How to apply the DPA

January 15th, 2015 by Robin Hopkins

Section 40 of FOIA is where the Freedom of Information Act (mantra: disclose, please) intersects with the Data Protection Act 1998 (mantra: be careful how you process/disclose, please).

When it comes to requests for the disclosure of personal data under FOIA, the DPA condition most commonly relied upon to justify showing the world the personal data of a living individual is condition 6(1) from Schedule 2:

The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

That condition has multiple elements. What do they mean, and how do they mesh together? In Goldsmith International Business School v IC and Home Office (GIA/1643/2014), the Upper Tribunal (Judge Wikeley) has given its view. See here Goldsmiths. This comes in the form of its endorsement of the following 8 propositions (submitted by the ICO, represented by 11KBW’s Chris Knight).

Proposition 1: Condition 6(1) of Schedule 2 to the DPA requires three questions to be asked:

(i) Is the data controller or the third party or parties to whom the data are disclosed pursuing a legitimate interest or interests?

(ii) Is the processing involved necessary for the purposes of those interests?

(iii) Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?

Proposition 2: The test of “necessity” under stage (ii) must be met before the balancing test under stage (iii) is applied.

Proposition 3: “Necessity” carries its ordinary English meaning, being more than desirable but less than indispensable or absolute necessity.

Proposition 4: Accordingly the test is one of “reasonable necessity”, reflecting the European jurisprudence on proportionality, although this may not add much to the ordinary English meaning of the term.

Proposition 5: The test of reasonable necessity itself involves the consideration of alternative measures, and so “a measure would not be necessary if the legitimate aim could be achieved by something less”; accordingly, the measure must be the “least restrictive” means of achieving the legitimate aim in question.

Proposition 6: Where no Article 8 privacy rights are in issue, the question posed under Proposition 1 can be resolved at the necessity stage, i.e. at stage (ii) of the three-part test.

Proposition 7: Where Article 8 privacy rights are in issue, the question posed under Proposition 1 can only be resolved after considering the excessive interference question posted by stage (iii).

The UT also added this proposition 8, confirming that the oft-cited cases on condition 6(1) were consistent with each other (proposition 8: The Supreme Court in South Lanarkshire did not purport to suggest a test which is any different to that adopted by the Information Tribunal in Corporate Officer).

Those who are called upon to apply condition 6(1) will no doubt take helpful practical guidance from that checklist of propositions.

Robin Hopkins @hopkinsrobin

Tags: , , , , ,
Posted in INFORMATION LAW | Comments Off on How to apply the DPA

Facebook, FOI and children

August 6th, 2014 by Robin Hopkins

The Upper Tribunal has got its teeth into personal data disputes on a number of occasions in recent months – Edem was followed by Farrand, and now Surrey Heath Borough Council v IC and Morley [2014] UKUT 0330 (AAC): Morley UT decision. Panopticon reported on the first-instance Morley decision in 2012. In brief: Mr Morley asked for information about members of the local authority’s Youth Council who had provided input into a planning application. The local authority withheld the names of the Youth Councillors (who were minors) under s. 40(2) of FOAI (personal data). In a majority decision, the First-Tier Tribunal ordered that some of those names be disclosed, principally on the grounds that it seemed that they appeared on the Youth Council’s (closed) Facebook page.

The local authority and the ICO challenged that decision. The Upper Tribunal (Judge Jacobs) has agreed with them. He found the dissenting opinion of the First-Tier Tribunal member to have been the more sophisticated (as opposed to the overly generalised analysis of the majority) and ultimately correct. The Youth Councillors’ names were correctly withheld.

In his analysis of the First Data Protection Principle, Judge Jacobs was not much bothered by whether fairness or condition 6(1) (the relevant Schedule 2 condition) should be considered first: “the latter is but a specific instance of the former”.

Judge Jacobs found that there was no sufficient interest in the disclosure of the names of the Youth Councillors. He also rejected the argument that, by putting their names on the relevant Facebook page, the data subjects had implicitly consented to public disclosure of their identities in response to such a FOIA request.

Judge Jacobs stopped short, however, of finding that the personal data of minors should never be disclosed under FOIA, i.e. that the (privacy) interests of children would always take precedence over transparency. Maturity and autonomy matter more than mere age in this context, and sometimes (as here) minors are afforded substantial scope to make their own decisions.

Morley is an important case on the intersection between children’s personal data and transparency, particularly in the social media context, but – as Judge Jacobs himself observed – “it is by no means the last word on the subject”.

There were 11KBW appearances by Joseph Barrett (for the local authority) and Heather Emmerson (for the ICO).

Robin Hopkins @hopkinsrobin

Tags: , , , , ,
Posted in INFORMATION LAW | Comments Off on Facebook, FOI and children

New from the Upper Tribunal: DWP work programmes, personal data. And security service algebra.

July 23rd, 2014 by Robin Hopkins

The Upper Tribunal has handed down a number of FOIA decisions in recent days. I refrain from comment or analysis, given my involvement in the cases (hopefully someone else from the Panopticon fold will oblige before long), but I post the judgments here for those who wish to read for themselves.

