Information rights: proposed legislative changes and more

Posted on | by Robin Hopkins

Earlier this week, James Goudie QC blogged on the Intellectual Property Bill’s amendment to FOIA, introducing a new qualified exemption (section 22A) for continuing programmes of research intended for future publication. On the issue of research – which featured prominently in submissions from the university sector during FOIA’s post-legislative scrutiny health-check – this would bring FOIA into line with its Scottish counterpart. For an informative discussion of this topic, see this post from Kit Good.

Interestingly, that post refers to an ICO decision notice (FS50163282 of 29 March 2010) about “tree ring” data, a method used to analyse wood from archaeological sites to determine past climates. The ICO found that Queen’s University Belfast was not entitled to rely on (among other exceptions) regulations 12(4)(d) of the EIRs (material which is still in the course of completion, unfinished documents or incomplete data). As it happens, the Tribunal has today issued a decision concerned with tree ring data in a university research context: McIntyre v IC and UEA, EA/2012/0156. The Tribunal noted the ICO’s note of caution concerning ever-evolving research data: “this argument should not be used to withhold tree-ring chronologies endlessly, by arguing that they are always a ‘work in progress’”. However, on the facts of the case the Tribunal upheld UEA’s reliance on regulation 12(4)(d), as supported by the ICO.

This has not been FOIA’s only outing in Parliament this week. An early day motion was tabled on Tuesday of this week expressing concern at the Government’s proposal to make cost restrictions more public authority-friendly. The motion is worded as follows:

“That this House notes that the Government is proposing to make it easier for public authorities to refuse Freedom of Information requests on cost grounds in order to prevent disproportionate use of the Freedom of Information Act 2000 by some requesters; expresses concern that requests by those making moderate use of the legislation will also be more easily refused under the proposals; is particularly concerned at the proposal that the time which authorities spend considering whether to release information should be taken into account when calculating whether the cost limit has been reached; further notes that this proposal was expressly rejected by the Justice Committee in its post-legislative review of the Act; believes that this proposal will penalise requests raising new or complex issues which will inevitably require substantial time to consider; observes that the Government’s objective will in any case be achieved following recent decisions of an Upper Tribunal that requests which involve a disproportionate, manifestly unjustified, inappropriate or improper use of the Act can be refused as vexatious; and calls on the Government not to proceed with its proposals.”

The motion’s primary sponsor is Richard Shepherd. At present, there are 12 signatories. Maurice Frankel of the Campaign for FOI is urging more MPs to take up the cause.

Turning from FOIA to information rights concerns of a data protection variety, the Care Bill was introduced in the House of Lords last week. Notably, it contains an express provision making the provision of “false or misleading information” an offence (subject of course to the statutory definitions being met). Clause 81 provides as follows:

(1) A care provider of a specified description commits an offence if—

(a) it supplies, publishes or otherwise makes available information of a specified description,

(b) the supply, publication or making available by other means of information of that description is required under an enactment or other legal obligation, and

(c) the information is false or misleading in a material respect.

The aims of this clause are not confined to matters affecting personal privacy – indeed, the explanatory document suggests it is confined to ‘management information’. There may, however, be some crossover with information on individual cases, particularly in ‘low cell count’ cases where individuals could be identified from higher-level data. The Data Protection 1998 does not use the language of “misleading” – focusing instead on inaccuracy and fairness. There are often DPA-related grievances, however, in which “misleading” is an excellent summary of the data subject’s concern.

Robin Hopkins

Thirteen deadly sins: new ICO guidance on vexatious requests

Posted on | by Robin Hopkins

On Wednesday, the ICO launched its new guidance on section 14 (vexatious requests) on Wednesday. This follows the Upper Tribunal’s recent decisions on this exemption (Panopticon passim), as well as decisions such as Salford City Council v IC and TieKey Accounts (EA/2012/0047) concerning reliance on section 14 to avoid incurring unreasonable cost burdens.

The ICO’s long-standing 5 indicators are supplanted by a new list of 13 indicators – though the emphasis remains on their not being intended as pseudo-statutory tests (and thus they are not really ‘deadly sins’). The thirteen indicators are (in no particular order):

abusive or aggressive language; burden on the authority; personal grudges; unreasonable persistence; unfounded accusations; intransigence; frequent or overlapping requests; deliberate intention to cause annoyance; scattergun approach; disproportionate effort; no obvious intent to obtain information; futile requests; frivolous requests.

