Anyone interested in issues of privacy and data protection cannot have avoided the recent allegations in The Guardian (and now, everywhere else) about blanket surveillance by GCHQ of emails and phone calls between UK residents, when they have been routed in and out of the UK through servers held abroad; and about the use by UK authorities of surveillance information on UK residents collected by the US, without going through the usual domestic legal checks on collection of such information. Liberty has now announced that it is taking legal action against the British Intelligence Services. It will argue that their actions have breached both the provisions of the Regulation of Investigatory Powers Act 2000, and the right to respect for private life, home and correspondence under Article 8 of the European Convention on Human Rights. Liberty’s press release of today (25 June 2013) can be seen at http://www.liberty-human-rights.org.uk/media/press/2013/liberty-issues-claim-against-british-intelligence-servic.php.
Bank Mellat: closed material procedures and FOIA
June 25th, 2013 by Julian MilfordLast week, the Supreme Court gave judgment in Bank Mellat v Her Majesty’s Treasury (no.1) [2013] UKSC 38. The Bank Mellat case involved financial restrictions imposed by HMT on the Bank under the Counter-Terrorism Act 2008 (“the 2008 Act”), on the basis that it enabled funding for Iran’s nuclear weapons programme. The High Court and Court of Appeal had both adopted a closed material procedure (“CMP”) – i.e. a procedure in which the court sits in private, and hears evidence and/or submissions without one party either being present or seeing the material – in order to consider sensitive material adduced by HMT which could not be disclosed to the Bank. They had specific statutory authority to do so under the 2008 Act. The Supreme Court did not have such authority. The relevant questions were whether it was possible for the Supreme Court to adopt a CMP on appeal, in the absence of specific statutory provision; and if so, whether it was appropriate to do so in that particular case. The Supreme Court was faced with the difficulty of reconciling two strong but opposing interests. On the one hand, it was important that the Court should be able to see and consider any relevant material before the High Court and Court of Appeal. On the other, the Supreme Court itself in Al Rawi v Security Service [2012] 1 AC 531 had uncompromisingly set its face against any derogation from the open justice principle. The Supreme Court was divided; but the majority considered that the Court had implied authority to adopt a CMP under its powers conferred by the Constitutional Reform Act 2005, where the lower courts had themselves used a CMP. Nevertheless, the Court was uncomfortable about doing so, and expressed that discomfort in strong terms.
Bank Mellat (no.1) was not, of course, a freedom of information case. But it has important things to say for freedom of information cases. Freedom of information appeals are the classic example of cases which may require a CMP. Submissions must be made about, and evidence given on, the disputed information in the appeal. But that may involve disclosing the content of the information itself. If the party requesting the information was present, this would wholly undermine the purpose of the appeal. So the general points made about CMPs in Bank Mellat (no.1) are of obvious significance for FOIA appeals.
At [68]-[74] of the judgment in Bank Mellat (no.1), Lord Neuberger (giving the majority’s view) made the following general points about the use of closed material by or before appeal courts:
(1) Where a judge gives an open and closed judgment, it is highly desirable that in the open judgment the judge (i) identifies every conclusion in the open judgment reached in whole or in part in the light of points made or evidence referred to in the closed judgment; and (ii) says that this is what they have done.
(2) A judge who has relied on closed material in a closed judgment should say in the open judgment as much as can properly be said about the closed material relied on. Any party excluded from the closed hearing should know as much as possible about the court’s reasoning, and the evidence and the arguments it has received.
(3) On an appeal against an open and closed judgment, an appellate court should only be asked to conduct a closed hearing if it is strictly necessary for fairly determining the appeal. That puts an important onus on legal representatives asking an appeal court to look at closed material. An advocate who wants a closed hearing should carefully consider whether the request should, or even can properly, be made, and advise their clients accordingly. (This would of course be relevant for appeals to the Upper Tribunal from FOIA decisions in the First-Tier Tribunal.)
