May 20, 2013 · 12:23 pm

There’s nothing like consistency…

Two contradictory decisions from the ICO as to whether disclosure of the names of councillors in the Local Government Pension Scheme is lawful might leave FOI officers – and requesters – scratching their heads

Remember those “Spot the Difference” competitions?

In 2010 the Information Commissioner’s Office (ICO) issued a Decision Notice concerning a request made to Buckinghamshire County Council under the Freedom of Information Act 2000 (FOIA). The request was for the names of councillors who had chosen to join the Local Government Pension Scheme (LGPS). The ICO agreed with BCC that

the withheld information is personal data relating to these councillors

But disagreed that section 40(2) and (3) of FOIA exempted the information from disclosure, rejecting an argument that the councillors would not have had a reasonable expectation of disclosure of the information:

the Commissioner has not found any evidence to support a view that disclosing the requested information would be likely to cause unnecessary or unjustified damage or distress to the individuals concerned

and

The Commissioner is satisfied the requested information relates primarily to the councillors’ public lives and does not intrude significantly on their private and family lives.

Consequently BCC was

to provide the complainant with the list of names of the ten councillors who were members of the LGPS

Compare and contrast with a Decision Notice issued recently relating to a FOIA request to Central Bedfordshire Council (CBC). The request was for names of councillors who had chosen to join the Local Government Pension Scheme (LGPS). The ICO agreed that

information regarding the details of an individual’s pension is personal data

And agreed with CBC that section 40(2) and (3) of FOIA exempted the information from disclosure, saying

individuals will have a reasonable expectation that information about their pension, and their decision whether or not to take one, will not be routinely disclosed

and that the councillors’

expectations of privacy with regard to their pensions are still objectively reasonable as it relates far more to their private lives than their professional lives

Consequently CBC was correct

to rely on section 40(2) to withhold…the requested information

A few questions arise: are BCC councillors entitled to bring a complaint against their council for unfair processing? if so, would BCC have a defence that they complied with a legal notice from the statutory regulator? Is local government “lagging behind best practice in other parts of the public sector” (para 20 of FS50233989) or not? Which Decision Notice should other councils follow when they get similar requests? And, finally, did the ICO even look at the earlier decision when it issued the second?

 

DISCLAIMER: I have a professional connection to one of the public authorities involved.

1 Comment

Filed under Data Protection, Freedom of Information, Information Commissioner

May 17, 2013 · 2:58 pm

Damages under s13 Data Protection Act – an Opportunity Lost?

A concession of an issue by the defendant in Halliday v Creation Consumer Finance means the law is still unclear as to whether nominal damages trigger compensation for distress arising from a contravention of the Data Protection Act

Section 13(1) of the Data Protection Act (DPA) provides a right to compensation for a data subject who has suffered damage by reason of any contravention by a data controller of any of the requirements of the Act.  The domestic authorities are clear that “damage” in this sense consists of pecuniary loss. Thus, section 13(1) is a “gateway” to a further right of compensation under section 13(2)(a), for distress. The right to distress compensation cannot be triggered unless section 13(1) damage has been suffered.

This point was addressed in Johnson v The Medical Defence Union Ltd (2) [2006] EWHC 321 and  on appeal (Johnson v Medical Defence Union [2007] EWCA Civ 262), with Buxton LJ in the latter saying

section 13 distress damages are only available if damage in the sense of pecuniary loss has been suffered

In the case at first instance  the judge had found against Mr Johnson in his claim that a failure to renew his membership was caused by unfair processing of his personal data. However, if the first head of claim had succeeded, pecuniary damages in the sum of £10.50, to cover the cost of a breakfast (don’t ask) would have been owed, and

the price of that breakfast [would have represented] his gateway to a right to recover compensation for distress under section 13(2)(a)

This point, already largely hypothetical, fell away on appeal, because the Court held 

The Judge was not entitled to find that this, the only item of pecuniary damage that survived, was attributable to damage for which the MDU was responsible

