A Search (Engine) for Enforcement? (Yes, Google again…sigh.)

In a move apparently carefully designed to hurt this blog’s rankings in the leading search engine algorithm, Panopticon must – yet again – note Google’s noble efforts to single-handedly ensure the development of data protection and privacy law.

Robin Hopkins has noted the AG’s Opinion on Google and the right to be forgotten case. I have noted the enforcement action taken by the ICO against Google in relation to the data harvested by its Street View cars.

Readers with marginally longer memories (or an expert search engine) may recall my blogging that on 20 June the French data protection agency issued a statement in relation to its investigation into Google’s privacy policy, announcing that it was taking enforcement action following a Europe-wide series of investigation which the French had spearheaded. I noted that the ICO had yet to announce its own decision.

Well, on 4 July, the ICO did announce its decision. It too has written to Google to inform the company that its privacy policy raises serious questions of non-compliance with the Data Protection Act 1998 and Google has been given until 20 September to amend the policy in a compliant manner or face formal enforcement action.

The ICO’s press release is here, and the text of their announcement is:

“We have today written to Google to confirm our findings relating to the update of the company’s privacy policy. In our letter we confirm that its updated privacy policy raises serious questions about its compliance with the UK Data Protection Act.

In particular, we believe that the updated policy does not provide sufficient information to enable UK users of Google’s services to understand how their data will be used across all of the company’s products.

Google must now amend their privacy policy to make it more informative for individual service users. Failure to take the necessary action to improve the policies compliance with the Data Protection Act by 20 September will leave the company open to the possibility of formal enforcement action.”

Google’s core values famously included the phrase “Don’t be evil”. Potential breaches of the DPA are perhaps not quite in that league (or at least, not usually), but Google is certainly having a difficult time finding its way through the DPA thicket. If only they could just Google the answer…

Christopher Knight

Knowing I’m On the Street Where You Live? Well, Google Does.

Following on from yesterday’s French enforcement announcement, the ICO announced on 21 June 2013 that the collection of personal data by Google’s Street View cars – including email addresses, URLs and passwords relating to thousands of individuals – was required to be deleted within 35 days. This payload data was, according to Google, accidentally collected by the cars when they travelled around the UK. Google has undertaken to comply and delete the data, so an appeal against the Enforcement Notice is not expected.

The terms of the Enforcement Notice can be seen here.
The ICO’s press release can be seen here.

Christopher Knight

Google and Data Protection Across Europe

On 20 June 2013 the Commission nationale de l’informatique et des libertés (the CNIL) – the French data protection agency – issued a statement in relation to its investigation into Google’s privacy policy. It formed part of co-ordinated action by data protection agencies in France, Germany, Italy, the Netherlands, Spain and the United Kingdom. The CNIL announced that Google was in breach of the French data protection legislation, mirroring findings in other European jurisdictions. The full text of the statement reads:

“From February to October 2012, the Article 29 Working Party (“WP29”) investigated into Google’s privacy policy with the aim of checking whether it met the requirements of the European data protection legislation. On the basis of its findings, published on 16 October 2012, the WP29 asked Google to implement its recommendations within four months.

After this period has expired, Google has not implemented any significant compliance measures.

Following new exchanges between Google and a taskforce led by the CNIL, the Data Protection Authorities from France, Germany, Italy, the Netherlands, Spain and the United Kingdom have respectively launched enforcement actions against Google.

The investigation led by the CNIL has confirmed Google’s breaches of the French Data Protection Act of 6 January 1978, as amended (hereinafter “French Data Protection Act”) which, in practice, prevents individuals from knowing how their personal data may be used and from controlling such use.

In this context, the CNIL’s Chair has decided to give formal notice to Google Inc., within three months, to:
◾Define specified and explicit purposes to allow users to understand practically the processing of their personal data;
◾Inform users by application of the provisions of Article 32 of the French Data Protection Act, in particular with regard to the purposes pursued by the controller of the processing implemented;
◾Define retention periods for the personal data processed that do not exceed the period necessary for the purposes for which they are collected;
◾Not proceed, without legal basis, with the potentially unlimited combination of users’ data;
◾Fairly collect and process passive users’ data, in particular with regard to data collected using the “Doubleclick” and “Analytics” cookies, “+1” buttons or any other Google service available on the visited page;
◾Inform users and then obtain their consent in particular before storing cookies in their terminal.

This formal notice does not aim to substitute for Google to define the concrete measures to be implemented, but rather to make it reach compliance with the legal principles, without hindering either its business model or its innovation ability.