In DWP v IC and Zola [2014] UKUT 0334 (AAC), the Upper Tribunal dismissed the DWP’s appeal against this First-Tier Tribunal decision. The disputed information is a list of the identities of companies, charities and other organisations who host placements through the DWP’s work programmes for job seekers. Zola determination 21.07.14

In Farrand v IC and London Fire and Emergency Planning Authority [2014] UKUT 0310 (AAC), the Upper Tribunal dismissed an appeal concerning a report into a fire in a London flat, on the grounds that the requested information was the occupant’s personal data and no condition from Schedule 2 to the DPA was met. The decision discusses Common Services Agency and identification, legitimate interests, necessity and fairness. Farrand UT

Third, in Home Office v IC and Cobain (GIA/1722/2013), the Upper Tribunal has issued an interim decision allowing the appeal. This case concerns this problem: x + y = z, where z is a publicly known number, x is non-exempt information but y is exempt information (in this case, on section 23 grounds – security service information). Normally, the requester is entitled to non-exempt information, but here the automatic effect of disclosure would be to reveal the exempt information. What to do about this? As I say, an interim decision which I don’t analyse here. Have a go at the security service algebra yourself.

Robin Hopkins @hopkinsrobin

Tags: , , , , , ,
Posted in INFORMATION LAW | Comments Off on New from the Upper Tribunal: DWP work programmes, personal data. And security service algebra.

FOIA disclosures: ‘motive blindness’ and risks to mental health

February 26th, 2014 by Robin Hopkins

Some FOIA ‘mantras’ frustrate requesters, such as judging matters as at the time of the request/refusal, regardless of subsequent events. Others tend to frustrate public authorities, such as ‘motive blindness’. A recent Tribunal discusses and illustrates both principles – in the context of the distress (including a danger to mental health) likely to arise from disclosure.

The background is that a certain pupil referral unit (PRU) in County Durham was the subject of complaints; 13 of its 60 staff had been suspended. An independent investigation team reported in November 2012. Later in that same month, the Council received a FOIA request for a copy of the investigators’ report. At that time, disciplinary proceedings were pending against each of the suspended members of staff. Those proceedings were to be conducted on a confidetial basis.

The Council refused the request, relying on section 31 (prejudice to conduct of function for purpose of ascertaining any improper conduct), section 40 (personal data) and 38 (health and safety). The ICO agreed, and so has the Tribunal, dismissing the requester’s appeal in Hepple v IC and Durham County Council (EA/2013/0168).

The Tribunal confirmed that, notwithstanding the appellant’s practical arguments to the contrary, it had to judge matters as they stood at the time of the Council’s refusal of the request (paras 4-7).

Section 31 was engaged: “We are satisfied, having read the Report in full, that disclosure in full would have given rise to a perception of unfairness and pre-judgement that would have prejudiced the disciplinary proceedings. Those deciding the complaint might have avoided being prejudiced but the perception of a disinterested third party would have been that the staff member’s right to a fair hearing had been undermined, particularly if publication had attracted media comment” (para 14). The public interest favoured maintaining the exemption.

Reliance on section 40(2) was upheld: the unwarranted interference to the data subjects prevailed over public interest arguments. The comparative balance may have shifted slightly since the date of the refusal, but that was not the relevant time for the purposes of the appeal.

Reliance on section 38 was also upheld. This exemption for health and safety (here, danger to mental health) seldom surfaces in FOIA caselaw. Here it was upheld, largely because the requester himself had sent certain text messages (for which he was later apologetic) to some of the individuals involved. The Tribunal “drew the clear impression that the texts had been transmitted with the purpose of menacing those whose addresses the Appellant had acquired” (para 37).

Those text messages were sent after the refusal of the request, but the Tribunal was satisfied that they evidenced a state of mind likely to have existed at the relevant time. As to ‘motive blindness’, the Tribunal said that “assessing an information request on this “motive blind” basis ought not to prevent us from considering the potential risk to safety posed by the requester him/herself”.

‘Motive blindness’ may be something of a mantra in FOIA cases, but – as with vexatious request cases – it is a principle which should be applied with appropriate nuance.

Robin Hopkins @hopkinsrobin

Tags: , , , , , ,
Posted in INFORMATION LAW | Comments Off on FOIA disclosures: ‘motive blindness’ and risks to mental health

Personal data and fitness to practice investigations – Tribunal overturns ‘neither confirm nor deny’ position

January 17th, 2014 by Robin Hopkins

When an identifiable individual has been the subject of a formal complaint about their competence or conduct, that fact constitutes their personal data. In terms of privacy/publicity decisions, such situations are often approached in this way: where the complaint is well founded or at least merits serious consideration, publication is warranted, but otherwise confidentiality is maintained, lest unjustified aspersions be cast against that person.

