DATA RETENTION

December 6th, 2010 by James Goudie QC

The Data Retention Directive (Directive 2006/24/EC) requires public electronic communications providers (telephone companies, mobile telecoms, Internet service providers) to retain traffic, location and subscriber data for the purpose of the investigation, detection and prosecution of serious crime. The Directive has been undergoing an evaluation process that seeks to assess its application by Member States, and its impact on businesses and consumers. The aim is also to establish whether the Directive is proportionate in relation to the law enforcement benefits it yields, the costs for the market, and the impact on fundamental rights, in particular the rights to privacy and the protection of personal data.

The Commission held a Conference on the Directive in Brussels on 3 December 2010.  Cecilia Malmström, the Member of the Commission responsible for Home Affairs, made four points: (1) the retention of data is useful for fighting crime; (2) the Directive is implemented in different ways in the Member States, especially as regards retention periods; (3) clearer rules are needed, including in relation to compensation for costs; and (4) there is no evidence of serious abuse.

At the Conference Peter Hustinx, the European Data Protection Supervisor (EDPS), strongly argued in favour of seizing the opportunity of the ongoing evaluation process to demonstrate the necessity and justification for the Directive. The EDPS emphasised once again that the retention of traffic and location data of all persons in the EU, whenever they use the telephone or the Internet, is a huge interference with the right to privacy of all citizens. As such, the EDPS regards the Directive as the most privacy invasive instrument ever adopted by the EU in terms of scale and the number of people it affects. Such a massive invasion of privacy needs profound justification. The EDPS therefore called on the Commission to use the evaluation exercise to prove the necessity for the Directive and its proportionality. The EDPS further insisted on the fact that the Directive clearly failed to harmonise national legislation. Significant discrepancies between the implementing laws of the EU Member States have led to legal uncertainty for citizens. It has also resulted in a situation where the use of the retained data is not strictly limited to the combat of really serious crimes. According to the EDPS, a new or modified EU instrument on data retention should be clear about its scope and create legal certainty for citizens. This means that it should also regulate the possibilities for access and further use by law enforcement authorities and leave no room for the Member States to use the data for additional purposes.

James Goudie QC

EU/US Cooperation

December 6th, 2010 by James Goudie QC

EU Justice Ministers have approved the start of talks between the EU and the US on a personal data protection agreement when cooperating to fight terrorism or crime. The stated aim is to ensure a high level of protection of personal information like passenger data or financial information that is transferred as part of transatlantic cooperation in criminal matters. Once in place, the agreement would enhance citizens’ right to access, rectify or delete data when it is processed with the aim to prevent, investigate, detect or prosecute criminal offences, including terrorism. Vice-President Viviane Reding, the EU’s Justice Commissioner, said: “Today’s decision gives us the green light to negotiate a solid and coherent agreement with the United States which balances enforceable rights for individuals with the strong cooperation we need to prevent terrorism and organised crime. I look forward to meeting my US counterparts in Washington next week to kick start these important negotiations.” The EU and US have different approaches in protecting personal data, leading to some controversy in the past when negotiating information exchange agreements (such as the Terrorist Finance Tracking Programme or Passenger Name Records). The purpose of the negotiations is also to address and overcome these differences.  The mandate aims to achieve an agreement which provides for a coherent and harmonised set of data protection standards including essential principles such as proportionality, data minimisation, minimal retention periods and purpose limitation; contains all the necessary data protection standards in line with the EU’s existing data protection rules, such as enforceable rights of individuals, administrative and judicial redress or a non-discrimination clause; and ensures the effective application of data protection standards and their control by independent public authorities.

The agreement would not provide the legal basis for any specific transfers of personal data between the EU and the US. A specific legal basis for such data transfers would always be required. The new EU-US data protection agreement would then apply to these data transfers.