If Google Inc. does not comply with this formal notice at the end of the given time limit, CNIL’s Select Committee (formation restreinte), in charge of sanctioning breaches to the French Data Protection Act, may issue a sanction against the company.

The Data Protection Authorities from Germany, Italy, the Netherlands, Spain and the United Kingdom carry on their investigations under their respective national procedures and as part of an international administrative cooperation.

Therefore,
◾The Spanish DPA has issued to Google his decision today to open a sanction procedure for the infringement of key principles of the Spanish Data Protection Law.
◾The UK Information Commissioner’s Office is considering whether Google’s updated privacy policy is compliant with the UK Data Protection Act 1998. ICO will shortly be writing to Google to confirm their preliminary findings.
◾The Data Protection Commissioner of Hamburg has opened a formal procedure against the company. It starts with a formal hearing as required by public administrative law, which may lead to the release of an administrative order requiring Google to implement measures in order to comply with German national data protection legislation.
◾As part of the investigation, the Dutch DPA will first issue a confidential report of preliminary findings, and ask Google to provide its view on the report. The Dutch DPA will use this view in its definite report of findings, after which it may decide to impose a sanction.
◾The Italian Data Protection Authority is awaiting additional clarification from Google Inc. after opening a formal inquiry proceeding at the end of May and will shortly assess the relevant findings to establish possible enforcement measures, including possible sanctions, under the Italian data protection law.”

Panopticon likes to deliver news from across la Manche too, and following on from Google’s involvement in the American Prism revelations, it would appear to have been a difficult couple of weeks for the leading internet search engine. Precise steps are awaited from the ICO at home.

 

Christopher Knight

Charges under Reg 8 EIR: a Power Cut for Public Authorities

In Kirklees Council v IC & Pali Ltd [2011] UKUT 104 (AAC) the Upper Tribunal held, in the context of property search information, that reg 8(2) EIR precluded an authority from charging for allowing applicants to inspect information in situ and that a charge was only permissible if copy documents were provided to the applicant or the information was accessed other than by means of in situ inspection. The First-tier Tribunal has revisited the application of the charging rule in reg 8 EIR, again in the context of property search information, in Leeds City Council v IC & APPS Claimants (EA/2012/0020-21) (judgment of 22 March 2013).

The requestors had requested all the information the Council held which would enable them to complete and answer the questions in the relevant property search form issued by the Law Society (the CON29R form). Some of this information was made available by enabling free public inspection, but not all of it. The Council charged, under reg 8(1), the requestors £22.50 for the fulfillment of their request. This was the same sum that the Council charged for completion of the CON29R form (although the request had been for the raw data and not for the Council to complete the form itself) and the costs were calculated on the basis of staff time etc, rather than solely on the costs of disbursements (such as photocopying). The primary question for the FTT was whether the non-disbursement costs could properly be the subject of a charge under reg 8 EIR.

The FTT held that they could not. There was no authority directly on the point – Kirklees not having had to decide this issue – and the FTT had primarily to decide the issue by reference to the principles underlying the Aarhus Convention, the Directive and the EIR. It considered that the Implementation Guidance to the Convention to be of assistance because it referred only charges within the disbursement category: at [52]-[53]. As to the Directive, the FTT found the judgment of the ECJ in Case C-217/97 Commission v Germany [1999] ECR I-5087 to be helpful, finding that the meaning of the judgment was clear: “The costs that can be imposed relate to the act of supplying information in order to comply with a request, not to the act of identifying or retrieving or collating the relevant material in the first place”: at [76]. The public authority is not, following Kirklees, entitled to charge for its evaluative and collation work so that it benefits from a failure to put in place proper systems to permit EIR requests to be dealt with by free public inspection: at [78].

Unsurprisingly, given the purpose of and recitals to the Directive, the FTT accepted that any approach to the interpretation of charges must be narrow to be consistent with the aim of increasing public access to environmental information. Any interpretation which permitted charges to include more than disbursement costs would have “significant adverse consequences” to that access. A public authority may not charge “for the cost of administrative tasks or administrative acts which may include, but are not necessarily limited to, the spent by staff in locating, retrieving or redacting the information requested”: at [96]-[99].

