Like everyone else who operates in the field, this blog may have touched once or twice on the issues arising out of Schrems. Both Robin (here) and Tim (here) have provided some summaries of the sorts of alternatives data controllers will need to think about, and the guidance issued by the Article 29 Working Party as a result. But what, everyone has been asking, does the European Commission have to say about all this?

Happily, the heavy lids of ignorance may be lifted as the Commission has awoken. (Whether it more closely resembles the Force or a Kraken is perhaps a matter of personal preference.) It has produced a lengthy document which is actually both helpful and readily understandable. Not adding umpteen recitals probably helps. It draws together a lot of the practical issues and much of the existing guidance from the Article 29 WP already discussed for a sort of cheat-sheet document to help you navigate the ongoing choppy waters. You can find and download it here. Continue reading →

This is not a lengthy analytical post; it is by way of quick update on the much overlooked younger sibling of the proposed General Data Protection Regulation: the Data Protection Directive for the police and criminal justice sector. Most practitioners are understandably focussing on the Regulation: that is the instrument which will affect most of us most of the time. But the EU is proposing to harmonise the rules across sectors and, at the same, implement a new Directive applicable to the police and criminal justice sectors. The existing Directive does not, of course, apply to that arena by virtue of article 3(2) (although the DPA 1998 is unlimited in its scope, so the point has rarely been of much relevance domestically). Continue reading →

As if TalkTalk don’t have enough to think about at the moment, the House of Commons yesterday discussed the sanctions available to the Information Commissioner for significant data breaches. Responding to an urgent question on the TalkTalk incident, the Minister for Culture and the Digital Economy (wasn’t that one of Gladstone’s titles once?), Ed Vaizey, made a number of interesting comments. Continue reading →

It has been an admirable trend of Tribunals in FOIA cases over the last few years that they have been increasingly sceptical of assertions on the part of public authorities that disclosure will provide chilling effects on their activities. An inevitable pattern forms of an insistence that the sky will fall in if information is released, information is released (or leaked), and the sky appears not to fall in. Government grinds on. But Judge Jacobs has provided a little more comfort for such arguments in DWP v Information Commissioner, Slater & Collins [2015] UKUT 535 (AAC). The case related to various risk register documents related to Universal Credit.

Before the FTT (see here) the DWP’s evidence was criticised for failing to provide any concrete evidence of ways in which this chilling effect had manifested itself across Government and noted that a different, but related, document had been leaked and had not appeared to have any chilling effect. Judge Jacobs was not impressed by this. He condemned the reasoning as sufficiently irrational to amount to an error of law because it had required evidence of something which would be very unlikely to be able to be evidenced (i.e. there wouldn’t be a paper trail of civil servants being circumspect) and because it compared the disputed information with a document it hadn’t seen (the leaked document). That error was sufficiently important to impugn the judgment as a whole, even though it was just one paragraph in a lengthy decision.

One can see the point about drawing conclusions from a document the Tribunal had not actually seen, but the other aspect of the criticism is more problematic. There might be expected to be some evidence of a chilling effect, if only by a comparison of the way in which civil servants worked before and after relevant events. Civil servants have duties to advise frankly which Tribunals have been rightly slow to conclude they would avoid complying with. The Justice Select Committee has previously found little evidence of such a chilling effect across Government (see the summary here). It is particularly difficult to see how the approach is especially consistent with that of Charles J in Department of Health v Information Commissioner & Lewis [2015] UKUT 159 (AAC), in which a Departmental tendency to indulge in a Mandy Rice-Davies approach was noted, along with a cautionary requirement for specific evidence of harm (see my commentary here). In short, the approach of Judge Jacobs is a little too close for comfort to allowing bare assertions of a nebulous chilling effect provided by a professional civil service. One must recognise the difficulties of proving a counter-factual, but whether Slater or Lewis more accurately casts the balance is a matter for some debate.

Judge Jacobs also noted that evidence will need to consider what officials ought to do as an aspect of the Tribunal’s predictive duties in relation to the actual effect of disclosure. More unusually, he also indicated a willingness (obiter) to open up the question of the trouble that can be caused by the media taking a selective approach to what it publishes and putting its own spin on that material as a relevant aspect. The ICO has long taken a clear line – applied in numerous cases by the FTT – that subsequent use and possible misrepresentation is, essentially, tough. Public authorities have to take it on the chin as part of the wider debate and can publish it with explanatory material which mitigates the risk of decontextualizing. Given the ability of people to take pretty much any sentence out of context, this would appear to be a very anti-disclosure line of reasoning of very broad scope and it will be interesting to see if it is returned to in future cases in which it matters more directly.

In the meantime, Judge Jacobs appears to have adopted the words of House Stark on the chilling effect: “Winter is Coming”.

Julian Milford appeared for the DWP and Robin Hopkins for the ICO.

