FOIA Appeals and Enforcement: Who has the Power?

When the First-tier Tribunal decides an information rights appeal and finds in favour of the requestor, who has the responsibility for enforcing any non-compliance with that judgment? Is it the FTT, or is the Information Commissioner? In an interesting judgment of Judge Jacobs in Moss v Information Commissioner & Royal Borough of Kingston upon Thames [2020] UKUT 174 (AAC), the Upper Tribunal has held that it is the FTT. Continue reading

ZXC v Bloomberg: privacy expectations about criminal investigations

The Court of Appeal has today given judgment in the long-running ZXC v Bloomberg litigation ([2020] EWCA Civ 611). The key points:

  1. In general, a person does have a reasonable expectation of privacy about the fact that/details of their being subject to a police investigation, up to the point of charge.
  2. Reporting about alleged conduct is different from reporting about a criminal investigation into that conduct.

Continue reading

NewsFlash: International Transfers Decision Coming Soon(ish)

The CJEU has announced that judgment will be handed down in Case C-311/18, Data Protection Commissioner v Facebook Ireland & Schrems on 16 July 2020. The judgment directly concerns the legality of standard contractual clauses in the context of transfers of personal data to the USA, and is also likely to comment on the validity of the Privacy Shield adequacy decision (which came under heavy fire at the hearing) and the role of data protection supervisory authorities in relation to international transfers. The Advocate General’s Opinion was issued in December: (EU:C:2019:1145). 

Christopher Knight

Health Records and the Deceased

The Access to Health Records Act 1990 is an oft-overlooked member of the information rights family, but it can have a useful role to play. In the case of Re AB [2020] EWHC 691 (Fam) (Re AB) it was important because the applicant was the personal representative seeking the health records of a deceased sibling; precisely the sort of territory to which data protection law does not apply. Continue reading