Local Government Transparency Code

Posted on | by Christopher Knight

The Secretary of State for Communities and Local Government has just issued a Local Government Transparency Code in exercise of his powers under section 2 of the Local Government, Planning and Land Act 1980 to issue a Code of Recommended Practice as to the publication of information by local authorities about the discharge of their functions and other matters which he considers to be related.

The Code sets out in some detail in Part 2 the type of information held by local authorities which must be published (some of it annually) and in Part 3 the information which, in the view of the Secretary of State, ought to be published. A helpful Annex A provides the details in tabular form.

Paragraph 14 of the Code provides that: “Where information would otherwise fall within one of the exemptions from disclosure under the Freedom of Information Act 2000, the Environmental Information Regulations 2004, the Infrastructure for Spatial Information in the European Community Regulations 2009 or falls within Schedule 12A to the Local Government Act 1972 then it is in the discretion of the local authority whether or not to rely on that exemption or publish the data.” There is therefore no attempt to override the FOIA exemptions. But where a qualified exemption applies, the appearance of the requested information in one of the categories set out in the Code will have a role (possibly a significant role) in establishing the public interest in support of disclosure.

Christopher Knight

Global Witness and the journalism exemption: ICO to have the first go?

Posted on | by Robin Hopkins

Panopticon has previously reported on the novel and important data protection case Steinmetz and Others v Global Witness [2014] EWHC 1186 (Ch). The High Court (Henderson J) has now given a judgment on a procedural point which will set the shape for this litigation.

The broad background to the case has been set out in Jason Coppel QC’s previous post – see here. In a nutshell, Global Witness is an NGO which reports and campaigns on natural resource related corruption around the world. Global Witness is one of a number of organisations which has recently reported on allegations that a particular company, BSG Resources Ltd (“BSGR”), secured a major mining concession in Guinea through corrupt means. Global Witness is now facing claims brought under the Data Protection Act 1998 by a number of individuals who are all in some way connected with BSGR. The claims include a subject access claim brought under s. 7; a claim under s. 10 requiring Global Witness to cease processing data in connection with the claimants and BSGR; a claim for rectification under s. 14 and a claim for compensation under s. 13.

For its part, Global Witness relies on the ‘journalism’ exemption under s. 32 of the DPA, which applies to “processing… undertaken with a view to the publication by any person of any journalistic, literary or artistic material”. Global Witness says it is exempt from the provisions of the DPA on which the claimants rely.

An unusual feature of the s. 32 exemption is that it provides, at subsections (4) and (5), for a mandatory stay mechanism which is designed in essence to enable the ICO to assume an important adjudicative role in the proceedings (my emphasis):

(4) Where at any time (“the relevant time”) in any proceedings against a data controller under section 7(9), 10(4), 12(8) or 14 or by virtue of section 13 the data controller claims, or it appears to the court, that any personal data to which the proceedings relate are being processed—

(a) only for the special purposes, and

(b) with a view to the publication by any person of any journalistic, literary or artistic material which, at the time twenty-four hours immediately before the relevant time, had not previously been published by the data controller, the court shall stay the proceedings until either of the conditions in subsection (5) is met.

(5) Those conditions are—

(a) that a determination of the Commissioner under section 45 with respect to the data in question takes effect, or

(b) in a case where the proceedings were stayed on the making of a claim, that the claim is withdrawn.

So: if the conditions in s. 32(4) are met, then the court must stay proceedings until either the claim is withdrawn or the ICO has issued a determination under section 45. S. 45 effectively requires the ICO to adjudicate upon the application of the journalism/’special purposes’ exemption to the facts of the particular case. Any determination made under s. 45 can be appealed to the Tribunal: see s. 48(4), which confers a right of appeal on the data controller.

Global Witness has invoked s. 32(4) in its defence and has since applied to the Court for a stay under that provision. The claimants disagree that a stay should be granted. They say Global Witness’ reliance on section 32 is misconceived and have made a cross-application to have the s. 32 defence struck out and for summary judgment in the alternative.

