Legal professional privilege does not automatically engage an EIR exception

Posted on | by Robin Hopkins

FOIA provides an exemption (s. 42) expressly for legal professional privilege; as is well known, there is ‘strong inherent weight’ in maintaining that exemption. What about the EIRs? LPP is not expressly mentioned, but regulation 12(5)(b) EIR applies to information the disclosure of which would adversely affect “the course of justice, the ability of a person to receive a fair trial or the ability of a public authority to conduct an inquiry of a criminal or disciplinary nature”. Does information attracting LPP automatically come within that exception? Many practitioners operate on the assumption that the answer is ‘yes’. The Upper Tribunal has on a previous occasion, however, left that question open: DCLG v IC and Robinson [2012] UKUT 103 (AAC); [2012] 2 Info LR 43.

That question has recently been revisited. In GW v IC, Local Government Ombudsman and Sandwell MBC [2014] UKUT 0130 (AAC), the Upper Tribunal answered ‘no’: just because LPP applies, it does not automatically follow that regulation 12(5)(b) EIR is engaged. Further analysis is needed – and the onus is on the public authority to make out its case on adverse effects on the course of justice etc.

The requester has complained to the Council about what was being emitted from the chimneys of two of his neighbours who were using wood-burning stoves. The Council obtained written legal advice from counsel. It told the requester it could not progress his complaint as he wished. He complained to the Ombudsman. The Council shared its legal advice with the Ombudsman, expressly on a confidential basis. The requester sought that advice from the Ombudsman. His request was refused. The IC’s decision went against him. So too did that of the First-Tier Tribunal.

The Upper Tribunal, however, found that the FTT went wrong in attributing too much weight to the prejudicial effects which it thought likely to arise “simply through the weakening of this important doctrine” [of LPP].

UT Judge Turnbull considered the wording of regulation 12(5)(b) EIR and said this: “In my judgment that requires attention to be focused on all the circumstances of the particular case, and there is no room for an absolute rule that disclosure of legally privileged information will necessarily adversely affect the course of justice”.

The crux, in his judgment was this: “What particularly matters for present purposes is in my judgment that the rationale for the doctrine and its absolute nature is established as being the need for the client to be able to obtain legal advice on a full and frank basis”.

In the present case, disclosure would be unlikely to prejudice that underlying principle – the Council’s ability to obtain free and frank advice would not be impeded. “What might be damaged would be not the course of justice but the ability of the LGO to conduct future investigations on a fully informed basis” – but that was a different point to the one at the heart of the FTT’s reasoning. The FTT had thus gone wrong in its public interest analysis.

Interestingly, one factor in the UT’s reasoning appears to have been that it was not taken to “any particular part or feature of the Advice which the Council would be unhappy about disclosing, or pointed to any specific concern which it has about Mr W or the public in general seeing it. Nor has it been suggested, for example, that the Advice needs to be qualified because of some inaccuracy or incompleteness in the instructions to counsel. The weight to be accorded to the adverse effect on the course of justice in this case is in my judgment very substantially less than it would have been if the LGO had been able to rely on the weakening of the doctrine of LPP which compulsory disclosure of legal advice will almost always involve”. This offers useful indications of what, in this UT’s view, might suffice to engage regulation 12(5)(b) EIR in respect of information which attracts LPP.

The public authorities also sought to rely on regulation 12(5)(d) EIR (confidentiality of proceedings). By regulation 12(9), however, that exception cannot be relied upon “to the extent that the environmental information to be disclosed relates to information on emissions”. Did that disapplication provision bite here? No, said the UT: “In substance the Advice did not “relate to” information as to the particular nature and extent of those emissions, but rather it related to the meaning and effect of the legislation”. In this case, regulation 12(5)(d) EIR was engaged.

Turning to the public interest balance, a preliminary point addressed by the UT concerned timing: matters post-dating the statutory time for compliance with a request can only properly be taken into account to the extent that they shed light on matters as they stood up to that time, or if they are relevant to the IC’s ‘steps discretion’ under s. 50(4) FOIA. They are not otherwise relevant to the public interest balance.

What might count in favour of the disclosure of privileged information? “In my judgment, therefore, when considering this issue it is relevant to consider not only whether the Council (and/or the LGO) made statements which were positively wrong, but whether they made statements which were liable to mislead or confuse the reader, and so have generated a confusing picture as to the effect of and reasoning behind the Advice”.