The guidance addresses such topics as round robins, fishing expeditions and requesters acting in concert/as part of a campaign, all of which arise frequently for consideration by public authorities. There is also a section on “recommended actions before making a final decision” (paragraphs 93-97) which public authorities would be wise to consider with an eye on complaints to the ICO from dissatisfied recipients of section 14 notices.

For discussions of the new guidance, see these blog posts from the ICO’s Deputy Commissioner, Graham Smith, and also from FOI Man.

Robin Hopkins

Google: autocomplete and the frontiers of privacy

Posted on | by Robin Hopkins

Unsurprisingly, the frontiers of privacy and data protection law are often explored and extended by reference to what Google does. Panopticon has, for example, covered disputes over Google Street View (on which a US lawsuit was settled in recent months), Google’s status as a ‘publisher’ of blogs containing allegedly defamatory material (see Tamiz v Google [2013] EWCA Civ 68) and its responsibility for search results directing users to allegedly inaccurate or out-of-date personal data (see Google Spain v Agencia Espanola de Proteccion de Datos (application C-131/12), in which judgment is due in the coming months).

A recent decision of a German appellate court appears to have extended the frontiers further. The case (BGH, VI ZR 269/12 of 14th May 2013) concerned Google’s ‘autocomplete’ function. When the complainants’ names were typed into Google’s search bar, the autocomplete function added the ensuing words “Scientology” and “fraud”. This was not because there was lots of content linking that individual with those terms. Rather, it was because these were the terms other Google users had most frequently searched for in conjunction with that person’s name. This was due to rumours the truth or accuracy of which the complainants denied. They complained that the continuing association of their names with these terms infringed their rights to personality and reputation as protected by German law (Articles 823(1) and 1004 of the German Civil Code).

In the Google Spain case, Google has said that the responsibility lies with the generators of the content, not with the search engine which offers users that content. In the recent German case, Google has argued in a similar vein that the autocomplete suggestions are down to what other users have searched for, not what Google says or does.

In allowing the complainants’ appeals, the Federal Court of Justice in Karlsruhe has disagreed with Google. The result is that once Google has been alerted to the fact that an autocomplete suggestion links someone to libellous words, it must remove that suggestion. The case is well covered by Jeremy Phillips at IPKat and by Karin Matussek of Bloomberg in Berlin.

The case is important in terms of the frontiers of legal protection for personal integrity and how we allocate responsibility for harm. Google says that, in these contexts, it is a facilitator not a generator. It says it should not liable for what people write (see Tamiz and Google Spain), not for what they search for (the recent German case). Not for the first time, courts in Europe have allocated responsibility differently.

Notably, this case was not brought under data protection law. In principle, it seems that such complaints could be expressed in data protection terms. Perhaps, if the EU’s final Data Protection Regulation retains the severe penalty provisions proposed in the draft version, data protection will move centre-stage in these sorts of cases.

Robin Hopkins

New FoIA Exemption

Posted on | by James Goudie KC

Following the Queen’s Speech, an Intellectual Property Bill has been introduced in the House of Lords.  Clause 19 inserts a new exemption into the FoIA (Section 22A).  The exemption is for continuing programmes of research intended for future publication.  Subsection 1(a) of Clause 19 provides that information is exempt from a Section 1(1)(b) FoIA disclosure requirement if it relates to information obtained in the course of, or derived from, a programme of continuing research that is intended for future publication.  Subsection (1)(b) of the new Clause, however, provides that the information will be exempt only if disclosure would, or would be likely to, prejudice a matter listed in that subsection.  The exemption will not be an absolute exemption. It will be subject to the public interest balance test.  Public authorities will not be required to confirm or deny that they hold Section 22A information if, or to the extent that, compliance would, or would be likely to prejudice, any of the matters mentioned in subsection (1)(b).  The Government does not consider that the new exemption raises any issues of compatibility under ECHR Article 10.

EIR: when is information ‘held’?