(4) If the appellate court decides that it should look at closed material, careful consideration should be given by the advocates and the court to whether it would nevertheless be possible to avoid a closed hearing, on the basis that the court can be addressed on confidential material in open court e.g. by elliptical references. This, again, is particularly relevant to the Upper Tribunal on FOIA appeals.
(5) If the court decides that a CMP is necessary, the parties should try and agree a way of avoiding, or minimising the extent of, a closed hearing.
(6) If there is a closed hearing, the lawyers representing the party relying on closed material should give the excluded party as much information as possible about closed documents relied on.
(7) Appellate courts should be robust about acceding to applications to go into closed session or even to look at closed material.
The general tenor of the judgments is to deprecate any use of CMPs. As Lord Neuberger put it: “any judge, indeed anybody concerned about the dispensation of justice, must regard the prospect of a closed material procedure, whenever it is mooted and however understandable the reasons it is proposed, with distaste and concern.”
Julian Milford
Knowing I’m On the Street Where You Live? Well, Google Does.
June 21st, 2013 by Christopher KnightFollowing on from yesterday’s French enforcement announcement, the ICO announced on 21 June 2013 that the collection of personal data by Google’s Street View cars – including email addresses, URLs and passwords relating to thousands of individuals – was required to be deleted within 35 days. This payload data was, according to Google, accidentally collected by the cars when they travelled around the UK. Google has undertaken to comply and delete the data, so an appeal against the Enforcement Notice is not expected.
The terms of the Enforcement Notice can be seen here.
The ICO’s press release can be seen here.
Christopher Knight
Google and Data Protection Across Europe
June 21st, 2013 by Christopher KnightOn 20 June 2013 the Commission nationale de l’informatique et des libertés (the CNIL) – the French data protection agency – issued a statement in relation to its investigation into Google’s privacy policy. It formed part of co-ordinated action by data protection agencies in France, Germany, Italy, the Netherlands, Spain and the United Kingdom. The CNIL announced that Google was in breach of the French data protection legislation, mirroring findings in other European jurisdictions. The full text of the statement reads:
“From February to October 2012, the Article 29 Working Party (“WP29”) investigated into Google’s privacy policy with the aim of checking whether it met the requirements of the European data protection legislation. On the basis of its findings, published on 16 October 2012, the WP29 asked Google to implement its recommendations within four months.
After this period has expired, Google has not implemented any significant compliance measures.
Following new exchanges between Google and a taskforce led by the CNIL, the Data Protection Authorities from France, Germany, Italy, the Netherlands, Spain and the United Kingdom have respectively launched enforcement actions against Google.
The investigation led by the CNIL has confirmed Google’s breaches of the French Data Protection Act of 6 January 1978, as amended (hereinafter “French Data Protection Act”) which, in practice, prevents individuals from knowing how their personal data may be used and from controlling such use.
In this context, the CNIL’s Chair has decided to give formal notice to Google Inc., within three months, to:
◾Define specified and explicit purposes to allow users to understand practically the processing of their personal data;
◾Inform users by application of the provisions of Article 32 of the French Data Protection Act, in particular with regard to the purposes pursued by the controller of the processing implemented;
◾Define retention periods for the personal data processed that do not exceed the period necessary for the purposes for which they are collected;
◾Not proceed, without legal basis, with the potentially unlimited combination of users’ data;
◾Fairly collect and process passive users’ data, in particular with regard to data collected using the “Doubleclick” and “Analytics” cookies, “+1” buttons or any other Google service available on the visited page;
◾Inform users and then obtain their consent in particular before storing cookies in their terminal.
This formal notice does not aim to substitute for Google to define the concrete measures to be implemented, but rather to make it reach compliance with the legal principles, without hindering either its business model or its innovation ability.
If Google Inc. does not comply with this formal notice at the end of the given time limit, CNIL’s Select Committee (formation restreinte), in charge of sanctioning breaches to the French Data Protection Act, may issue a sanction against the company.
The Data Protection Authorities from Germany, Italy, the Netherlands, Spain and the United Kingdom carry on their investigations under their respective national procedures and as part of an international administrative cooperation.
