CIVIL MONETARY PENALTIES FOR SECURITY BREACHES OF PERSONAL DATA

Posted on | by James Goudie KC

The Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010, SI 2010/31, and the Draft Data Protection (Monetary Penalties) Order 2010, create a framework for the Information Commissioner to serve a monetary penalty notice on a data controller if he is satisfied there has been both a serious contravention by the data controller of the data protection principles and that the contravention was of a kind likely to cause substantial damage or distress.   Such contraventions must be either deliberate or something which the data controller knew would occur (or ought to have known) and of a kind likely to cause substantial damage or substantial distress, but in respect of which he failed to take reasonable steps to prevent.   

 

The Regulations prescribe the maximum amount of a monetary penalty.  They also set out the minimum details to be contained in a notice of intent, and in a monetary penalty notice.

 

The Order sets out procedural details of the issue of a monetary penalty notice following a notice of intent.  It also contains details of when enforcement action can be taken, and the power to cancel or vary a monetary penalty notice issued by the Information Commissioner, as well as details of appeal rights of data controllers.    

REDACTION IS NOT PART OF THE COST OF COMPLIANCE

Posted on | by Robin Hopkins

Public authorities will wish to note the Information Tribunal’s recent confirmation of the Commissioner’s view that the costs of redaction do not count towards the cost of complying with a request, and should thus be ignored for the purposes of s. 12 FOIA.

 

That section contains an exemption where the estimated cost of compliance with a request under FOIA would exceed the appropriate limit set by the Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004. By regulation 4(3)(d), the ‘”allowable tasks” for the purposes of the cost calculation include “extracting the information from a document containing it”. In its recent decision in Chief Constable of South Yorkshire Police v Information Commissioner (EA/2009/0029), the Tribunal held that this did not extend to redaction.

 

A differently constituted Tribunal had reached the same decision in Jenkins v IC and DEFRA (EA/2006/0067), but had observed that the point was not free from doubt. The more recent decision – which deals with both statutory construction and matters of principle – appears to have dispelled this doubt.

 

 

 

 

 

VOLUNTARY ORGANISATIONS: DO THEY FEAR THE CONSEQUENCES OF FOI REQUESTS?

Posted on | by James Goudie KC

A study, carried out by researchers at the University of Strathclyde, has examined the use of FOI by voluntary organisations and campaign groups across Scotland.  It found that where requests for information were refused, more than half of respondents reported that the public authority failed to notify them of their right to appeal against the refusal, despite there being a legal requirement to do so.  The researchers also found that, where appeals against refusal were made to an authority, one in four respondents said the authority failed to notify them of their right of further appeal to the Scottish Information Commissioner.  The research was undertaken as part of an ongoing 3-year study into the use of FOI laws by the voluntary sector.  The study also found that almost half (49%) of the voluntary sector respondents surveyed would be discouraged from requesting information under FOI because of a fear that it might harm working or funding relationships.

 

The full research study, entitled ‘Public Communication, Democracy and Citizenship: Assessing Civil Society Uptake of Freedom of Information’ is due to be published in 2011.  The research report published on 4 January 2010 “Voluntunteering Information?  The use of FOI laws by the Third Sector in Scotland – Survey Findings” brings together the first-phase quantitative findings from this study.  The research is funded by the Economic and Social Research Council (ESRC), and is supported by the Scottish Information Commissioner.  The research was launched in 2008 following evidence to suggest that the FOI ‘right to information’ might not be being used to its full potential by Scotland’s voluntary and campaign organisations, with only 4% of the appeals received in 2007 by the Commissioner coming from the sector.  This figure compared with 6% from the media, 7% from politicians, and 77% from the public.

 

The Scottish Government is currently considering extending the FOI Act to cover additional bodies.  It announced on 8 December 2009 that it plans to consult on the extension of FOI to cover PFI/PPP contractors, trusts that provide cultural and leisure services and bodies such as the Association of Chief Police Officers in Scotland, the Glasgow Housing Association and privately-run prisons.  The Scottish Information Commissioner has welcomed the announcement, arguing that the practice of handing the delivery of public services to third party organisations not covered by FOI is eroding the public’s right to information.