The question for Henderson J was whether those rival applications should be heard together (the claimant’s case), or whether Global Witness’ application for a stay should be determined first (Global Witness’ case). Henderson J has agreed with Global Witness on this point. In reaching the view that the stay application should be heard first, it appears that Henderson J had in mind arguments to the effect that requiring the two applications to be heard together would itself risk pre-empting Global Witness’ stay application and may also result in a more cumbersome and costly process (see in particular paragraphs 16-24). Henderson J went on to make the following observation as to the effect of s. 32(4): :

“Subject to argument about the precise nature of a claim sufficient to trigger section 32, Parliament has, in my view, pretty clearly taken the line that issues of this kind should be determined in the first instance by the Commissioner, and any proceedings brought in court should be stayed until that has been done” (paragraph 21).

The stay application will now be heard at the end of June. The matter will then either go off to the ICO or, if the stay application fails, the claimants’ summary judgment/strike-out applications will be considered. The stay application will therefore determine the immediate trajectory of this particular litigation. Whilst the Court declined to order indemnity costs against the claimants, it did award Global Witness close to 100% of its costs.

Anya Proops acts for Global Witness.

Robin Hopkins @hopkinsrobin

Interfering with the fundamental rights of practically the entire European population

Posted on | by Robin Hopkins

In the Digital Rights Ireland case, the Grand Chamber of the CJEU has this week declared invalid the 2006 Directive which provides for the mass retention – and disclosure to policing and security authorities – of individuals’ online traffic data. It found this regime to be a disproportionate interference with privacy rights. Depending on your perspective, this is a major step forward for digital privacy, or a major step backwards in countering terrorism and serious crime. It probably introduces even more uncertainty in terms of the wider project of data protection reform at the EU level. Here is my synopsis of this week’s Grand Chamber judgment.

Digital privacy vs national security: a brief history

There is an overlapping mesh of rights under European law which aims to protect citizens’ rights with respect to their personal data – an increasingly important strand of the broader right to privacy. The Data Protection Directive (95/46/EC) was passed in 1995, when the internet was in its infancy. It provides that personal data must be processed (obtained, held, used, disclosed) fairly and lawfully, securely, for legitimate purposes and so on.

Then, as the web began to mature into a fundamental aspect of everyday life, a supplementary Directive was passed in 2002 (2002/58/EC) on privacy and electronic communications. It is about privacy, confidentiality and the free movement of electronic personal data in particular.

In the first decade of the 21st century, however, security objectives became increasingly urgent. Following the London bomings of 2005 in particular, the monitoring of would-be criminals’ web activity was felt to be vital to effective counter-terrorism and law enforcement. The digital confidentiality agenda needed to make space for a measure of state surveillance.

This is how Directive 2006/24 came to be. In a nutshell, it provides for traffic and location data (rather than content-related information) about individuals’ online activity to be retained by communications providers and made available to policing and security bodies. This data was to be held for a minimum of six months and a maximum of 24 months.

That Directive – like all others – is however subject to the EU’s Charter of Fundamental Rights. Article 7 of that Charter enshrines the right to respect for one’s private and family life, home and communications. Article 8 is about the right to the protection and fair processing of one’s personal data.

Privacy and Digital Rights Ireland prevail

Digital Rights Ireland took the view that the 2006 Directive was not compatible with those fundamental rights. It asked the Irish Courts to refer this to the CJEU. Similar references were made during different litigation before the Austrian Courts.

The CJEU gave its answer this week. In Digital Rights Ireland Ltd v Minister for Communications, Marine and Natural Resources and Others (C‑293/12) joined with Kärntner Landesregierung and Others (C‑594/12), the Grand Chamber held the 2006 Directive to be invalid on the grounds of its incompatibility with fundamental privacy rights.