Posted on | by Edward Capewell

One of the issues which commonly arises for information law practitioners is the question, which arises under both FOIA and the EIR, of whether a public authority actually holds the information which has been requested. The leading case on section 1(1) FOIA is University of Newcastle v IC & British Union for the Abolition of Vivisection [2011] UKUT 185 (AAC), [2011] 2 Info LR 54 and substantially the same approach has been adopted in, for example, Keiller v IC and University of East Anglia [2012] 1 Info LR 128 and Clyne v IC & London Borough of Lambeth [2012] 2 Info LR 24 in relation to regulation 3(2) EIR. What is required is a common-sense and non-technical approach. That, of course, is easier stated than applied.

The issue arose again in Holland v IC & University of East Anglia (EA/2012/0098). Like Keiller, this case was concerned with the Climatic Research Unit (“CRU”) at UEA, the source of the so-called ‘Climategate’ controversy. Readers will recall that in November 2009 there was an unauthorised disclosure of a large number of emails concerning work undertaken at the CRU. The ensuing controversy led the university to set up the Independent Climate Change E-mail Review (“ICCER”) chaired by Sir Muir Russell, which reported in 2010.

Mr Holland, who had made a submission to the ICCER, requested “copies of all of the information held” by it. A lot of information had been published on the ICCER’s own website, and essentially what remained, the tribunal found, was the Review’s “working papers”. It seems not to have been in issue that they were in the physical possession of Sir Muir Russell or his solicitors and not UEA. The issue was, therefore, whether the information was held ‘on behalf of’ UEA for EIR purposes. The Commissioner thought not, and the tribunal agreed with him.

Directing itself by reference to BUAV as well as a number of other FTT decisions, the Tribunal decided that it needed first to examine the nature of the legal and practical relationship between UEA and the ICCER/Sir Muir Russell. It found that the inquiry could have been conducted internally, but that UEA had decided to externalise it not, as Mr Holland had argued, in order to avoid its obligations under FOIA and the EIR, but “at a time when UEA’s credibility was very much at stake, in order to inspire confidence in the independence of the findings” (para 104). It went on to find that there was nothing in the EIR, nor in the Aarhus Convention, which prevents public bodies from externalising functions or which means that environmental information thereby created is necessarily held by the public body (para 105). Although there was no written document evidencing a contract between Sir Muir and UEA, the Tribunal found that a contract did exist (para 108). It did, however, express considerable surprise at the absence of a written contract and of the fact that “there was no discussion … about the information that would be received or generated by the ICCER” (para 110). Nevertheless, the Tribunal accepted that both parties had proceeded on the assumption that UEA would have no claim to or be able to access the information and that it would be held by the ICCER on its own behalf (para 114).

The Tribunal went on to hold that there was no other sense in which the ICCER was beholden to UEA or in which its independence was compromised. It was not, as Mr Holland had argued, merely a ‘sham’: “we do not find it likely that [UEA] would have compounded its problems so greatly, and risked its credibility so completely, by setting up an inquiry that was independent in name only” (para 116). Neither the involvement of a Professor Boulton on the Review panel (who had previously worked for UEA) nor the decision not to publish the Appellant’s submission in full affected the fundamental independence of the ICCER (paras 117-118). It followed that the information requested was not held ‘on behalf of’ UEA and the appeal therefore failed. Interestingly, the Tribunal did perhaps give some succour to Mr Holland by saying in para 122 “It may be that the information should be held by the UEA and there may be good reason why, barring anything provided in confidence, the information should be passed to the UEA to form part of its historical records. Were that to happen, then in the future, the information may be held by the UEA.” Leaving aside the question-begging first sentence (why, in EIR terms, ‘should’ UEA hold this information?), the second sentence is an important reminder that the answer to the question of whether information is held is one which is liable to change over time and with circumstances.

Edd Capewell

Article 8 and enhanced criminal record certificates

Posted on | by Rachel Kamm

There have been a number of Panopticon posts about the lawfulness of disclosures in enhanced criminal record certificates. The latest decision is that of Mr Justice Stuart-Smith in R (L) v Chief Constable of Cumbria Constabulary [2013] EWHC 869 (Admin).