In that respect, the process outlined by the Tribunal in Foster v IC (EA/2013/0176) – which concerned a complaint to the Nursing & Midwifery Council – is typical:

“The complaints procedure administered by the NMC has two stages. The first stage is designed to determine whether or not the matter should be referred to the NMC’s Fitness to Practice Panel. If it is, then the Panel will meet in public and its decision will be made publicly available. But if the complaint does not proceed beyond the first stage, (either because a decision is made not to investigate or because the NMC’s Investigating Committee Panel concludes that the complaint does not justify a reference to the Fitness to Practice Panel), then the process remains confidential. The rationale appears to be that an individual’s professional reputation should not be undermined by the publication of allegations that are found not to have sufficient merit to justify being referred to the Fitness to Practice Panel”.

The Appellant, whose son died following his participation in a drug trial, considered that the NMC investigation in this case – which did not pass the first stage – may have been inadequate. She asked for information about its investigation into her complaint about a named practitioner.

The NMC adopted a ‘neither confirm nor deny’ position under section 40(5), i.e. it considered that to say whether or not it held information on a complaint about this individual would be to tell the world at large whether or not that person had been the subject of a professional complaint of this description. The ICO agreed, but the Tribunal overturned that decision, ordering the NMC to confirm or deny whether it held the requested information.

In reaching that view, the Tribunal – while not passing judgment on the merits of the complaint or the NMC’s investigation – considered the criticisms that had been made:

“If it were to be the case that any member of the care team had realised the error earlier, but had not raised the alarm until after its very sad consequences had become clear, then there would seem to us to be strength in the Appellant’s argument that the evidential basis for the decision of the NMC’s Investigating Committee Panel required investigation”.

In those circumstances, the Tribunal thought the fairness balance favoured confirming or denying whether the requested information was held:

“In reaching that conclusion we reject the Information Commissioner’s argument that it is always unfair, and therefore in breach of the Data Protection Principles, to make a statement that discloses the existence of a complaint of professional misconduct against an individual, where there has been no finding of wrongdoing or malpractice. That would create an inflexible test which prevented all relevant circumstances being taken into account. Nor do we accept the Information Commissioner’s argument that the limited degree of disclosure involved in a “confirm or deny” response would constitute unwarranted interference into X’s privacy, without satisfying a legitimate public interest in disclosure”.

Public authorities who routinely adopt a default ‘neither confirm nor deny stance’ of the type outlined at the start of this post will wish to note that, at least in some circumstances, that approach can be called into question.

Robin Hopkins @hopkinsrobin

Tags: , , ,
Posted in INFORMATION LAW | Comments Off on Personal data and fitness to practice investigations – Tribunal overturns ‘neither confirm nor deny’ position

Data protection: trends, possibilities and FOI disclosures

April 29th, 2013 by Robin Hopkins

At 11KBW’s information law seminar in May, one of the discussion topics was ‘the future of data protection’. Here are some further thoughts on some interesting trends and developments.

Progress at the EU level

A major issue on this front is of course progress on the draft EU Data Protection Regulation – on which see this blog post from the ICO’s David Smith for an overview of the issues currently attracting the most debate. While that negotiation process runs its course, the Article 29 Working Party continues to provide influential guidance for users and regulators on some of the thorniest data protection issues. Its most recent opinion addresses purpose limitation, i.e. the circumstances under which data obtained for one purpose can be put to another. A summary of its views is available here.

Subject access requests

Turning to domestic DPA litigation in the UK, practitioners should watch out for a number of other developments (actual or potential) over the coming months. On the subject access request front, for example, data controllers have tended to take comfort from two themes in recent judgments (such as Elliott and Abadir, both reported on Panopticon). In short, the courts in those cases have agreed that (i) data controllers need only carry out reasonable and proportionate searches, and (ii) that section 7(9) claims being pursued for the collateral purpose of aiding other substantive litigation will be an abuse of process.

Data controllers should, however, note that neither of those points is free from doubt: there are plenty who doubt the legal soundness of the proportionality point, and the abuse of process point has arisen for section 7(9) claims to the court – it should not, in other words, be relied upon too readily to refuse requests themselves.

Damages

Damages under section 13 of the DPA is another area of potentially important change. The Halliday v Creation Consumer Finance case (briefly reported by Panopticon) has been given further discussion in the Criminal Law & Justice Weekly here. Based on that information, perhaps the most interesting point is this: defendants have rightly taken comfort from the requirement under section 13 that compensation for distress can be awarded only where damage has also been suffered. In Halliday, however, nominal damages (of £1) were awarded, thereby apparently fulfilling the ‘damage’ requirement and opening the door for a ‘distress’ award (though note that Panopticon has not yet seen a full judgment from the Court of Appeal in this case, so do not take this as a definitive account). If that approach becomes standard practice, claimants may be in much stronger positions for seeking damages.

A further potential development on the damages front arises out of monetary penalty notices: data controllers who are subject to hefty penalties by the ICO may in some cases also find themselves facing section 13 claims from the affected data subjects themselves, presenting a worrying prospect of paying out twice for the same mistake.

Disclosure of personal data in the FOIA context

In general terms, requesters struggle to obtain the personal data of others through FOIA requests. A couple of very recent decisions have, however, gone the other way.