James Goudie QC

A Language you Understand

December 6th, 2010 by James Goudie QC

EU Justice Ministers have agreed on a “Letter of Rights” proposed by the Commission.  Once voted upon by the European Parliament, this will provide that suspects will have to be informed in writing of their rights in a language they understand.  Anyone arrested, or the subject of a European Arrest Warrant, will have to be given, whether they ask for it or not, and translated if necessary, the Letter of Rights, listing their basic rights, in simple, everyday language, ie their rights to a lawyer, to be informed of the charge, to interpretation and translation, and to be brought promptly before a Court following arrest, and giving practical details. The Lisbon Treaty enables the EU to adopt measures to strengthen the rights of EU citizens, in line with the EU Charter of Fundamental Rights, particularly the rights of individuals in criminal procedures. The right to a fair trial and defence are set out in Articles 47 and 48 of the EU Charter of Fundamental Rights; as well as in Article 6 of the ECHR.

James Goudie QC

Police Reform and Social Responsibility Bill

December 6th, 2010 by James Goudie QC

The Police Reform and Social Responsibility Bill (the Bill), introduced in the House of Commons on 30 November 2010, is replete with requirements for the provision of information.  The Bill is primarily, but by no means exclusively, concerned with police reform.  Part 1 of the Bill contains provisions to abolish police authorities (excluding the City of London) and replace them with directly elected Police and Crime Commissioners for each police force outside London, and the Mayor’s Office for Policing and Crime for the Metropolitan Police.  Police and Crime Commissioners will be responsible for holding the chief constable of their police force to account for the full range of their responsibilities. The chief constable will retain responsibility for the direction and control of the police force. Part 1also contains provisions for establishing Police and Crime Panels for each police area. The role of the Police and Crime Panel will be to advise and scrutinise the work of the police and crime commissioner.

Part 1 states the basic duties of a police and crime commissioner. These include publishing a police and crime plan, setting the local police and crime objectives, and setting the local precept and annual force budget (including contingency reserves) in discussion with the chief constable. Provisions are also included in Part 1 for police and crime commissioners to appoint, suspend and dismiss the chief constable of their police force. The appointment of all other officers will remain a matter for the chief constable. Part 1 also contains provisions for the first and subsequent elections of police and crime commissioners.  Police and crime commissioners will hold office for four years and can only hold office for a maximum of two terms. The two terms need not be consecutive.

Clause 11 of the Bill imposes obligations on a police and crime commissioner and the Mayor’s Office for Policing and Crime in relation to the publication of information. Subsections (1) and (6) allow the Secretary of State to specify by order information which a police and crime commissioner and the Mayor’s Office for Policing and Crime must publish, and also to specify the time and manner of publication. It is anticipated that this power will be used to ensure the publication of standard information as to numbers of staff and the rates of their pay, items of expenditure above a specified monetary limit, and any gifts or loans received. Subsection (2) requires a police and crime commissioner and the Mayor’s Office for Policing and Crime to publish such further information as is necessary to allow local people to assess the performance of the body itself and also that of the chief officer of police for the police area (either the chief constable or, in the metropolitan police district, the Commissioner).

Clause 12 requires a police and crime commissioner and the Mayor’s Office for Policing and Crime to produce an annual report.  Subsection (1) requires an annual report to show, in respect of the financial year in question, how the police and crime commissioner or the Mayor’s Office for Policing and Crime has carried out his functions and the progress made in meeting the objectives in the police and crime plan. Subsections (2) to (5) make provision for the police and crime panel to scrutinise the annual report. Subsections (6) and (7) require a police and crime commissioner and the Mayor’s Office for Policing and Crime to publish each annual report in such manner as he thinks fit. Subsection (8) allows a police and crime commissioner and the Mayor’s Office for Policing and Crime to produce reports other than the annual report.

Clause 13 allows a police and crime panel to require its police and crime commissioner or (in the case of the metropolitan police district, the Mayor’s Office for Policing and Crime) to provide it with information.  Subsection (1) requires a police and crime commissioner or the Mayor’s Office for Policing and Crime to provide the police and crime panel with any information they reasonably require in order to carry out their duties. Subsection (2) excludes from the requirement under subsection (1) information which, in the view of the chief constable it would be harmful to disclose for various reasons set out in the subsection. This does not prevent the disclosure of the information to the police and crime panel; it means that the police and crime commissioner or the Mayor’s Office for Policing and Crime is not required to disclose it.

