NEW TECHNIQUES FOR APPLYING RIPA – OUTCOME OF HOME OFFICE CONSULTATION

November 10th, 2009 by Anya Proops

The Regulation of Investigatory Powers Act 2000 (RIPA) has attracted a considerable amount of negative publicity over the past couple of years. In no small part, this has been due to public outcry in response media reports of local authorities using their powers under RIPA to engage in activities such as monitoring the use of domestic wheelie bins, recording dog-fouling incidents on camera and carrying out surveillance on families suspected of trying to cheat the school catchment system (see further the discussion of the case of Paton v Poole Borough Council below). Concerns have been expressed by members of the public as well as privacy campaigners that such actions on the part of local authorities constitute abuses of their powers both because the surveillance powers of the state should not be used for trivial purposes and because there has been a failure on the part of the authority to achieve a proper balance between the rights of the state to identify civil and criminal wrongdoing and the individual’s right to have his or her privacy respected. Those concerns resulted in the Home Office commencing a consultation in April 2009 on proposals to introduce new RIPA techniques which would purportedly help ensure that RIPA would only be used when it was necessary and proportionate. Last week, the Home Office published a summary of the responses to those proposals along with an announcement. In the announcement, the view expressed by the Minister for State Security, Counter-Terrorism and Policing, David Hanson, was that the responses to the consultation had been broadly positive. He said that, subject to certain minor amendments, he would now take steps to introduce the proposals as secondary legislation. The announcement suggests that the new legislation will aim to:

  • clarify the test of necessity and proportionality so techniques will not be used for trivial purposes such as investigating dog fouling or people putting bins out a day early
  • raise the rank of the authorising officer for RIPA techniques in local authorities to senior executive at a minimum of ‘Director’ level
  • give elected councillors a role in overseeing the way local authorities use covert
    investigatory techniques
  • require constituents’ communications with MPs on constituency business to be
    treated as confidential information, and therefore subject to authorisation by a
    higher rank of officer
  • treat covert surveillance of legal consultations as ‘intrusive’ rather than ‘directed’
    surveillance, meaning that it can only be carried out by a very limited number of
    public authorities, primarily the police and intelligence agencies, and only with
    independent approval
  • clarify how provisions currently in the Policing and Crime Bill will reduce
    bureaucracy relating to RIPA in police collaborative units comprising two or
    more forces

It also appears that, following a proposal by the Local Government Association, local authorities will need to appoint a single official to be responsible for ensuring that all authorising officers are of an appropriate standard. Notably, the Home Office rejected suggestions that a more radical approach should be adopted, namely removing local authorities from the scope of RIPA altogether.

Coincidentally, the Investigatory Powers Tribunal, chaired by its President, Mummery LJ, was itself hearing a complaint last week brought under s. 65 RIPA that a particular local authority had unlawfully exercised its surveillance powers under RIPA. In Paton v Poole Borough Council, which was heard on 5 and 6 November, the IPT was called upon to decide whether the Poole BC had acted unlawfully under RIPA when it conducted directed surveillance of Ms Paton and her family. The surveillance had been conducted in circumstances where the council suspected that Ms Poole may have been dishonestly trying to abuse the school catchment system by giving a false address when applying for a place for her child at a local school. It was accepted by the council before the IPT that, in fact, its suspicions about Ms Paton had proved to be unfounded. However, the council nonetheless sought to maintain the position before the IPT that the surveillance constituted a necessary, proportionate and, hence, lawful exercise of its powers under RIPA. In advancing this case, it was argued on behalf of the council that there existed no simple means of uncovering fraudulent abuses of the school catchment system that did not involve any invasion of privacy rights. The council was represented by 11KBW’s Ben Hooper.

WHEN WILL THEY EVER LEARN?

November 10th, 2009 by Timothy Pitt-Payne QC

We call them “data protection duck outs”.  The New Zealanders call them “BOTPAs” (standing for “Because of the Privacy Act”).  Organisations do something silly, and then blame it on data protection legislation.

There’s a nice recent example. A parcel was addressed to a 9 day old baby.  Initially the Royal Mail wouldn’t deliver it to her grandfather, apparently because the Data Protection Act required the baby to sign for it personally.  Not surprisingly, the ICO has confirmed that the Act does not require anything of the kind.

