Information rights: proposed legislative changes and more

Earlier this week, James Goudie QC blogged on the Intellectual Property Bill’s amendment to FOIA, introducing a new qualified exemption (section 22A) for continuing programmes of research intended for future publication. On the issue of research – which featured prominently in submissions from the university sector during FOIA’s post-legislative scrutiny health-check – this would bring FOIA into line with its Scottish counterpart. For an informative discussion of this topic, see this post from Kit Good.

Interestingly, that post refers to an ICO decision notice (FS50163282 of 29 March 2010) about “tree ring” data, a method used to analyse wood from archaeological sites to determine past climates. The ICO found that Queen’s University Belfast was not entitled to rely on (among other exceptions) regulations 12(4)(d) of the EIRs (material which is still in the course of completion, unfinished documents or incomplete data). As it happens, the Tribunal has today issued a decision concerned with tree ring data in a university research context: McIntyre v IC and UEA, EA/2012/0156. The Tribunal noted the ICO’s note of caution concerning ever-evolving research data: “this argument should not be used to withhold tree-ring chronologies endlessly, by arguing that they are always a ‘work in progress’”. However, on the facts of the case the Tribunal upheld UEA’s reliance on regulation 12(4)(d), as supported by the ICO.

This has not been FOIA’s only outing in Parliament this week. An early day motion was tabled on Tuesday of this week expressing concern at the Government’s proposal to make cost restrictions more public authority-friendly. The motion is worded as follows:

“That this House notes that the Government is proposing to make it easier for public authorities to refuse Freedom of Information requests on cost grounds in order to prevent disproportionate use of the Freedom of Information Act 2000 by some requesters; expresses concern that requests by those making moderate use of the legislation will also be more easily refused under the proposals; is particularly concerned at the proposal that the time which authorities spend considering whether to release information should be taken into account when calculating whether the cost limit has been reached; further notes that this proposal was expressly rejected by the Justice Committee in its post-legislative review of the Act; believes that this proposal will penalise requests raising new or complex issues which will inevitably require substantial time to consider; observes that the Government’s objective will in any case be achieved following recent decisions of an Upper Tribunal that requests which involve a disproportionate, manifestly unjustified, inappropriate or improper use of the Act can be refused as vexatious; and calls on the Government not to proceed with its proposals.”

The motion’s primary sponsor is Richard Shepherd. At present, there are 12 signatories. Maurice Frankel of the Campaign for FOI is urging more MPs to take up the cause.

Turning from FOIA to information rights concerns of a data protection variety, the Care Bill was introduced in the House of Lords last week. Notably, it contains an express provision making the provision of “false or misleading information” an offence (subject of course to the statutory definitions being met). Clause 81 provides as follows:

(1) A care provider of a specified description commits an offence if—

(a) it supplies, publishes or otherwise makes available information of a specified description,

(b) the supply, publication or making available by other means of information of that description is required under an enactment or other legal obligation, and

(c) the information is false or misleading in a material respect.

The aims of this clause are not confined to matters affecting personal privacy – indeed, the explanatory document suggests it is confined to ‘management information’. There may, however, be some crossover with information on individual cases, particularly in ‘low cell count’ cases where individuals could be identified from higher-level data. The Data Protection 1998 does not use the language of “misleading” – focusing instead on inaccuracy and fairness. There are often DPA-related grievances, however, in which “misleading” is an excellent summary of the data subject’s concern.

Robin Hopkins

The Equitable Life collapse: strong public interests needed to trump s. 30

Wynn v IC and Serious Fraud Office (EA/2011/0185) concerned the dramatic closure in late 2000 of the insurer Equitable Life. Both the Ombudsman and the Penrose Inquiry examined the collapse and published their reports. Attempts to compensate those who lost money have been pursued through the courts and considered by parliament.

The Serious Fraud Office became involved to consider whether any criminal charges should be brought against those involved in the collapse. Pursuant to its functions under the Criminal Justice Act 1987, it analysed the material and took legal advice in order to decide whether or not to commence a criminal investigation. In effect, it investigated whether or not to investigate. In December 2005, the SFO announced that it would not commence an investigation.