The Grand Chamber accepted that, while privacy rights were interfered with, this was in pursuit of compelling social objectives (the combatting of terrorism and serious crime). The question was one of proportionality. Given that fundamental rights were being interfered with, the Courts would allow the European legislature little lee-way: anxious scrutiny would be applied.

Here, in no particular order, are some of the reasons why the 2006 Directive failed its anxious scrutiny test (quotations are all from the Grand Chamber’s judgment). Unsurprisingly, this reads rather like a privacy impact assessment which data controllers are habitually called upon to conduct.

The seriousness of the privacy impact

First, consider the nature of the data which, under Articles 3 and 5 the 2006 Directive, must be retained and made available. “Those data make it possible, in particular, to know the identity of the person with whom a subscriber or registered user has communicated and by what means, and to identify the time of the communication as well as the place from which that communication took place. They also make it possible to know the frequency of the communications of the subscriber or registered user with certain persons during a given period.”

This makes for a serious incursion into privacy: “Those data, taken as a whole, may allow very precise conclusions to be drawn concerning the private lives of the persons whose data has been retained, such as the habits of everyday life, permanent or temporary places of residence, daily or other movements, the activities carried out, the social relationships of those persons and the social environments frequented by them.”

Second, consider the volume of data gathered and the number of people affected. Given the ubiquity of internet communications, the 206 Directive “entails an interference with the fundamental rights of practically the entire European population”.

Admittedly, the 2006 regime does not undermine “the essence” of data protection rights (because it is confined to traffic data – the contents of communications are not retained), and is still subject to data security rules (see the seventh data protection principle under the UK’s DPA 1998).

Nonetheless, this is a serious interference with privacy rights. It has objective and subjective impact: “it is wide-ranging, and it must be considered to be particularly serious… the fact that data are retained and subsequently used without the subscriber or registered user being informed is likely to generate in the minds of the persons concerned the feeling that their private lives are the subject of constant surveillance.”

Such a law, said the Grand Chamber, can only be proportionate if it includes clear and precise laws governing the scope of the measures and providing minimum safeguards for individual rights. The 2006 Directive fell short of those tests.

Inadequate rules, boundaries and safeguards

The regime has no boundaries, in terms of affected individuals: it “applies even to persons for whom there is no evidence capable of suggesting that their conduct might have a link, even an indirect or remote one, with serious crime”.

It also makes no exception for “persons whose communications are subject, according to rules of national law, to the obligation of professional secrecy”.

There are no sufficiently specific limits on the circumstances in which this can be accessed by security bodies, on the purposes to which that data can be put by those bodies, or the persons with whom those particular bodies may share the data.

There are no adequate procedural safeguards: no court or administrative authority is required to sign off the transfers.

There are also no objective criteria for justifying the retention period of 6-24 months.

The Grand Chamber’s conclusion

In summary, the Grand Chamber found that “in the first place, Article 7 of Directive 2006/24 does not lay down rules which are specific and adapted to (i) the vast quantity of data whose retention is required by that directive, (ii) the sensitive nature of that data and (iii) the risk of unlawful access to that data, rules which would serve, in particular, to govern the protection and security of the data in question in a clear and strict manner in order to ensure their full integrity and confidentiality. Furthermore, a specific obligation on Member States to establish such rules has also not been laid down…”

There was also an international transfer aspect to its concern: “in the second place, it should be added that that directive does not require the data in question to be retained within the European Union…”

This last point is of course highly relevant to another of the stand-offs between digital privacy and national security which looms in UK litigation, namely the post-Snowden litigation against security bodies.

Robin Hopkins @hopkinsrobin

Steinmetz and Others v Global Witness: latest developments

Posted on | by Robin Hopkins

Panopticon devotees will have noted that important DPA litigation is afoot between a group of businessmen (Beny Steinmetz and others) and the NGO Global Witness. The Economist has recently reported on the latest developments in the case: see here.

