NEW TRIBUNAL DECISION ON DISCLOSURE OF COUNCIL’S COMPROMISE AGREEMENT WITH EX-CEO

February 28th, 2011 by Robin Hopkins

Those involved in requests for information about compromise agreements between public authorities and departing senior employees will wish to pay careful attention to the Tribunal’s very recent decision in Gibson v IC and Craven District Council (EA/2010/0095). In this case, the Tribunal ordered disclosure of information insofar as it related to the use of public funds; the remainder could be withheld on the basis of s. 40 FOIA. This provides an illuminating contrast with other s. 40 FOIA cases about compromise or severance agreements, such as Wilson v IC (EA/2009/0082) and Waugh v IC and Doncaster College (EA/2008/0038).

The Tribunal found that all information in the requested compromise agreement was personal data. It agreed that generally information on compromise agreements should not be disclosed – but, as ever, context is important. Here the case concerned a very senior employee; further, the Council’s ex-CEO left office with the Council finances “in disarray”, but the auditor had – ultimately – approved the settlement paid under the compromise agreement.

As to the lawfulness of disclosure, it observed that this term is not defined in the DPA, but “seems to mean that information may not be processed when the law does not allow it, as opposed to when two parties have entered into a voluntary agreement not to disclose the information”. In other words, a mere contractual agreement as to confidentiality does not suffice to render disclosure “unlawful”.

As to the fairness of disclosure, the Tribunal distinguished between information on the use of public funds and other information. It noted that compromise agreements are “personnel matters”, generally attracting a strong expectation of privacy. Although “personnel” information comes into existence as part of the employee’s professional (rather than personal) activities, some of it (such as pension contributions and tax arrangements) are “nevertheless inherently private and would attract a very strong expectation of privacy and protection from the public gaze”.

Again, expectations of confidentiality were not decisive on the question of fairness: the Tribunal did “not regard it as reasonable for the ex-CEO (or the council) to expect that certain information relating to the use of public funds, to be hidden from public gaze by virtue of a confidentiality clause agreed between them”. Nor was the Tribunal impressed by submissions that disclosure would have a substantial adverse impact on the ex-CEO’s employment prospects or personal life.

Ultimately, fairness and condition 6 from Schedule 2 DPA were determined in similar terms: the Tribunal found that “the legitimate interests of members of the public [in transparency] outweigh the prejudice to the rights, freedoms or legitimate interests of the ex-CEO only to the extent that the information concerns the use of public funds”.

DATA PROTECTION IN THE UK: CURRENT AND FUTURE CONCERNS

February 25th, 2011 by Robin Hopkins

The British Medical Association has expressed concern this week about the Health and Social Care Bill – in particular, about its approach to data protection and the sharing of patients’ medical information. The Bill proposes a new “information standard” for the NHS which, according to the BMA, shows that “the Government has decided to place its desire for access to information over the need to respect patient confidentiality”. The new law would empower the Secretary of State to obtain such information as he considers it necessary to have; it would also widen the access to medical information by the NHS Commissioning Board, NHS Information Centre and local authorities. More detail on the proposed changes can be found in articles in the Daily Telegraph here, and the Guardian here.

The BMA wants to see the Bill amended: “so that it enshrines the need for explicit patient concent to any disclosure of information, unless the information has been properly anonymised or there is an overriding public interest.” The Department for Health, on the other hand, is confident that the proposals would preserve confidentiality and comply with the data protection law. Presumably, the Department means data protection law as implemented in the UK. At the 11KBW Information Law Seminar last week, I discussed the tension between the narrow approach to data protection that has prevailed under UK common law since Durant, and the considerably wider approach taken at a European level (and favoured domestically by the Information Commissioner).

On this subject, there is a very interesting report on Amberhawk this week, available here. This sets out in some detail the European Commission’s concerns about the UK’s apparently “bare minimum” approach to implementing its data protection obligations. It’s not yet clear what the Commission will do about this, but it appears to be only a matter of time before negotiation or confrontation on this issue comes to a head.

CONTRACTING OUT OF FOIA AND THE DPA?