Mr Wynn was dissatisfied with that decision. Eventually, in 2009, he asked the SFO for all of the information it held on Equitable Life. It provided him with some information – importantly, this included (pursuant to a direction from the ICO) a ‘vetting note’, which summarised the SFO’s reasoning on why successful prosecutions were unlikely. The SFO withheld the remainder of the voluminous information it held, relying on s. 12 (cost of compliance) for some it and ss. 30(1) (investigations) and 42 (legal professional privilege) for the rest. The ICO agreed.

Mr Wynn’s appeal to the Tribunal was dismissed. The Tribunal was satisfied that the s. 12 estimate was reasonable and well evidenced. S. 30(1) was engaged: a preliminary investigation (or, as I have put it above, an investigation into whether to investigate) was an investigation for s. 30(1) purposes nonetheless.

The public interest favoured maintaining that exemption. Case-specific points included the substantial transparency delivered by the Ombudsman and Penrose Inquiry reports and the SFO’s vetting note. There was nothing to suggest that the SFO had got things wrong.

The decision also contains a number of points of more general application. The Tribunal endorsed the account given in Breeze v Information Commissioner (EA/2011/0057) of the concerns protected by s. 30(1): protecting witnesses and informants (including their confidentiality), maintaining the integrity of the prosecution and judicial process, and ensuring that the court remained the sole forum for determining guilt. The ‘safe space’ point was also important: prosecutors need a safe space in which to make their decisions without any fear their frank assessments being publicised too soon after the event.

Notwithstanding the passage of time between the conclusion of that investigation and the request under FOIA, those factors counted very heavily in favour of maintaining the exemption under s. 30(1). The Tribunal endorsed this general proposition from Public Prosecutor of Northern Ireland v IC (EA/2010/0109): “in order for disclosure to be ordered in such cases public interest factors of at least equal weight would have to be adduced. A general interest in transparency as to a prosecution authority’s decisions will not be sufficient. Something substantial and particular to the information would be required” (paragraph 35).

The general upshot is that, in recent years, s. 30(1) has grown into a ‘strong’ exemption, i.e. one that requires weighty and particular factors to ‘defeat’. ‘Safe space’ arguments have also fared somewhat better in the prosecution context than the policy-making
context (under s. 35 of FOIA) in Tribunal decisions over the last year or two.

Finally, it is long-established that s. 42(1) is a ‘strong’ exemption, requiring weighty factors if disclosure of privileged information is to ordered. None were forthcoming in Wynn.

Robin Hopkins

IMPORTANT NEW DECISION ON LATE RELIANCE, COST OF COMPLIANCE AND COMMISSIONER’S DISCRETION

In Sittampalam v IC and BBC (EA/2010/0141), the Tribunal has considered a number of important questions. Framed generally (i.e. outside the specific factual context of this case), they are as follows. I add the “short answer” to the questions straight away, and then give some detailed analysis of each in turn below:

(1)  Can a public authority rely on the cost ‘exemption’ under section 12 FOIA at a late stage as of right? Answer: no.

(2)  If not, does the Commissioner have a discretion to allow late reliance on section 12? Answer: yes.

(3)  If he does, can he take into account developments after the time at which the request was refused – and in particular, can he decide that, due to those later developments, disclosure should not be ordered, even though the information should have been disclosed at the time when the request was handled? Answer: yes.

(4)  When allowing late reliance on section 12, can the Commissioner require the public authority to answer a disaggregated or narrowed version of the original request, which might bring it within the cost limit? Answer: yes.

Can section 12 be relied on as of right?

First, can a public authority claim late reliance on the cost ‘exemption’ under section 12 FOIA as of right? To put it another way, is the law on late reliance on section 12 the same as the law on late reliance on the exemptions under Part II of FOIA (which may be relied upon late as of right).

The Tribunal’s answer was “no”. This was in light of APPGER (explained in my post here), where the Upper Tribunal explained that section 12 was different from other exemptions. Section 12 is about saving public expenditure; if the requested information has already been retrieved, the expenditure has already been incurred, so there can be no saving and thus no reliance on section 12 from that point onwards.