Therefore,
◾The Spanish DPA has issued to Google his decision today to open a sanction procedure for the infringement of key principles of the Spanish Data Protection Law.
◾The UK Information Commissioner’s Office is considering whether Google’s updated privacy policy is compliant with the UK Data Protection Act 1998. ICO will shortly be writing to Google to confirm their preliminary findings.
◾The Data Protection Commissioner of Hamburg has opened a formal procedure against the company. It starts with a formal hearing as required by public administrative law, which may lead to the release of an administrative order requiring Google to implement measures in order to comply with German national data protection legislation.
◾As part of the investigation, the Dutch DPA will first issue a confidential report of preliminary findings, and ask Google to provide its view on the report. The Dutch DPA will use this view in its definite report of findings, after which it may decide to impose a sanction.
◾The Italian Data Protection Authority is awaiting additional clarification from Google Inc. after opening a formal inquiry proceeding at the end of May and will shortly assess the relevant findings to establish possible enforcement measures, including possible sanctions, under the Italian data protection law.”
Panopticon likes to deliver news from across la Manche too, and following on from Google’s involvement in the American Prism revelations, it would appear to have been a difficult couple of weeks for the leading internet search engine. Precise steps are awaited from the ICO at home.
Christopher Knight
How can this level of state surveillance be legal?
June 19th, 2013 by Timothy Pitt-Payne QCAnya Proops addresses the above question, prompted by the recent revelations about the US Prism programme, in an article in today’s Guardian. She discusses the main legal constraints on surveillance in the UK – Article 8, the Data Protection Act, and the Regulation of Investigatory Powers Act. And she even manages a name check for Panopticon – both the Benthamite version, and this blog. The article is at page 32 of today’s print edition, and it’s online here. It’s already attracted a lot of attention, both by way of comments on the online version, and on Twitter.
Enhanced criminal records certificates – teachers on trial
June 13th, 2013 by Anya ProopsThe theory that there is no smoke without fire is one which often looms large where teachers are accused of sexual offences against pupils. Even in the face of a decision by the CPS that there is insufficient evidence to proceed with a prosecution or an acquittal following a criminal trial, a teacher who has been accused of sexual offences may find it hard to escape the tainting effects of the allegations. Of course, a critically important issue for the teacher in question is whether the allegations will ultimately find their way into any enhanced criminal record certificate (ECRC). This is an issue which has been considered by the High Court in two recent cases.
In the first, R (L) v Chief Constable of Cumbria Constabulary [2013] EWHC 869 (Admin), L, a teacher, had been accused of having improperly propositioned and hugged an 18 year old pupil whilst at a pub. L had denied the allegations and no criminal prosecution had ultimately been mounted. The High Court held that inclusion in the ECRC of information relating to the allegations was unlawful as it constituted a disproportionate and hence unjustified interference with L’s Article 8 rights (see further Rachel Kamm’s more detailed post on this judgment here).
This week, the High Court has given judgment in the case of RK v (1) Chief Constable of South Yorkshire (2) Disclosure and Banning Service [2013] EWHC 1555 (Admin). RK had previously been acquitted of six counts of indecent assault and sexual activity with a child (in essence it was alleged that RK had repeatedly touched the bottoms of teenage girls in his care). Nine years later RK sought disclosure of a draft ECRC from the Constabulary. The draft included information about the allegations and referred to them as ‘offenses’. RK sought a judicial review of the draft certificate.
In a fairly damning judgment, Coulson J held that inclusion of this information was unlawful as constituting a breach of RK’s Article 8 rights. Fundamental to the court’s judgment was the conclusion that the Constabulary had impermissibly treated the allegations as if they had been proven, notwithstanding the fact that RK had been acquitted. Indeed the court lamented the ‘unblinking equation’ between the unproven allegations with the so-called sexual offences (para. 61). Whilst the judgment makes clear that an acquittal does not automatically bar the police from referencing the original allegations in the ECRC (see para. 37), it does confirm that an acquittal is likely to be an important factor weighing heavily in the balance when it comes to determining whether or not a particular disclosure should be made. On the facts of the case before him, Coulson J found that inclusion of information about the allegations relating to RK was unlawful having regard to the fact of the acquittal; the fact that, even if proven, the incidents would not have been particularly grave or serious and further the fact that there were aspects of the prosecution case which raised serious questions about the reliability of the information.