In White v IC and Carmarthenshire County Council (EA/2012/0238), the First-Tier Tribunal allowed the requester’s appeal and ordered disclosure of a list of licensed dog-breeders in the council’s area. In particular, it concluded that (paragraphs 21-23):

“…the Tribunal believes – on the facts of this case – that an important factor for any assessment in relation to the “fairness” of the disclosure of the personal data is best discovered from the context in which the personal data was provided to the Council in the first place.

22. The context, here, is to secure a commercial licence required by law to breed dogs. That license is necessary for the local authority to know who the licensed dog breeders in that area are, and so that the law can be enforced and welfare checks can be conducted as and when necessary in relation to the welfare of the dogs being bred commercially.

23. Licensing – in the ordinary course of things – is a public regulatory process. Indeed it was a public process in Carmarthenshire, in relation to the information that is at the core of this appeal, until the Council changed its policy in 2008.”

The Tribunal was unimpressed by the suggestive language of a survey of dog breeders which the council had carried out to support its case for non-disclosure. It also noted that a neighbouring council had disclosed such information.

The First-Tier Tribunal issued its decision in Dicker v IC (EA/2012/0250) today. It allowed the requester’s appeal and ordered disclosure of the salary of the chief executive of the NHS Surrey PCT over specified time periods, including total remuneration, expenses allowance, pension contributions and benefit details. As to legitimate interests in disclosure, the Tribunal said that (paragraph 13):

“In this case the arrangements (including secondment and recharge from another public authority at one stage) mean that the arrangements are not as transparent as might be wished and it is not entirely clear from the information published (as opposed to the assurances given) that the national pay guidance has been complied with. Mr Dicker asserted that the CEO was paid in excess of the national framework. The Tribunal was satisfied that there was a legitimate public interest in demonstrating that the national framework had been complied with and that the published information did not properly establish this”.

On the questions of distress and privacy infringements, the Tribunal took this view (paragraph 14):

“The CEO is a prominent public servant discharging heavy responsibilities who must expect to be scrutinised. Individuals in such circumstances are rational, efficient, hard-working and robust. They are fully entitled to a high degree of respect for their private lives. However the protection of personal information about their families and their health is a very different matter from having in the public domain information about income… The Tribunal simply cannot accept that anyone in such a role would feel the slightest distress, or consider that there has been any intrusion or that they would be prejudiced in any way by such information. From the perspective of the individual such information is essentially trivial; indeed, in other European societies, such information would be routinely available.”

If this approach were to become standard, the implications for public authorities would be significant.

Further, there are two very important personal data FOIA cases to look out for in the coming months. Following its decision in the Edem case late in 2012, the Upper Tribunal’s next consideration of personal data in the FOIA context is the appeal in the Morley v IC & Surrey Heath Borough Council (EA/2011/0173) case, in which the Tribunal – in a majority decision in which Facebook disclosures played a significant part – ordered the disclosure of names of certain youth councillors.

More importantly, the Supreme Court will hear an appeal from the Scottish Court of Session in July about a FOISA request for the number of individuals employed by the Council on specific points in the pay structure. The council relied on the personal data exemption (contending that individuals could be identified from the requested information), but the Scottish Information Commissioner ordered disclosure and succeeded before Scotland’s highest court. The Supreme Court will consider issues including the approach to ‘legitimate interests’ under condition 6(1) of schedule 2 to the DPA (the condition most often relied upon in support of disclosing personal data to the public). The case is likely to have far-reaching implications. For more detail, see Alistair Sloan’s blog.

Panopticon will, as ever, keep its eye on these and other related developments.

Robin Hopkins

Tags: , , , , , ,
Posted in INFORMATION LAW | Comments Off on Data protection: trends, possibilities and FOI disclosures

Local authorities and NHS Trusts (1): compromise agreements, officers’ identities and gagging clauses

September 17th, 2012 by Robin Hopkins

From a FOIA perspective, local authorities and NHS Trusts have this in common: both frequently receive requests for details of compromise agreements and other details about individual officers’ employment and disciplinary records. Three recent cases before the Tribunal confirm the general trend that – absent case-specific and well-evidenced arguments – the Commissioner and Tribunal re reluctant to order disclosure of such personal data, notwithstanding the context of public sector employees.

First, Trago Mills v IC and Teignbridge DC (EA/2012/0028) involved a request for the details of the severance package of a senior planning officer. Based on his dealings with that officer during a number of planning applications, the requester suspected that the stated reason for the officer’s departure from the Council (i.e. early retirement/redundancy) was in fact a ‘shield’, and that the officer had left for reasons of misconduct. The requester had also asked for information on that officer’s handling of planning applications in 2007.

The Council refused the request for the severance information on s. 40(2) grounds. The Commissioner and the Tribunal agreed: the requester’s suspicions were not borne out by the evidence, and the Council had a duty to respect its former employee’s reasonable expectation of privacy. The Tribunal also found that the Council held no further information within the scope of the request given the thoroughness of its searches. I represented the Council in this case, so no further commentary from me. For a detailed analysis of the issues, see the Local Government Lawyer’s article here. 11KBW’s Chris Knight represented the Information Commissioner.

