Author: Robin Hopkins

GASKELL: COMMISSIONER CAN, IN EXCEPTIONAL CIRCUMSTANCES, DECLINE TO ORDER DISCLOSURE

Posted on | by Robin Hopkins

In my recent post on Sittampalam v IC and BBC (EA/2010/0141), I explained that the Tribunal took the view that the Commissioner does have a discretion to decline to order disclosure, even where information was incorrectly withheld at the time, due to subsequent developments such as legislative changes, inquiries or court proceedings and so on. In so doing, that Tribunal differed from the decision in Gaskell v IC (EA/2010/0090), where it was held that no such discretion existed.

The Upper Tribunal (UT Judge Wikeley) has this week allowed an appeal against the Gaskell decision, meaning that the Sittampalam position has now been confirmed as correct. The issue is put succinctly at paragraph 10 of UT decision GIA 3016 2010:

“The reasoning in the Commissioner’s Decision Notice can be summarized simply. Section 44(1)(a) of FOIA provides an absolute exemption where disclosure by the public authority holding it “is prohibited by or under any enactment”. Section 18(1) of CRCA [Commissioners for Revenue and Customs Act] 2005 provides that “Revenue and Customs officials may not disclose information which is held by the Revenue and Customs in connection with a function of the Revenue and Customs.” Section 18(1) did not apply to the Rent Service at the time that Mrs Gaskell made her original request. However, by the time of his Decision Notice, Rent Service staff had become HMRC officials. If the Commissioner were to order disclosure, those staff would be contravening section 18 of CRCA 2005.”

The First-Tier Tribunal found that the Commissioner has no discretion to decline to order disclosure in such circumstances (and that if he did have such a discretion, he exercised it incorrectly in this instance). In contrast, however, the UT concluded as follows (paragraph 31; my emphases):

“In conclusion, I agree with both counsel [11KBW’s Karen Steyn and Ben Hooper] that the requirement under section 50(4) that the decision notice should specify the steps which must be taken by the public authority does not amount to a mandatory obligation on the Commissioner to require steps to be taken to comply with the requirements of sections 1(1), 11 or 17 in every case, although that consequence will usually follow, save for exceptional cases such as the present one. As a matter of law the mandatory element of section 50(4) is that, if the Commissioner considers that the public authority ought to take any steps to comply with those statutory requirements, then he must specify them in the decision notice, along with the defined period within which they must be undertaken.”

The UT went on to decide that the Commissioner had exercised his discretion correctly in this case.

UT Judge Wikeley’s judgment also includes both a Jane Austenism and the first citation of the Information Law Reports (or Info LRs), launched by Justis and 11KBW this month: Office of Government Commerce v Information Commissioner [2008] EWHC 737 (Admin); [2010] QB 98; [2011] 1 Info LR 743.

Robin Hopkins

NEW TRIBUNAL DECISION ON “JACK THE RIPPER” INFORMATION

Posted on | by Robin Hopkins

The Tribunal’s recent decision in Marriott v IC and Metropolitan Police (EA/2010/0183) saw the Tribunal consider registers and ledgers of policing information from the late Victorian period – some of which, the requester contended, related to the “Jack the Ripper” investigations. The Tribunal was unanimous that section 30(2)(a) FOIA (information obtained or recorded for the purposes of functions relating to investigations or criminal proceedings etc) was engaged. It decided by a majority that the public interest favoured the maintenance of that exemption. I say no more about the case, given my involvement. David Higgerson’s blog, however, comments on the application of FOIA to very old information here.

“SANDSTORM” PERSONAL DATA AND THE BCCI COLLAPSE

Posted on | by Robin Hopkins

The Tribunal’s recent decision in Sikka v IC and HMT (EA/2010/0054) is a good illustration of how FOIA exemptions (here concerning prejudice to international relations and personal data) may be trumped by the overwhelming interest in the public being informed about corporate wrongdoing on a massive scale – including the public knowing the names of those involved in that wrongdoing. Some topical resonance perhaps.

