Author: Robin Hopkins

ICO’S SURVEILLANCE REPORT 2010: ‘SLEEPWALKING’ RISK REMAINS; ‘PRIVACY IMPACT ASSESSMENTS’ PROPOSED FOR NEW LEGISLATION

Posted on | by Robin Hopkins

The Information Commissioner has delivered his latest report to the Home Affairs Select Committee on “the state of surveillance” in the UK. The report traces privacy-related developments since the Commissioner’s 2006 report on the same theme, which memorably observed that the UK may be “sleepwalking into a surveillance society”. According to the November 2010 report, that warning

 “… is no less cogent in 2010 than it was several years ago. It is not being suggested that the UK is a ‘police state’ or that there are surveillance conspiracies afoot against the public. Neither the 2006 report nor this one supports such an assumption, and evidence for it is lacking. Much of what is taken to be surveillance is done for benign reasons and has beneficial effects on individuals and society. But much surveillance also goes beyond the limits of what is tolerable in a society based on the rule of law and human rights, one of which is the right to privacy.”

The report provides an illuminating summary of trends in (amongst others) the use of CCTV, body scanning and border control (including ‘ethnic targeting’ for security searches), workplace monitoring, social networking, ‘crowdsourcing’, the monitoring of protest activities and even the use of unmanned drones. Scrutiny is also given to a number of governmental policy tools, such as databases and the use of ‘social sorting’ (eg into groups such as ‘high cost, high risk’ social groups who are vulnerable to social exclusion’) to develop targeted welfare strategies.

As regards private-sector online commerce, the Commissioner recommends a number of measures to correct what he describes as the “worrying trend particularly with those who provide on-line services not to have thought through the privacy implications of their activities and given users robust privacy settings as a default”.

What to do about the risks identified in the report? The ICO’s recommendations focus principally on overhauling the legislative process insofar as it affects privacy, by introducing: 

  • a requirement for a privacy impact assessment to be presented during the parliamentary process where legislative measures have a particular impact on privacy;
  • an opportunity for the Information Commissioner to provide a reasoned opinion to Parliament on measures that engage concerns within his areas of competence, and
  • a legal requirement to make sure all new laws that engage significant privacy concerns undergo post-legislative scrutiny to ensure they are being implemented and used as intended by Parliament.

If implemented, these measures would add substantially to the ICO’s clout as the guardian of privacy.

The report can be found here, with the accompanying press release from the ICO here.

ELECTORAL COMMISSION’S INVESTIGATION INTO UNLAWFUL POLITICAL DONATIONS: PERSONAL AND NON-PERSONAL DATA

Posted on | by Robin Hopkins

Wendy Alexander MSP became leader of the Labour Party group in the Scottish Parliament in September 2007. In the course of her leadership election campaign, someone in her team recorded a donation of £950 as coming from a domestically-based company, whereas it in fact came (unlawfully) from an overseas-based individual. The Electoral Commission investigated two potential criminal offences that arose under the Political Parties, Elections and Referendums Act 2000. In February 2008, it issued what the Information Tribunal described as a “meagre statement”. It said that there was insufficient evidence of an offence under section 61 (knowingly facilitating, concealing or disguising an impermissible donation), but it acknowledged – implicitly – that an offence under section 56(3) (failure to return an impermissible donation within 30 days). Nonetheless, the case was not referred to the Procurator Fiscal. Many were dissatisfied with the investigation.

 

The requester in this case sought further information. Answers to a number of his questions were withheld. The Tribunal in Ferguson v IC and The Electoral Commission (EA/2010/0085) has today handed down a decision which is notable both for its commentary on the interaction between personal data and the inherent publicity of political life, and for a number of distinctions it draws between types of information which, at first glance, may appear to be personal.

 

Broadly, there were two types of question in dispute. One type sought the names of those who provided the Electoral Commission with answers to certain questions. Applying Durant, the Tribunal held that this was not personal data. Even if it were personal data, a Schedule 2 condition would be met, and the processing would be lawful and fair because there was no indication that interviewees had an expectation of confidentiality. The Tribunal emphasised that fairness does involve a balance of competing interests. Section 30(1) was engaged, but the public interest favoured disclosure. Here the Tribunal rejected the submission that disclosure would undermine voluntary co-operation with the Electoral Commission’s investigations: “politicians and their supporters have strong incentives to co-operate with the Commission”.