OFCOM & THE AGGREGATION OF PUBLIC INTEREST CONSIDERATIONS: UPDATE

November 9th, 2009 by Anya Proops

On 17 November 2009, the Supreme Court will hear the Information Commissioner’s appeal against the Court of Appeal’s judgment in Office of Communications v Information Commissioner [2009] EWCA Civ 90 (Ofcom). In Ofcom, the Court of Appeal held that, when multiple exceptions were engaged in respect of particular information, the public interest test provided for under regulation 12(1)(b) of the Environmental Information Regulations 2004 would operate so as to entitle the public authority to aggregate all the different public interest factors relating to all applicable exceptions in a single, compendious public interest balancing exercise. This judgment was controversial, not least because it represented a departure from the well-established approach of tailoring public interest considerations to the individual exception in issue. Notably, in a recent Information Tribunal decision, the Tribunal highlighted some of the practical difficulties posed by the adoption of the aggregate approach to the public interest test (South Gloucestershire v Information Commissioner (EA/2009/0032), §§48-52). 11KBW’s Clive Lewis and Akhlaq Choudhury will be appearing on behalf of the Commissioner in the Supreme Court.

ACCESSING LOCAL AUTHORITY INFORMATION UNDER THE AUDIT COMMISSION ACT 1998

November 9th, 2009 by Anya Proops

It is often thought by members of the public that the only way to access information relating to how local authorities are spending public monies is through the application of the Freedom of Information Act 2000. However, a recent judgment of the High Court has highlighted that such information may also be accessed in certain circumstances under another much less well known enactment, namely the Audit Commission Act 1998 (ACA). In summary, section 15 ACA permits ‘any person interested’ (e.g. local council tax payers) to inspect a local authority’s accounts and documents ‘relating to’ those accounts at the time of the authority’s annual audit.

In Veolia ES Nottinghamshire Ltd v Nottinghamshire CC & Ors [2009] EWHC 2382 (Admin), an inspection request was submitted to the Nottinghamshire CC by an interested person. The documents falling within the ambit of the request included a particular waste management contract which Veolia had entered into with the Council, along with invoices which Veolia had supplied to the Council under the contract. The Council decided that it was obliged to permit inspection of these documents under s. 15 ACA. Veolia challenged that decision by way of judicial review. Evidently, in mounting that challenge, Veolia was concerned that the information contained in the documents was commercially sensitive and should not therefore be permitted to enter the public domain under s. 15. Veolia’s case before the High Court was advanced principally on the basis that inspection should not be permitted under s. 15 as the contract and the invoices did not ‘relate to’ the local authority’s accounts. This argument was firmly rejected by Cranston J. He held that the words ‘relating to’ were sufficiently flexible that they could accommodate the documents in issue.

In reaching this conclusion, Cranson J evidently had in mind that the function of s. 15 is to enable interested persons to inspect documents which reveal precisely how the local authority is spending public monies. He concluded, in effect, that such a function would be frustrated if such persons could not consider the various contracts and invoices under which the local authority made payments to third parties.

It is apparent from the judgment in Veolia, that considerations relating to commercial sensitivity and confidentiality will not be relevant to the decision as to whether documents may be inspected under s. 15. This very generous approach to accessing commercial information under the ACA is to be contrasted with the more restrictive approach adopted under FOIA and the Environmental Information Regulations 2004 (see further the specific exemptions afforded under those enactments in respect of confidential and commercial information; and see also South Gloucestershire Council v Information Commissioner (EA/2009/0032) for a recent example of how these exemptions apply in practice – see further the post on this case). Veolia’s application for permission to appeal against Cranston J’s judgment is currently being considered by the Court of Appeal.

11KBW’s Michael Supperstone QC, Tim Pitt-Payne and Peter Oldham all appeared in the case.

 

Media Law and Practice – new book from OUP

October 30th, 2009 by Timothy Pitt-Payne QC

Hot off the press is a new book from OUP on “Media Law and Practice”, edited by David Goldberg, Gavin Sutter, and Ian Walden. 

This is a multi-author book, written by a team of practitioners and academics.  It covers a wide range of media topics, including ownership, regulation, intellectual property, defamation, and commercial communications.       

I contributed a chapter on Information Law:  this discusses data protection, freedom of information, and human rights issues, including articles 8 and 10 of the Convention.  One of the book’s features is that it deals with new forms of communication (including blogging), as well as traditional print or broadcast media.  So I had to address questions such as, how would the “special purposes” defined in the DPA (ie artistic, journalistic and literary purposes) apply to web-based publications?

The impetus for the book comes from the Institute of Computer and Communications Law, based in the Centre for Commercial Law Studies, Queen Mary, University of London.  All three editors are members of the Institute.  It’s a major centre for research and teaching in areas related to information law, including intellectual property, telecoms regulation, computer law, and media law.

The book is available online from OUP’s website.