It is also another useful illustration of how personal data should not be assessed on a “one size fits all” basis, but should (where appropriate) be analysed by category. In other words, distinguish between, for example, companies, senior management, employees and customers.

Background

In March 1991, the Bank of England instructed Price Waterhouse to undertake an audit of The Bank of Credit and Commerce International. Price Waterhouse submitted a draft of its report, known as the “Sandstorm” report. The report was never finalised, but the Bank of England relied on the draft to justify its decision to order BCCI immediately to close down its activities in the UK. That led to the collapse of BCCI into insolvency, owing creditors around the world something in the region of US$10 billion.

By the time of the request for a copy of this report (March 2006), an almost complete copy of the Sandstorm Report had been published on the internet, even though it had never been formally published by the Bank of England, albeit with certain names redacted and certain sections missing. The Bank of England relied upon section 40(2) (personal data) and section 27(1)(a) (prejudice to international relations) in refusing to disclose this remaining information. The Commissioner agreed. For the most part, the Tribunal did not.

Prejudice to international relations

The Tribunal agreed that section 27(1)(a) was engaged, but decided that the public interest favoured disclosure. At paragraph 31, it said this:

“Although the material proposed to be redacted under this exemption comprises just a few sentences in a 44 page report, it does contribute a very relevant element to the story as a whole. And we do not think that the public interest is materially reduced by the appearance of much of the same information in other published reports. The public has an interest in seeing how each of those who carried out an investigation illuminated the facts and assessed the actions of those who were involved, whether they contributed to the problems, tried to resolve them or played a neutral role. The weight we apply to this element of public interest has been heavily influenced by our view of the importance of the events surrounding the collapse of BCCI, the serious ramifications it had for many innocent people caught up in it and the questions it raised about the regulation and auditing of a large international institution.”

Personal data

A number of categories of allegedly personal data were identified. An interesting category was the names of companies, from which it was argued that individuals could be identified. The Tribunal was not persuaded by the evidence as to the risk of identifiability.

In any event, as regards senior management, it took the view that “those having [such] positions in either BCCI or other organisations that were closely involved in the unlawful elements of its activities should be identified”, given the seriousness of the issue.

The Commissioner had decided that the names of employees should not be disclosed, whether or not their involvement with BCCI had previously been raised in the course of criminal proceedings. He argued as follows. If they had been convicted, it might be unfair to raise their involvement again some 15 years or more after the event. If they were acquitted, or faced no criminal action, there would be unfairness in blighting future employment prospects by disclosing, in 2007, their involvement with BCCI some years previously. The Tribunal disagreed in part. Its view was that the question of disclosure in these circumstances should turn on the seniority of the employee. At paragraph 44, it said this:

“As regards the potential impact on future employment prospects of those who were acquitted or never prosecuted, we believe that any truthful job application and curriculum vitae will, in any event, include mention of time spent in the employment of BCCI. We do not think that those individuals mentioned in the confidential schedule, whose names we say should be disclosed, should be encouraged to omit or misrepresent this part of their career history, given the criticism voiced in the Sandstorm Report and the importance of employee competence and honesty to future employers in the banking sector.”

As regards the personal data of BCCI customers, the Tribunal distinguished between those whose hands were clean with respect to the BCCI fraud (do not disclose) and those whose hands were not (disclose).

Much turned on the gravity and public profile of the BCCI collapse. In these circumstances, the Tribunal found that information aired in a public trial was likely to remain in the public domain (contrast Armstrong v IC and HMRC (EA/2008/0026)), and that the passage of time undermined rather than strengthened the argument in favour of individual privacy.

Robin Hopkins

IMPORTANT NEW DECISION ON LATE RELIANCE, COST OF COMPLIANCE AND COMMISSIONER’S DISCRETION

Posted on | by Robin Hopkins

In Sittampalam v IC and BBC (EA/2010/0141), the Tribunal has considered a number of important questions. Framed generally (i.e. outside the specific factual context of this case), they are as follows. I add the “short answer” to the questions straight away, and then give some detailed analysis of each in turn below:

(1)  Can a public authority rely on the cost ‘exemption’ under section 12 FOIA at a late stage as of right? Answer: no.

