Author: Rachel Kamm

Google Spain – article in The Lawyer by Anya Proops

Posted on | by Rachel Kamm

Ahklaq Choudhury posted this week about the Google Spain judgment. For more 11KBW commentary on the topic, see the article in The Lawyer by Anya Proops: “Privacy but at what price?“. Anya’s article concludes:

“Of course, it may well be that these issues will be resolved in the context of the new Data Protection Regulation which is still being debated in Europe. However, in the meantime, the judgment in Google Spain means we may well find ourselves exposed to a degree of data impoverishment which augurs ill for the development of our information society.”

Rachel Kamm, 11KBW

Universal Credit reports

Posted on | by Rachel Kamm

The Tribunal has ordered disclosure of information about Universal Credit, in three appeals which were heard together: John Slater v ICO and DWP EA/2013/0145; DWP v ICO and John Slater EA/2013/0148; and DWP v ICO and Tony Collins EA/2013/0149. The Tribunal dismissed both of DWP’s appeals and allowed Mr Slater’s appeal (subject to the removal of some names from the information).

The disputed information in Mr Collins’s appeal was a Project Assessment Review of the Universal Credit Programme (UCP), which was prepared by the Cabinet Office’s Major Projects Authority in early November 2011 and requested by Mr Collins on 1 March 2012.

In Mr Slater’s case, the disputed information was the Risk Register, Issues Register and the High Level Milestone Schedule for UCP and he made the request on 14 April 2012. As described by the Tribunal, “All three categories of document are essential risk management and planning tools in any large long – running project. They are designed to identify and reduce uncertainty and to gain uncompromising input from the widest possible spectrum of participants. UCP, on which work began in 2011, is scheduled for completion in 2017” (§22).

In response to both requests, the DWP relied on the exemption in section 36 FOIA, on ground that, in the reasonable opinion of a qualified person (the Minister), disclosure of the information under FOIA would be likely to inhibit the free and frank provision of advice, or the free and frank exchange of views for the purposes of deliberation, or would be likely otherwise to prejudice the effective conduct of public affairs and that the balance of the public interest was in favour of maintaining this exemption.

The ICO found that the qualified exemption in section 36 was engaged, but that the balance of the public interest favoured disclosure of the Project Assessment Review, Issues Register and  High Level Milestone Schedule (but not the Risks Register).

On appeal, the Tribunal agreed with DWP and the ICO that the exemption in section 36 was engaged i.e. it was reasonable for the Minister to conclude that disclosure would be likely to inhibit the free and frank provision of advice, or the free and frank exchange of views for the purposes of deliberation, or would be likely otherwise to prejudice the effective conduct of public affairs. The test was whether there was a realistic possibility, not a 51%+ probability (§49).

Turning to the public interest, the Tribunal attached great importance “not only to the undisputed significance of UCP as a truly fundamental reform but to the criticism and controversy which it was attracting by the time of these requests in March and April, 2012″ (§55). The Tribunal also noted “the unfailing confidence and optimism of a series of press releases” and that UCP was described as on track when milestones had not been achieved on time. It commented that “Where, in the context of a major reform, government announcements are so markedly at odds with current opinion in the relatively informed and serious media, there is a particularly strong public interest in up to date information as to the details of what is happening within the programme, so that the public may judge whether or not opposition and media criticism is well – founded” (§56). It took into account the costs of the programme and the size of the IT interface with local authority systems (§57). Publication of the disputed information upon completion of UCP, “would be a wholly inadequate answer to the demands for transparency” (§58).

On the other hand, the Tribunal acknowledged that the ‘safe space’ requirement can apply in section 36 (as well as section 35) cases (§59). The Tribunal did not take into account evidence which had been given by the Department of Health in a different Tribunal appeal, but which this Tribunal had not seen and which had not been tested in cross examination §61). There was no evidence that disclosure of another risk document, the Starting Gate Review, had inhibited frank discussion (§62). In this context, the need for a degree of deference to the experience of senior public authorities was not as pressing as when tackling questions of security or foreign policy: “The duty of the Tribunal is to consider government evidence on issues such as these carefully, conscious of the experience and expertise of the witness, but using its own knowledge of appeals of this kind, of institutions and behaviour in the workplace to determine whether government information requires the protection claimed, considering the importance of the subject matter to the public. We are not persuaded that disclosure would have a chilling effect in relation to the documents before us” (§63).