The judgment in a recent case, Halliday v Creation Consumer Finance Ltd (CCF) [2013] EWCA Civ 333 had been anticipated as possibly clarifying whether nominal, as opposed to substantial, damages under section 13(1), could suffice to be a gateway to distress compensation, and, indeed, whether the DPA effectively transposes the requirements of the European Data Protection Directive to which it gives effect. The case concerned errors by the defendant regarding disputed payments, which affected the claimant’s credit record. As Robin Hopkins said in a recent post on the Panopticon blog, after reports of the ex tempore judgment surfaced,

In Halliday…nominal damages (of £1) were awarded, thereby apparently fulfilling the ‘damage’ requirement and opening the door for a ‘distress’ award (though note that Panopticon has not yet seen a full judgment from the Court of Appeal in this case, so do not take this as a definitive account). If that approach becomes standard practice, claimants may be in much stronger positions for seeking damages.

Now that the full judgment has been made available, it can be seen that Mr Halliday did indeed succeed in using the nominal £1 damages as a gateway to £750 compensation for distress, but only because the defendant conceded the point:

this issue, which was the main issue of the proposed appeal to this court, is now academic as the respondent, CCF, concedes an award of nominal damages is “damage” for the purposes of the Directive and for the purposes of section 13(2) of the Data Protection Act 1998

So it appears we must continue to wait for fuller consideration of the meaning of the word “damage” in both the Directive and section 13 DPA.

UPDATE: Robin Hopkins has blogged on this case at the Panopticon blog. As he says – and as I may have omitted – “the judgment is not without its notable points”.

1 Comment

Filed under damages, Data Protection

May 16, 2013 · 7:58 am

NO THANK YOU I DON’T WANT TO REGISTER

The other day I was in town, and popped in to a shop to look at an interesting item. I was rather annoyed to be greeted by a shop assistant waving a large banner which obscured everything. He said he’d put the banner down if I handed over my contact details so he could send me marketing guff in the future. He only got out of the way when I kneed him in the Edwards.

Not strictly true of course. However – you wouldn’t run a physical shop this way, so why run web scripts that have the same effect?

bfp

I don’t want to register for your website – I just want to dip in for a quick look then leave (that still counts as a page view for you to quote to advertisers) and I’d suggest that’s pretty standard practice for the large majority of internet users.

I confidently state that no one, ever, in recorded history, has thought, when they got a pop-up inviting them to register their details, “Oo, how helpful that was. Thank you for obstructing my journey to what I really wanted”.

And I know I could probably configure a pop-up blocker to bypass them, but I don’t (often) walk around town accompanied by a bouncer. So just stop it, everyone who does this.

2 Comments

Filed under Uncategorized

April 16, 2013 · 12:15 pm

Police, poems and FOI

In which I am inspired into literary expression by a rather bizarre ICO decision notice saying that a poem sent by a senior police officer on his mobile device is exempt from disclosure under the “personal data” provisions of the Freedom of Information Act

Mr Plod once sent friends a rhyme
Which was rumoured to be out of line
When a request was lodged
To see what it was
His bosses politely declined

Chris Graham agreed with the force
Saying “It’s personal data because
He’s easy to spot
From the words that we’ve got:
It’s exempt from disclosure, of course!”

A Tribunal may have to decide later
- As the statutory arbitrator -
If it’s rather perverse
To suggest that a verse
Can possibly be personal data.

1 Comment

Filed under Data Protection, Freedom of Information, Information Commissioner, police

Tagged as , , ,

April 5, 2013 · 5:11 pm

A Howitzer of an FOI Exemption

A recent decision by the Information Commissioner shows that the House of Commons is able, under the FOI Act, to apply a blanket provision preventing disclosure of information of potential public interest, from which there is no appeal. If I were a cynical adviser to the House, I’d suggest using it more often.

The Freedom of Information Act 2000 (FOIA) contains a few howitzers with which a relevant public authority can obliterate an otherwise valid request for information. The most familiar of these is at section 53, whereby, in relation to a Information Commissioner (IC) decision notice served on a government department requiring them to disclose information, a Cabinet minister can issue a veto, from which there is no right of appeal.

Less well-known are the certificates which can be served under sections 23 and 24, by ministers, to be conclusive evidence that information requested was supplied by or relates to national security bodies, or is exempt from disclosure for reasons of national security. (These are appealable, either by the IC or by the applicant, under section 60 of FOIA).