(2)  If not, does the Commissioner have a discretion to allow late reliance on section 12? Answer: yes.

(3)  If he does, can he take into account developments after the time at which the request was refused – and in particular, can he decide that, due to those later developments, disclosure should not be ordered, even though the information should have been disclosed at the time when the request was handled? Answer: yes.

(4)  When allowing late reliance on section 12, can the Commissioner require the public authority to answer a disaggregated or narrowed version of the original request, which might bring it within the cost limit? Answer: yes.

Can section 12 be relied on as of right?

First, can a public authority claim late reliance on the cost ‘exemption’ under section 12 FOIA as of right? To put it another way, is the law on late reliance on section 12 the same as the law on late reliance on the exemptions under Part II of FOIA (which may be relied upon late as of right).

The Tribunal’s answer was “no”. This was in light of APPGER (explained in my post here), where the Upper Tribunal explained that section 12 was different from other exemptions. Section 12 is about saving public expenditure; if the requested information has already been retrieved, the expenditure has already been incurred, so there can be no saving and thus no reliance on section 12 from that point onwards.

In this case, the Tribunal concluded that (see paragraph 48):

“The proper time for raising reliance on s12 is the time required by section 17(5), i.e. promptly and in any event not later than the twentieth working day after receipt of the request. Later reliance – at least up to the conclusion of an internal review – is not a matter of right but is to be controlled by reference to the scheme and purposes of the Act.”

Does the Commissioner have a discretion to allow late reliance on section 12?

Subject to the APPGER qualifier – namely that the section 12 cost-saving exemption cannot be claimed when the cost has already been incurred – the Tribunal found that the answer to this question is “yes”.

When might late reliance on section 12 be claimed? One example would be where, because of the nature of the requested information, a public authority is able to rely on a Part II exemption without having to locate or retrieve the requested information. If the Part II exemption falls away (for example, if the Commissioner decides that it is inapplicable), the authority may then need to locate and retrieve the information, and it may be able to raise section 12 for the first time at that stage.

Can the Commissioner take into account developments after the refusal of the request?

The next question considers this scenario. The Commissioner decides that the public authority should have disclosed the requested information at the relevant time. He considers, however, that – because of events subsequent to the time at which the request was refused – disclosure would now be inappropriate. Is this allowed under FOIA?

Another way of looking at this is to ask whether the Commissioner has a discretion to order that “no steps be taken”, notwithstanding a public authority’s wrongful refusal of a request. To understand this issue, one must consider the wording of FOIA itself. Section 50(4) provides that, where a public authority has failed to comply with section 1 (disclosure duties and so on) or sections 11-17 (procedure for refusing a request), then “the decision notice must specify the steps which must be taken by the authority for complying with the requirement and the period within which they must be taken” (my emphasis). Where the Commissioner has found such a failure, this question arises: does section 50(4) mean that he must always direct that steps be taken, or does it simply mean he must stipulate what steps if any are to be taken?

In Gaskell v IC (EA/2010/0090), the Tribunal decided that the Commissioner has no such discretion: the Commissioner must always make a “steps direction”, and he cannot allow events subsequent to the relevant time to determine whether disclosure is ordered or not. The concern of the Tribunal in Gaskell was that such a discretion would give public authorities two bites of the cherry: if their refusal of the request failed (when judged by reference to the time of the handling of the request), they could invite the Commissioner to use his discretion to decline to order disclosure anyway, because of subsequent developments.