As to diversion of resources if the disputed information was disclosed, the Tribunal commented that “a programme such as UCP required at the outset a clear public relations strategy and a substantial staff to handle the inevitable flow or even torrent of inquiries and bad news stories which such an important change must attract” and that delivery of UCP may be facilitated by good communication (§64).

Having reached the above general conclusions, the Tribunal considered each of the requested documents in turn. It found that the public interest was in favour of disclosing the information, taking into account in particular that “Ordinary people, properly informed, are capable of grasping why a document dwells on problems rather than successes” and that whilst there may be some prejudice to DWP, the public interest required disclosure. It dismissed DWP’s appeals and allowed Mr Slater’s appeal (subject to the removal of some names from the information), thereby ordering disclosure under FOIA of each of the documents.

Julian Milford represented DWP and Robin Hopkins represented the ICO.

Rachel Kamm, 11KBW

 

 

 

Blair, Bush, Iraq, oil: two new Upper Tribunal decisions

Posted on | by Rachel Kamm

The Upper Tribunal has handed down two decisions on Iraq and section 27 FOIA, which raise some interesting procedural points – FCO v Information Commissioner and Plowden GIA/2474/2012 and Cabinet Office and Information Commissioner v Muttitt GIA/0957/2012.

In Plowden, the disputed information was a letter which was relevant to a telephone call on 12 March 2003 between Tony Blair and George Bush during which it was said that they had agreed to say that it was the French who had prevented them securing a UN resolution. The Information Commissioner had ordered the FCO to disclose the information provided by Mr Blair to Mr Bush, but not also the information provided by Mr Bush to Mr Blair. The Tribunal broadly agreed with the Information Commissioner, deciding the appeal under sections 27(1) (international relations) and 35(1)(b) (formulation of Government policy) of the Freedom of Information Act 2000. The Upper Tribunal first considered two preliminary matters, which are of general importance:

  1. Closed hearings. Judge Jacobs found that he could have set aside the Tribunal’s decision on ground that evidence had been given in closed session which could have been given in open session. He emphasised that as much evidence as possible should be given in open session and that, after evidence has been given in closed session, the other party should be told of any evidence that could properly be disclosed (paragraph 10).
  2. Respect for the Tribunal’s expertise. The Upper Tribunal generally will be reluctant to interfere with the (specialist fact-finding) First-tier Tribunal’s assessment of the public interest (paragraph 11). However, less respect will be due where the Tribunal does not have relevant specialist knowledge, for example in relation to the diplomatic consequences of disclosure (paragraph 12).

Having dealt with those preliminary issues, Judge Jacobs went on to set aside the First-tier Tribunal’s decision. It had failed to take account of the benefits of disclosure when assessing the public interest. It had also erred in considering the information line by line, instead of as a package; it was unrealistic to isolate one side of a conversation from the other. The appeal was remitted to the First-tier Tribunal for rehearing. To comply with Article 6 ECHR, that rehearing will be a full reconsideration of the issues which were before the Information Commissioner and it will not be limited to arguments raised by the appellant (paragraph 18).

Judge Jacobs had considered section 27 (international relations) a month earlier, in the Muttitt case. Again, this raised a preliminary issue of general procedural importance. Judge Jacobs found that the parties were not entitled to rely on the reasons given by the First-tier Tribunal for refusing permission to appeal (paragraph 4). These did not supplement the original reasons given by the Tribunal on determining the appeal, which was the decision under challenge. Turning to the substantive issues in the appeal, the disputed documents related to a vist by Mr Blair to Iraq in May 2006. Judge Jacobs found that the Tribunal had erred in law when ordering disclosure, in that it had failed to take into account the nature of the information (in contrast to its content). Reading the First-tier Tribunanl’s reasons as a whole, either it had failed to take account of the circumstances in which the documents came into existence or it had failed to give adequate reasons for its analysis of the information in light of those circumstances.  Judge Jacobs set aside the decision and remitted it for a rehearing of all of the issues raised by the appeal.