Critically the judgments in both L and RK highlight the dangers attendant on the police unthinkingly substituting their own view of an individual’s guilt or innocence in the face of an acquittal by the criminal courts or other important evidence raising questions about the reliability of the information in issue.
Anya Proops
Surveillance and RIPA: Radio 4 discussion
June 12th, 2013 by Ben HooperI took part in what will hopefully prove to be an interesting discussion of surveillance and RIPA in an episode of Clive Anderson’s “Unreliable Evidence” that will be broadcast at 8pm today on Radio 4 (and available on the iplayer thereafter). The show was recorded prior to the recent leaks regarding US surveillance activities, and so focuses on the UK perspective. The other panel members were Eric Metcalfe (former director of human rights policy at Justice, now a barrister at Monckton Chambers) and solicitor Simon McKay.
Ben Hooper
Breach of confidence: the latest from the Supreme Court
May 22nd, 2013 by Ben HooperThe Supreme Court gave judgment today in Vestergaard Frandsen A/S v. Bestnet Europe Limited [2013] UKSC 31. The appeal concerned whether a company (Vestergaard) could sue a former employee – who had helped to establish a rival business – for breach of confidence in circumstances where the former employee (i) had never herself acquired the confidential information in question and (ii) did not know at the time that the rival business was using the confidential information. The sole judgment was given by Lord Neuberger, who held that (i) and (ii) precluded liability in breach of confidence on the part of the former employee.
The judgment does not contain any novel or radical principles. But information lawyers will wish to note the useful overview of the types of cases in which liability will arise (paragraphs 22-27), and Lord Neuberger’s analysis of the limits of liability based on common design (paragraphs 32-39).
Ben Hooper
Workfare and the First-tier Tribunal
May 20th, 2013 by Timothy Pitt-Payne QCEmployment programmes for welfare recipients – often referred to as “workfare” – are highly controversial. In Department for Work and Pensions v Information Commissioner and Zola (EA/2012/0207,0232 and 0233), the First-tier Tribunal considered three FOIA requests for information about companies participating in such programmes. The Tribunal ordered disclosure, rejecting the Department’s reliance on the exemptions in FOIA section 43(2) (prejudice to commercial interests) and section 36(2)(c) (prejudice to the effect conduct of public affairs).
The case related to three programmes run by the DWP: Mandatory Work Activity (MWA); Work Experience (WE); and the Work Programme (WP). MWA provided short term work placements in the local community, usually with a charitable organisation. WE provided placements for 18-21 year old Jobseekers’ Allowance claimants. WP was aimed at those considered to be at risk of becoming long-term unemployed. For each programme, the Government entered into contracts with providers, and these (or their sub-contractors) in turn arranged work placements with various organisations. The three requests sought information as to the identity of organisations that had hosted placements.
The Information Commissioner required the DWP to provide the requested information.
The Commissioner rejected the DWP’s reliance on section 43(2), holding that the exemption was not engaged. The Commissioner considered that the risk of providers withdrawing from the scheme as a result of disclosure would have been capable of engaging section 43(2), but that on the evidence any risk of this nature was speculative. Any harm consisting of increased welfare costs was financial rather than commercial in nature, and did not engage section 43(2). The Commissioner noted the existence of campaign groups and websites opposed to workfare, but said that the extent to which these had influenced any past withdrawals from the scheme was unclear. In order to establish that section 43(2) was engaged, the Commissioner considered that the DWP would have had to indicate how many organisations would have been likely to withdraw as a result of disclosure, and what it would have cost to find alternative work placements; this had not been done.