 

SUPREME COURT JUDGMENT ON THE INVESTIGATORY POWERS TRIBUNAL

Posted on | by Anya Proops KC

This week the Supreme Court handed down an important judgment on the jurisdictional scope of the Investigatory Powers Tribunal (IPT): R (on the application of A) v B [2009] UKSC 12. The case involved a former spy, ‘A’, who wished to publish a manuscript relating to the successes, failures and recruiting techniques of MI5. MI5 had refused to authorise the publication of certain elements of the manuscript under the Official Secrets Act 1989. A subsequently brought a claim for judicial review in the administrative court challenging MI5’s decision. The claim was advanced in particular on the basis that MI5’s refusal breached A‘s right to freedom of expression under Article 10 of the European Convention of Human Rights. The claim was resisted on the basis that, under s. 65 of the Regulation of Investigatory Powers Act (RIPA), it was the Investigatory Powers Tribunal (IPT) which had exclusive jurisdiction to hear any challenge made against MI5’s decision, irrespective of whether or not that challenge was made under the Human Rights Act 1998 (HRA). A’s claim for judicial review was allowed at first instance. In summary, Collins J held that the High Court exercised jurisdiction in respect of the claim in parallel with the IPT ([2008] 4 All ER 511). Collins J’s judgment was subsequently overturned by a majority of the Court of Appeal ([2009] 3 WLR 717). The Supreme Court has now unanimously upheld the Court of Appeal’s majority judgment. In essence, the Supreme Court held that:

 

  • the wording of s. 65 RIPA should be construed broadly so as to ensure that, where decisions of this nature were in issue, they should be heard by the IPT, even if they embraced challenges brought under the HRA;

 

  • the fact that s. 65 operated to oust the jurisdiction which the ordinary courts would otherwise have to hear a human rights challenge was not objectionable on constitutional grounds (i.e. it did not constitute an unlawful ouster). In particular, the ouster of jurisdiction embodied in s. 65 was lawful because: (a) it had been provided for in clear terms under the relevant legislation; and (b) it did not operate to prevent judicial scrutiny of the particular decision but instead merely ensured that that scrutiny was conducted by the IPT;

 

  • the mere fact that the IPT procedures were more secretive than those which would apply in the ordinary courts did not mean that there would be any breach of A’s right to a fair trial under Article 6 ECHR. The use of such procedures could be justified in view of the fact that determination of A’s claim would entail consideration of information which raised issues of national security. (It was noted in the judgment that an application to the ECtHR is currently pending on the question of whether certain of the IPT rules breach various articles of the Convention, including articles 6, 8 and 10).

 

The judgment is likely to be seen as controversial in certain quarters, not least because the secretive nature of the IPT process is regarded by many as being inherently unjust. 11KBW’s Jason Coppel appeared on behalf of B before the Supreme Court.  See further my post on the recent application of the IPT process to a surveillance procedure applied by a local authority.

JACK STRAW EXERCISES MINISTERIAL VETO (AGAIN)

Posted on | by Anya Proops KC

In February of this year, Justice Secretary Jack Straw issued the first ministerial veto under s. 53 FOIA. The veto, which met with considerable public controversy at the time, was issued in response to an Information Tribunal decision which required disclosure of minutes of a Cabinet meeting at which the government decided to go to war in Iraq (see further my paper on this issue). Yesterday, Mr Straw announced that he was exercising his powers of veto for a second time. The new veto has been issued in respect of a decision of the Commissioner requiring disclosure of minutes of the Cabinet Ministerial Committee on devolution to Scotland and Wales and the English Regions 1997. In the public announcement of the veto, Mr Straw stated that disclosure of the information in issue would have put the convention of collective cabinet responsibility at ‘serious risk of harm’. He also stated that he considered the circumstances of the case to be exceptional. Notably, similar points had been used to justify the veto in respect of the Iraq minutes. See further the certificate and Mr Straw’s Statement of Reasons and Veto. The effect of the veto is that the appeal against the Commissioner’s decision, which was due to be heard by the Information Tribunal at the end of January 2010, will now be aborted as the effect of the veto is that the decision notice ceases to have effect. The Commissioner has today issued a statement in response to the veto. The statement expresses regret and concern that the veto was issued in circumstances where the Tribunal had yet to adjudicate on the Cabinet Office’s appeal (cf. the Iraq minutes case where the veto was issued subsequent to the tribunal’s decision). The Commissioner will in due course issue a report to Parliament on the matter.