In Sittampalam, the Tribunal has taken a different view. It found that the Commissioner does have this discretion to consider subsequent events and, if appropriate, decline to order disclosure. Such cases will, however, be “exceptional” (see paragraph 60). This Tribunal took the view that the Tribunal in Gaskell had not been presented with scenarios illustrating the pitfalls of the “no discretion” position (see paragraphs 58-60). In support of its conclusion about this discretion, the Tribunal said as follows (paragraphs 53-54):

“Stanley Burnton J (as he then was) in Office of Government Commerce v IC [2008] EWHC 774 (Admin); [2010] QB 98; at [98] regarded it as arguable that the Commissioner’s decision as to the steps required to be taken by the authority might take account of subsequent changes of circumstances. In our view, that is not merely arguable but is correct, and flows from the nature of the Commissioner’s jurisdiction and its subject matter, and from the wording of the Act.

The Commissioner, when acting under section 50, is not merely deciding whether an information requester was or was not entitled to information at the time when the request was dealt with. He must also decide what is to be done. The Commissioner has a role both as guardian of the public interest in the appropriate disclosure of information held by public authorities and as a guardian of data protection rights. In our view the statute leaves to him a measure of discretion over what is the appropriate enforcement of information rights in a particular case. It would be perverse, in our view, if he were wholly debarred from taking into account fresh circumstances, not in existence at the date when the request was originally dealt with.”

Can the Commissioner require a public authority to answer a reformulated or narrowed request?

The Tribunal went on to consider whether, when allowing late reliance on section 12, the Commissioner can do so subject to the public authority handling the request in a prescribed way. It considered two possibilities.

First, is the Commissioner is entitled to allow the late reliance on terms as to disaggregation of the request, so as to prevent reliance on section 12 in relation to information that can be provided under the cost limit? The Tribunal concluded, albeit “with some hesitation”, that this is permissible (see paragraph 73):

“If during the Commissioner’s investigation the public authority is to be allowed to change its response to the request with retrospective effect, so as to raise a defence which should have been raised earlier, it does not seem unreasonable or out of line with the statutory scheme to say that the requester might also in a suitable case be allowed to refine or clarify the terms of the request retrospectively. In effect, the Commissioner would say to the public authority: ‘I will permit you to raise section 12 late but, for fairness’ sake, only on terms that you agree to permit the requester to narrow his request and that you agree to treat the narrowed request as validly made.’”

Secondly, is the Commissioner entitled to prescribe the steps to be taken so as to put the requester in the position that he would have been in if the public authority had complied with its duty to advise and assist under section 16. Compliance might enabled the requester to resubmit his request in a narrower form to which section 12 would not have been a defence.

The Tribunal again found that this was permissible, this time “with greater confidence”. It considered the case law on the relationship between sections 12 and 16. It agreed with Roberts v IC (EA/2008/0050) that entitlement to rely on section 12 is not conditional upon compliance with section16. It took the view, however, that “compliance with section 16 may be taken into account where the question is one not of entitlement but of discretion. If this is correct, it should enable the Commissioner to give greater practical effect to s16 than hitherto”. In other words, whenever late reliance on section 12 is claimed, public authorities should pay extra attention to their duties under section 16.

Robin Hopkins

PERSONAL DATA: CRUCIAL POINTS FROM THE ‘ABORTION STATISTICS’ CASE

Posted on | by Robin Hopkins

Judgment in Department of Health v IC [2011] EWHC 1430 (Admin) – the ‘abortion statistics’ appeal – was handed down on 20 April this year. Cranston J’s judgment has now been made available. The following salient points from that judgment may be of use to those interested in the concept and extent of ‘personal data’ under s. 40 FOIA and the DPA – especially when looking at the grey area of statistics or other anonymous data which is rooted in or derived from other data which is more overtly personal. The judgment is also essential reading for anyone grappling with the application of the leading House of Lords decision on this subject, Common Services Agency v Scottish Information Commissioner [2008] UKHL47, [2008] 1 WLR 1550 (‘CSA’). (‘Grappling’ is probably apt: even Cranston J conceded that “it would be wrong to pretend that the interpretation of the CSA case is an easy matter”).

Briefly by way of background: the Department refused a request for detailed statistics on the number of late-term abortions carried out on prescribed grounds. It relied on s. 40 FOIA, basing its case on the risk that, given the ‘low cell counts’ in these categories, the relevant patients and/or doctors might be identified by those sufficiently motivated to do so. The Commissioner found that these statistics were not personal data. The Information Tribunal agreed with the Department that they did constitute personal data, but was not satisfied that s. 40 was effective, as there was insufficient risk of identification.