Clause 88 makes the chief inspector of constabulary (and thus the inspectors) subject to the duties under the Freedom of Information Act 2000 to confirm that requested information is held, and to provide it.

James Goudie QC

PARTIES MAY APPEAL AGAINST DECISION NOTICES IN THEIR FAVOUR

December 2nd, 2010 by Robin Hopkins

Shepard v IC and West Sussex County Council (GIA/1681/2010) involved the Commissioner upholding the appellant’s complaint against the local authority, and issuing a decision notice in his favour. That notice required the authority to search for specified information and to provide it to the Claimant if found. The authority informed the appellant that its search had been fruitless. Apparently therefore, it had complied with the decision notice, but the appellant received no information.

At first instance, his appeal failed, partly on the grounds of the well-established principle that a successful party should not be permitted to bring an appeal. The Upper Tribunal disagreed, and granted permission to appeal, observing that the aforementioned principle “surely relates to judicial decisions by courts and tribunals; it does not necessarily apply to decisions by administrative first-instance decision-makers or independent office-holders”.

Nor was the wording of FOIA itself a barrier to such appeals: section 57(1) expressly confers a right of appeal on both parties, and not simply “the losing party”. Furthermore, both the steps prescribed in a decision notice and the timing of such steps are matters of discretion for the Commissioner. Unlike the enforcement of a decision notice, such questions of discretion are within the Tribunal’s jurisdiction.

It is not clear, however, whether a challenge to a first-instance Tribunal’s refusal to entertain an appeal lies by way of an appeal to the Upper Tribunal or by way of judicial review. A test case (combined references of CH/1758/2009 and JR/2204/2009) will determine this question shortly. In the present case, the Upper Tribunal therefore granted permission to apply for judicial review as a precaution.

TRIBUNAL’S STRIKE-OUT OF ‘ACADEMIC’ APPEALS

December 2nd, 2010 by Robin Hopkins

In Edwards v IC and the Ministry of Defence (EA/2010/0056), the Tribunal has exercised its power to strike out a party’s case under Tribunal Procedure (First-Tier Tribunal) (GRC) Rules 2009. This was done partly on a lack of reasonable prospects of success, and partly on jurisdictional grounds: some of the appellant’s grounds of complaint invited the Tribunal to “monitor or influence” the way in which the Commissioner had carried out his statutory duties, or the way in which the public authority had done so. The Tribunal has no jurisdiction over such matters. 

Perhaps more interestingly, this was a case where the appeal was in effect academic, as the requested material had already been given to the appellant. The grounds on which a Tribunal may strike out an appeal are contained in rule 8(3) of the 2009 Rules: lack of reasonable prospect of success, non-compliance with an order or failure to co-operate with the Tribunal “to such an extent that the Tribunal cannot deal with the proceedings fairly and justly”.

At first glance, it is not obvious how any of those three exhaustive categories accommodate appeals which have become academic due to events post-dating the handling of the relevant request. The Tribunal in Edwards has provided its answer. The key provision is rule 8(3)(b), which concerns the fair and just dealing with proceedings. By rule 2(2) of the 2009 Rules, this includes considerations of proportionality, costs and resources. Rule 5 empowers the Tribunal to regulate its own procedure. In particular, rule 5(2) allows it to give a direction in relation to the conduct or disposal of proceedings at any time.

The combination of rules 2 and 5 can therefore suffice to engage rule 8(3)(b) and support a strike-out even where questions of jurisdiction or lack of reasonable prospects of success are not in play.

BACKDOOR ATTEMPT TO OBTAIN IRAQ WAR CABINET MINUTES FAILS

December 2nd, 2010 by Robin Hopkins

The minutes of the Cabinet meetings at which it was decided to go to war in Iraq have resurfaced for consideration by the Tribunal. First time round, the Tribunal agreed with the Commissioner that the minutes should be released, but the final word went to Jack Straw, by means of a ministerial veto – which was not subject to a judicial review challenge – issued under section 53 FOIA.