In Plowden, Julian Milford of 11KBW was led by James Eadie QC and represented the FCO, with Robin Hopkins of 11KBW representing the Information Commissioner.  In Muttitt, Julian Milford represented the Cabinet Office, Robin Hopkins represented Mr Muttitt and Ben Hooper of 11KBW prepared a written submission on behalf of the Information Commissioner.

Rachel Kamm, 11KBW

Article 8 and enhanced criminal record certificates

Posted on | by Rachel Kamm

There have been a number of Panopticon posts about the lawfulness of disclosures in enhanced criminal record certificates. The latest decision is that of Mr Justice Stuart-Smith in R (L) v Chief Constable of Cumbria Constabulary [2013] EWHC 869 (Admin).

The principles are now well established. In R (L) v Commissioner of Police of the Metropolis [2010] 1 AC 410 the Supreme Court identified that s.113B (4) of the Police Act 1997 requires that information can only be included in an enhanced criminal record certificate if, in the Chief Officer’s opinion, the information might be relevant and ought to be included in the certificate. Where it is alleged that disclosure would breach an individual’s rights under Article 8 ECHR, the Court must take into account up to date information to reach its own judgment (without deference to the Chief Constable) as to whether or not there has been an interference with the applicant’s right to private life and, if such interference has occurred, whether it is lawful.

In this case, the claimant (“L”) was an experienced secondary school teacher aged in his mid-forties. He challenged the Chief Constable of Cumbria Constabulary’s decisions, communicated by letters dated 15 May and 27 July 2012, not to remove contested information from the “other relevant information” section of the claimant’s enhanced criminal record certificates.

The following is an example of the information disclosed to L’s prospective employers:

 “Cumbria Constabulary hold the following information which we believe to be relevant to the application of L  …. The information relates to an allegation of inappropriate behaviour towards a female pupil of the school where L was employed as a teacher. Cumbria Constabulary believe this information to be relevant to an employer’s risk and suitability assessment when considering L‟s application for the post of supply teacher with vision for education, working with children and vulnerable adults, because the information, which is considered likely to be true, indicates an abuse by L of the position of trust in which he was placed as a teacher.

The information held by police involves an allegation by an 18- year old female that on 07.05.10, whilst in licensed premises, L had inappropriately hugged her and persistently asked her to go home with him, offering her £200 to do so, causing her to feel vulnerable and harassed. The complainant was a pupil at the school where L was employed as a teacher and he had known her since she was 12 or 13 years of age when he was her teacher.

When interviewed by police, L agreed that he had been present that evening but denied all allegations stating that he had not seen or spoken to the complainant. No further police action was taken against L in relation to these allegations as the complainant was 18 years of age and therefore no criminal offences had been committed.

After careful consideration, Cumbria Constabulary considers that this information ought to be disclosed as the alleged incident of inappropriate behaviour occurred in relation to a female pupil of the school where L was a teacher at the time. The information is materially relevant to the post of supply teacher applied for in which L will have regular and unsupervised contact with children and young adults. The risks of similar inappropriate behaviour of a sexual nature by L towards vulnerable young persons must, in this instance, outweigh the prejudicial impact that disclosure may have on L‟s private life and employment prospects as a teacher.”

Mr Justice Stuart-Smith held that the Chief Constable was obliged and right to carry out an assessment of reliability, but that he did not have materials available to him that could justify a determination that some form of communication had taken place between the claimant and the pupil. There was ample material upon which the Chief Constable could have reached the conclusion that the pupil’s evidence may well have been reliable, but the real possibility remained that the allegations were without foundation.

Mr Justice Stuart-Smith went on to find that even if the allegations were true, “the risk disclosed by the one episode of which she complained was not shown to be anything other than slight and was a risk to a very limited class of persons in tightly defined circumstances” (namely, current and former pupils whom L might come across in a pub). The incident alleged was itself relatively minor in the overall scheme of sexually inappropriate behaviour and it was an isolated incident in a long career. The incident had not been properly or fully investigated.