I particularly like the article’s subtitle: “Libel laws have become laxer. Try invoking data protection instead”. This is an observation I (and others) have made in the past: see here for example. The point appears to be gathering momentum.

Robin Hopkins @hopkinsrobin

Universal Credit reports

Posted on | by Rachel Kamm

The Tribunal has ordered disclosure of information about Universal Credit, in three appeals which were heard together: John Slater v ICO and DWP EA/2013/0145; DWP v ICO and John Slater EA/2013/0148; and DWP v ICO and Tony Collins EA/2013/0149. The Tribunal dismissed both of DWP’s appeals and allowed Mr Slater’s appeal (subject to the removal of some names from the information).

The disputed information in Mr Collins’s appeal was a Project Assessment Review of the Universal Credit Programme (UCP), which was prepared by the Cabinet Office’s Major Projects Authority in early November 2011 and requested by Mr Collins on 1 March 2012.

In Mr Slater’s case, the disputed information was the Risk Register, Issues Register and the High Level Milestone Schedule for UCP and he made the request on 14 April 2012. As described by the Tribunal, “All three categories of document are essential risk management and planning tools in any large long – running project. They are designed to identify and reduce uncertainty and to gain uncompromising input from the widest possible spectrum of participants. UCP, on which work began in 2011, is scheduled for completion in 2017” (§22).

In response to both requests, the DWP relied on the exemption in section 36 FOIA, on ground that, in the reasonable opinion of a qualified person (the Minister), disclosure of the information under FOIA would be likely to inhibit the free and frank provision of advice, or the free and frank exchange of views for the purposes of deliberation, or would be likely otherwise to prejudice the effective conduct of public affairs and that the balance of the public interest was in favour of maintaining this exemption.

The ICO found that the qualified exemption in section 36 was engaged, but that the balance of the public interest favoured disclosure of the Project Assessment Review, Issues Register and  High Level Milestone Schedule (but not the Risks Register).

On appeal, the Tribunal agreed with DWP and the ICO that the exemption in section 36 was engaged i.e. it was reasonable for the Minister to conclude that disclosure would be likely to inhibit the free and frank provision of advice, or the free and frank exchange of views for the purposes of deliberation, or would be likely otherwise to prejudice the effective conduct of public affairs. The test was whether there was a realistic possibility, not a 51%+ probability (§49).

Turning to the public interest, the Tribunal attached great importance “not only to the undisputed significance of UCP as a truly fundamental reform but to the criticism and controversy which it was attracting by the time of these requests in March and April, 2012″ (§55). The Tribunal also noted “the unfailing confidence and optimism of a series of press releases” and that UCP was described as on track when milestones had not been achieved on time. It commented that “Where, in the context of a major reform, government announcements are so markedly at odds with current opinion in the relatively informed and serious media, there is a particularly strong public interest in up to date information as to the details of what is happening within the programme, so that the public may judge whether or not opposition and media criticism is well – founded” (§56). It took into account the costs of the programme and the size of the IT interface with local authority systems (§57). Publication of the disputed information upon completion of UCP, “would be a wholly inadequate answer to the demands for transparency” (§58).

On the other hand, the Tribunal acknowledged that the ‘safe space’ requirement can apply in section 36 (as well as section 35) cases (§59). The Tribunal did not take into account evidence which had been given by the Department of Health in a different Tribunal appeal, but which this Tribunal had not seen and which had not been tested in cross examination §61). There was no evidence that disclosure of another risk document, the Starting Gate Review, had inhibited frank discussion (§62). In this context, the need for a degree of deference to the experience of senior public authorities was not as pressing as when tackling questions of security or foreign policy: “The duty of the Tribunal is to consider government evidence on issues such as these carefully, conscious of the experience and expertise of the witness, but using its own knowledge of appeals of this kind, of institutions and behaviour in the workplace to determine whether government information requires the protection claimed, considering the importance of the subject matter to the public. We are not persuaded that disclosure would have a chilling effect in relation to the documents before us” (§63).