The requester in that case subsequently sought a backdoor route to the minutes, by requesting them under FOIA from the ICO itself. He also sought “background papers which show the processes of thought behind the Information Commissioner’s conclusion that the Cabinet minutes in question should be disclosed”. The ICO did not hold the minutes themselves, but it did hold some handwritten notes made by the then Commissioner, Richard Thomas, and by an ICO caseworker when visiting the Cabinet Office to inspect the minutes. It also held a confidential annex to the Decision Notice, which fell within the veto. All of these he refused to disclose.

The usual FOIA complaints and appeals process ensued, with the Commissioner issuing a decision notice in respect of his own refusal, and then defending that notice before the Tribunal in Lamb v IC (EA/2009/0108).

The basis of the refusal was section 44 FOIA, which provides that information is exempt if its disclosure is “prohibited by or under any enactment”. The Commissioner relied for the latter on section 59 of the DPA, which says that the Commissioner may not disclose information he obtained under the auspices of the Act “unless the disclosure is made with lawful authority”, which arises where “having regard to the rights and freedoms or legitimate interests of any person, the disclosure is necessary in the public interest”.

As the Tribunal accepted, this is a much higher threshold than the usual public interest test under FOIA: under section 59, there is effectively a presumption against disclosure.

The Tribunal was satisfied that this information was “obtained from” the Cabinet Office, notwithstanding the Appellant’s challenge on that point.

It also agreed with the Commissioner’s application of section 59. Much of the Appellant’s argument turned on the importance of the material he sought. This, said the Tribunal, overlooked the point that the Commissioner had already decided in the Appellant’s favour concerning the Cabinet minutes which he sought. The Tribunal also commented that:

“It is no part of the freedom of information regime to provide a mechanism by which a party who prosecuted a successful complaint to the Information Commissioner in the past may have his or her winning margin reassessed in the light of events subsequent to the date of the original victory”.

The Tribunal did not comment on whether the mere existence of the veto gave rise to the engagement or effectiveness of section 59. Nor did it speculate as to the circumstances in which reliance on section 59 could be defeated – although the wording of that section clearly envisaged this prospect.

COST OF COMPLYING WITH A REQUEST: NO DUTY TO SEARCH UP TO THE COST LIMIT

December 1st, 2010 by Robin Hopkins

Cooksey v ICO and Chief Officer of Greater Manchester Police (EA/20100113) is the Information Tribunal’s latest application of the ‘cost of compliance’ “exemption” at section 12 of FOIA.

The case concerned a request in six severable parts for information concerning documents from a murder investigation undertaken between1992 and 1995. The material from that investigation was stored in entirely disorganised boxes – a state of affairs which the Tribunal found “astonishing”. This disorganisation gave rise to the engagement of section 12. Notably, the Commissioner had examined a sample of the material and produced his own cost estimate which was lower than that advanced by the public authority. The Tribunal was satisfied that section 12 was engaged on the basis of the Commissioner’s estimate – but not that of the public authority.

The Appellant argued that the boxes should have been searched up to the costs limit, given that any information found in relation to her request, even if only partial, would be useful. The Tribunal rejected this approach to section 12: if the costs limit is engaged, the effect of section 12 is to disapply altogether the duty to comply with the information request.

The Tribunal also found that the margin of difference between the compliance estimate and the costs limit is a relevant consideration “in these circumstances”.

Interestingly, the Tribunal further noted that the boxes had been numbered after receipt of the request for information, for purposes of transportation. This, the Tribunal suggested, constituted a change in the way that information was organised which might allow for differently constituted information requests to be made, relying on the box numbers as a way of targeting those requests.