On the Department’s appeal to the High Court, Cranston J agreed with the Commissioner that these statistics are not personal data.

One route to that conclusion was that advocated by the Commissioner, namely to adopt the approach of Baroness Hale in CSA: anonymised statistics remain personal data and therefore subject to the protection of the DPA in the hands of the data controller (who possesses the underlying data from which individuals could be identified) but not in the hands of the general public (who do not). This approach commended itself to the Upper Tribunal in the recent case of All Parliamentary Group on Extraordinary Rendition v Information Commissioner [2011] UKUT 153 AAC (on which, see my post here).

Cranston J, however, rejected that route, as it was the reasoning of Lord Hope rather than Baroness Hale in CSA which had attracted the majority’s support in that case. Lord Hope’s approach can be paraphrased as follows. The definition of personal data under s. 1 DPA provides for two means of identification: either from the data itself (inapplicable in the case of anonymous statistics) or from “from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller”. Lord Hope’s approach to situations such as this is to ask: does the ‘other information’ (if provided to the hypothetical member of the public) add anything to the statistics which would enable them to identify the underlying individuals? If the answer is no, the statistics are not personal data. The underlined words are important: if identification can be achieved from the ‘other information’ in isolation (rather than when added to the statistics) then the statistics themselves are truly anonymous, and are not personal data. The statistics in this case failed Lord Hope’s test, and were thus not personal data.

Cranston J’s conclusion was that the Tribunal had been correct to conclude that the data was ‘truly anonymised’ – but it had erred in treating this as personal data which had been truly anonymised. The Department contended that, because it held the underlying identification data, the abortion statistics remained personal data in all circumstances. Cranston J rejected this submission, stating that:

“If that were the case, any publication would amount to the processing of sensitive personal data…  Thus, the statistic that 100,000 women had an abortion in a particular year would constitute personal data about each of those women, provided that the body that publishes this statistic has access to information which would enable it to identify each of them.  That is not a sensible result and would seriously inhibit the ability of healthcare organisations and other bodies to publish medical statistics”.

In going on to dismiss the Department’s other grounds of appeal, Cranston J made a number of other points of general application. For example, in rejecting the criticism that the Tribunal had failed adequately to engage with the Department’s expert evidence, Cranston J said this:

“To begin, the issue before the Tribunal was one of assessment: the likelihood that a living individual could be identified from the statistics.  That was in my judgment only partly a question of statistical expertise, as regards matters such as the sensitivity of the data.  Partly, also, it was a matter of assessing a range of every day factors, such as the likelihood that particular groups, such as campaigners, and the press, will seek out information of identity and the types of other information, already in the public domain, which could inform the search.  These are factors which the Tribunal was in as good a position to evaluate as the statistical experts, a point which one of the Department of Health’s experts conceded.  The analysis also applies to the evidence of senior civil servants.”

As regards the Department’s contentions that conditions from Schedules 2 and 3 of the DPA were not met, their points were “wounding” to the Tribunal’s judgment, but not “fatal”, in light of the evidence at the Tribunal hearing. Finally, Cranston J described the Department’s argument based on Article 8 ECHR as “very much a jury argument”.

Interestingly, on the same day as judgment was given in this case, the High Court (Kenneth Parker J) gave judgment in R (BT & Anor) v The Secretary of State for Business, Innovation and Skills [2011] EWHC 1021 (Admin)  – BT’s unsuccessful application for judicial review of the Digital Economy Act 2010 (on which, see my piece here). One of the grounds of challenge was alleged non-compliance with the Data Protection Directive. In that judgment, IP addresses (anonymous strings of numbers linked to internet subscribers’ accounts) were treated as personal data even in the hands of copyright owners who possessed only those IP addresses. This was by application of the definition of personal data under the Directive: here copyright owners were deemed likely to come into possession of the underlying personal data when taking legal action against the individual internet subscribers who downloaded content in breach of copyright. This conclusion was reached independently of the Lord Hope test. Note, however, that it seems from the judgment that this question – are IP addresses always personal data or not – was not argued in full before Kenneth Parker J. There is talk of a potential appeal, so the application of these principles to IP addresses might be considered in the courts again before too long.