In this case, the Tribunal concluded that (see paragraph 48):

“The proper time for raising reliance on s12 is the time required by section 17(5), i.e. promptly and in any event not later than the twentieth working day after receipt of the request. Later reliance – at least up to the conclusion of an internal review – is not a matter of right but is to be controlled by reference to the scheme and purposes of the Act.”

Does the Commissioner have a discretion to allow late reliance on section 12?

Subject to the APPGER qualifier – namely that the section 12 cost-saving exemption cannot be claimed when the cost has already been incurred – the Tribunal found that the answer to this question is “yes”.

When might late reliance on section 12 be claimed? One example would be where, because of the nature of the requested information, a public authority is able to rely on a Part II exemption without having to locate or retrieve the requested information. If the Part II exemption falls away (for example, if the Commissioner decides that it is inapplicable), the authority may then need to locate and retrieve the information, and it may be able to raise section 12 for the first time at that stage.

Can the Commissioner take into account developments after the refusal of the request?

The next question considers this scenario. The Commissioner decides that the public authority should have disclosed the requested information at the relevant time. He considers, however, that – because of events subsequent to the time at which the request was refused – disclosure would now be inappropriate. Is this allowed under FOIA?

Another way of looking at this is to ask whether the Commissioner has a discretion to order that “no steps be taken”, notwithstanding a public authority’s wrongful refusal of a request. To understand this issue, one must consider the wording of FOIA itself. Section 50(4) provides that, where a public authority has failed to comply with section 1 (disclosure duties and so on) or sections 11-17 (procedure for refusing a request), then “the decision notice must specify the steps which must be taken by the authority for complying with the requirement and the period within which they must be taken” (my emphasis). Where the Commissioner has found such a failure, this question arises: does section 50(4) mean that he must always direct that steps be taken, or does it simply mean he must stipulate what steps if any are to be taken?

In Gaskell v IC (EA/2010/0090), the Tribunal decided that the Commissioner has no such discretion: the Commissioner must always make a “steps direction”, and he cannot allow events subsequent to the relevant time to determine whether disclosure is ordered or not. The concern of the Tribunal in Gaskell was that such a discretion would give public authorities two bites of the cherry: if their refusal of the request failed (when judged by reference to the time of the handling of the request), they could invite the Commissioner to use his discretion to decline to order disclosure anyway, because of subsequent developments.

In Sittampalam, the Tribunal has taken a different view. It found that the Commissioner does have this discretion to consider subsequent events and, if appropriate, decline to order disclosure. Such cases will, however, be “exceptional” (see paragraph 60). This Tribunal took the view that the Tribunal in Gaskell had not been presented with scenarios illustrating the pitfalls of the “no discretion” position (see paragraphs 58-60). In support of its conclusion about this discretion, the Tribunal said as follows (paragraphs 53-54):

“Stanley Burnton J (as he then was) in Office of Government Commerce v IC [2008] EWHC 774 (Admin); [2010] QB 98; at [98] regarded it as arguable that the Commissioner’s decision as to the steps required to be taken by the authority might take account of subsequent changes of circumstances. In our view, that is not merely arguable but is correct, and flows from the nature of the Commissioner’s jurisdiction and its subject matter, and from the wording of the Act.

The Commissioner, when acting under section 50, is not merely deciding whether an information requester was or was not entitled to information at the time when the request was dealt with. He must also decide what is to be done. The Commissioner has a role both as guardian of the public interest in the appropriate disclosure of information held by public authorities and as a guardian of data protection rights. In our view the statute leaves to him a measure of discretion over what is the appropriate enforcement of information rights in a particular case. It would be perverse, in our view, if he were wholly debarred from taking into account fresh circumstances, not in existence at the date when the request was originally dealt with.”

Can the Commissioner require a public authority to answer a reformulated or narrowed request?

The Tribunal went on to consider whether, when allowing late reliance on section 12, the Commissioner can do so subject to the public authority handling the request in a prescribed way. It considered two possibilities.