Second, McFerran v IC (EA/2012/0030) involved a police search of a Council residence owned by Shropshire County Council. At the police’s request, two junior Council officers were present, but they had not been involved in any of the decision-making. The requester had concerns about the search and about what the Council may have told the police in the lead-up to the search. He requested the names of the two junior officers as well as their immediate superior. The Council refused, relying on s. 40(2).

The Commissioner ordered disclosure of the name of the more senior officer, but not of the two juniors. The requester’s appeal against the latter finding was dismissed, with the Tribunal observing that “although… there is clearly a legitimate public interest in transparency of activity by public authorities, which impinges on the personal freedom of householders, there is insufficient information provided to add significant weight to the general public interest in transparency in public affairs. The Appellant has not satisfied us, either, that his attempts to have the matter investigated are being thwarted by the absence of the names of the individuals in question. If there is sufficient information about the event to interest those responsible for an investigation the absence of names will not deter them.”

The McFerran decision illustrates that, when it comes to junior officials, general transparency considerations will usually not suffice for the disclosure of personal data: case-specific factors will be needed. Local authorities should, however, avoid the blanket non-disclosure of the names of all officers below a certain level of seniority. What matters is what work they have done, rather than what grade or band they are at.

McFerran also illustrates that requesters will often face the following sorts of objection: even if you have valid grounds for concern or complaint about individuals, there are ways of addressing those without disclosure of personal data to the world at large.

The third recent s. 40(2) arose in the context of NHS Trusts and allegations of Trusts using “gagging clauses” in compromise agreements to silence criticism or whistleblowing from departing employees. In Bousfield v IC and Six NHS Trusts (EA/2011/0212; 0213; 0247; 0250; 0251; 0252), the requester was interested not in any specific individual’s compromise agreement, but in the use of such agreements by NHS Trusts more generally. He asked: “Please provide copies of all compromise agreements you have entered into with doctors of any grade. Please also provide a list of exploratory or illustrator issues covered by the compromise agreements (ie the reasons the compromise agreements were entered into)”. One Trust refused to confirm or deny whether it held such information, relying on s. 40(5) (the argument being that there was a risk of identifying any individuals involved, which would breach the first data protection principle) and s. 43(3) (the argument being that confirmation or denial would prejudice the Trust’s commercial interests). Other Trusts also refused the requests, relying on a combination of s. 40(2) (personal data), s. 41 (actionable breach of confidence), 42 (legal professional privilege) and 36(2) (prejudice to the effective conduct of public affairs).

The Commissioner agreed, and the Tribunal has dismissed the requesters appealed. One Trust had conceded that, if there was evidence of gagging clauses being used to prevent former employees from raising any issues concerning patient safety, there would be enormous public interest in disclosing such practices. The decisive issue in this case, however, was that the Tribunal was satisfied on the evidence that no such clauses were being used by these Trusts. Therefore, it concluded that “it is entirely sympathetic to the overall concern that the Appellant feels with regard to the apparently increasing prevalence of gagging clauses but does not find that issue or concern in any way material to the matters which the Tribunal in fact has had to consider”.

It seems that, if the evidence had borne out the requester’s concerns, the analysis may have been very different. This ‘gagging clause’ issue has been considered at Tribunal level before: Bousfield v IC (EA/2009/0113). It may yet resurface.

Robin Hopkins

Tags: , , , , ,
Posted in INFORMATION LAW | Comments Off on Local authorities and NHS Trusts (1): compromise agreements, officers’ identities and gagging clauses

Section 40 FOIA, NCND and the public interest

June 1st, 2012 by Robin Hopkins

The requester (anonymised for the purposes of the decision) in Mr A v IC and The Health Professions Council (EA/2011/0223) asked for information about the response given by a named registrant to an investigation allegedly being carried out by the HPC into that registrant’s fitness to practice. The IC found that a ‘neither confirm nor deny’ response was appropriate, given that to confirm or deny (NCND) whether or not the HPC held the information requested would in and of itself disclose to the public whether there a complaint as to the registrant’s fitness to practise had been made. This would breach the first data protection principle. Section 40(5)(b)(i) FOIA therefore applied.

The Tribunal agreed. Curiously, it approached its task under section 58 FOIA thus: “The Tribunal does not take the IC’s decision again, rather its task is to consider the Decision Notice and to consider whether it can be impugned on legal grounds.”

Its decision turned largely on the usual features of a request for personal data: privacy implications, reasonable expectations and so on. The Tribunal’s decision does, however, contain a number of points of interest concerning the correct approach to section 40.

First, when judging whether, for section 40(5) purposes, confirmation or denial would breach any of the data protection principles, the appropriate reference point was disclosure to the public, not disclosure to the individual requester, given the overall wording of section 40 and the ‘motive blind’ approach to FOIA. The Upper Tribunal in All Party Parliamentary Group on Extraordinary Rendition v Information Commissioner [2011] UKUT 153 (AAC) appeared to think otherwise, but its observation was obiter, and the Tribunal in the present case declined to follow it.

