Author: Robin Hopkins

PARTIES MAY APPEAL AGAINST DECISION NOTICES IN THEIR FAVOUR

Posted on | by Robin Hopkins

Shepard v IC and West Sussex County Council (GIA/1681/2010) involved the Commissioner upholding the appellant’s complaint against the local authority, and issuing a decision notice in his favour. That notice required the authority to search for specified information and to provide it to the Claimant if found. The authority informed the appellant that its search had been fruitless. Apparently therefore, it had complied with the decision notice, but the appellant received no information.

At first instance, his appeal failed, partly on the grounds of the well-established principle that a successful party should not be permitted to bring an appeal. The Upper Tribunal disagreed, and granted permission to appeal, observing that the aforementioned principle “surely relates to judicial decisions by courts and tribunals; it does not necessarily apply to decisions by administrative first-instance decision-makers or independent office-holders”.

Nor was the wording of FOIA itself a barrier to such appeals: section 57(1) expressly confers a right of appeal on both parties, and not simply “the losing party”. Furthermore, both the steps prescribed in a decision notice and the timing of such steps are matters of discretion for the Commissioner. Unlike the enforcement of a decision notice, such questions of discretion are within the Tribunal’s jurisdiction.

It is not clear, however, whether a challenge to a first-instance Tribunal’s refusal to entertain an appeal lies by way of an appeal to the Upper Tribunal or by way of judicial review. A test case (combined references of CH/1758/2009 and JR/2204/2009) will determine this question shortly. In the present case, the Upper Tribunal therefore granted permission to apply for judicial review as a precaution.

TRIBUNAL’S STRIKE-OUT OF ‘ACADEMIC’ APPEALS

Posted on | by Robin Hopkins

In Edwards v IC and the Ministry of Defence (EA/2010/0056), the Tribunal has exercised its power to strike out a party’s case under Tribunal Procedure (First-Tier Tribunal) (GRC) Rules 2009. This was done partly on a lack of reasonable prospects of success, and partly on jurisdictional grounds: some of the appellant’s grounds of complaint invited the Tribunal to “monitor or influence” the way in which the Commissioner had carried out his statutory duties, or the way in which the public authority had done so. The Tribunal has no jurisdiction over such matters. 

Perhaps more interestingly, this was a case where the appeal was in effect academic, as the requested material had already been given to the appellant. The grounds on which a Tribunal may strike out an appeal are contained in rule 8(3) of the 2009 Rules: lack of reasonable prospect of success, non-compliance with an order or failure to co-operate with the Tribunal “to such an extent that the Tribunal cannot deal with the proceedings fairly and justly”.

At first glance, it is not obvious how any of those three exhaustive categories accommodate appeals which have become academic due to events post-dating the handling of the relevant request. The Tribunal in Edwards has provided its answer. The key provision is rule 8(3)(b), which concerns the fair and just dealing with proceedings. By rule 2(2) of the 2009 Rules, this includes considerations of proportionality, costs and resources. Rule 5 empowers the Tribunal to regulate its own procedure. In particular, rule 5(2) allows it to give a direction in relation to the conduct or disposal of proceedings at any time.

The combination of rules 2 and 5 can therefore suffice to engage rule 8(3)(b) and support a strike-out even where questions of jurisdiction or lack of reasonable prospects of success are not in play.

BACKDOOR ATTEMPT TO OBTAIN IRAQ WAR CABINET MINUTES FAILS

Posted on | by Robin Hopkins

The minutes of the Cabinet meetings at which it was decided to go to war in Iraq have resurfaced for consideration by the Tribunal. First time round, the Tribunal agreed with the Commissioner that the minutes should be released, but the final word went to Jack Straw, by means of a ministerial veto – which was not subject to a judicial review challenge – issued under section 53 FOIA.

The requester in that case subsequently sought a backdoor route to the minutes, by requesting them under FOIA from the ICO itself. He also sought “background papers which show the processes of thought behind the Information Commissioner’s conclusion that the Cabinet minutes in question should be disclosed”. The ICO did not hold the minutes themselves, but it did hold some handwritten notes made by the then Commissioner, Richard Thomas, and by an ICO caseworker when visiting the Cabinet Office to inspect the minutes. It also held a confidential annex to the Decision Notice, which fell within the veto. All of these he refused to disclose.

The usual FOIA complaints and appeals process ensued, with the Commissioner issuing a decision notice in respect of his own refusal, and then defending that notice before the Tribunal in Lamb v IC (EA/2009/0108).

The basis of the refusal was section 44 FOIA, which provides that information is exempt if its disclosure is “prohibited by or under any enactment”. The Commissioner relied for the latter on section 59 of the DPA, which says that the Commissioner may not disclose information he obtained under the auspices of the Act “unless the disclosure is made with lawful authority”, which arises where “having regard to the rights and freedoms or legitimate interests of any person, the disclosure is necessary in the public interest”.