Less well-known still is a section which allows the Speaker of the House of Commons (or the Clerk of the Parliaments) to issue a certificate which provides conclusive evidence that disclosure would or would be likely to cause prejudice to the effective conduct of public affairs. This is section 36(7) and, read with section 2(3)(e), it provides an absolute exemption to disclosure, which the IC is duty bound to accept. In effect, it is a means whereby the Houses of Parliament can prevent FOIA disclosure, with no right of appeal.

Thus, in a decision notice published this week about a request for information relating to the tax treatment of residential accommodation provided by the House of Commons, the IC says

Given the nature and provenance of the certificate, the Commissioner is obliged by section 36(7) FOIA to accept the certificate as “conclusive evidence” that the opinion is reasonable in both process and substance and that the alleged inhibition would be likely to occur; therefore, the Commissioner accepts that section 36(2) FOIA is engaged and that the withheld information is exempt

Any appeal of this decision would have the same outcome: if a properly-made certificate states that the exemption applies, then it does, and no regulator or court can say different. So, despite what appears to be a potentially high degree of public interest in the information requested, about, in the applicant’s words

issues of principle… the provision of residential accommodation is a substantial benefit, and its tax treatment is of legitimate interest to the public

we will not get to see it.

There could, I imagine, potentially be an application for judicial review of the decision to issue the certificate, in the same way that the ministerial veto at section 53 is potentially amenable to judicial review, but this would have to be on the classic public law grounds, and would be a very difficult challenge.

One rather wonders why this provision has not been used more often. It has been used in the past to prevent disclosure of information relating to names and salaries of MPs’ staff, and to prevent disclosure of information about the claiming of parliamentary privilege. But when requests were made for disclosure of MPs’ expenses information, the exemption claimed was the one relating to personal data. A section 36(7) certificate would, it seems to me, have rendered those requests dead in the water. Did the House of Commons miss a cynical trick?

Leave a Comment

Filed under Freedom of Information, Information Commissioner, Uncategorized

Tagged as ,

April 2, 2013 · 11:33 am

A Question of Apparent Bias?

So, the Information Commissioner’s Office (ICO) has been using “ctrl+v” a bit too much. Large chunks of source material from Wikipedia and – to me more crucially – the website of the Royal Household were quoted, without attribution (and without indication that they were quotations) in a decision letter upholding the Royal Household’s refusal to disclose environmental information to tweeter @foimonkey.

Paul Gibbons – “FOIMan” – has blogged about this, and he wonders if this is evidence of a current lack of resources for the ICO. I think the ICO is under-resourced, and this is set to get worse but I’m not sure I agree with Paul that @FOIMonkey’s case illustrates this.

When Christopher Graham, the current Information Commissioner, was appointed, he inherited a damning backlog of FOI complaint cases, some going back several years. He stated openly that, to deal with this backlog, there might at times be a “silver standard” of investigation (as opposed to a gold one) from his office. True to his word, and much to his credit, the backlog has been greatly reduced, to the point where no cases were more than one year old, at the time of the publication of his last annual report.

So, I would agree with Paul, if @FOImonkey’s case was simply one of these “silver standard” ones, but that surely is not the case here. The refusal by the Royal Household to consider itself a public authority for the purposes of the Environmental Information Regulations 2004 was made over a year ago, and I understand the complaint to the ICO was made promptly after that. This means the ICO has had effectively twelve months to consider a request of considerable (if perhaps obscure) constitutional interest and significance. Even with limited resources twelve months is an awfully long time for a qualified solicitor and national Director of Freedom of Information to have to arrive at a decision.

I have a bigger concern though.

Paul is by no means uncritical of the ICO, and he notes that internal quality controls appear to be lacking, but he is perhaps not overly concerned with the act of copying itself (which could potentially be in breach of copyright):

I’m sure there are FOI out there who have copied chunks of the ICO’s decisions into their own FOI responses without citing them where it suited

However, I think the difference here is related to authority, and perception.