Secondly, it followed that for the purposes of condition 6(1) of Schedule 2 to the DPA (which refers to the “legitimate interests of the … third party or parties to whom the data are disclosed”), the appropriate reference point was again the public. Public rather than private interests are what count for condition 6(1) purposes.

Finally, the NCND provisions of section 40(5) do not appear in the list of absolute exemptions at section 2(3)(f) of FOIA. Does this mean the public interest test must be applied, even where – as the Tribunal had found – disclosure would breach the first data protection principle? The Tribunal agreed with the IC and the HPC that the answer is ‘no’. It followed Heath v IC (EA/2009/0020) in finding that the word ‘provision’ at section 2(1) FOIA is sufficiently ambiguous (as to whether it means a section of FOIA as a whole, or rather subsections) to admit of a purposive interpretation. In these circumstances, this allowed for data protection principles to be given primacy; no public interest question under section 2(2) of FOIA arose.

Robin Hopkins

Tags: , ,
Posted in INFORMATION LAW | Comments Off on Section 40 FOIA, NCND and the public interest

CHILLING EFFECT, SAFE SPACE AND THE NHS RISK REGISTERS

April 15th, 2012 by Robin Hopkins

In a recent post, Panopticon brought you, hot-off-the-press, the Tribunal’s decision in the much-publicised case of Department of Health v IC, Healey and Cecil (EA/2011/0286 & EA/2011/0287). Somewhat less hot-off-the-press are my observations. This is a very important decision, both for its engagement with the legislative process and for its analysis of the public interest with respect to section 35(1)(a) of FOIA (formulation or development of government policy) – particularly the “chilling effect” argument. At the outset, it is important to be clear about what was being requested and when.

Risk registers in general

The DOH prepared two “risk registers” documenting the risks associated with implementing the “far-reaching and highly controversial” NHS reforms under what was then the Health and Social Care Bill. The Tribunal heard that risk registers are used widely across government for project planning. They provide snapshots (rather than detailed discussions) combining the probability of and outcomes from any given risk associated with the proposed reform; risks are then classified in red, amber or green terms. According to Lord Gus O’Donnell, who gave evidence in support of the DOH’s case, risk registers are the most important tool used across government to formulate and develop policy for risk management in advising ministers. John Healey MP, one of the requesters in this case, said that he was a minister for ten years and was never shown such a register.

The requests and these particular registers

On 29 November 2010, Mr Healey requested a copy of the “Transition Risk Register” (TRR). This, the Tribunal found, was largely concerned with operational matters; it aimed to identify implementation risks. By this stage, the government had already published its White Paper on the reforms. Crucially, the Tribunal’s finding was that the broad policy decision had been taken by the time of the White Paper. The subsequent consultation was largely directed at how best to implement the White Paper. In response to that consultation, the government adhered to the vast majority of its plans, and set about implementing them early where possible.

On 28 February 2011, the second requester, Nicholas Cecil, asked for a copy of the Strategic Risk Register (“SRR”). This was concerned with potential policy decisions for ministers. By that time, the Bill had been laid before Parliament. Parliament’s reaction meant that, in a number of respects, ministers were called upon to rethink policy decisions surrounding the NHS reforms.

Both requests were refused. The IC ordered that they be disclosed. The Tribunal upheld the IC’s decision on the TRR, but allowed the DOH’s appeal on the SRR.

The approach to section 35(1)(a) of FOIA

Before the Tribunal, it was accepted that this exemption was engaged with respect to both registers. The Tribunal considered that the need for a safe space for policy-making was not linear. Its analysis is worth quoting in detail:

“We are prepared to accept that there is no straight line between formulation and development and delivery and implementation. We consider that during the progress of a government introducing a new policy that the need for a safe space will change during the course of a Bill. For example while policy is being formulated at a time of intensive consultation during the initial period when policy is formed and finalised the need for a safe space will be at its highest. Once the policy is announced this need will diminish but while the policy is being debated in Parliament it may be necessary for the government to further develop the policy, and even undertake further public consultation, before the Bill reflects the government’s final position on the new policy as it receives the Royal Assent. Therefore there may be a need to, in effect, dip in and out of the safe space during this passage of time so government can continue to consider its options. There may also come a time in the life of an Act of Parliament when the policy is reconsidered and a safe space is again needed. Such a need for policy review and development may arise from implementation issues which in themselves require Ministers to make decisions giving rise to policy formulation and development. We therefore understand why the UCL report describes the process as a “continuous circle” certainly until a Bill receives the Royal Assent. However the need for safe spaces during this process depends on the facts and circumstances in each case. Critically the strength of the public interest for maintaining the exemption depends on the public interest balance at the time the safe space is being required.

We would also observe that where a Bill is a Framework Bill we can understand that even after it receives the Royal Assent there will be a need for safe spaces for policy formulation as secondary legislation is developed. We note in this case that the Bill, although suggested by DOH to be a Framework Bill, is prescriptive of economic regulation, and cannot be described purely in framework terms.”

