right was engaged (which can be sidewind route to using the Convention). She firmly held that FOIA was not ambiguous, there was no ECHR issue and FOIA could not be incorporating or reflecting article 3(1) in any way. In short, everyone had been thinking of the children, and they were not required to think about them with any greater force.

Christopher Knight

If you thought the GDPR had a disappointing ring of informality to it, you will be delighted to hear that the final translated text of the GDPR has now been published in the Official Journal. As a result, it has a number: Regulation 2016/679. But it is not just a number; it is also a free man, having a lengthy name (“Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC”). The OJ English text in html can be found here, and the pdf here. Article 99(2) provides that it shall apply from 25 May 2018.

Altogether now: ‘Remember my name: Regulation 2016/679! I’m going to live forever!* I’m going to learn how to fly!**”

*Or at least until the next burst of data protection enthusiasm.

**Although better details on learning to fly may be found in the new Passenger Name Record Directive, or Directive 2016/681. The Criminal Law Enforcement Data Protection Directive, or Directive 2016/680, has also now been published.

Regulation 2016/679 doesn’t sound very catchy, but we’ll all know it off by heart soon enough.

Christopher Knight

Like a baby found in a basket of reeds, the long-awaited review of the Independent Press Standards Organisation (IPSO) has appeared over the horizon.

Today IPSO issued a press release announcing the appointment of Sir Joseph Pilling, a retired civil servant, to conduct a review of its independence and effectiveness (for coverage of which see here). The review will be assisted by 11KBW’s own Zoe Gannon.

The terms of reference are available on its website and it is inviting submissions from the general public and key stakeholders. I suspect regular readers of Panopticon will have a lot of things to say (at least some of which will not be a Moses-based pun) and may want to get in touch.

In any event, we look forward to hearing what Sir Joseph concludes on whether IPSO is successfully regulating the press. The plan is for the review to have concluded in six months.

Christopher Knight