As to diversion of resources if the disputed information was disclosed, the Tribunal commented that “a programme such as UCP required at the outset a clear public relations strategy and a substantial staff to handle the inevitable flow or even torrent of inquiries and bad news stories which such an important change must attract” and that delivery of UCP may be facilitated by good communication (§64).

Having reached the above general conclusions, the Tribunal considered each of the requested documents in turn. It found that the public interest was in favour of disclosing the information, taking into account in particular that “Ordinary people, properly informed, are capable of grasping why a document dwells on problems rather than successes” and that whilst there may be some prejudice to DWP, the public interest required disclosure. It dismissed DWP’s appeals and allowed Mr Slater’s appeal (subject to the removal of some names from the information), thereby ordering disclosure under FOIA of each of the documents.

Julian Milford represented DWP and Robin Hopkins represented the ICO.

Rachel Kamm, 11KBW

 

 

 

FOIA’s not all that: Kennedy v The Charity Commission [2014] UKSC 20

Posted on | by Tom Cross

 

The Supreme Court’s much anticipated judgments in Kennedy v The Charity Commission make for a long read. But they are very important. All the parties in Kennedy were represented by Counsel from 11KBW: Andrew Sharland for Mr Kennedy; Karen Steyn and Rachel Kamm for the Charity Commission and the Secretary of State; Ben Hooper for the ICO; and Christopher Knight for the Media Legal Defence Initiative and Campaign for Freedom of Information.

The factual background is described in previous posts. In short the appeal concerned a FOIA request made by Mr Kennedy, a journalist at The Times, in June 2007, for disclosure of information concerning three inquiries conducted by the Charity Commission between 2003 and 2005 into the ‘Mariam Appeal’, which was launched by Mr George Galloway in connection with the sanctions imposed on Iraq following the first Gulf War. The Charity Commission relied on section 32(2) of FOIA in refusing the request. That provides an absolute exemption from disclosure where information held by a public authority is held only by virtue of being contained in either (a) any document placed in the custody of a person conducting an inquiry or arbitration, for the purposes of the inquiry or arbitration, or (b) any document created by a person conducting an inquiry or arbitration, for the purposes of the inquiry or arbitration. The Court of Appeal had held that this exemption applied to a request made in 2007 concerning inquiries which had finished in 2005.

The two primary questions for the Supreme Court were (1) whether the absolute exemption in section 32(2) continued after the end of an inquiry (so that Mr Kennedy was precluded from receiving the information); and (2) if so, what, if any difference Mr Kennedy’s rights under article 10 of the European Convention on Human Rights (the “ECHR”) made to that result. In the result the Court’s discussion ranged more widely than may have been anticipated.

The majority of the Court agreed with the judgments of Lord Mance and Lord Toulson. (Lord Sumption gave a separate, concurring, judgment). The majority decided as follows.

(1) Section 32(2) continues to apply after the end of an inquiry

The Court held that the absolute exemption in section 32(2) FOIA does last beyond the end of an inquiry until the relevant information is destroyed or for up to 30 (or in future 20) years under the Public Records Act 1958. There were two principal reasons. First, that construction was supported by the words of the section themselves read as a whole. The words “for the purposes of the inquiry or arbitration” qualified the immediately preceding words in 32(2)(a) and (32)(2)(b) and referred to the original purpose for which the relevant documents were placed in the custody of, or were created by, a person conducting an inquiry. Secondly, the Court considered that its interpretation sat comfortably within FOIA as a whole.  Under section 62(1) FOIA, a record becomes a “historical record” at the end of 30 years, and, under section 63(1), information contained in a historical record cannot be exempt information because of section 32. Lords Mance and Toulson considered that, in that context, information falling within section 32 would continue to be exempt for 30 years instead of ceasing to be exempt at the end of an inquiry. That meant that, absent Mr Kennedy’s being able to demonstrate that Article 10 required a different result, he would not be entitled to the information he sought under FOIA itself.

