CALL FOR EVIDENCE ON THE EUROPEAN COMMISSION’S DATA PROTECTION PROPOSALS

Posted on | by Rachel Kamm

The Government is seeking evidence on the  new legislative proposals for data protection, which were published by the European Commission on 25 January 2012. Responses are due by 6 March 2012 and can be submitted online here. The European Commission aims to have a final agreed legislative framework by 2014.

The European Commission has published in draft both a Regulation and a Directive. The proposed Regulation will set out a general EU framework for data protection to replace the 1995 Data Protection Directive, which is implemented into UK law by the Data Protection Act 1998. The proposed Directive will cover the protection of personal data processed for the purposes of prevention, detection, investigation or prosecution of criminal offences and related judicial activities (to replace the existing Data Protection Framework Decision).  For those of you who have not looked  at the proposals yet, the Government’s Call for Evidence is a good place to start for a summary.

Rachel Kamm

NICK GRIFFIN IN THE TRIBUNAL: APPLICANT BLINDNESS, THE “JOURNALIST’S ROUTE” AND ARTICLE 10

Posted on | by Robin Hopkins

BNP leader Nick Griffin was convicted in 1998 for publishing material likely to stir up racial hatred. In 2009, Ian Cobain, an investigative journalist at The Guardian, requested sight of all Crown Prosecution Service papers relating to that prosecution. The Commissioner upheld its refusal. In Cobain v IC and Crown Prosecution Service (EA/2011/0112 & 0113), the Tribunal considered 3 exemptions, namely ss. 40(2), 32(1) and 30(1) of FOIA. For the most part, Mr Cobain’s arguments prevailed.

The decision is notable – indeed, essential reading – for a number of its key points. For example: when it comes to journalists requesting sensitive personal data, FOIA is not “applicant blind”. More generally, the decision affirms the importance of FOIA in facilitating investigative journalism. The approach to Article 10 ECHR from the Kennedy “report” is boldly affirmed. General guidance on s. 30(1) is set out. I’ll look at the key points from each exemption in turn. The decision is worth quoting in some detail.

Section 40(2) (personal data)

A number of important points emerge. First, in general, just because information emerged during evidence in a public trial, this does not mean it should automatically be disclosed under FOIA:

“Much of the information… was freely publicised at the trial in 1998… Where the public interest is engaged (as here where s. 30(1)(c) is invoked) it does not by any means automatically follow that such publication in the past determines the question of disclosure today. Most witnesses are entitled to expect that their exposure to public scrutiny ends with the conclusion of their evidence. Those who make statements do so in the expectation that, if not used at trial, they will not surface later.”

Secondly, just because information is in a prosecution file, it does not follow that it is necessarily personal data. The Commissioner was criticised for insufficiently granular analysis:

“It was clear that the broad and unparticularised approach adopted in the First Decision Notice could not be upheld. The fact that it is information held in a file assembled for the purposes of criminal proceedings against Mr. Griffin (see DPA s.2(g)) does not make it sensitive personal data, unless it is personal data in the first place.”

Some of the disputed information was therefore outside s. 40(2) because it was not personal data in the first place. Other information, however, was sensitive personal data. This meant that not only would the usual conditions need to be met (fairness, lawfulness, condition 6(1)) but a Schedule 3 condition was also mandatory. Those can be difficult to meet – unless you are a journalist. Condition 10 triggers the Data Protection (Processing of Sensitive Personal Data) Order 2000. This contains particular “lawful processing” conditions for the purposes of, among other things, journalism: see article 3 of the Order, which also imposes other conditions such as the disclosure being in the “substantial public interest” and “in connection with” issues such as “the commission of an unlawful act”. Paragraphs 31-33 of the Tribunal’s decision contain a useful summary of how the relevant provisions work.

This “journalist’s route” (my term, rather than the Tribunal’s) to obtaining sensitive personal data has been considered in a number of Tribunal decisions. In this case, it was given full effect:

 “Disclosure of the sensitive data would be “in connection with” the commission of an unlawful act (hence the conviction), seriously improper conduct and arguably Mr. Griffin`s unfitness for political office. It would be for the purpose of journalism, Mr. Cobain`s occupation, and would be intended for publication in his newspaper and possibly thereafter, in a book. Given the issues involved, namely racial and/or religious hatred and the right to express even extreme views, we find that disclosure would be in the substantial public interest. We do not consider that the passage of eleven years before the request renders disclosure unfair, or unwarranted by reason of prejudice to Mr. Griffin`s interests nor likely to cause substantial damage or distress to him. In making that judgement we have regard to Mr. Griffin`s age ( 50 at the date of the request, 39 at the date of trial), his continuing political prominence and his apparent claim to be an educated, reasonable and responsible MEP and party leader who has rejected any racial extremism formerly associated with his party.”