Court of Appeal judgment on Police Database

October 21st, 2009 by James Goudie QC

On 19 October 2009, the Court of Appeal, in Chief Constable of Humberside Police v Information Commissioner (2009) EWCA Civ 1079, allowed police appeals against a decision of the IC, upheld by the IT, that data on old minor convictions (of which there are probably about 1 million) must be deleted from the Police National Computer (“the PNC”). The Court of Appeal held that retaining information for police operational needs in the fight against crime and for other purposes was justified and did not infringe the data protection principles (“the DPP”) under the DPA 1998, especially principles 3 (personal data shall not be excessive in relation to the purpose for which they are procured) and 5 (personal data shall not be kept for longer than is necessary).

Waller LJ, applying the approach from the Bichard Inquiry, following the Soham murders, said, at paragraph 43: “If the police say rationally and reasonably that convictions, however old or minor, have a value in the work they do that should, in effect, be the end of the matter.”

Carnwath LJ referred to the importance in a case of this kind having the involvement of a Judge with direct and hands-on experience of the criminal system. Hughes LJ, with direct hands-on experience of both the criminal and family systems, summarised the position as being that it is for the data controller to determine the purpose(s) for which the data is processed; it is not open to the IC to impose his own determination of those purposes; the imposition of a concept of ‘core police purposes’ was misconceived; and in any event the proper purposes of the police in managing the PNC plainly include the retention of information for provision to others who have a legitimate need for it.

Hughes LJ emphasized practical considerations and in particular the value, in the public interest, of the existence of a single comprehensive record of convictions and of its being held by police forces acting collectively. Hughes LJ said, at paragraph 107: “Like both Waller and Carnwath LJJ, I take the clear view that if senior police officers with considerable operational experience are satisfied that even very old and comparatively minor convictions may sometimes be of assistance in police investigations, then unless that view is perversely or unreasonably held, it is not open to the Commissioner to substitute his own view of their potential use. But I should also add that the opinion expressed by the police witnesses in this case entirely accords with what is seen to be true from time to time in major criminal investigations. As was in evidence in these proceedings, Dame Janet Smith also reached a similar conclusion when considering the investigation into Dr Shipman. Such old convictions, if never subsequently repeated, may very well not be the kind of material which it is proper to put before a jury, … but that does not begin to mean that they have not been of use in the investigation. Quite apart from propensity (or lack of it) to offend in a particular manner, they are likely to be useful for other reasons, of which location and associates are but two simple examples. Moreover, the critical consideration is not the use of the conviction standing by itself, but its potential value in conjunction with other information pieced together by a skilled detective.”

Hughes LJ further observed that many others depend heavily, and reasonably, on the maintenance by the police of these records. Those others include (but are not limited to) the criminal courts, the family courts and those concerned with the protection of children and the vulnerable. He said that the criminal courts have a plain need for reliable and comprehensive information. The Rehabilitation of Offenders Act 1974 is expressly made not to apply to criminal proceedings. There are at least two situations in which the need for such records arises daily. The first is in sentencing. The second relates to the credit of witnesses, especially those relied upon by the Crown. The Secretary of State for Justice expressed the view in this case that “providing anything less than full information to the courts would potentially undermine the criminal justice process”. Hughes LJ agreed.

Hughes LJ also stated that the importance of multi-agency working to child welfare in general, and to child-centred family proceedings in particular, has been recognised for many years, has been the repeated subject of judicial and ministerial exhortation alike, and is difficult to overstate. It is, nowadays, the daily norm of cases in the family courts. The Rehabilitation of Offenders Act 1974 is expressly made not to apply to these proceedings either. It may well be that at times such co-operation throws up difficult questions about the extent of disclosure which a police force ought to make to social services or other child welfare professionals, but that is not a reason for failing to have available a comprehensive record in order to make a fully-informed decision about it.

As regards the vetting of potential employees, Hughes J said that, given the statutory framework, it is plain that it is part of the necessary public purposes of the PNC that it maintain a complete record of convictions etc to enable the statutory scheme to work.

 

 

DISCLOSING CONSULTANTS’ REPORTS UNDER THE EIR

October 21st, 2009 by Anya Proops

Yesterday, the Information Tribunal promulgated an important decision on the application of certain exceptions in the Environmental Information Regulations 2004 (EIR), South Gloucestershire Council v Information Commissioner & Bovis (EA/2009/32). The case concerned an application made by a developer (Bovis) for disclosure of information contained in a number of consultants’ appraisals. The appraisals had been commissioned by the council in respect of a proposed section 106 planning agreement. The agreement in turn related to a major development which Bovis was proposing to undertake in the council’s area. The appraisals had been commissioned in essence in order to assist the council in its negotiations with Bovis in respect of the section 106 agreement. The council had refused disclosure of some of the information in the appraisals, which largely consisted of financial information, on the basis that that information fell within the exceptions provided for under r. 12(4)(e) EIR (the internal communications exception) and r. 12(5)(e) EIR (the confidential/commercial information exception). The Commissioner held that neither of these exceptions was engaged.