(2) Article 10 ECHR did not lead to a different construction of section 32(2)

Mr Kennedy argued that if (as the Court held, above) he was not entitled to the information because of s.32(2), section 32(2) was incompatible with his rights under Article 10 ECHR, and that it should be ‘read down’ under the HRA (at the very least so as to mean that s.32(2) ceased to be an absolute exemption after the end of an inquiry).

There were two bases on which the Court decided that Article 10 did not, however, assist him.

The first was that there was no basis for concluding that section 32(2) was inconsistent with Article 10 in circumstances where s.32(2) put him in no less favourable a position than he was otherwise in under general statute and common law to access the information. That was because FOIA is not the only means through which information can be accessed. What section 32(2) of FOIA does is to take information falling within the absolute exemption outside the scope of that particular disclosure regime; but this does not mean that the information subject to the exemption could not otherwise be required to be disclosed by law.  Other statute, or the common law, might require disclosure, even though FOIA did not. According to the majority it could not be said that section 32(2) of FOIA was incompatible with the ECHR in those circumstances.

This is, plainly, a point of wider significance. It may be that the extent to which Article 10 may lack application because of the existence of equivalent rights of access under other statute or common law is likely to depend on the circumstances.

Both Lord Mance and Lord Toulson discussed rights of access to information in the specific context of Mr Kennedy’s request. In Lord Mance’s opinion, the Charity Commission had the power to disclose information to the public concerning inquiries on which it has published reports, both in pursuit of its statutory objective under the Charities Act 1993 (since replaced with the Charities Act 2011) of increasing public trust in, and the accountability of, charities, and under general common law duties of openness and transparency on public authorities. Lord Toulson placed greater emphasis on the fundamental principle of open justice forming part of the common law:

‘It has long been recognised that judicial processes should be open to public scrutiny unless and to the extent that there are valid countervailing reasons. This is the open justice principle. The reasons for it have been stated on many occasions. Letting in the light is the best way of keeping those responsible for exercising the judicial power of the state up to the mark and for maintaining public confidence’ (paragraph 110)

The exercise of the power of disclosure pursuant to the open justice principle would be subject to judicial review. Lord Mance considered that the courts should apply a high standard of review to any decision not to disclose information in answer to questions of real public interest raised by a journalist in relation to inquiries on which the Charity Commission has published reports (see e.g. paragraph 56).

The second reason why Mr Kennedy was not assisted by Article 10 according to the majority was that article 10 was not engaged because it does not impose a freestanding positive general duty of disclosure on public authorities. There is a particularly detailed discussion of the recent developments in the case law of the European Court of Human Rights in the judgment of Lord Mance at paragraphs 57-100, which starts with the statement that the jurisprudence ‘is neither clear nor easy to reconcile’. Technically, the discussion is obiter, because, on the majority’s approach, it was unnecessary to decide the point for the resolution of the appeal. But it will remain, on the present state of the Strasbourg case law, difficult or impossible for requesters to rely on Article 10 as a means of arguing for a more favourable construction of FOIA.

Mr Kennedy’s appeal was, accordingly dismissed. His request under FOIA was properly refused in reliance on s.32(2) and Article 10 did not assist him.

Lord Wilson and Lord Carnwath, dissenting, would have allowed the appeal on the basis that Article 10 was engaged by Mr Kennedy’s FOIA request and should have led to s.32(2) being read down such that the absolute exemption expired at the end of the relevant inquiry.

My own view is that the greatest significance of Kennedy is its highlighting of the fact that FOIA is only one means of obtaining information from public authorities. If a different statutory or common law basis may be found for invoking a right in particular circumstances, a judicial review application may also be available. Whether that is a wise route for requesters to pursue, including given the costs implications of that form of litigation which do not apply in the same way in the tribunal, is a different question, but it is one to which fresh consideration might now be given in appropriate cases.