How does this “journalist’s route” square with the usual “applicant blindness” FOIA principle? The ICO argued that the latter prevails, such that the former only applies to pure DPA cases, not to FOIA ones. It emphasized the wording of s. 40(3)(a): disclosure to “a member of the public otherwise than under [FOIA]”. It argued that the average member of the public is the reference point for a FOIA disclosure. The average member of the public is not a journalist. The “journalist’s route” therefore has no place in FOIA.

The Tribunal disagreed (as the First-Tier Tribunal has done on a number of occasions now). It relied on the Upper Tribunal’s judgment in the APPGER case on this point, and said that:

 “… a requester who fulfils one or more of the schedule conditions is also a member of the public ( and is not the data processor ) who is receiving the information under FOIA. If this were not so, FOIA would be a valueless tool for the serious researcher, journalist, writer, politician or scholar seeking to investigate serious wrongdoing within the preceding thirty years. If that were the case, it would be reasonable to ask whether FOIA was worth enactment.”

The effect in this case was that s. 40(2) did not apply at all.

Section 32 (court records)

Next, the CPS relied on s. 32, the ambiguous wording of which has opened the door for Article 10 ECHR arguments: see the Kennedy v Charity litigation (Panopticon passim) in which the First-Tier Tribunal’s “report” on the application and effect of Article 10 on s. 32 will be considered by the Court of Appeal later this month. The Tribunal in Cobain wholeheartedly adopted the Kennedy report:

“We adopt with gratitude and respect the very careful reasoning of the report on this issue, which we believe accurately states the law as to Article 10 as recently developed… We do not doubt that s. 32(1) can be read down in a way which is consistent with Article 10. We consider that limiting the restriction in [s. 32(1)] so that it ends once a reasonable time has elapsed after the exhaustion or evident abandonment of the available appeal process would avoid a breach of Article 10.”

Consequently, s. 32 was not available as a ground for refusal in this case.

The Article 10 issue is obviously of enormous importance to the interpretation of FOIA – particularly, but not exclusively for journalists. As things stand, the role of Article 10 is uncertain. At least two other First-Tier Tribunals have heard or will hear argument on it this month (in the contexts of ss. 23, 40(2) and 41); the Court of Appeal will consider it in two cases this month, and the Supreme Court gives judgment in Sugar v BBC next week. Watch this space.

Section 30(1) (investigations)

In the context of this case, this exemption was “unarguably” engaged. The Tribunal made the following observations about the public interest in maintaining this exemption:

“The Tribunal acknowledges the substantial public interest in many circumstances in protecting from disclosure information gathered for the purposes of a criminal case, including the need to offer informants and witnesses protection from public exposure and a prosecuting authority a proper space in which to discuss and decide issues that arise.”

As against that, it said this about the public interest in disclosure:

“On the other hand, the public has a legitimate interest in criminal investigations and resulting court proceedings, especially where the defendant was a prominent political figure charged with an offence of great current importance in proceedings that he was keen to publicise. The passage of time is also a consideration. Legitimate public interest in such a case continues due to the profile of the defendant but the risk of any impact on the resulting proceedings disappeared long ago. More importantly, the relevant information in this appeal does not include statements from potentially vulnerable witnesses or highly sensitive material”.

The Tribunal therefore concluded that, in general, the public interest favoured the disclosure of the disputed information in this case, except for three categories which could properly be withheld.

On s. 30(1), this decision is a useful summary of the most relevant considerations. It is on ss. 40(2) and Article 10, however, that it has given a fresh boost to requesters.

Robin Hopkins

ARTICLE 8 CHALLENGE TO ENHANCED CRIMINAL RECORDS REGIME FAILS (AT FIRST INSTANCE)

Posted on | by Robin Hopkins

Yesterday, the High Court(Kenneth Parker J) gave judgment in R (T) v (1) Chief Constable of Greater Manchester Police, (2) Secretary of State for the Home Department (Secretary of State for Justice an interested party) [2012] EWHC 147 (Admin). The judgment is available here:  T_v_Greater_Manchester_Police.

In July 2002, the Claimant was 11 years old. He received a warning (a private procedure, under the Crime and Disorder Act 1998) from Greater Manchester Police for the theft of two bicycles. His subsequent conduct was apparently exemplary. By section 113B of the Police Act 1997, Enhanced Criminal Record Certificates (ECRCs) must contain all convictions, cautions and warnings. The Claimant, a 20-year old student applying for a sports studies course, obtained his ECRC in December 2010. It contained details of the bike theft warning.