In this case, while there was no intention to mislead, “the combined effect of the information which the LGO and the Council had given up to this point was liable to create substantial confusion, in the mind of any reasonable reader, as to what the Advice did say”.

As to the public interest in maintaining the exception, the main factor was “the effect which disclosure would have on the ability of the LGO to obtain legally privileged information from local authorities on the footing that it should remain confidential” – especially given that the Ombudsman cannot compel local authorities to share such information with it. There would thus be a chilling effect on such information-sharing.

In contrast, the unfairness to the Council of having its legal advice shared with the requester was a relatively weak factor.

Overall, however, the balance very firmly favoured the maintenance of the exception. In this case therefore, the likely damage to the LGO’s work prevailed where LPP had not.

Robin Hopkins @hopkinsrobin

Local Government Transparency Code

Posted on | by Christopher Knight

The Secretary of State for Communities and Local Government has just issued a Local Government Transparency Code in exercise of his powers under section 2 of the Local Government, Planning and Land Act 1980 to issue a Code of Recommended Practice as to the publication of information by local authorities about the discharge of their functions and other matters which he considers to be related.

The Code sets out in some detail in Part 2 the type of information held by local authorities which must be published (some of it annually) and in Part 3 the information which, in the view of the Secretary of State, ought to be published. A helpful Annex A provides the details in tabular form.

Paragraph 14 of the Code provides that: “Where information would otherwise fall within one of the exemptions from disclosure under the Freedom of Information Act 2000, the Environmental Information Regulations 2004, the Infrastructure for Spatial Information in the European Community Regulations 2009 or falls within Schedule 12A to the Local Government Act 1972 then it is in the discretion of the local authority whether or not to rely on that exemption or publish the data.” There is therefore no attempt to override the FOIA exemptions. But where a qualified exemption applies, the appearance of the requested information in one of the categories set out in the Code will have a role (possibly a significant role) in establishing the public interest in support of disclosure.

Christopher Knight

Global Witness and the journalism exemption: ICO to have the first go?

Posted on | by Robin Hopkins

Panopticon has previously reported on the novel and important data protection case Steinmetz and Others v Global Witness [2014] EWHC 1186 (Ch). The High Court (Henderson J) has now given a judgment on a procedural point which will set the shape for this litigation.

The broad background to the case has been set out in Jason Coppel QC’s previous post – see here. In a nutshell, Global Witness is an NGO which reports and campaigns on natural resource related corruption around the world. Global Witness is one of a number of organisations which has recently reported on allegations that a particular company, BSG Resources Ltd (“BSGR”), secured a major mining concession in Guinea through corrupt means. Global Witness is now facing claims brought under the Data Protection Act 1998 by a number of individuals who are all in some way connected with BSGR. The claims include a subject access claim brought under s. 7; a claim under s. 10 requiring Global Witness to cease processing data in connection with the claimants and BSGR; a claim for rectification under s. 14 and a claim for compensation under s. 13.

For its part, Global Witness relies on the ‘journalism’ exemption under s. 32 of the DPA, which applies to “processing… undertaken with a view to the publication by any person of any journalistic, literary or artistic material”. Global Witness says it is exempt from the provisions of the DPA on which the claimants rely.

An unusual feature of the s. 32 exemption is that it provides, at subsections (4) and (5), for a mandatory stay mechanism which is designed in essence to enable the ICO to assume an important adjudicative role in the proceedings (my emphasis):

(4) Where at any time (“the relevant time”) in any proceedings against a data controller under section 7(9), 10(4), 12(8) or 14 or by virtue of section 13 the data controller claims, or it appears to the court, that any personal data to which the proceedings relate are being processed—

(a) only for the special purposes, and

(b) with a view to the publication by any person of any journalistic, literary or artistic material which, at the time twenty-four hours immediately before the relevant time, had not previously been published by the data controller, the court shall stay the proceedings until either of the conditions in subsection (5) is met.

(5) Those conditions are—

(a) that a determination of the Commissioner under section 45 with respect to the data in question takes effect, or

(b) in a case where the proceedings were stayed on the making of a claim, that the claim is withdrawn.