STOLEN PRIVATE AND CONFIDENTIAL INFORMATION

November 30th, 2010 by James Goudie QC

In KJH v HGF [2010] EWHC 3064 (QB) Sharp J held that it was appropriate to continue an interim injunction and grant anonymity to protect the victim of blackmail which involved the threat of the revelation of stolen private and confidential information.  The evidence established to a high degree of probability that H was the victim of blackmail involving the threat of the revelation of stolen private and confidential information.  H was therefore likely to establish at trial that publication of the information should not be allowed.  There had also been no waiver of H’s privacy rights and there was no public interest justification for the publication of the information. The privacy interests engaged and the claim in breach of confidence were strong.  There was also a continuing risk that the private and confidential information stolen from H would be made public.  Strong public policy considerations which justified the protection of the identity of victims of blackmail arose in criminal and civil proceedings: such persons should not be deterred from seeking the courts’ protection for fear that the information which the blackmailer had threatened to reveal would be exposed or that their identity as the victim of blackmail would be made known.  A final determination of the matter had to await trial, granting anonymity at the interim stage served the interest of such an applicant in protecting his or her rights under ECHR Art 8 and the public interest in promoting the prevention and punishment of blackmail.  As a result it had also been necessary to derogate from the principle of open justice by holding the hearing in private and to anonymise the names of H and F.

James Goudie QC

WATER UTILITY COMPANIES NOT ‘PUBLIC AUTHORITIES’ UNDER THE EIR

November 25th, 2010 by Anya Proops

The Upper Tribunal has this week handed down an important decision on the question of whether privatised water utility companies are ‘public authorities’ for the purpose of the Environmental Information Regulations 2004 (EIR): Smartsource v IC & 19 Water Companies (case no. GI/2458/2010). The background to the appeal was that Smartsource had submitted near identical requests for disclosure of information to some 19 water utility companies. It was not in dispute that the requests fell to be addressed under the EIR. The companies refused to provide the requested information on the basis that they were not ‘public authorities’ for the purposes of r. 2(2) EIR and, hence, were not subject to the disclosure obligations provided for in r. 5 EIR. The Commissioner rejected Smartsource’s complaint about the refusal on the basis that he accepted that the companies were not public authorities under r. 2(2). Smartsource appealed the Commissioner’s decision to the tribunal. The importance of the issues at stake in the case resulted in the appeal being transferred to the Upper Tribunal. The central issues which the Upper Tribunal was called upon to determine were as follows: (1) did the companies ‘carry out functions of public administration’ such that they fell within limb 2(2)(c) of the r. 2 definition of public authority; (2) alternatively, were they ‘under the control’ of a relevant public authority such that they fell within limb 2(2)(d) of the r. 2 definition.

With respect to the first issue, the Tribunal held that the companies did not carry out functions of public administration. It reached this conclusion applying a multifactoral approach akin to the approach adopted in the earlier cases of Network Rail v IC (EA/2006/0061) and Port of London Authority v IC & Hibbert (EA/2006/0083). Notably, the Tribunal rejected arguments advanced by Smartsource that the companies fell within limb 2(2)(d) of the definition because they: were appointed as statutory undertakers; were subject to a range of conditions imposed under statute; were subject to a comprehensive regulatory regime; were unable to choose their own customers or set their own prices; were obliged to provide a universal service; and would be subject to State intervention in the event that they failed. With respect to the second issue, the Tribunal held that that the companies were not ‘under the control’ of a relevant public authority for the purposes of r. 2(2)(d). In reaching this conclusion, the Tribunal accepted arguments advanced on behalf of the Commissioner and the companies that: the concept of ‘control’ in this context meant something more than that the body in question was merely subject to a stringent regime of statutory regulation; the aim of r. 2(2)(d) was to capture State/Executive functions in all their various guises and not the activities of privatised companies of the sort which were in issue in the instant case.

Importantly, the Tribunal also rejected ‘hybridity’ arguments to the effect that a body can be a public authority under the EIR for some purposes but not for others. According to the Tribunal, the way in which r. 2 was formulated meant that the body either was or was not a public authority (cf. the approach adopted in Port of London v IC).