 

On appeal by the council, the Tribunal held that the circumstances of the case were such that the council had not been entitled to treat the appraisals as an ‘internal communication’ for the purposes of r. 12(4)(e) (cf. the Tribunal’s decision in Secretary of State for Transport v Information Commissioner (EA/2008/0052): draft report on transport policy prepared by independent third party was an ‘internal communication’, particularly in view of the extent to which the third party had been ‘embedded’ in the public authority). However, the Tribunal went on to allow the council’s appeal on the basis that the information in the appraisals did constitute confidential, commercial information falling within the ambit of r. 12(5)(e). The Tribunal also held that the public interest balance weighed in favour maintaining the exception and, accordingly, that the council had been lawfully entitled to withhold the requested information.

 

In reaching the conclusion that r. 12(5)(e) was engaged in respect of the information, the Tribunal rejected arguments advanced by the Commissioner that r. 12(5)(e) would only be engaged in respect of confidential information where the duty of confidence was owed by the public authority to a third party. It held that r. 12(5)(e) applied equally to the authority’s own confidential information. Notably, in finding that the public interest balance weighed in favour of the information being withheld, the Tribunal relied in particular on the volume of information which the council had already disclosed relating to the section 106 process and the planning process more generally.

Paying for the ICO

October 2nd, 2009 by Timothy Pitt-Payne QC

Organisations that process personal data must notify the Information Commissioner’s Office, and pay an annual fee. Up to now the fee has been £35, for all data controllers. With effect from 1st October 2009, some large data controllers will instead pay a fee of £500.

The changes are made by the Data Protection (Notification and Notification Fees) (Amendment) Regulations 2009 (SI 2009 No 1677). These divide data controllers into two groups: tier 1 organisations, which pay £35, and tier 2 organisations, which pay £500. All data controllers not in tier 2 are in tier 1.

A data controller will be in tier 2 if it satisfies the following three conditions: (i) it is not a charity or a small occupational pension scheme; (ii) it has been in existence for more than a month; and (iii) it has a turnover of £25.9 million or more for the data controller’s financial year and 250 or more members of staff, or it is a public authority with 250 or more members of staff. There are detailed provisions as to how turnover and staff numbers should be calculated for these purposes.

An explanatory memorandum issued by the Ministry of Justice gives the policy background to the change. Essentially it argues that large organisations cost more for the ICO to regulate, and so should pay a higher fee. The memorandum suggests that about 4% of data controllers will pay the higher fee, and that the extra annual income to the ICO will be about £4.7 million.

 A more interesting question perhaps – and one that the new Regulations do not affect at all – is who is obliged to notify the Information Commissioner. Anyone who uses a computer to process personal data is a data controller and obliged to notify, unless they are subject to an exemption. Under section 36 of the Data Protection Act 1998, personal data processed by an individual only for the purposes of that individual’s personal, family or household affairs (including recreational purposes) are exempt from the duty to notify (and indeed from most of the rest of the Act as well). This is sometimes referred to as the “domestic use”, or “Christmas card list” exemption: if you keep your family’s Christmas card list on a computer, you do not have to notify the ICO that you are processing personal data, and you can spend the £35 on something else instead.

But what if you put personal data on to the internet? The Lindqvist case in the European Court of Justice suggests that the domestic exemption would not apply here, because information posted on the internet is available to all the world. Since Lindqvist was decided, there has been an explosion of blogging, and social networking, all internet-based. How much of this activity would come within the domestic use exemption remains unclear.

 

 

Proving Identity and Privacy – Scottish Consultation Paper

September 2nd, 2009 by Anya Proops

The Scottish government has recently published a consultation paper on certain draft identity management and privacy principles. The draft principles have been developed with a view to ensuring that public services in Scotland are better placed to manage the process of proving identity (e.g. in the case of benefit claims) in a way that protects individual privacy. The deadline for responses is 23 November 2009

GOVERNMENT REPORT ON APPLICATION OF ENVIRONMENTAL INFORMATION DIRECTIVE

August 14th, 2009 by Anya Proops

Member States of the EU are subject to an obligation to report to the European Commission on the application of European Directive 2003/4/EC on public access to environmental information. Last week, the UK Government submitted its report to the Commission. The report highlights the Government’s experience of the application of the Environmental Information Regulations 2004 since they came into force in the UK on 1 January 2005. It is worth noting in particular Annex 1 to the report which contains a summary of tribunal decisions on the definition of ‘environmental information’ for the purposes of the Regulations. The Government is inviting comments on the report from members of the public.