So: if the conditions in s. 32(4) are met, then the court must stay proceedings until either the claim is withdrawn or the ICO has issued a determination under section 45. S. 45 effectively requires the ICO to adjudicate upon the application of the journalism/’special purposes’ exemption to the facts of the particular case. Any determination made under s. 45 can be appealed to the Tribunal: see s. 48(4), which confers a right of appeal on the data controller.

Global Witness has invoked s. 32(4) in its defence and has since applied to the Court for a stay under that provision. The claimants disagree that a stay should be granted. They say Global Witness’ reliance on section 32 is misconceived and have made a cross-application to have the s. 32 defence struck out and for summary judgment in the alternative.

The question for Henderson J was whether those rival applications should be heard together (the claimant’s case), or whether Global Witness’ application for a stay should be determined first (Global Witness’ case). Henderson J has agreed with Global Witness on this point. In reaching the view that the stay application should be heard first, it appears that Henderson J had in mind arguments to the effect that requiring the two applications to be heard together would itself risk pre-empting Global Witness’ stay application and may also result in a more cumbersome and costly process (see in particular paragraphs 16-24). Henderson J went on to make the following observation as to the effect of s. 32(4): :

“Subject to argument about the precise nature of a claim sufficient to trigger section 32, Parliament has, in my view, pretty clearly taken the line that issues of this kind should be determined in the first instance by the Commissioner, and any proceedings brought in court should be stayed until that has been done” (paragraph 21).

The stay application will now be heard at the end of June. The matter will then either go off to the ICO or, if the stay application fails, the claimants’ summary judgment/strike-out applications will be considered. The stay application will therefore determine the immediate trajectory of this particular litigation. Whilst the Court declined to order indemnity costs against the claimants, it did award Global Witness close to 100% of its costs.

Anya Proops acts for Global Witness.

Robin Hopkins @hopkinsrobin

Interfering with the fundamental rights of practically the entire European population

Posted on | by Robin Hopkins

In the Digital Rights Ireland case, the Grand Chamber of the CJEU has this week declared invalid the 2006 Directive which provides for the mass retention – and disclosure to policing and security authorities – of individuals’ online traffic data. It found this regime to be a disproportionate interference with privacy rights. Depending on your perspective, this is a major step forward for digital privacy, or a major step backwards in countering terrorism and serious crime. It probably introduces even more uncertainty in terms of the wider project of data protection reform at the EU level. Here is my synopsis of this week’s Grand Chamber judgment.

Digital privacy vs national security: a brief history

There is an overlapping mesh of rights under European law which aims to protect citizens’ rights with respect to their personal data – an increasingly important strand of the broader right to privacy. The Data Protection Directive (95/46/EC) was passed in 1995, when the internet was in its infancy. It provides that personal data must be processed (obtained, held, used, disclosed) fairly and lawfully, securely, for legitimate purposes and so on.

Then, as the web began to mature into a fundamental aspect of everyday life, a supplementary Directive was passed in 2002 (2002/58/EC) on privacy and electronic communications. It is about privacy, confidentiality and the free movement of electronic personal data in particular.

In the first decade of the 21st century, however, security objectives became increasingly urgent. Following the London bomings of 2005 in particular, the monitoring of would-be criminals’ web activity was felt to be vital to effective counter-terrorism and law enforcement. The digital confidentiality agenda needed to make space for a measure of state surveillance.

This is how Directive 2006/24 came to be. In a nutshell, it provides for traffic and location data (rather than content-related information) about individuals’ online activity to be retained by communications providers and made available to policing and security bodies. This data was to be held for a minimum of six months and a maximum of 24 months.

That Directive – like all others – is however subject to the EU’s Charter of Fundamental Rights. Article 7 of that Charter enshrines the right to respect for one’s private and family life, home and communications. Article 8 is about the right to the protection and fair processing of one’s personal data.

Privacy and Digital Rights Ireland prevail

Digital Rights Ireland took the view that the 2006 Directive was not compatible with those fundamental rights. It asked the Irish Courts to refer this to the CJEU. Similar references were made during different litigation before the Austrian Courts.

The CJEU gave its answer this week. In Digital Rights Ireland Ltd v Minister for Communications, Marine and Natural Resources and Others (C‑293/12) joined with Kärntner Landesregierung and Others (C‑594/12), the Grand Chamber held the 2006 Directive to be invalid on the grounds of its incompatibility with fundamental privacy rights.