February 22nd, 2011 by Robin Hopkins

Roy Greenslade has posted a very interesting piece this afternoon on his blog on the Guardian website about a purported instance of “contracting out” of FOIA and DPA rights. According to his piece, Cheshire West and Chester Council has signed a compromise agreement with a former employee in which he or she contracts not to make requests to the Council under FOIA or the DPA (the EIR is not mentioned). The Council is confident that these provisions are effective. The ICO takes the opposite view – I suspect it will not be alone in doing so. Click here to read the piece.

PAYMENTS TO SENIOR PUBLIC SECTOR EMPLOYEES: ROUNDUP OF RECENT PERSONAL DATA CASES

February 22nd, 2011 by Robin Hopkins

The FOIA update paper given at last week’s 11KBW Information Law Seminar provides a roundup of recent caselaw in a few of the most common areas of Tribunal litigation.

One is commercially sensitive or confidential information: in particular, Veolia and its aftermath.

Another is information on planning applications and property developments: in particular, those cases subsequent to South Gloucestershire, namely Bristol City, Bath & North East Somerset and Elmbridge.

A third area is personal data: here the recent cases of Dun, Bryce, Ferguson and Ince have all – like the cases mentioned above – been covered in Panopticon posts. Two others to take note of, however, both in the context of public sector pay (other than salaries).

One concerns bonus payments to public sector employees. Davis v IC and Olympic Delivery Authority (EA/2010/0024) saw the Tribunal distinguish between bonus information and performance assessment information. It ordered disclosure of certain information relating to the bonuses of senior employees of the ODA: the maximum performance-related bonuses to which the chief executive and communications director were contractually entitled, and the percentage of the maximum available bonus actually paid to certain other members of senior management. The Tribunal decided, however, that details of the performance targets which individuals failed to hit to 100% satisfaction should not be disclosed.

The other recent case on the personal data exemption is Pycroft v IC and Stroud District Council (EA/2010/0165). The context was an auditor’s report which observed that the local authority’s former Strategic Director of Housing “did not ensure that staff had taken ownership of managing the budgets”. The applicant requested the details of this Director’s early retirement package. The Commissioner found that disclosure of this information would not be fair, and the Tribunal agreed. It should be noted by those dealing with requests for information about payments to allegedly poorly-performing public sector employees.

REDUCING DATA REPORTING BURDENS ON LOCAL AUTHORITIES: LGA DISAPPOINTED BY LACK OF PROGRESS

February 22nd, 2011 by Robin Hopkins

In October of 2010, Eric Pickles, Secretary of State for Communities and Local Government announced – as part of the government’s drive to boost localism and reduce bureacracy – his intention to reduce the amount and complexity of data which local authorities are required to provide to central government for performance monitoring purposes. In particular, he announced that the “National Indicator Set” was to be replaced with a single comprehensive list of all the data returns central government expects local authorities to provide. Apparently, these requirements involve thousands of datasets and the employment of high numbers of full-time staff.

How has this drive progressed? Not very well, according to the Local Government Association. 

The LGA welcomed Mr Pickles’ announcement and the Department’s consultation on its ‘Reducing Data Burdens’ Code of Practice. It announced yesterday, however, that it is “disappointed at the scale of the reductions proposed so far and remain unconvinced about the extent of the Government’s ambition to minimise the reporting burdens it imposes on councils”. It provides this example: for the 45 data items or collections that have been stopped, another 18 new ones have been introduced. 

It calls for “an immediate and significant reduction in the data Government requires of local government”. See the details of the LGA’s position here.

LATE RELIANCE AND OTHER DEVELOPMENTS TO LOOK OUT FOR

February 22nd, 2011 by Robin Hopkins

My paper from last week’s 11KBW Information Law Seminar contains a number of updates on important developments – both recent and imminent – at Upper and First-Tier Tribunal levels.

One of the most important concerns the contentious question of late reliance: in particular, is a public authority entitled to rely as of right on an exemption it raises for the first time before the Commissioner or even the Tribunal? The Upper Tribunal has recently answered with a firm “yes”: the decision in the joint appeals from the Tribunal decisions in Home Office v IC, and DEFRA v IC and Birkett (GIA/1694/2010 and GIA/2098/2010) can be downloaded here; see also commentary by FOI Man on his blog here. As I mention in my paper, however, the Upper Tribunal may have more to say on this matter very shortly (in an appeal involving the All Parliamentary Group on Extraordinary Rendition) – so watch this space for updates.