He argued that the inflexible requirement under the 1997 Act for all convictions, cautions and warnings to be disclosed in ECRCs was incompatible with Article 8 of the ECHR.

With overt reluctance, Kenneth Parker J dismissed the claim. His decision was based on the analysis of R (L) v Commissioner of Police for the Metropolis [2009] UKSC 3 [2010] 1 AC 410, where the majority of the Supreme Court decided that the disclosure of “information” (under s. 115(6) of the 1997 Act) potentially breached Article 8. Such a breach would be justified only if (a) the information is relevant to the decision for which the ECRC is required, and (b) disclosure is proportionate, taking into account factors such as the gravity of the material, the reliability of the information on which it was based, the relevance of the material to the particular job application, the period since the relevant events and the impact on the applicant of including the material in the ECRC.

The disclosure of “information” was, however, a separate matter from the disclosure of convictions, cautions and warnings. It was clear from L that, insofar as it required the latter, the 1997 Act was not open to challenge under Article 8.

Kenneth Parker J had great sympathy with the Claimant’s analogy with R (F) v Justice Secretary [2010] UKSC 17; [2011] 1 AC 331, in which the subjecting of the claimants to indefinite reporting requirements under the Sexual Offences Act 2003 was found to violate their rights under Article 8. As in F, the provisions under challenge in the present case provided for no reviews, and no exceptions. This caused the learned judge great concern. He observed that:

“… a system that allows no exceptions imposes a very heavy cost in terms of effect on the fundamental rights protected by Article 8 ECHR.  I am not persuaded that the marginal benefit that a system which admits no exceptions brings to, admittedly important, competing interests is justified as a matter of proportionality when the serious detrimental effects of such a system, particularly on child offenders, are weighed in the balance.  A system that permitted exceptions would probably be more prone to error, but only marginally so if the criteria for review were themselves conservative and risk averse.  The consequential improvement to the protection of Article 8 rights on the other hand, would be likely to be substantial.”

Nonetheless, his hands were tied by L: the requirement to disclose convictions, cautions and warnings did not violate Article 8. It may be a “bright line rule”, and arguably a harsh one, but the law has condoned such rules in other circumstances (see for example R (Animal Defenders International) v Secretary of State for Culture, Media and Sport [2008] 1 AC).

The Claimant also sought to challenge the lawfulness of the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975 – which removes, in certain circumstances, the protections concerning spent convictions. This claim failed for the same reasons. Kenneth Parker J added this notable observation:

“In these circumstances I do not believe that there is any real independent issue about the legality of the Order under Article 8 ECHR.  The conclusion must be the same.  However, I should perhaps add that the reverse argument does not necessarily apply.  In other words, even if it were disproportionate under Article 8 ECHR for the state to disclose, say, a warning long ago given to a child for a minor criminal matter, it would not automatically be an infringement if the state permitted a private employer to enquire about all criminal convictions, to insist on truthful answers and to take appropriate action in response to the answers given.”

The learned judge also observed that, if he had had to decide the issue of whether the state had a positive obligation in these circumstances, he would have found that it did not.

The claims were accordingly dismissed. However, given their general importance and Kenneth Parker J’s reluctant conclusions, he granted leave to appeal.

11KBW’s Jason Coppel appeared for the Secretaries of State.

Robin Hopkins

CLIMATEGATE IN THE TRIBUNAL: DELETED EMAILS ON BACKUP SERVERS ARE “HELD”

Posted on | by Robin Hopkins

The “Climategate” controversy surrounding the University of East Anglia’s Climatic Research Unit has received extensive media coverage. The Unit’s computer servers were hacked into in late 2009 (around the time of the Copenhagen Summit). Following the posting of much of this material on the internet, it was alleged that, in some instances, the scientific data had been manipulated so as to produce conclusions in support of the existence of climate change, or to suppress conclusions pointing the other way. FOI requests were inevitable.

The issue has now surfaced at Tribunal level. Keiller v IC and University of East Anglia (EA/2011/0152) is an important decision, not only because of the underlying subject matter, but because it deals with the thorny question of whether or not deleted emails which still exist on back-up servers are “held” for FOIA purposes.

The case concerned a request for the covering email from one of the Unit’s researchers to a colleague in the US, attaching datasets. The requester contended that the covering email contained instructions as to the use of that data, and he wished to see those instructions. UEA responded that, as the covering email had been deleted, it no longer “held” the requested information. The Commissioner agreed – but the Tribunal did not.