The FTT’s conclusion on that issue resolved the appeal against the Council, but it went on to indicate its view as to the reasonableness of the charge imposed by the Council in any event. It considered that £22.50 was not a reasonable charge within the meaning of reg 8(3) EIR. In particular, the Council had automatically completed the CON29R form itself and charged the standard rate rather than answering the specific request for the raw data, as well as providing data at a charge which was already available for free. The charge was calculated by reference to matters which should not have been taken into account: “the nature of the information, the motives and assumed means of the applicants, the use to which the information would be put, and the fact that no objections had been received to the CON29R fee”: at [102](ii). Various of the other factors the FTT considered at [102] may be of assistance in other disputes over the reasonableness of the charge, although if the charge remains limited to disbursements such challenges may be relatively rare. The Council was also criticised for a failure to comply with reg 8(8) in that it had not published a schedule of charges, or the basis for their calculation, which could be scrutinised for fairness and reasonableness and as a result lost the entitlement to levy a charge under reg 8(1): at [118]-[119].

The case provides some helpful clarity to an area of some practical importance to public authorities, and is of considerable utility to those requesting environmental information. It remains to be seen whether it triggers a rash of complaints to the Commissioner about the reasonableness of the copying and postage charges levied under reg 8(1) (although they must, of course, be published in advance under reg 8(8)), but there is no doubt that the judgment in Leeds should prompt all public authorities to examine their information systems and charging structures to ensure that they are genuinely restricting themselves to charging for disbursements.

Anya Proops appeared for the Information Commissioner.

Christopher Knight

Court of Appeal Declares Criminal Records Regime Incompatible with Article 8

The Court of Appeal has today handed down an important judgment in R (T & others) v Chief Constable of Greater Manchester & others [2013] EWCA Civ 25. The case concerned the blanket requirement in the Rehabilitation of Offenders Act 1974, section 113B of the Police Act 1997 and articles 3 and 4 of the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975 that criminal convictions and cautions must be disclosed in an enhanced criminal record check (“ECRC”) in the context of particular types of employment (such as with children or vulnerable adults), even if those convictions or cautions would otherwise be deemed spent by the 1974 Act. (For a summary of the issues prior to the hearing, see Hannah Slarks’ post here.)

The Cases

The Court heard three conjoined cases. The lead case, T, was an appeal against a judgment of Kenneth Parker J: [2012] EWHC 147 (Admin) (upon which Robin Hopkins blogged here). T had received two cautions in relation to two stolen bicycles when he was 11 years old, which was disclosed as part of his participation in a sports studies degree course because he was required to work with children. T was not in fact prevented from completing his degree following the ECRC. JB was a lady who had been refused employment as a care home worker following the revelation in her ECRC that she had a caution for theft of some false nails eight years previously. Permission to judicially review the legislative scheme had been refused by HHJ Gosnell. A third case was also joined, that of AW, who when 16 had received custodial sentences for manslaughter and robbery arising out of a car-jacking and who wished to join the Army. Permission had been refused in her case by HHJ Gosnell, and unlike JB, permission to appeal had also been refused on the papers by the Court of Appeal.

Interference with Article 8

Lord Dyson MR, Richards and Davis LJJ accepted the written concession of the Secretary of State that there was an interference with the Article 8 rights of the claimants. There are two possible forms of interference. First, it may occur where there is disclosure of personal information which individuals wish to keep to themselves. Cautions are generally given in private and will fade into the past. Secondly, disclosure may lead to an individual’s exclusion from employment. For T, the first of these was clearly engaged, but Court also considered the second to be in play, holding that it was sufficient that disclosure “was liable to affect his ability to obtain employment”, even though it did not in fact do so: at [31]-[32].

Justification

The Court had no difficulty in finding that the criminal records regime pursued a legitimate aim, generally of protecting employers and children or vulnerable adults in their care, and particularly of enabling employers to make an assessment as to whether an individual is suitable for a particular kind of work. However, the Court held that that the disclosure of all convictions and cautions relating to recordable offences was disproportionate to that aim: at [37].

The fact that a bright-line rule had been adopted did not save the regime, where there was no attempt to control disclosure by reference to the information’s relevance to the legitimate aim. Nor did the Court accept an argument based upon resource implications. It was not necessary to consider every case individually; bright-line sub-rules could be used. The Court was particularly struck by a Criminal Records Review carried out an Independent Advisor to the Government, which had recommended the introduction of a filter to remove minor and old convictions where appropriate, which the Government had not rejected. The Independent Advisory Panel for the Disclosure of Criminal Records, set up following the Review, has been considering the issue. In short, the Court considered that there was a range of possible filter mechanisms which could have been adopted and which were, at the least, less disproportionate than the blanket requirement imposed by s.113B of the 1997 Act.