Further, the disclosure was made in circumstances where both the General Teaching Council and the Independent Safeguarding Authority had concluded that there was no case to answer. However, the result of the disclosure “had been as severe for L’s employment prospects as if he had been convicted of a serious offence of sexual misconduct and placed on the Sex Offenders’ Register: it is a killer blow and its effects are likely to be long lasting”.

Mr Justice Stuart-Smith concluded that “any proper balancing exercise comes down in favour of the conclusion that this interference with L’s Article 8 rights is disproportionate and unjustifiable, particularly in a jurisdiction where people are generally to be presumed innocent until proved guilty … the defendant has not shown a pressing need for the disclosure, because of the limited circumstances in which a possible risk of repetition might arise and the relative lack of gravity of the alleged conduct. Nor has the defendant shown that the means used to impair L’s rights are no more than necessary to accomplish a legitimate objective”. The disclosures in the enhanced criminal record certificates had breached his Article 8 ECHR rights.

Rachel Kamm, 11KBW

Leveson Inquiry Report: spotlight on proposed data protection reforms

Posted on | by Rachel Kamm

Lord Justice Leveson has today published his eagerly awaited report into the culture, practices and ethics of the press.  The key proposal which will shape the future of press regulation is the recommendation to create an independent self-regulatory body, governed by an independent board. Of particular interest to information lawyers is the discussion of the extent to which the current legal, policy and regulatory framework has failed in relation to data protection. In this respect, the Report considers the lessons that can be learned from the practices of the press in relation to data handling and processing, makes bold recommendations in relation to legislative reform and further considers a bolstering of the Information Commissioner’s role and function.  The principal parts of the report dealing with the Data Protection Act 1998 (“DPA”) and ICO are Volume III, Part H and Volume IV, Appendix 4, Part 4.

Data protection: a key element of privacy rights

A key part of the Leveson Inquiry has been to consider the extent to which the press has unjustifiably interfered with the privacy of individuals in a manner which cannot be justified in the public interest. In this context, invasion of privacy does not mean simply through the publication of articles which intrude into the details of individuals’ private lives, but rights of individuals to keep personal information private, and rights restricting how personal information is processed by journalists. The Inquiry’s Terms of Reference expressly required Lord Justice Leveson to consider the extent to which the current policy and regulatory framework has failed in relation to data protection. The Inquiry provided a fresh and independent perspective for considering the DPA and the role of the ICO.

Historic difficulties in investigating and regulating data protection breaches by the press

Operation Motorman was an investigation by the ICO into the conduct of a private investigator, Steve Whittamore, which revealed that a significant amount of personal data was being sought by journalists working for most of the major newspaper groups. The data was being obtained by Mr Whittamore in breach of s.55 DPA (for example, through payments to public officials for details from a DVLA database, or through the blagging of friends and family telephone numbers from BT) and subsequently supplied to journalists. Mr Whittamore was prosecuted, but no journalist was interviewed by the ICO or subjected to enforcement action or prosecution. The Report highlights that the investigation produced a ‘treasure trove’ of evidence of serious and systemic illegality and poor practice in the acquisition and use of personal information which could have spread across the press as a whole. It also questions why the ICO failed to interview journalists or prosecute journalists for breach of the DPA, and notes that two reports laid before Parliament by the ICO had set out the evidence of a flourishing and unlawful trade in confidential personal information.

The Report highlights that one of the difficulties encountered by the ICO in pursuing breaches of data protection legislation against the press arose from deficiencies in the legal framework, which “puts unnecessary and inappropriate barriers in the way of regulatory law enforcement and the protection of victims’ rights”. Perhaps for this reason, amendments to the legal framework form a key part of the recommendations on data protection reform.

Recommendations to amend data protection legislation

Section 32 of the DPA restricts the circumstances in which the ICO can exercise most of its powers in relation to the press. Section 32 operates by disapplying a number of investigative and enforcement powers in circumstances where the data processing falls within section 32, namely where (i) the processing is undertaken with a view to the publication by any person of any journalistic material; (ii) the data controller reasonably believes that, having regard in particular to the special importance of the public interest in freedom of expression, publication would be in the public interest; and (iii) the data controller reasonably believes that, in all the circumstances, compliance with that provision is incompatible with the special purposes.