It had “no doubt” that the deleted email had been backed up onto the server which had been seized by the police as part of the investigation into the hacking affair. It was “rather disconcerted” by UEA’s evidence on this issue: its witness was unable to answer several pertinent questions about UEA’s email servers, back-up systems and deletion/retention policy. It also found that this email probably would have contained instructions or stipulations on the use of the data.

Following Harper v IC (EA/2005/0001), the Tribunal dismissed the argument that even if the email was on the back-up server, UEA did not “hold” that email for FOIA purposes: in one sense, deletion suggested an intention no longer to hold an email – but the whole purpose of a back-up system is to ensure emails are still recoverable after deletion. In the Tribunal’s view, “it was a matter of common-sense that information backed-up onto a backup server in the control of UEA, but deleted from the computer on which the original email was composed, was still ‘held’ by UEA”. It “considered the counter-arguments to be over-technical”.

UEA must now establish whether the email exists on the back-up server being held by the Police, obtain a copy and either disclose it or state its case for withholding the email. This may not be the last time a Tribunal considers “Climategate”.

On a related note, the Tribunal will consider an appeal on Friday 27th January in which the disputed information is the name of the principal donor behind the Global Warming Policy Forum, a think tank fronted by Lord Lawson, which is sceptical about prevailing theories on climate change – see the Guardian‘s story here.

Robin Hopkins

“IMPERMISSIBLE” DONATIONS TO THE LIBERAL DEMOCRATS: LIST OF CASES COMES WITHIN S. 42 OF FOIA

Posted on | by Robin Hopkins

In Jackson v IC and the Electoral Commission (EA/2011/0136), the appellant had requested information in connection with an investigation made into donations made to the Liberal Democrat Party by the company 5th Avenue Partners. The company’s sole director was Michael Brown, who had been convicted of theft, money laundering and perverting the course of justice. It was alleged that the company was therefore an impermissible donor under the law governing donations to political parties. The Electoral Commission did not uphold that allegation: it issued a short press statement explaining that there was no legal justification for piercing the corporate veil in connection with the company’s donation.

The requester asked for the list of legal authorities upon which that opinion was based.

The request was refused on the grounds of s. 42 of FOIA (legal professional privilege). The Commissioner upheld the refusal, and so has the Tribunal: it has confirmed that a simple list of cases can attract LPP, and it found that – in view of the limited assistance this list would offer the requester – the public interest favoured maintaining the exemption.

Robin Hopkins

COURT GRANTS INJUNCTION RESTRAINING DISTRIBUTION OF PRIVATE INFORMATION AGAINST UNKNOWN BITTORRENT SEEDERS

Posted on | by Julian Wilson

I have previously blogged here on why the use of the BitTorrent peer to peer file sharing protocol to distribute large amounts of information over the internet has proved problematic for the law, see Privacy of internet users, internet file-sharing and copyright: the present “Wild West” and the Digital Economy Act 2010

On 12 January 2012, the Technology & Construction Court demonstrated a readiness to tackle BitTorrent seeders in appropriate cases. In AMP-v- Persons Unknown [2011] EWHC 3454 (TCC) the Claimant’s explicit private digital photographic images had been stored on her mobile phone which was stolen while she was at University. Following the theft, the images of her were uploaded to a free online media hosting service for the sharing of images. They were then also uploaded to a Swedish site hosting BitTorrent files.

Ramsey J granted the Claimant an interim injunction to prevent the distribution of the images both by conventional downloading and by downloading by the use of the BitTorrent Protocol.

Unsurprisingly, the court found that the publication of the images infringed the Claimant’s right to respect for her private and family life under Article 8 and that right outweighed the rights of freedom of expression of users of BitTorrent client software to download the digital photographic images using the BitTorrent protocol and to disseminate them by seeding them.

Ramsay J. found that the users of the BitTorrent client software who were downloading and uploading the digital images had no rights in that information and that information was of a personal, private and confidential nature which the Courts should protect.

The court also found that the Claimant had a good arguable case that the conduct of disseminating the digital photographic images amounted to harassment of the Claimant under the Protection from Harassment Act 1997.

Interestingly, the Respondents who were named in the application as “Persons Unknown” were neither present nor represented and the Claimant had not taken all practical steps to notify them. However, the Judge considered there were compelling reasons why they should not be notified. If each Defendant had to be notified before the Injunction were granted it would effectively deprive the Claimant of the opportunity to obtain the immediate interim relief which would otherwise be appropriate to protect her Article 8 rights.

The court accepted expert evidence to the effect that seeders of the BitTorrent files could be identified by way of their Internet Protocol Addresses whilst they were seeding and that it would therefore be possible to obtain the IP Address of every seeder and identify from that address their physical location, name and address from their Internet Service Provider. They could therefore be served with an order requiring them to take steps to stop their account from being used.