Public interest factors in favour of maintaining the exemption: safe space and chilling effect

One of the DOH’s witnesses contended that the registers allowed a safe space for officials to “think the unthinkable”, but the Tribunal found it difficult to see how the registers – particularly the TRR – could be described in that way: “the TRR identifies the sorts of risks one would expect to see in such a register from a competent Department”. Nonetheless, the Tribunal accepted the strong public interest in there being a safe space for policy formulation.

The main argument concerned the chilling effect, which Lord O’Donnell addressed in his evidence. The Tribunal considered that there was no actual evidence of the chilling effect following other instances of comparable disclosures (e.g. following OGC v IC (EA/2006/2068 & 80), or following a 2008 disclosure of a risk register concerning a third runway at Heathrow). Similarly, a 2010 report from UCL’s Constitution Unit concluded there to be little evidence for the chilling effect.

Overall, the Tribunal cautioned against treating qualified exemptions as absolute ones. It said:

“We would observe that the DOH’s position expressed in evidence is tantamount to saying that there should be an absolute exemption for risk registers at the stages the registers were requested in this case. Parliament has not so provided. S.35 (and s.36) are qualified exemptions subject to a public interest test, which means that there is no absolute guarantee that information will not be disclosed, however strong the public interest in maintaining the exemption.”

Factors in favour of disclosure

The DOH’s witnesses sought to play down the significance of the NHS reforms in comparison to other important reforms implemented by government. Mr Healey, however, argued that they were exceptional. The Tribunal agreed with him.

It also noted that the Conservatives’ manifesto for the 2010 election had promised an end to top-down NHS reorganisation, but that its NHS White Paper then appeared to propose exactly such a reorganisation. It was not preceded by a Green Paper. It was clear to the Tribunal that the White Paper was published in a hurry and to much public concern. Given the scale and controversial nature of the reforms, transparency of decision-making was very important.

The Tribunal found the public interest balance to be very difficult in this case. Judging the matters at the time of the DOH’s refusal notices, the Tribunal concluded that the balance favoured disclosure of the TRR but not the SRR – due to the differences in the nature of the registers and the timing of the requests (see above).

Section 40(2) of FOIA and civil servants’ names

Finally, the Tribunal also considered the DOH’s reliance on section 40(2) to redact the names of a number of civil servants on the grounds of their being insufficiently senior for disclosure to be fair. The Tribunal ordered the disclosure of the majority of these names. In so doing, it focused on the substance of what each individual did with respect to this particular information – rather than on their Civil Service grades.

Robin Hopkins

Tags: , , , ,
Posted in INFORMATION LAW | Comments Off on CHILLING EFFECT, SAFE SPACE AND THE NHS RISK REGISTERS

NICK GRIFFIN IN THE TRIBUNAL: APPLICANT BLINDNESS, THE “JOURNALIST’S ROUTE” AND ARTICLE 10

February 10th, 2012 by Robin Hopkins

BNP leader Nick Griffin was convicted in 1998 for publishing material likely to stir up racial hatred. In 2009, Ian Cobain, an investigative journalist at The Guardian, requested sight of all Crown Prosecution Service papers relating to that prosecution. The Commissioner upheld its refusal. In Cobain v IC and Crown Prosecution Service (EA/2011/0112 & 0113), the Tribunal considered 3 exemptions, namely ss. 40(2), 32(1) and 30(1) of FOIA. For the most part, Mr Cobain’s arguments prevailed.

The decision is notable – indeed, essential reading – for a number of its key points. For example: when it comes to journalists requesting sensitive personal data, FOIA is not “applicant blind”. More generally, the decision affirms the importance of FOIA in facilitating investigative journalism. The approach to Article 10 ECHR from the Kennedy “report” is boldly affirmed. General guidance on s. 30(1) is set out. I’ll look at the key points from each exemption in turn. The decision is worth quoting in some detail.

Section 40(2) (personal data)

A number of important points emerge. First, in general, just because information emerged during evidence in a public trial, this does not mean it should automatically be disclosed under FOIA:

“Much of the information… was freely publicised at the trial in 1998… Where the public interest is engaged (as here where s. 30(1)(c) is invoked) it does not by any means automatically follow that such publication in the past determines the question of disclosure today. Most witnesses are entitled to expect that their exposure to public scrutiny ends with the conclusion of their evidence. Those who make statements do so in the expectation that, if not used at trial, they will not surface later.”

Secondly, just because information is in a prosecution file, it does not follow that it is necessarily personal data. The Commissioner was criticised for insufficiently granular analysis:

“It was clear that the broad and unparticularised approach adopted in the First Decision Notice could not be upheld. The fact that it is information held in a file assembled for the purposes of criminal proceedings against Mr. Griffin (see DPA s.2(g)) does not make it sensitive personal data, unless it is personal data in the first place.”

Some of the disputed information was therefore outside s. 40(2) because it was not personal data in the first place. Other information, however, was sensitive personal data. This meant that not only would the usual conditions need to be met (fairness, lawfulness, condition 6(1)) but a Schedule 3 condition was also mandatory. Those can be difficult to meet – unless you are a journalist. Condition 10 triggers the Data Protection (Processing of Sensitive Personal Data) Order 2000. This contains particular “lawful processing” conditions for the purposes of, among other things, journalism: see article 3 of the Order, which also imposes other conditions such as the disclosure being in the “substantial public interest” and “in connection with” issues such as “the commission of an unlawful act”. Paragraphs 31-33 of the Tribunal’s decision contain a useful summary of how the relevant provisions work.