 

The second type was about who had misrecorded the donation and why. This was held to be sensitive personal data. The Tribunal cautioned against generalising about FOIA being purpose-blind: an applicant’s identity and motives may sometimes shed light on the public interests involved, and on whether conditions from Schedules 2 and 3 are met. In this case, however, a Schedule 3 condition was not met: the Tribunal was not persuaded that, at the relevant time, the answers the appellant sought were necessary for him to obtain legal advice on a possible application for judicial review of the Electoral Commission.

 

The Tribunal remarked that the appellant would have had a “strongly arguable case” under condition 6(1) of Schedule 2, and made a number of observations on fairness. It commented that “politics is an inherently public activity. The extent and manner of compliance with the rules should be expected to be subject to public scrutiny”. The Tribunal did, however, distinguish between the section 56 offence (implicit finding of guilt) and the section 61 offence (explicit finding of insufficient evidence). Disclosure concerning the former would not be unfair: Ms Alexander “would be well able to say in mitigation anything that she wished by making public statements, as any serious politician would”. Disclosure concerning the latter would be unfair: it “would risk placing the data subjects under a cloud of suspicion, in circumstances where there might be no definitive termination of speculation and where, as a result, undue distress would be likely to ensue”.

 

GOOGLE ESCAPES FINE OVER STREET VIEW CARS, BUT MUST SIGN UNDERTAKING

Posted on | by Robin Hopkins

Google used cars equipped with cameras to gather material for its much-publicised Street View feature. The material was not confined to photographs, but also included data by which wi-fi hotspots could be located. Earlier in 2010, the ICO investigated this ‘payload data’. It concluded that the information it had inspected was not personal data, in that it could not be linked to identifiable individuals. The ICO stated, however, that it would continue to work with its international counterparts, such as the Canadian authorities, in investigating Google. This co-operation has now shown the payload data to include URLs, passwords and email details.

 

The ICO today announced that:

 

“The Commissioner has concluded that there was a significant breach of the Data Protection Act when Google Street View cars collected payload data as part of their wi-fi mapping exercise in the UK. He has instructed Google UK to sign an undertaking in which the company commits to take action to ensure that breaches of this kind cannot happen again. An audit of Google UK’s Data Protection practices will also be undertaken. The Commissioner has rejected calls for a monetary penalty to be imposed but is well placed to take further regulatory action if the undertaking is not fully complied with”.

 

This follows the ICO’s press release on Monday, in which it commented that:

 

“It is also important to note that none of the regulators currently investigating Google Street View have taken direct enforcement action at this stage, with the US investigation led by the US Federal Trade Commission for example ruling out direct action, although mirroring our own concern that this data was allowed to be collected by an organisation who showed such disregard for international data protection legislation. This week the Metropolitan Police have also closed their case believing it would not be appropriate to pursue a criminal case against Google under the Regulation of Investigatory Powers Act (RIPA). Whilst we continue to work with our other international counterparts on this issue we will not be panicked into a knee jerk response to an alarmist agenda.”

 

The latter press release also explained the ICO is “keen to discuss with MPs and Ministers how we can further defend privacy on the internet as technologies and applications develop”. In this regard, the Guardian reports today that culture minister Ed Vaizey is proposing a new internet code of conduct and a mediation mechanism to resolve complaints by individuals against data controllers. He is reportedly meeting with the ICO today to discuss these matters. Watch this space.

 

COUNCIL ENTITLED TO WITHHOLD PROPERTY DEVELOPER’S FINANCIAL MODEL: BRISTOL CITY DISTINGUISHED

Posted on | by Robin Hopkins

Bath & North East Somerset Council v IC (EA/2010/0045) is the latest application of the ‘commercial confidentiality’ exemption under regulation 12(5)(e) EIR to a request for information on agreements between a local authority and a property developer.

 

The council and the developer entered into discussions about building homes on 70 acres of brownfield land within a UNESCO World Heritage Site. Only a small proportion of this land was owned by the council, the rest being owned by the developer, who would also bear 100% of the risk of the project. The proposed £500m project would deliver 50% of the council’s new homes target for the next 10 years – the council was therefore acting as both beneficiary and planning authority.