First, is the Commissioner is entitled to allow the late reliance on terms as to disaggregation of the request, so as to prevent reliance on section 12 in relation to information that can be provided under the cost limit? The Tribunal concluded, albeit “with some hesitation”, that this is permissible (see paragraph 73):

“If during the Commissioner’s investigation the public authority is to be allowed to change its response to the request with retrospective effect, so as to raise a defence which should have been raised earlier, it does not seem unreasonable or out of line with the statutory scheme to say that the requester might also in a suitable case be allowed to refine or clarify the terms of the request retrospectively. In effect, the Commissioner would say to the public authority: ‘I will permit you to raise section 12 late but, for fairness’ sake, only on terms that you agree to permit the requester to narrow his request and that you agree to treat the narrowed request as validly made.’”

Secondly, is the Commissioner entitled to prescribe the steps to be taken so as to put the requester in the position that he would have been in if the public authority had complied with its duty to advise and assist under section 16. Compliance might enabled the requester to resubmit his request in a narrower form to which section 12 would not have been a defence.

The Tribunal again found that this was permissible, this time “with greater confidence”. It considered the case law on the relationship between sections 12 and 16. It agreed with Roberts v IC (EA/2008/0050) that entitlement to rely on section 12 is not conditional upon compliance with section16. It took the view, however, that “compliance with section 16 may be taken into account where the question is one not of entitlement but of discretion. If this is correct, it should enable the Commissioner to give greater practical effect to s16 than hitherto”. In other words, whenever late reliance on section 12 is claimed, public authorities should pay extra attention to their duties under section 16.

Robin Hopkins

EXTRAORDINARY RENDITION UPPER TRIBUNAL APPEAL: LATE RELIANCE, PERSONAL DATA & OTHER ISSUES

The All Party Parliamentary Group on Extraordinary Rendition (APG) requested information from the Ministry of Defence on (i) memoranda of understanding between the UK and the governments of Iraq, Afghanistan and the USA regarding the treatment of prisoners detained in the conflicts in Iraq and Afghanistan, (ii) a copy of the Detentions Practices Review, (iii) a copy of the UK’s policy on capture and joint transfer, and (iv) statistics on detainees held in Iraq and Afghanistan. The MOD refused the requests, relying on a number of exemptions under FOIA. For the most part, the Commissioner agreed. APG’s appeal was expedited to the Upper Tribunal and heard by Blake J, Andrew Bartlett QC and Rosalind Tatam.

Except as regards request (iii), its appeal has succeeded, to a limited but substantial extent. The Upper Tribunal has ordered disclosure or significantly more information than that ordered by the Commissioner.

Its judgment (available here) is complex. Some of the key points of interest are as follows.

Late reliance

The Upper Tribunal was mindful of the decision of a differently constituted Upper Tribunal in the DEFRA/Brikett appeals, where it was held that public authorities may rely on exemptions as of right at any stage in proceedings. In this case, the Upper Tribunal did not need to decide the issue of late reliance, but it did confess to having “some general concerns” about such an approach, which threatens to “turn the time limit provisions of ss. 10 and 17 almost into dead letters”, and “can also create a strong sense of injustice”. The internal review mechanism provides sufficient time for the public authority to make its mind up; if new points are taken thereafter, “then fairness requires that the requester should be allowed to add to the terms of his complaint under s. 50(1)”.

Cost of compliance under s. 12 FOIA

The Upper Tribunal approved principles from Urmenyi v IC and LB Sutton (EA/2006/0093) concerning the Commissioner’s enquiries into the assumptions behind the public authority’s estimate, and from Roberts v IC (EA/2008/0050) about the activities falling within s. 12 and the reasonableness of estimates.

Late reliance on s. 12 is a different matter to late reliance on exemptions under Part II of FOIA. Delay by a public authority robs the requester of the opportunity to split the request into parts separated by 60 days, thereby avoiding s. 12. The cost exemption “only has meaning if the point is taken early on in the process, before substantial costs are incurred” – it looks at whether costs would exceed, not whether they have been exceeded.