Christopher Knight

It is difficult to imagine what could possibly have happened yesterday to cause the CJEU’s judgment in Case C-71/14 East Sussex County Council v Information Commissioner (judgment of 6 October 2015) to slip beneath the waves, but for those who spent the day reading, talking and thinking about Safe Harbo(u)rs (presumably something to do with shipping?) East Sussex represents a comforting return to normality, if not mundanity, where the CJEU is asked straightforward questions and it doesn’t quite answer them.

The ability to impose charges for the provision of property search information is an important financial issue for many local authorities. Historically it had been thought by many that the imposition of such charges was governed by the Local Authorities (England) (Charges for Property Searches) Regulations 2008 (“CPSR”), which allow local authorities to recover all the costs of making such information available (including staff costs, overhead costs and the costs of maintaining relevant information systems). However, in recent years there has been an increasing awareness of the fact that requests for property search information to a large extent amount to requests for access to environmental information, such that they call for an application of the charging regime provided for in reg 8 of the Environmental Information Regulations 2004. The CPSR itself specifically provides that it does not apply to the provision of any information which is governed by other statutory charging regimes. Accordingly, it would seem that the CPSR is inapplicable in respect of requests for property search information insofar as those requests are made under the EIR.

Regulation 8 EIR – implementing Article 5 of Directive 2003/4/EC – allows reasonable charges to be imposed for making environmental information available, save that no charge may be imposed for permitting access to public registers or examining the requested information in situ. In East Sussex the applicant requested answers to questions in the standard property search form issued by the Law Society, the CON29R form. The Council imposed a fixed charge for providing this information, the fixed charge having been calculated on the basis of the approach provided for in the CPSR (i.e. was a charge which was intended to produce a cost neutral result for the Council). The charge itself factored in not only disbursement costs, but also staff time, a portion of the Council’s overhead costs, office costs and a portion of the costs of maintaining the information systems from which the relevant information is derived. Was this lawful? And also, was it permissible to approach the question of whether the costs were reasonable on a judicial review-type basis (which follows from reg 8(3) EIR which frames the question in terms whether the “the public authority is satisfied” that the charge was reasonable)?

To be fair to the CJEU, it provided a relatively clear answer on the first issue of what sort of costs can be recouped through charging. It emphasised that the charges must relate to the supply of the information, and that supply had to be something over and above the costs of establishing and maintaining the register/list of environmental information which had to be able to be inspected in situ for free. Any cost which relates to maintaining that database cannot be attributed to the supply: at [33]-[38]. The sort of thing which can be charged for encompasses “not only postal and photocopying costs but also the costs attributable to the time spent by the staff of the public authority concerned on answering an individual request for information, which includes the time spent on searching for the information and putting it in the form required. Such costs do not arise from the establishment and maintenance of registers and lists of environmental information held and facilities for the examination of that information“: at [39]. Staff costs/overheads which are actually attributable to the supply (as opposed to database maintenance) are recoverable in the application of ordinary accounting principles: at [41].

Any charge must still not exceed a reasonable amount, not least because there should not be a deterrent effect on those wishing to exercise their right of access to environmental information, applying Case C-217/97 Commission v Germany [1999] ECR I-5087. In assessing whether such an effect would result, and the charge is unreasonable, the Tribunal must consider both an objective analysis of the situation and the subjective financial position of the requestor: at [43]. The point of this is, of course, to ensure that a charge is not waved through simply because the requestor happens to be rich or well-funded when it would plainly deter others, and nor should the Court be taken to be approving requestor-specific variable charges. Although the Court did not finally determine the matter, it gave a clear indication at [44] that costs of £1-£4.50 were unlikely to fall foul of the reasonableness requirement, particularly given a reduction would be required to ensure the charges complied with the Court’s interpretation of what charges could be recovered in the first place.

More abstractly, the CJEU also considered the nature of the review process applied under reg 8(3), which has been interpreted to be restricted to judicial review principles. This the Court does not quite answer. It reiterates the unsurprising principle that the review must comply with the principles of equivalence and effectiveness, that JR which does not involve a full factual assessment is not necessarily problematic for EU law (at [58]; which is entirely consistent with the flexible nature of English JR principles in any event: R (A) v Croydon LBC [2009] UKSC 8; [2009] 1 WLR 2557), but that the assessment of whether charges are actually for supplying and whether they are reasonable are questions of EU law which must be capable of review on the basis of objective elements: at [58]-[59].

No need then to rip up reg 8 EIR, but some finessing on the part of local authorities will probably be needed as to their charging schemes, and Tribunals will need to be willing to engage a little more closely with those charging decisions on appeal. As Radiohead would say, “no surprises”. And they would. Panopticon has it on good (/made up) authority that Radiohead are very interested in charging decisions, lobbying strongly for a ‘pay what you want’ approach not only to albums but also to environmental information. Maybe next time lads.

Anya Proops appeared for the ICO.

Christopher Knight

To no-one’s very great surprise following the Opinion of AG Bot, the CJEU has today declared the Commission’s Safe Harbor Decision invalid in Case C-362/14 Schrems, with all the consternation that that causes to inter-state trade between the US and the EU.

Fuller commentary when the judgment is available later but it tops off a bad week for data controllers.

Christopher Knight