The Open University? Application of FOIA to University Course Materials

Posted on | by Anya Proops KC

The question of whether and to what extent FOIA can be used as a device to open up public access to educational resources is obviously an important one for our society. It is a question which was very recently considered in the case of University of Lancashire v IC (EA/2009/0034). In that case, the Tribunal was called upon to decide whether a university (UCLAN) had acted unlawfully in refusing a request made under FOIA for disclosure of course materials relating to a BSc degree course in homeopathy. The request had been refused initially on the basis that disclosure of the course materials would damage UCLAN’s commercial interests (application of s. 43 FOIA). Subsequently, when the matter came before the Commissioner, UCLAN also argued that it was entitled to refuse disclosure because of the risks disclosure would pose to the effective conduct of its affairs (application of s. 36 FOIA). The Commissioner held that UCLAN had erred in refusing to disclose the course materials, save that he accepted that certain elements of the course materials, and particularly empirical case studies, could be withheld under s. 41 FOIA (the confidential information exemption). UCLAN appealed the Commissioner’s decision to the Tribunal.

The Tribunal dismissed UCLAN’s appeal. In summary, it held that:

·       with respect to the application of s. 43 FOIA (the commercial interests exemption):

o      despite being a charitable institution, UCLAN did have ‘commercial interests’ and those commercial interests were engaged in respect of teaching materials produced for its degree courses (§31);

o      however, it could not be said that, at the time of the request (July 2006), there was any real and significant risk that disclosure of the homeopathy course materials would prejudice UCLAN’s commercial interestsand accordingly s. 43 was not engaged (§§32-39);

o      in any event, had s. 43 been engaged, the public interest balance under s. 2 FOIA would have weighed firmly in favour of disclosure (§§40-50).

·       with respect to the application of s. 36 FOIA (the public affairs exemption), the exemption was not engaged because the opinion of the qualified person relied on for the purposes of this section was neither reasonable in substance nor reasonably arrived at (§§52-62).

The following aspects of the Tribunal’s decision are particularly worthy of note:

·       in line with the earlier Student Loans case, the Tribunal took a broad approach to the concept of ‘commercial interests’ for the purposes of s. 43. It readily accepted that universities could have commercial interests in the courses which they ran;

·       UCLAN argued before the tribunal that the course materials were exempt from disclosure not least having regard to the facts that: (a) they contained a significant amount of third party copyrighted information and (b) disclosure of that copyrighted information under FOIA would disincline third parties from contributing to course materials in the future. The tribunal rejected these arguments. It did so on the basis that: (1) disclosure of information under FOIA would not in any way have diluted any copyright enjoyed by the third parties and (2) there was in any event no sufficient evidence before the tribunal to substantiate UCLAN’s case that disclosure of the copyrighted material would have had an alienating effect on third party contributors.

·        the Tribunal highlighted the degree of rigour which must be applied when the relevant qualified person is seeking to formulate an opinion which engages s. 36. It also highlighted that the public authority must itself provide evidence that the person who reached the relevant opinion was a ‘qualified person’ for the purposes of s. 36 (§53);

·       on the question of the public interest test, the Tribunal found that there were strong public interests in disclosure. Those interests included both: (1) a general public interest in members of the public being able to test the educational value of publicly funded degree courses and (2) a specific public interest in accessing information relating to a homeopathy degree course which was by its very nature inherently controversial.

The parties were represented by 11KBW’s Tim Pitt-Payne (counsel for UCLAN) and Anya Proops (counsel for the Commissioner).