As the Tribunal accepted, this is a much higher threshold than the usual public interest test under FOIA: under section 59, there is effectively a presumption against disclosure.

The Tribunal was satisfied that this information was “obtained from” the Cabinet Office, notwithstanding the Appellant’s challenge on that point.

It also agreed with the Commissioner’s application of section 59. Much of the Appellant’s argument turned on the importance of the material he sought. This, said the Tribunal, overlooked the point that the Commissioner had already decided in the Appellant’s favour concerning the Cabinet minutes which he sought. The Tribunal also commented that:

“It is no part of the freedom of information regime to provide a mechanism by which a party who prosecuted a successful complaint to the Information Commissioner in the past may have his or her winning margin reassessed in the light of events subsequent to the date of the original victory”.

The Tribunal did not comment on whether the mere existence of the veto gave rise to the engagement or effectiveness of section 59. Nor did it speculate as to the circumstances in which reliance on section 59 could be defeated – although the wording of that section clearly envisaged this prospect.

COST OF COMPLYING WITH A REQUEST: NO DUTY TO SEARCH UP TO THE COST LIMIT

Posted on | by Robin Hopkins

Cooksey v ICO and Chief Officer of Greater Manchester Police (EA/20100113) is the Information Tribunal’s latest application of the ‘cost of compliance’ “exemption” at section 12 of FOIA.

The case concerned a request in six severable parts for information concerning documents from a murder investigation undertaken between1992 and 1995. The material from that investigation was stored in entirely disorganised boxes – a state of affairs which the Tribunal found “astonishing”. This disorganisation gave rise to the engagement of section 12. Notably, the Commissioner had examined a sample of the material and produced his own cost estimate which was lower than that advanced by the public authority. The Tribunal was satisfied that section 12 was engaged on the basis of the Commissioner’s estimate – but not that of the public authority.

The Appellant argued that the boxes should have been searched up to the costs limit, given that any information found in relation to her request, even if only partial, would be useful. The Tribunal rejected this approach to section 12: if the costs limit is engaged, the effect of section 12 is to disapply altogether the duty to comply with the information request.

The Tribunal also found that the margin of difference between the compliance estimate and the costs limit is a relevant consideration “in these circumstances”.

Interestingly, the Tribunal further noted that the boxes had been numbered after receipt of the request for information, for purposes of transportation. This, the Tribunal suggested, constituted a change in the way that information was organised which might allow for differently constituted information requests to be made, relying on the box numbers as a way of targeting those requests.

COMMISSIONER HANDS DOWN FIRST MONETARY PENALTIES FOR DPA BREACHES

Posted on | by Robin Hopkins

Up to now, the Commissioner has not exercised his powers under sections 55A-E of the Data Protection Act 1998 to impose monetary penalties on data controllers for breaches of the Act. Today, he imposed his first two financial penalties.

Hertfordshire County Council has been handed a penalty of £100,000 for twice sending faxes containing sensitive personal data to members of the public in error. The first fax, which is the subject of an injunction preventing further details being disclosed, was intended for a barrister but sent to a member of the public. The second fax, which concerned child protection matters, was intended for a County Court. The errors both occurred in June 2010, and were both reported to the Commissioner by the Council itself.

Secondly, the employment services company A4e has been fined £60,000 after an unencrypted laptop containing personal details of 24,000 users of community law centres was stolen from an employee’s home. This too was reported to the Commissioner by A4e itself.

ICO SIGNS UNDERTAKING WITH GOOGLE AND DEFENDS ITS STANCE

Posted on | by Robin Hopkins

I reported in a recent post that the Information Commissioner had instructed Google to sign an undertaking aimed at any repeat of the breaches of the Data Protection Act 1998 committed during Google’s information-gathering for its Street View feature. That undetaking has now been signed, and a copy can be viewed here. It requires Google engineers to maintain a “privacy design document” for each new Google project prior to launch. It provides for further training and data protection awareness for Google engineers and other employees. The undertaking also assures the deletion of all personal data which had been gathered unlawfully, and provides for the Commissioner to audit Google’s revamped data protection procedures nine months from now. Interestingly, the undertaking applies to Google’s global activities and not just its UK ones.

The ICO has come under fire for being soft on Google. The Commissioner, Christopher Graham, has defended his stance, including in an interview with the Daily Telegraph which can be found here. In that interview, the Commissioner remarks that “a lot of people out there want somebody – probably not me – to be the privacy tsar. But that’s not what the Information Commissioner is”. Recent indications suggest, however, that the ICO could potentially take on a “privacy tsar” role – see the recommendations from its recent surveillance report, summarised here.