The Grand Chamber accepted that, while privacy rights were interfered with, this was in pursuit of compelling social objectives (the combatting of terrorism and serious crime). The question was one of proportionality. Given that fundamental rights were being interfered with, the Courts would allow the European legislature little lee-way: anxious scrutiny would be applied.

Here, in no particular order, are some of the reasons why the 2006 Directive failed its anxious scrutiny test (quotations are all from the Grand Chamber’s judgment). Unsurprisingly, this reads rather like a privacy impact assessment which data controllers are habitually called upon to conduct.

The seriousness of the privacy impact

First, consider the nature of the data which, under Articles 3 and 5 the 2006 Directive, must be retained and made available. “Those data make it possible, in particular, to know the identity of the person with whom a subscriber or registered user has communicated and by what means, and to identify the time of the communication as well as the place from which that communication took place. They also make it possible to know the frequency of the communications of the subscriber or registered user with certain persons during a given period.”

This makes for a serious incursion into privacy: “Those data, taken as a whole, may allow very precise conclusions to be drawn concerning the private lives of the persons whose data has been retained, such as the habits of everyday life, permanent or temporary places of residence, daily or other movements, the activities carried out, the social relationships of those persons and the social environments frequented by them.”

Second, consider the volume of data gathered and the number of people affected. Given the ubiquity of internet communications, the 206 Directive “entails an interference with the fundamental rights of practically the entire European population”.

Admittedly, the 2006 regime does not undermine “the essence” of data protection rights (because it is confined to traffic data – the contents of communications are not retained), and is still subject to data security rules (see the seventh data protection principle under the UK’s DPA 1998).

Nonetheless, this is a serious interference with privacy rights. It has objective and subjective impact: “it is wide-ranging, and it must be considered to be particularly serious… the fact that data are retained and subsequently used without the subscriber or registered user being informed is likely to generate in the minds of the persons concerned the feeling that their private lives are the subject of constant surveillance.”

Such a law, said the Grand Chamber, can only be proportionate if it includes clear and precise laws governing the scope of the measures and providing minimum safeguards for individual rights. The 2006 Directive fell short of those tests.

Inadequate rules, boundaries and safeguards

The regime has no boundaries, in terms of affected individuals: it “applies even to persons for whom there is no evidence capable of suggesting that their conduct might have a link, even an indirect or remote one, with serious crime”.

It also makes no exception for “persons whose communications are subject, according to rules of national law, to the obligation of professional secrecy”.

There are no sufficiently specific limits on the circumstances in which this can be accessed by security bodies, on the purposes to which that data can be put by those bodies, or the persons with whom those particular bodies may share the data.

There are no adequate procedural safeguards: no court or administrative authority is required to sign off the transfers.

There are also no objective criteria for justifying the retention period of 6-24 months.

The Grand Chamber’s conclusion

In summary, the Grand Chamber found that “in the first place, Article 7 of Directive 2006/24 does not lay down rules which are specific and adapted to (i) the vast quantity of data whose retention is required by that directive, (ii) the sensitive nature of that data and (iii) the risk of unlawful access to that data, rules which would serve, in particular, to govern the protection and security of the data in question in a clear and strict manner in order to ensure their full integrity and confidentiality. Furthermore, a specific obligation on Member States to establish such rules has also not been laid down…”

There was also an international transfer aspect to its concern: “in the second place, it should be added that that directive does not require the data in question to be retained within the European Union…”

This last point is of course highly relevant to another of the stand-offs between digital privacy and national security which looms in UK litigation, namely the post-Snowden litigation against security bodies.

Robin Hopkins @hopkinsrobin

Steinmetz and Others v Global Witness: latest developments

Posted on | by Robin Hopkins

Panopticon devotees will have noted that important DPA litigation is afoot between a group of businessmen (Beny Steinmetz and others) and the NGO Global Witness. The Economist has recently reported on the latest developments in the case: see here.

I particularly like the article’s subtitle: “Libel laws have become laxer. Try invoking data protection instead”. This is an observation I (and others) have made in the past: see here for example. The point appears to be gathering momentum.

Robin Hopkins @hopkinsrobin

Universal Credit reports

Posted on | by Rachel Kamm

The Tribunal has ordered disclosure of information about Universal Credit, in three appeals which were heard together: John Slater v ICO and DWP EA/2013/0145; DWP v ICO and John Slater EA/2013/0148; and DWP v ICO and Tony Collins EA/2013/0149. The Tribunal dismissed both of DWP’s appeals and allowed Mr Slater’s appeal (subject to the removal of some names from the information).