The Report recommends that section 32 should be amended so as to make it available only where: (a) the processing of data is necessary for publication, rather than simply being in fact undertaken with a view to publication; (b) the data controller reasonably believes that the relevant publication would be or is in the public interest, with no special weighting of the balance between the public interest in freedom of expression and in privacy; and (c) objectively, that the likely interference with privacy resulting from the processing of the data is outweighed by the public interest in publication. These amendments would render it more difficult for those organisations processing data for the purposes of publication to bring themselves within the scope of s.32. The proposed amendments seek to re-set the balance between the public interest in freedom of expression and the public interest in personal information privacy.

Further, the report recommends that the extent to which s.32 disapplies provisions of the DPA should be reduced and  that the processing of data by the press should be subject to the following obligations (which previously attracted exemption):

  •  the requirement of the first data protection principle to process personal data fairly (except in relation to the provision of information to the data subject under paragraph 2(1)(a) of Part II Schedule 1 to the DPA) and in accordance with statute law;
  •  the second data protection principle (personal data to be obtained only for specific purposes and not processed incompatibly with those purposes);
  • the fourth data protection principle (personal data to be accurate and kept up to date);
  •  the sixth data protection principle (personal data to be processed in accordance with the rights of individuals under the Act);
  •  the eighth data protection principle (restrictions on exporting personal data); and
  • the right of subject access (subject to further investigation and clarification of protection of journalists’ sources).

Recommendations for procedural amendments

The Report recommends:

  • The repeal of certain procedural provisions of the DPA with special application to journalism (namely section 32(4) and (5) and sections 44 to 46). The purpose of this is to give the ICO, and the Courts, greater powers to consider breaches of data protection without procedural hurdles in place, for example repealing section 32(4) would allow Courts to consdier preventing the Courts considering the complaint whilst the ICO determines whether the data controller has been processing the date for the purposes of journalism;
  • In conjunction with the repeal of those procedural provisions, consideration should be given to the desirability of including in the DPA a provision to the effect that, in considering the exercise of any powers in relation to the media or other publishers, the ICO should have special regard to the obligation in law to balance the public interest in freedom of expression alongside the public interest in upholding the data protection regime;
  • Specific provision should be made to the effect that, in considering the exercise of any of its powers in relation to the media or other publishers, the ICO must have regard to the application to a data controller of any relevant system of regulation or standards enforcement which is contained in or recognised by statute; and
  • To further strengthen individuals’ rights, the right to compensation for distress conferred by section 13 of the DPA is not restricted to cases of pecuniary loss, but should include compensation for pure distress.

ICO’s powers of prosecution

In his evidence to the Inquiry, the former Information Commissioner Richard Thomas described the ICO as “primarily not a prosecuting authority. That was almost on the side”. The main formal power in the event of non-compliance was the ‘enforcement notice’, which could specify and require compliance action subject to the back-up sanctions of court enforcement, although this was not frequently used. Prosecution powers were limited to section 55 of the DPA and did not extend, for example, to other offences such as phone hacking (although this might also technically involve a section 55 DPA breach).

The Report recommends that:

  • The necessary steps should be taken to bring into force the amendments made to section 55 of the DPA by section 77 of the Criminal Justice and Immigration Act 2008 (increase of sentence maxima) to the extent of the maximum specified period; and by section 78 of the 2008 Act (enhanced defence for public interest journalism);
  • The prosecution powers of the Information Commissioner should be extended to include any offence which also constitutes a breach of the data protection principles.
  • A new duty should be introduced (whether formal or informal) for the ICO to consult with the Crown Prosecution Service in relation to the exercise of its powers to undertake criminal proceedings;
  • The ICO should immediately adopt the Guidelines for Prosecutors on assessing the public interest in cases affecting the media, issued by the Director of Public Prosecutions in September 2012; and
  • The ICO should take immediate steps to engage with the Metropolitan Police on the preparation of a long-term strategy in relation to alleged media crime with a view to ensuring that it is well placed to fulfil any necessary role in this respect in the future, and in particular in the aftermath of Operations Weeting, Tuleta and Elveden.