 

With a potential section 106 agreement in mind, the council and developer reached a co-operation agreement, whereby the developer taking an ‘open book’ approach, i.e. making its financial models and reports available to the council. This was the information at issue before the Tribunal.

 

The Tribunal found that the public interest favoured maintaining the exemption. In so doing, it distinguished this case from Bristol City Council v ICO and Portland and Brunswick Squares Association (EA/2010/0012) – on which, see my post here and article in the Local Government Lawyer here – where disclosure of the information was ordered. Bristol City concerned a viability assessment designed to show that a hypothetical scheme was not viable; that assessment used generic, industry-level pricing. In contrast, this case concerned detailed and developer-specific financial information about an actual proposal. The commercial sensitivities differed materially.

 

Disclosure of such information, held the Tribunal, would lead to the developer refusing to provide any further ‘open book’ information, which would stymie this particular development and dissuade developers from future ‘open book’ co-operation. The Tribunal was also impressed by the availability of alternative scrutiny mechanisms in this case. It was less impressed with the council’s argument that disclosure of the disputed information would damage its reputation with developers.

 

The Tribunal did order the disclosure of consultants’ reports and emails, with commercially sensitive information redacted. The developer’s financial model however, could not be redacted, and could be withheld. On this last point, a notable practical issue emerged: both the council and the Commissioner had interpreted the request as being for a static version of the developer’s financial model. A ‘live’ model – i.e. a spreadsheet containing visible formulae – is another matter. The Tribunal warned that in future cases, clarification should be sought from the requester.

TRIBUNAL ORDERS DISCLOSURE OF 1986 ‘WESTLAND HELICOPTER’ CABINET MINUTES

Posted on | by Robin Hopkins

A number of Tribunal decisions have dealt with requests for minutes of cabinet meetings. Section 35 is inevitably relied upon, and arguments about both collective responsibility and confidentiality ensue.

 

The most famous concerned the decision to go to war in Iraq, which case saw disclosure being ordered by the Tribunal, but vetoed by Jack Straw.

 

More recently (Cabinet Office v ICO (EA/2010/ 0031)), the Tribunal has ordered disclosure of the cabinet’s meeting on 9th January 1986, in which Michael Heseltine resigned over the Westland Helicopter decision.

 

The Tribunal agreed that cabinet minutes are of the highest sensitivity, and should only be disclosed in rare cases “where it involves no apparent threat to the cohesive working of Cabinet government, whether now or in the future”. Relevant factors include: the passage of time, the departure of the relevant ministers from active politics, publication of memoirs and ministerial statements describing the meeting, the issue lacking ongoing significance, the ‘objectivity value’ where publicised accounts conflict, and whether the issue is of “particular political or historical significance”.

 

The last-mentioned factor was one Jack Straw expressly disagreed with when issuing the certificate of veto mentioned above: in other words, his position was that the more momentous a decision, the greater the need for confidentiality.

 

Many of these factors were, however, at work in the present case: for example, Margaret Thatcher and Michael Heseltine both made (acrimonious) public statements about the meeting at the time, and the meeting has since surfaced in plenty of memoirs. The outcome was that, whilst section 35 was engaged, the public interest favoured disclosure.

 

No sign of the incumbent Lord Chancellor, Ken Clarke – who, incidentally, was in the cabinet and present for the 1986 Westland Helicopter meeting – reaching for the veto just yet.

 

The Tribunal concluded its judgment with stringent criticism of the Cabinet Office’s delay in dealing with this request. The Cabinet Office is one of the 33 authorities on the ICO’s first monitoring list – on which, see my post below.

ICO BEGINS TARGETED MONITORING OF TARDY AUTHORITIES

Posted on | by Robin Hopkins

The Information Commissioner’s Enforcement Team has begun cracking down on public authorities that habitually fail to respond to requests for information within the statutory limits. This morning, it began publishing a list – to be updated quarterly – of authorities whose timeliness will now be subject to specific monitoring by the ICO.

 

 Those on the list have either (i) been the subject of six or more complaints of delay in the last six months, (ii) exceeded the time limit by a significant margin on at least one occasion, or (iii) appear to respond in time to fewer than 85% of requests.

  

There are 33 authorities on the first monitoring list.

 

For the ICO’s statement, click here. For the debut monitoring list, click here.