This “journalist’s route” (my term, rather than the Tribunal’s) to obtaining sensitive personal data has been considered in a number of Tribunal decisions. In this case, it was given full effect:

 “Disclosure of the sensitive data would be “in connection with” the commission of an unlawful act (hence the conviction), seriously improper conduct and arguably Mr. Griffin`s unfitness for political office. It would be for the purpose of journalism, Mr. Cobain`s occupation, and would be intended for publication in his newspaper and possibly thereafter, in a book. Given the issues involved, namely racial and/or religious hatred and the right to express even extreme views, we find that disclosure would be in the substantial public interest. We do not consider that the passage of eleven years before the request renders disclosure unfair, or unwarranted by reason of prejudice to Mr. Griffin`s interests nor likely to cause substantial damage or distress to him. In making that judgement we have regard to Mr. Griffin`s age ( 50 at the date of the request, 39 at the date of trial), his continuing political prominence and his apparent claim to be an educated, reasonable and responsible MEP and party leader who has rejected any racial extremism formerly associated with his party.”

How does this “journalist’s route” square with the usual “applicant blindness” FOIA principle? The ICO argued that the latter prevails, such that the former only applies to pure DPA cases, not to FOIA ones. It emphasized the wording of s. 40(3)(a): disclosure to “a member of the public otherwise than under [FOIA]”. It argued that the average member of the public is the reference point for a FOIA disclosure. The average member of the public is not a journalist. The “journalist’s route” therefore has no place in FOIA.

The Tribunal disagreed (as the First-Tier Tribunal has done on a number of occasions now). It relied on the Upper Tribunal’s judgment in the APPGER case on this point, and said that:

 “… a requester who fulfils one or more of the schedule conditions is also a member of the public ( and is not the data processor ) who is receiving the information under FOIA. If this were not so, FOIA would be a valueless tool for the serious researcher, journalist, writer, politician or scholar seeking to investigate serious wrongdoing within the preceding thirty years. If that were the case, it would be reasonable to ask whether FOIA was worth enactment.”

The effect in this case was that s. 40(2) did not apply at all.

Section 32 (court records)

Next, the CPS relied on s. 32, the ambiguous wording of which has opened the door for Article 10 ECHR arguments: see the Kennedy v Charity litigation (Panopticon passim) in which the First-Tier Tribunal’s “report” on the application and effect of Article 10 on s. 32 will be considered by the Court of Appeal later this month. The Tribunal in Cobain wholeheartedly adopted the Kennedy report:

“We adopt with gratitude and respect the very careful reasoning of the report on this issue, which we believe accurately states the law as to Article 10 as recently developed… We do not doubt that s. 32(1) can be read down in a way which is consistent with Article 10. We consider that limiting the restriction in [s. 32(1)] so that it ends once a reasonable time has elapsed after the exhaustion or evident abandonment of the available appeal process would avoid a breach of Article 10.”

Consequently, s. 32 was not available as a ground for refusal in this case.

The Article 10 issue is obviously of enormous importance to the interpretation of FOIA – particularly, but not exclusively for journalists. As things stand, the role of Article 10 is uncertain. At least two other First-Tier Tribunals have heard or will hear argument on it this month (in the contexts of ss. 23, 40(2) and 41); the Court of Appeal will consider it in two cases this month, and the Supreme Court gives judgment in Sugar v BBC next week. Watch this space.

Section 30(1) (investigations)

In the context of this case, this exemption was “unarguably” engaged. The Tribunal made the following observations about the public interest in maintaining this exemption:

“The Tribunal acknowledges the substantial public interest in many circumstances in protecting from disclosure information gathered for the purposes of a criminal case, including the need to offer informants and witnesses protection from public exposure and a prosecuting authority a proper space in which to discuss and decide issues that arise.”

As against that, it said this about the public interest in disclosure:

“On the other hand, the public has a legitimate interest in criminal investigations and resulting court proceedings, especially where the defendant was a prominent political figure charged with an offence of great current importance in proceedings that he was keen to publicise. The passage of time is also a consideration. Legitimate public interest in such a case continues due to the profile of the defendant but the risk of any impact on the resulting proceedings disappeared long ago. More importantly, the relevant information in this appeal does not include statements from potentially vulnerable witnesses or highly sensitive material”.

The Tribunal therefore concluded that, in general, the public interest favoured the disclosure of the disputed information in this case, except for three categories which could properly be withheld.

On s. 30(1), this decision is a useful summary of the most relevant considerations. It is on ss. 40(2) and Article 10, however, that it has given a fresh boost to requesters.

Robin Hopkins

Tags: , , , , ,
Posted in INFORMATION LAW | Comments Off on NICK GRIFFIN IN THE TRIBUNAL: APPLICANT BLINDNESS, THE “JOURNALIST’S ROUTE” AND ARTICLE 10

« Older Entries