In the present case, the MOD’s estimate was not reasonable because it was based upon a search for a broader class of information than that which was actually requested.

Prejudice to international relations under s. 27 FOIA

The Upper Tribunal was not persuaded that this exemption was effective: “since the maintenance of the rule of law and protection of fundamental rights is known to be a core value of the government of the United Kingdom, it is difficult to see how any responsible government with whom we have friendly relations could take offence at open disclosure of the terms of an agreement or similar practical arrangements to ensure that the law is upheld”.

Legal professional privilege under s. 42 FOIA

This exemption was engaged, and the public interest in favour of disclosure of the UK’s Detention Practices Review did not outweigh the public interest in maintaining the exemption.

Bodies dealing with security matters under s. 23 FOIA

The MOD successfully relied on this exemption – including where it was relied on “late”.

Personal data under s. 40 FOIA and the conditions in Schedule 2 DPA

Information on the dates and locations of individual cases of detention and prisoner transfer would not enable identification of those individuals, and was thus not personal data. If it had been personal data, condition 6(1) from Schedule 2 DPA would have been met.

APG in fact submitted that conditions 4, 5(a), 5(d) and 6(1) would be met by disclosure of statistics on detainees. The MOD submitted that a number of these conditions could not be relied on in the context of a request under FOIA because the public at large (to whom disclosure under FOIA is deemed to be made) cannot fulfil these conditions. The Upper Tribunal disagreed: at least some of these conditions can be fulfilled by a member of the public, and that is sufficient.

APG further relied on s. 35(2) DPA, which provides an exemption from the non-disclosure provisions of the DPA where disclosure is “necessary for the purposes of establishing, exercising or defending legal rights”. The Upper Tribunal confirmed that “establishing” for these purposes had the sense of “vindicating” rather than merely determining what the relevant rights are.

Where data is anonymised, it continues to attract the protection of the data protection principles insofar as it is in the hands of the data controller (who holds the key to identification of the otherwise anonymous data subjects). “But outside the hands of the data controller, the information is no longer personal data, because no individual can be identified… the best analysis is that disclosure of fully anonymised information is not a breach of the [DPA] because at the moment of disclosure the information loses its character as personal data”. The publication of truly anonymised or other “plain vanilla” data therefore does not involve “processing of personal data” for DPA purposes.

Related judgments

On the late reliance issue, permission to appeal to the Court of Appeal is being sought in the DEFRA/Birkett case.

On the s. 40 FOIA issue, the Upper Tribunal’s decision needs to be read in conjunction with the High Court’s decision (also handed down very recently) in the Department of Health’s “abortion statistics” appeal.

COST OF COMPLYING WITH A REQUEST: NO DUTY TO SEARCH UP TO THE COST LIMIT

Cooksey v ICO and Chief Officer of Greater Manchester Police (EA/20100113) is the Information Tribunal’s latest application of the ‘cost of compliance’ “exemption” at section 12 of FOIA.

The case concerned a request in six severable parts for information concerning documents from a murder investigation undertaken between1992 and 1995. The material from that investigation was stored in entirely disorganised boxes – a state of affairs which the Tribunal found “astonishing”. This disorganisation gave rise to the engagement of section 12. Notably, the Commissioner had examined a sample of the material and produced his own cost estimate which was lower than that advanced by the public authority. The Tribunal was satisfied that section 12 was engaged on the basis of the Commissioner’s estimate – but not that of the public authority.

The Appellant argued that the boxes should have been searched up to the costs limit, given that any information found in relation to her request, even if only partial, would be useful. The Tribunal rejected this approach to section 12: if the costs limit is engaged, the effect of section 12 is to disapply altogether the duty to comply with the information request.

The Tribunal also found that the margin of difference between the compliance estimate and the costs limit is a relevant consideration “in these circumstances”.

Interestingly, the Tribunal further noted that the boxes had been numbered after receipt of the request for information, for purposes of transportation. This, the Tribunal suggested, constituted a change in the way that information was organised which might allow for differently constituted information requests to be made, relying on the box numbers as a way of targeting those requests.