Another imminent Upper Tribunal decision to look out for is the case of Gaskell. concerns an appeal against a Decision Notice involving the Valuation Office Agency. In that Decision Notice, the Commissioner found that – notwithstanding the public authority’s unlawful withholding of the requested information – he would not be ordering disclosure because of events (in this case, the coming into force of new legislation) arising after the time at which the request was handled. The appeal invites the Upper Tribunal to find that the Commissioner has no discretion to make such a decision based on events subsequent to the relevant time for his assessment.

The High Court has recently confirmed that the “costs of compliance” for FOIA purposes does not include the costs of redaction: see Chief Constable of South Yorkshire v IC ([2011] EWHC 44 (Admin)).

Two notable EIR decisions are expected shortly, one at first instance in the GM Freeze case (which is expected to provide much-needed guidance on how widely the concept of “emissions” should be construed), the other by the Upper Tribunal in the Kirklees case (which is expected to clarify the question of imposing charges following a request to inspect information).

The latter case also saw this argument raised before the Upper Tribunal: a “purposive request” (i.e. one that takes the form “please provide me with the information I would need to answer the following questions”) is not a valid request for EIR and FOIA purposes.

Finally, the First-Tier Tribunal has recently heard an appeal by Channel 4, in which the appellant argued that contracts should be treated as whole, rather than severable documents, meaning that if part of the contract can be withheld, then the whole contract can also be withheld. The implications of this position would be substantial, so again – watch this space.

PERSONAL DATA OF WHISTLEBLOWING CIVIL SERVANTS: REDACTION AND FAIRNESS

January 24th, 2011 by Robin Hopkins

Those considering the disclosure of personal data in a civil service context will wish to pay close attention to last week’s decision in Dun v IC and National Audit Office (EA/2010/0060). This is the latest Tribunal exercise in forensic scrutiny of fairness under the “personal information” exemption at section 40 (applied in tandem with the first data protection principle under the DPA).

The disputed information concerned the NAO’s enquiry into the Foreign & Commonwealth Office’s handling of employee grievances of a whistleblowing variety, i.e. those in which the employee had raised concerns as to “the proper conduct of public interest, fraud, value for money and corruption in relation to the provision of centrally-funded public services”. The request for information was triggered by the FCO’s inadvertent publication on its intranet of a “track changes” version of the draft report sent to it by the NAO: this tended to suggest that the FCO had sought not only to correct points of fact in that draft report, but also to influence its conclusions.

Unfairness of grievance and investigation information was pleaded based largely on the expectations of the complainants that their personal data would not be disclosed, and on the distress of their potentially being perceived as “trouble makers”.

A number of categories of arguably personal data were examined: junior civil servants’ names (outcome: don’t disclose), junior civil servants’ roles or job titles (outcome: disclose), contact details (outcome: don’t disclose, except for that part of an email address containing the name of a person whose name was otherwise to be disclosed), details of complaints and criticisms of employees (outcome: disclose in sufficiently redacted form).

The issue of redaction turned on whether disclosure in redacted form would preserve anonymity or achieve fairness – the NAO and IC had said no, but the Tribunal disagreed. It found that disclosure of whistleblowing case information in redacted form would be fair where (i) only those involved would be able to identify the persons being referred to, and (ii) those involved would not learn anything from the disclosed material which they did not know already.

This case is another instance of the established position that disclosure of the names of senior civil servants (here Grade 5 or above) will generally be fair, whereas those of their more junior colleagues would not. A note of caution here, however: the Tribunal was clear that no blanket policy should apply, and that fairness depends on the particular responsibilities and information with which the case is concerned.

One interesting aside: what of a civil servant who was junior at the time the information was created, but has since been promoted? Generally, subsequent events should not make a difference, but not necessarily: the Tribunal observed that it could “envisage a scenario where it is fair to disclose an earlier document in order to refute protestations of ignorance from the same individual who later becomes more senior and accountable”.

DEPUTY PM DETAILS GOVERNMENT’S PLANS TO EXTEND FOIA

January 7th, 2011 by Robin Hopkins

This morning’s speech by Nick Clegg on civil liberties had much to say about FOIA and access to information more broadly.