The Court drew further support from the recent decision of the Strasbourg Court in MM v UK (App. No. 24029/07) (on which see Charles Bourne’s post here), although it accepted that the judgment did not go to proportionality in terms but was a finding that the interference was not in accordance with the law. However, the Strasbourg Court had identified the blanket nature of the Northern Irish system in issue as a shortcoming and had directly relied upon the Supreme Court’s decision in R (F) v Secretary of State for Justice [2010] UKSC 17, [2011] 1 AC 331 (blanket notification requirements imposed on sex offenders without possibility of review incompatible with Article 8, a judgment which the Prime Minister described as “appalling“): at [53].

Contrary to the position taken by Kenneth Parker J, the Court of Appeal refused to consider themselves bound to find the regime compatible with Article 8 following the Supreme Court’s judgment in R (L) v Commissioner of Police for the Metropolis [2009] UKSC 3, [2010] 1 AC 410 because it had been concerned with the discretionary disclosure of police information rather than the mandatory disclosure convictions and cautions, and any assumptions made by the Supreme Court as to the compatibility of the disclosure regime had not been part of the ratio of the decision: at [62].

The 1975 Order

Kenneth Parker J had also accepted an argument from the Secretary of State that the 1975 Order could not be impugned on Article 8 grounds because to do so would presuppose that the State had a positive obligation to intervene in private employment relationships to permit individuals to conceal information about their criminal records. The Court of Appeal declined to engage in distinguishing between positive and negative obligations where the State had already “altered the legal landscape” by enacting the 1974 Act and 1975 Order. The real question was one of fair balance, which had not been struck and it would be absurd if the ECRC regime in the 1997 Act was incompatible with Article 8 so that the State could not disclose the record but that the individual, under the 1975 Order, must do so or face civil liability: at [68].

Relief

In the case of both T and JB the Court of Appeal declared the regime implemented by the 1997 Act incompatible with Article 8 ECHR, and in the case of T, that articles 3 and 4 of the 1975 Order were ultra vires because they had been made incompatibly with Article 8. However, in the case of AW permission to appeal was refused because the disclosure of convictions for manslaughter and robbery because such offences could never be spent fell within the area of discretionary judgment open to Parliament.

The Court held that it was necessary for Parliament to decide what filtering mechanism would most effectively balance the Article 8 rights of the individual with the interests of employers and vulnerable individuals. There were a number of potential approaches, and the Court declined to proscribe or provide guidance: at [69], [75]. Although it rejected a request by the Secretaries of State to narrowly limit the declarations it in respect of the 1975 Order, the Court stayed the effect of their judgment pending any application by the Secretaries of State for permission to appeal to the Supreme Court. The Court refused permission itself, and the Government has indicated that it will seek to appeal.

The judgment raises difficult questions for Parliament as to how to proceed, as well – prior to the legislation being amended – as for employers and others who wish to rely upon spent convictions or cautions as a ground for excluding employment etc. in the circumstances spelled out in the 1975 Order (such as, notably, employment involving responsibility for children and vulnerable adults).

Jason Coppel appeared for the Secretaries of State for the Home Department and Justice; Timothy Pitt-Payne QC appeared for Liberty as an intervener.

Christopher Knight

Prince of Wales Correspondence Vetoed

In his post of 19 September 2012, Robin Hopkins commented on the decision of the Administrative Appeals Chamber of the Upper Tribunal in Evans v IC & Seven Government Departments [2012] UKUT 313 (AAC), in which Walker J held that it was in the public interest that the majority of the correspondence from The Prince of Wales to those Government departments to be disclosed.

Instead of bringing an appeal, the Attorney-General today announced that he was vetoing disclosure under s.53 FOIA. In a ten page Statement of Reasons the AG stated that he had taken account of the views of the Cabinet, former Ministers and the Information Commissioner (who had not supported disclosure). Of particular note is the reason given by the AG that “it is of very considerable practical benefit to The Prince of Wales’ preparation for kingship that he should engage in correspondence and engage in dialogue with Ministers“. Urging views upon Ministers comes, in the view of the AG, within the ambit of advising or warning the Government under the tripartite convention. The AG adds that the contents are very frank and concern The Prince’s deeply held personal beliefs, but contain nothing improper.

The veto is concerned only with the correspondence of The Prince of Wales at issue in the Evans case. It remains to be seen whether the ongoing FOIA litigation concerning access to the Duchy of Cornwall’s information will result in a similar response.

Update: Following the announcement of the Attorney-General’s veto, the Guardian (for which Mr Evans writes) has announced that it intends to seek judicial review of the decision under s.53. As far as I am aware, the small number of vetoes previously issued have not been challenged by way of judicial review (see Lamb v IC (EA/2009/0108) at [5]).

Christopher Knight