The disputed information in Mr Collins’s appeal was a Project Assessment Review of the Universal Credit Programme (UCP), which was prepared by the Cabinet Office’s Major Projects Authority in early November 2011 and requested by Mr Collins on 1 March 2012.

In Mr Slater’s case, the disputed information was the Risk Register, Issues Register and the High Level Milestone Schedule for UCP and he made the request on 14 April 2012. As described by the Tribunal, “All three categories of document are essential risk management and planning tools in any large long – running project. They are designed to identify and reduce uncertainty and to gain uncompromising input from the widest possible spectrum of participants. UCP, on which work began in 2011, is scheduled for completion in 2017” (§22).

In response to both requests, the DWP relied on the exemption in section 36 FOIA, on ground that, in the reasonable opinion of a qualified person (the Minister), disclosure of the information under FOIA would be likely to inhibit the free and frank provision of advice, or the free and frank exchange of views for the purposes of deliberation, or would be likely otherwise to prejudice the effective conduct of public affairs and that the balance of the public interest was in favour of maintaining this exemption.

The ICO found that the qualified exemption in section 36 was engaged, but that the balance of the public interest favoured disclosure of the Project Assessment Review, Issues Register and  High Level Milestone Schedule (but not the Risks Register).

On appeal, the Tribunal agreed with DWP and the ICO that the exemption in section 36 was engaged i.e. it was reasonable for the Minister to conclude that disclosure would be likely to inhibit the free and frank provision of advice, or the free and frank exchange of views for the purposes of deliberation, or would be likely otherwise to prejudice the effective conduct of public affairs. The test was whether there was a realistic possibility, not a 51%+ probability (§49).

Turning to the public interest, the Tribunal attached great importance “not only to the undisputed significance of UCP as a truly fundamental reform but to the criticism and controversy which it was attracting by the time of these requests in March and April, 2012″ (§55). The Tribunal also noted “the unfailing confidence and optimism of a series of press releases” and that UCP was described as on track when milestones had not been achieved on time. It commented that “Where, in the context of a major reform, government announcements are so markedly at odds with current opinion in the relatively informed and serious media, there is a particularly strong public interest in up to date information as to the details of what is happening within the programme, so that the public may judge whether or not opposition and media criticism is well – founded” (§56). It took into account the costs of the programme and the size of the IT interface with local authority systems (§57). Publication of the disputed information upon completion of UCP, “would be a wholly inadequate answer to the demands for transparency” (§58).

On the other hand, the Tribunal acknowledged that the ‘safe space’ requirement can apply in section 36 (as well as section 35) cases (§59). The Tribunal did not take into account evidence which had been given by the Department of Health in a different Tribunal appeal, but which this Tribunal had not seen and which had not been tested in cross examination §61). There was no evidence that disclosure of another risk document, the Starting Gate Review, had inhibited frank discussion (§62). In this context, the need for a degree of deference to the experience of senior public authorities was not as pressing as when tackling questions of security or foreign policy: “The duty of the Tribunal is to consider government evidence on issues such as these carefully, conscious of the experience and expertise of the witness, but using its own knowledge of appeals of this kind, of institutions and behaviour in the workplace to determine whether government information requires the protection claimed, considering the importance of the subject matter to the public. We are not persuaded that disclosure would have a chilling effect in relation to the documents before us” (§63).

As to diversion of resources if the disputed information was disclosed, the Tribunal commented that “a programme such as UCP required at the outset a clear public relations strategy and a substantial staff to handle the inevitable flow or even torrent of inquiries and bad news stories which such an important change must attract” and that delivery of UCP may be facilitated by good communication (§64).

Having reached the above general conclusions, the Tribunal considered each of the requested documents in turn. It found that the public interest was in favour of disclosing the information, taking into account in particular that “Ordinary people, properly informed, are capable of grasping why a document dwells on problems rather than successes” and that whilst there may be some prejudice to DWP, the public interest required disclosure. It dismissed DWP’s appeals and allowed Mr Slater’s appeal (subject to the removal of some names from the information), thereby ordering disclosure under FOIA of each of the documents.

Julian Milford represented DWP and Robin Hopkins represented the ICO.

Rachel Kamm, 11KBW