The Deputy Prime Minister said that the progress in transparency brought about by the introduction of FOIA has stalled: FOIA, he said “was a good start, but it was only a start. Exceptions remain far too common. And the available information is too often placed behind tedious bureaucratic hurdles.”

He hailed the Treasury’s COINS database, which details public services expenditure, the work of The Open Knowledge Foundation in processing that data for ready public consumption, and the Cabinet Office’s new transparency rules concerning the publication of spending figures by Whitehall departments (the Cabinet Office’s website explains its work on transparency).

He advertised the government’s plans for a Public Data Corporation, which will “bring existing government bodies together into one organisation, responsible for disseminating a wealth of data” (on which, see The Guardian‘s article here).

FOIA’s scope is to be extended “to cover potentially hundreds more bodies; including UCAS, the Association of Chief Police Officers, the Financial Ombudsman Service and many more”. A complete list has yet to be announced. The government does not, it appears, intend to make bodies such as water utility companies or Network Rail subject to FOIA.

Nor, it appears, will the Secretary of State’s right of veto over Tribunal decisions be repealed.

The 30-year rule is being scaled back to a 20-year rule.

Finally, the Justice Select Committee is to be tasked with “post-legislative scrutiny” (although it is not entirely clear to what legislation this task will apply) of how FOIA is being implemented.

Data protection crept in via Mr Clegg’s recognition that government “must be very respectful in handling personal information”. The EIR did not get a mention in the speech.

The full text of Mr Clegg’s speech is available here.

TRIBUNAL ORDERS DISCLOSURE OF VIABILITY REPORT FROM HAMPTON COURT PLANNING APPLICATION

January 7th, 2011 by Robin Hopkins

Elmbridge Borough Council v IC (Additional Party: Gladedale Group Limited) (EA/2010/0106) is the latest Tribunal decision concerning requests for information about planning applications (see my posts on other such cases here and here, and Anya’s post on an earlier important planning case here). In particular, the disputed information here comprised a viability report containing details on costs, revenues, values and finances of a development in the vicinity of Hampton Court. The Council pleaded commercial confidentiality and sought to rely on regulations 12(5)(e) and 12(5)(f) EIR. The Commissioner found that these exemptions were not engaged. The Tribunal agreed, and ordered disclosure.

In so doing, the Tribunal confirmed that the confidentiality of this information must be objectively required at the time of the request (rather than, for example, when the information was created or passed to the Council) in order to protect a relevant interest. The Tribunal also confirmed that it is not enough that some harm might be caused by disclosure, but that it is necessary to establish (on the balance of probabilities) that some harm to the economic interest would be caused by disclosure.

A crucial feature of this case was the lack of evidence offered to demonstrate commercial confidentiality or prejudice. The Tribunal observed that:

“Throughout the investigation and consideration of the issues leading to the Decision, the Respondent consistently and repeatedly sought evidence from the Appellant to support their contention that the subject information was commercially sensitive or that its release would be prejudicial to the third parties concerned. It is noted by this Tribunal that the information made available to the respondent amounts to assertions and speculation by the interested parties. There is a notable absence of independent or objective evidence to support the assertions or speculation put before the Respondent.” 

SCOTTISH GOVERNMENT ISSUES PRIVACY GUIDANCE

January 5th, 2011 by Robin Hopkins

The Scottish Government has published its guidance document on Identity Management and Privacy Principles. The guidance is aimed at both public sector policy makers and with those involved in devising or operating systems for proving or recording identity. Key principles include:

  • For services which are used frequently and for which identification is needed, users should be required to register only once. Thereafter, unless there is a statutory requirement to prove identity, a person should generally be able to access the service by authenticating themselves using a token (such as a bus pass or library card) that proves their entitlement without revealing personal information. In other circumstances, a user name and a password may be required.
  • A Privacy Impact Assessment (PIA) or proportionate equivalent should be conducted and published prior to the implementation of a project which involves the collection of personal information.
  • Where a public body has a contract with the private sector or the third sector, the contractor must be contractually bound to adhere to best practice as outlined in the guidance.
  • The creation of centralised databases of personal information is to be avoided.
  • If a public service organisation needs to link personal information from different systems and databases (internally or between organisations), it should avoid sharing persistent identifiers. Instead, other mechanisms – such as matching – should be considered.