It is quite right for an FOI officer to quote ICO decisions in their own FOI responses (although I agree that citations should be given). Common law relies on a system of precedent and judicial authority, and, although the ICO is a regulator, and not a judicial body, the principle is similar: refer to and cite the authoritative statements of those who make decisions on the law in question.

However, the ICO is the one in a position of decision-making authority here, and to cite the website (without attribution) of one of the parties in a case he has to decide, gives rise to a perception of lack of independence, or bias. And that is an extremely important thing for a regulator to avoid doing.

As it is, most of the unattributed quotes are merely of uncontroversial statements of fact, and I am not sure they are clear evidence of any actual bias on the part of the ICO, but perception of bias is corrosive in itself. The classic test, as propounded by Lord Hope in Porter v Magill [2002] 2 AC 357, is

whether the fair-minded and informed observer, having considered the facts, would conclude that there was a real possibility that the tribunal was biased

Maybe I’m not fair-minded (although I do consider myself reasonably informed) so I would have to invite other observers to say whether they would conclude there was a real possibility of bias in this case.

UPDATE: the ICO has now tweeted saying the failure to cite sources was an error. Fair enough, but I’m not sure that changes my views here.

3 Comments

Filed under Environmental Information Regulations, Freedom of Information, Information Commissioner, transparency

March 27, 2013 · 2:35 pm

Private NHS Providers and FOI

Monitor have recommended that FOI requirements should apply to private providers of NHS services. I’m not sure we should be too optimistic that much will ensue.

Regardless of one’s views of the Health and Social Care Act 2012* it is important that, if “any willing provider” can be commissioned to provide private health services, there should be parity of treatment. And, indeed, the need to ensure a “Fair Playing Field” was, at least ostensibly, what led the Secretary of State for Health to ask Monitor (“the sector regulator of NHS-funded health care services”) to conduct

an independent review of matters that may be affecting the ability of different providers of NHS services to participate fully in improving patient care

That review has now finished, and was laid before Parliament by the Secretary of State yesterday.

My specific interest is in the section regarding transparency. Monitor note that

Historically, public providers have faced higher levels of scrutiny than other providers, including requests for information under the Freedom of Information Act. This degree of scrutiny can improve accountability to patients and promote good practice. Freedom of Information requirements have been extended through the standard NHS contract to private and charitable providers. However, it is not clear that this is operating effectively as yet, and other aspects of transparency do not apply across all types of provider

Accordingly

The Government and commissioners should ensure that transparency, including Freedom of Information requirements, is implemented across all types of provider of NHS services on a consistent basis

This could be read as a recommendation that the Freedom of Information Act 2000 (FOIA) be extended to all (including private) providers.

However, I am not sure we should be too optimistic that the recommendation will be read in this way by the Department of Health. The Justice Committee, in its recent post-legislative scrutiny of FOIA, was unconvinced that FOIA needed to be extended to private providers of public services, feeling that the use of contractual terms to ensure transparency was sufficient:

The evidence we have received suggests that the use of contractual terms to protect the right to access information is currently working relatively well…We believe that contracts provide a more practical basis for applying FOI to outsourced services than [extending FOIA to those private providers]

and rather unsurprisingly the government, in its response to the Justice Committee, agreed

 The Government therefore does not intend, at this time, to legislate to extend FOIA obligations to contractors.

 Given this, I suspect that, rather than taking up Monitor’s recommendation and extending FOIA to private healthcare providers, the government will merely reiterate the point about the use of contractual terms to promote transparency aims.

However, even if FOIA is not to be explicitly extended to include private contractual providers, there is a potential way forward which would achieve those transparency aims in a clearer and more enforceable way. This is the proposal by the Campaign for Freedom of Information, who observed (in light of the post-legislative scrutiny reports)

We don’t believe that relying on every authority to insert an appropriate clause into every contract one at a time is likely to be effective. The FOI Act itself should state that all such contracts are deemed to include a wide disclosure requirement, automatically bringing information about the contractor’s performance and the way the contractor goes about it within the Act’s scope

This seems eminently sensible. I wish eminently sensible things would happen more often than they do.

 

*I happen to think it’s an example of an ideologically-driven privatisation of public services which we will look back on in decades to come as a drastic mistake.

1 Comment

Filed under Freedom of Information

Tagged as