Recommendation to issue guidance

The Report includes a number of recommendations directed at the ICO in relation to its provision of guidance and advice. In particular, it recommends that the ICO should issue good practice guidelines and advice on appropriate principles and standards to be observed by the press in the processing of personal data. Further, it should issue guidance to the public on their individual rights in relation to the press and their personal data and also advice for data subjects who are concerned that their data may have been processed by the press unlawfully or otherwise than in accordance with good practice. In full:

  • The ICO should take immediate steps to prepare, adopt and publish a policy on the exercise of its formal regulatory functions in order to ensure that the press complies with the legal requirements of the data protection regime.
  • In discharge of its functions and duties to promote good practice in areas of public concern, the ICO should take immediate steps, in consultation with the industry, to prepare and issue comprehensive good practice guidelines and advice on appropriate principles and standards to be observed by the press in the processing of personal data. This should be prepared and implemented within six months from the date of this Report.
  • The ICO should take steps to prepare and issue guidance to the public on their individual rights in relation to the obtaining and use by the press of their personal data, and how to exercise those rights.
  • In particular, the ICO should take immediate steps to publish advice aimed at individuals (data subjects) concerned that their data have or may have been processed by the press unlawfully or otherwise than in accordance with good practice.
  • The ICO, in the Annual Report to Parliament which it is required to make by virtue of section 52(1) of the DPA, should include regular updates on the effectiveness of the foregoing measures, and on the culture, practices and ethics of the press in relation to the processing of personal data.

Strengthening the ICO

The Report recommends that the opportunity should be taken to consider amending the DPA formally to reconstitute the ICO as an Information Commission, led by a Board of Commissioners with suitable expertise drawn from the worlds of regulation, public administration, law and business, and active consideration should be given in that context to the desirability of including on the Board a Commissioner from the media sector.

The Report recommended to the ICO that:

  • It should take the opportunity to review the availability to it of specialist legal and practical knowledge of the application of the data protection regime to the press, and to any extent necessary address it; and
  • It should take the opportunity to review its organisation and decision-making processes to ensure that large-scale issues, with both strategic and operational dimensions (including the relationship between the culture, practices and ethics of the press in relation to personal information on the one hand, and the application of the data protection regime to the press on the other) can be satisfactorily considered and addressed in the round.

Conclusion

The recommendations in the Report seek to significantly strengthen the ICO’s powers to investigate and enforce against poor press practices and, if enacted, would represent a marked change in the relationship between the ICO and the press.

Rachel Kamm

(11KBW’s Heather Emmerson was instructed by the Treasury Solicitor as part of the team of Counsel to the Leveson Inquiry.)

New Code of Practice on anonymisation

Posted on | by Rachel Kamm

The Information Commissioner has published a new code of practice on “Anonymisation: managing data protection risk“.

Under the Data Protection Act 1998, the definition of personal data does not include information relating to an individual if that individual cannot be identified from that information together with all other information which is in the possession of, or is likely to come into the possession of, the data controller. It follows that where an organisation holds data relating to individuals which is anonymised, or where it is deciding whether or not to anonymise its data, it will need to consider carefully whether the anonymisation method means that the information falls outside the scope of the DPA or not.  The 100+ page code includes guidance and practical examples to assist organisations in assessing their options in relation to anonymisation. This guidance will not only be useful in relation to DPA obligations, but also where an organisation is considering anonymising data in order to respond to a Freedom of Information request. Note that whilst the code gives advice on good practice, it is not mandatory to comply with its recommendations where they go beyond the obligations under the DPA; it  is issued under section 51 of the DPA, but it is not legally enforceable.

In addition to the new Code of Practice, the ICO has announced that “a consortium led by the University of Manchester, with the University of Southampton, Office for National Statistics and the government’s new Open Data Institute (ODI), will run a new UK Anonymisation Network (UKAN). The Network will receive £15,000 worth of funding from the ICO over the next two years to enable sharing of good practice related to anonymisation, across the public and private sector. The network will include a website, case studies, clinics and seminars“.

Rachel Kamm