WordPress + Bootstrap

Quite a lot of the time, when a public authority refuses a request for information based on vexatiousness (under FOIA) or manifest unreasonableness (under the EIRs), its thinking is something like this:

‘We are not saying there is zero public interest in the information you seek; rather, we are saying that – in light of everything that has passed between us – the burden imposed by compliance with your request is disproportionate to the good it would do’.

That rationale is sensible. Isn’t it? Continue reading →

For those of you who missed Elizabeth Denham’s first speech as the UK Information Commissioner, you can read it here. Ms Denham also spoke on Friday’s Radio 4 PM programme, which you can listen to here.

One of the core themes emerging from Ms Denham’s speech was the importance of public trust when it comes to the management of personal data. The delivery of Ms Denham’s speech was particularly timely in view of the fact that it coincided with the release of a survey by the Chartered Institute of Marketing (CIM) survey which showed that, of the 2,500 people surveyed, 57% did not trust companies to handle their data responsibly – see here. Continue reading →

The medical profession is only too used to the occasional outbreak of SARS. It is perhaps a little less used to an influx of SARs, as made under section 7 of the Data Protection Act 1998. In the case of the General Medical Council, requests for personal data will involve very sensitive data and just as sensitive issues of balance and extraction of the data of different parties. So it was in Dr DB v General Medical Council [2016] EWHC 2331 (QB).

Continue reading →

Some of you will be aware that Companies House is proposing to reduce the amount of time its records are retained from twenty years to six, citing various drivers including data protection concerns. This has caused a certain amount of consternation and pooh-pooing in the press, for understandable journalistic reasons. But on 8 September 2016, AG Bot handed down an Opinion in Case C-398/15, Camera di Commercio, Industria, Artigianato e Agricoltura di Lecce v Mnni in which he appears to have given a certain grist to the Companies House mill by concluding that the data protection principle of retention of personal data for no longer than necessary must take precedence over and, therefore, preclude the system of disclosure through the registers provided for by Directive 68/151. That regime, under Italian law, appears to have allowed for unrestricted permanent access to the register. The AG appears to have endorsed a principle that disclosure should be managed on a case-by-case basis by the data controller; a view which if applied in the UK would pose colossal resource implications for an already stretched Companies House. Unfortunately, AG Bot’s Opinion is not currently available in English, so the nuances escape this parochial reader, but the eventual ruling of the CJEU will certainly be worth watching out for.

Christopher Knight