The principles are now well established. In R (L) v Commissioner of Police of the Metropolis [2010] 1 AC 410 the Supreme Court identified that s.113B (4) of the Police Act 1997 requires that information can only be included in an enhanced criminal record certificate if, in the Chief Officer’s opinion, the information might be relevant and ought to be included in the certificate. Where it is alleged that disclosure would breach an individual’s rights under Article 8 ECHR, the Court must take into account up to date information to reach its own judgment (without deference to the Chief Constable) as to whether or not there has been an interference with the applicant’s right to private life and, if such interference has occurred, whether it is lawful.

In this case, the claimant (“L”) was an experienced secondary school teacher aged in his mid-forties. He challenged the Chief Constable of Cumbria Constabulary’s decisions, communicated by letters dated 15 May and 27 July 2012, not to remove contested information from the “other relevant information” section of the claimant’s enhanced criminal record certificates.

The following is an example of the information disclosed to L’s prospective employers:

 “Cumbria Constabulary hold the following information which we believe to be relevant to the application of L  …. The information relates to an allegation of inappropriate behaviour towards a female pupil of the school where L was employed as a teacher. Cumbria Constabulary believe this information to be relevant to an employer’s risk and suitability assessment when considering L‟s application for the post of supply teacher with vision for education, working with children and vulnerable adults, because the information, which is considered likely to be true, indicates an abuse by L of the position of trust in which he was placed as a teacher.

The information held by police involves an allegation by an 18- year old female that on 07.05.10, whilst in licensed premises, L had inappropriately hugged her and persistently asked her to go home with him, offering her £200 to do so, causing her to feel vulnerable and harassed. The complainant was a pupil at the school where L was employed as a teacher and he had known her since she was 12 or 13 years of age when he was her teacher.

When interviewed by police, L agreed that he had been present that evening but denied all allegations stating that he had not seen or spoken to the complainant. No further police action was taken against L in relation to these allegations as the complainant was 18 years of age and therefore no criminal offences had been committed.

After careful consideration, Cumbria Constabulary considers that this information ought to be disclosed as the alleged incident of inappropriate behaviour occurred in relation to a female pupil of the school where L was a teacher at the time. The information is materially relevant to the post of supply teacher applied for in which L will have regular and unsupervised contact with children and young adults. The risks of similar inappropriate behaviour of a sexual nature by L towards vulnerable young persons must, in this instance, outweigh the prejudicial impact that disclosure may have on L‟s private life and employment prospects as a teacher.”

Mr Justice Stuart-Smith held that the Chief Constable was obliged and right to carry out an assessment of reliability, but that he did not have materials available to him that could justify a determination that some form of communication had taken place between the claimant and the pupil. There was ample material upon which the Chief Constable could have reached the conclusion that the pupil’s evidence may well have been reliable, but the real possibility remained that the allegations were without foundation.

Mr Justice Stuart-Smith went on to find that even if the allegations were true, “the risk disclosed by the one episode of which she complained was not shown to be anything other than slight and was a risk to a very limited class of persons in tightly defined circumstances” (namely, current and former pupils whom L might come across in a pub). The incident alleged was itself relatively minor in the overall scheme of sexually inappropriate behaviour and it was an isolated incident in a long career. The incident had not been properly or fully investigated.

Further, the disclosure was made in circumstances where both the General Teaching Council and the Independent Safeguarding Authority had concluded that there was no case to answer. However, the result of the disclosure “had been as severe for L’s employment prospects as if he had been convicted of a serious offence of sexual misconduct and placed on the Sex Offenders’ Register: it is a killer blow and its effects are likely to be long lasting”.

Mr Justice Stuart-Smith concluded that “any proper balancing exercise comes down in favour of the conclusion that this interference with L’s Article 8 rights is disproportionate and unjustifiable, particularly in a jurisdiction where people are generally to be presumed innocent until proved guilty … the defendant has not shown a pressing need for the disclosure, because of the limited circumstances in which a possible risk of repetition might arise and the relative lack of gravity of the alleged conduct. Nor has the defendant shown that the means used to impair L’s rights are no more than necessary to accomplish a legitimate objective”. The disclosures in the enhanced criminal record certificates had breached his Article 8 ECHR rights.

Rachel Kamm, 11KBW