Robin Hopkins

UPPER TRIBUNAL DECISION IN NEWCASTLE UNIVERSITY V IC & BUAV: MEANING OF “HELD”, APPLICATION OF S. 44 FOIA

Posted on | by Robin Hopkins

The Upper Tribunal has published its decision in the case of University of Newcastle upon Tyne v Information Commissioner and BUAV [2011] UKUT 185 (AAC). The case concerned requests by BUAV (the British Union for the Abolition of Vivisection) for information on licenses for animal experimentation issued under the Animal (Scientific Procedures) Act 1986 (ASPA). The University’s response was that it did not hold the requested information (rather, the information was held by individual researchers) and that, even if it did, the exemption under s. 44 FOIA applied, in that disclosure otherwise than under FOIA would involve the University committing an offence under s. 24 ASPA. The Tribunal disagreed, and found against the University on both points. The University’s appeal to the Upper Tribunal has failed on both points.

On the question of whether the University “held” the information for the purposes of s. 3(2) FOIA, the UT found that the present case was a straightforward application of the rules of attribution of knowledge to a corporate body. Reliance on the cases of McBride and Digby-Cameron did not assist the University: in both cases, the crucial issue was whether the information was held by the public authority “otherwise than on behalf of another person”, whereas the present case concerned the meaning of “hold”.

The UT’s analysis of the meaning of “holds” will have broad application to FOIA requests. UT Judge Wikeley approved the following passage from the Tribunal’s decision as a correct statement of the law:

“The effect of this subsection [s. 3(2) FOIA] is to confirm the inclusion of information within the scope of FOIA s1 which might otherwise have been arguably outside it. The effect of paragraph (a) is that information held by the authority on behalf of another is outside s.1 only if it is held solely on behalf of the other: if the information is held to any extent on behalf of the authority itself, the authority ‘holds’ it within the meaning of the Act. The effect of paragraph (b) is that the authority ‘holds’ information in the relevant sense even when physically someone else holds it on the authority’s behalf.”

The test is not whether the public authority “controls” or “possesses” or “owns” the information in question; simply whether it “holds” it. “Hold” is an ordinary English word and is not used in some technical sense in FOIA; it should not be re-defined or replaced, as to do so would risk distorting its ordinary meaning. The UT’s interpretation of “hold” means that, in general, public authorities should base their cases for refusal on exemptions rather than on arguments about whether they “held” the information for s. 3(2) purposes. See these statements from UT Judge Wikeley:

“A key feature of the FOIA regime is the need to balance the interests of the requester and the public interest in the free flow of information with the legitimate interests of public authorities and third parties.  Moreover, that balance is struck not by over-complicating the simple factual concept of whether information is “held” by a public authority – rather, it is achieved by the matrix of absolute and qualified exemptions and the application, where appropriate, of the public interest test.”

and

“I am reasonably confident that if the ordinary officious commuter on the Tyne & Wear Metro were presented with the scenario in the present case, their response would be along the lines of: “Has the University got the information BUAV requested? Of course it has. But presumably there may be some defences it can use so it doesn’t have to disclose some or all of it?””

Turning to s. 44(1)(a) FOIA, the UT noted the wording of the exemption and emphasised these words “if its disclosure (otherwise than under this Act) by the public authority holding it … is prohibited by or under any enactment”. It analysed s. 24(1) ASPA and asked itself whether the University (as opposed to any individuals) would not be committing an offence under that section if it disclosed this information otherwise than under FOIA. Its answer was no. The University therefore cannot rely on s. 44 in these circumstances, and will have to consider other exemptions if it wishes to withhold the information.

Robin Hopkins