The Commissioner also rejected the DWP’s reliance on section 36(2)(c). Although the exemption was engaged, on the basis of the opinion of the qualified person (the then Minister for Employment), the public interest in maintaining the exemption was outweighed by the public interest in disclosure.
Before the Tribunal, the DWP disputed the Commissioner’s categorisation of higher welfare and related costs as being “financial” rather than “commercial” in nature. It contended that the Commissioner had required an undue level of detail from the DWP in support of its claim that section 43(2) was engaged. In relation to section 36(2)(c), the DWP argued that disclosure would have been likely to lead to the collapse of the MWA scheme. As to the public interest in disclosure, the DWP contended that this had been greatly over-estimated by the Commissioner: there was already information in the public domain as to the kinds of employers that were participating; there was little public interest in knowing which specific organisations were taking part within any particular area.
The DWP placed evidence before the Tribunal about a survey carried out by the DWP in October and November 2012. The DWP had sought information from contractors, their sub-contractors, and organisations that had hosted placements; the DWP had asked for information about the perceived impact of public awareness of their involvement in the programmes. In March 2013 some organisations had provided further information in support of the DWP’s stance of not releasing the names of placement hosts, and this was also put before the Tribunal by the DWP.
The Tribunal’s conclusion was that section 43(2) was not engaged; and that, although section 36(2)(c) was engaged, the public interest balance favoured disclosure. The Tribunal would have reached the same conclusion as to the public interest under section 43(2), had that exemption been engaged.
In relation to section 43(2), any prejudice relating to increased cost of welfare payments was held to be financial rather than commercial in nature, and irrelevant to the exemption. The Tribunal therefore focused instead on the risk that disclosure would lead participating organisations to withdraw from the schemes. It referred to the “Boycott Workface” website, and various news articles, concluding that media coverage and comment were inevitable and that there was always an inherent risk that participants would be identified. At the time of the requests there were some 200 names of participating organisations already in the public domain. There had not been a “media frenzy” as a result of publication of these names. At most, seven of the 200 names had come in for criticism which had perhaps resulted, or could have resulted, in their withdrawal; but the evidence even in these cases was unpersuasive. The speculative views elicited by the DWP’s survey carried considerably less weight than these real-life examples of what had actually happened where specific organisations had been named.
In relation to section 36(2)(c), the public interest in disclosure outweighed any interest in maintaining the exemption. The schemes were controversial; it was important for the public to see and examine the schemes and how participants performed.
Overall, the case is an example of the Tribunal’s readiness to scrutinise closely any reliance on section 43(2). Speculation about what might happen following disclosure – even when presented in the form of a survey – carried little weight. The Tribunal was much more interested in the specific examples of providers that had been named in the past; and in these cases, the Tribunal considered that the evidence did not support the DWP’s position. Overall, the Tribunal’s approach seems to be that private sector bodies that become involved in a controversial Government programme can expect to be exposed to a degree of scrutiny and criticism; and the Tribunal is reluctant to use this as a basis for protecting those organisations from the effect of disclosure under FOIA.
Timothy Pitt-Payne QC
New FoIA Exemption
May 14th, 2013 by James Goudie QCFollowing the Queen’s Speech, an Intellectual Property Bill has been introduced in the House of Lords. Clause 19 inserts a new exemption into the FoIA (Section 22A). The exemption is for continuing programmes of research intended for future publication. Subsection 1(a) of Clause 19 provides that information is exempt from a Section 1(1)(b) FoIA disclosure requirement if it relates to information obtained in the course of, or derived from, a programme of continuing research that is intended for future publication. Subsection (1)(b) of the new Clause, however, provides that the information will be exempt only if disclosure would, or would be likely to, prejudice a matter listed in that subsection. The exemption will not be an absolute exemption. It will be subject to the public interest balance test. Public authorities will not be required to confirm or deny that they hold Section 22A information if, or to the extent that, compliance would, or would be likely to prejudice, any of the matters mentioned in subsection (1)(b). The Government does not consider that the new exemption raises any issues of compatibility under ECHR Article 10.