Category Archives: Information Commissioner

May 20, 2013 · 12:23 pm

There’s nothing like consistency…

Two contradictory decisions from the ICO as to whether disclosure of the names of councillors in the Local Government Pension Scheme is lawful might leave FOI officers – and requesters – scratching their heads

Remember those “Spot the Difference” competitions?

In 2010 the Information Commissioner’s Office (ICO) issued a Decision Notice concerning a request made to Buckinghamshire County Council under the Freedom of Information Act 2000 (FOIA). The request was for the names of councillors who had chosen to join the Local Government Pension Scheme (LGPS). The ICO agreed with BCC that

the withheld information is personal data relating to these councillors

But disagreed that section 40(2) and (3) of FOIA exempted the information from disclosure, rejecting an argument that the councillors would not have had a reasonable expectation of disclosure of the information:

the Commissioner has not found any evidence to support a view that disclosing the requested information would be likely to cause unnecessary or unjustified damage or distress to the individuals concerned

and

The Commissioner is satisfied the requested information relates primarily to the councillors’ public lives and does not intrude significantly on their private and family lives.

Consequently BCC was

to provide the complainant with the list of names of the ten councillors who were members of the LGPS

Compare and contrast with a Decision Notice issued recently relating to a FOIA request to Central Bedfordshire Council (CBC). The request was for names of councillors who had chosen to join the Local Government Pension Scheme (LGPS). The ICO agreed that

information regarding the details of an individual’s pension is personal data

And agreed with CBC that section 40(2) and (3) of FOIA exempted the information from disclosure, saying

individuals will have a reasonable expectation that information about their pension, and their decision whether or not to take one, will not be routinely disclosed

and that the councillors’

expectations of privacy with regard to their pensions are still objectively reasonable as it relates far more to their private lives than their professional lives

Consequently CBC was correct

to rely on section 40(2) to withhold…the requested information

A few questions arise: are BCC councillors entitled to bring a complaint against their council for unfair processing? if so, would BCC have a defence that they complied with a legal notice from the statutory regulator? Is local government “lagging behind best practice in other parts of the public sector” (para 20 of FS50233989) or not? Which Decision Notice should other councils follow when they get similar requests? And, finally, did the ICO even look at the earlier decision when it issued the second?

 

DISCLAIMER: I have a professional connection to one of the public authorities involved.

1 Comment

Filed under Data Protection, Freedom of Information, Information Commissioner

April 16, 2013 · 12:15 pm

Police, poems and FOI

In which I am inspired into literary expression by a rather bizarre ICO decision notice saying that a poem sent by a senior police officer on his mobile device is exempt from disclosure under the “personal data” provisions of the Freedom of Information Act

Mr Plod once sent friends a rhyme
Which was rumoured to be out of line
When a request was lodged
To see what it was
His bosses politely declined

Chris Graham agreed with the force
Saying “It’s personal data because
He’s easy to spot
From the words that we’ve got:
It’s exempt from disclosure, of course!”

A Tribunal may have to decide later
- As the statutory arbitrator -
If it’s rather perverse
To suggest that a verse
Can possibly be personal data.

1 Comment

Filed under Data Protection, Freedom of Information, Information Commissioner, police

Tagged as , , ,

April 5, 2013 · 5:11 pm

A Howitzer of an FOI Exemption

A recent decision by the Information Commissioner shows that the House of Commons is able, under the FOI Act, to apply a blanket provision preventing disclosure of information of potential public interest, from which there is no appeal. If I were a cynical adviser to the House, I’d suggest using it more often.

The Freedom of Information Act 2000 (FOIA) contains a few howitzers with which a relevant public authority can obliterate an otherwise valid request for information. The most familiar of these is at section 53, whereby, in relation to a Information Commissioner (IC) decision notice served on a government department requiring them to disclose information, a Cabinet minister can issue a veto, from which there is no right of appeal.

Less well-known are the certificates which can be served under sections 23 and 24, by ministers, to be conclusive evidence that information requested was supplied by or relates to national security bodies, or is exempt from disclosure for reasons of national security. (These are appealable, either by the IC or by the applicant, under section 60 of FOIA).

Less well-known still is a section which allows the Speaker of the House of Commons (or the Clerk of the Parliaments) to issue a certificate which provides conclusive evidence that disclosure would or would be likely to cause prejudice to the effective conduct of public affairs. This is section 36(7) and, read with section 2(3)(e), it provides an absolute exemption to disclosure, which the IC is duty bound to accept. In effect, it is a means whereby the Houses of Parliament can prevent FOIA disclosure, with no right of appeal.

Thus, in a decision notice published this week about a request for information relating to the tax treatment of residential accommodation provided by the House of Commons, the IC says

Given the nature and provenance of the certificate, the Commissioner is obliged by section 36(7) FOIA to accept the certificate as “conclusive evidence” that the opinion is reasonable in both process and substance and that the alleged inhibition would be likely to occur; therefore, the Commissioner accepts that section 36(2) FOIA is engaged and that the withheld information is exempt

Any appeal of this decision would have the same outcome: if a properly-made certificate states that the exemption applies, then it does, and no regulator or court can say different. So, despite what appears to be a potentially high degree of public interest in the information requested, about, in the applicant’s words

issues of principle… the provision of residential accommodation is a substantial benefit, and its tax treatment is of legitimate interest to the public

we will not get to see it.

There could, I imagine, potentially be an application for judicial review of the decision to issue the certificate, in the same way that the ministerial veto at section 53 is potentially amenable to judicial review, but this would have to be on the classic public law grounds, and would be a very difficult challenge.

One rather wonders why this provision has not been used more often. It has been used in the past to prevent disclosure of information relating to names and salaries of MPs’ staff, and to prevent disclosure of information about the claiming of parliamentary privilege. But when requests were made for disclosure of MPs’ expenses information, the exemption claimed was the one relating to personal data. A section 36(7) certificate would, it seems to me, have rendered those requests dead in the water. Did the House of Commons miss a cynical trick?

Leave a Comment

Filed under Freedom of Information, Information Commissioner, Uncategorized

Tagged as ,

April 2, 2013 · 11:33 am

A Question of Apparent Bias?

So, the Information Commissioner’s Office (ICO) has been using “ctrl+v” a bit too much. Large chunks of source material from Wikipedia and – to me more crucially – the website of the Royal Household were quoted, without attribution (and without indication that they were quotations) in a decision letter upholding the Royal Household’s refusal to disclose environmental information to tweeter @foimonkey.

Paul Gibbons – “FOIMan” – has blogged about this, and he wonders if this is evidence of a current lack of resources for the ICO. I think the ICO is under-resourced, and this is set to get worse but I’m not sure I agree with Paul that @FOIMonkey’s case illustrates this.

When Christopher Graham, the current Information Commissioner, was appointed, he inherited a damning backlog of FOI complaint cases, some going back several years. He stated openly that, to deal with this backlog, there might at times be a “silver standard” of investigation (as opposed to a gold one) from his office. True to his word, and much to his credit, the backlog has been greatly reduced, to the point where no cases were more than one year old, at the time of the publication of his last annual report.

So, I would agree with Paul, if @FOImonkey’s case was simply one of these “silver standard” ones, but that surely is not the case here. The refusal by the Royal Household to consider itself a public authority for the purposes of the Environmental Information Regulations 2004 was made over a year ago, and I understand the complaint to the ICO was made promptly after that. This means the ICO has had effectively twelve months to consider a request of considerable (if perhaps obscure) constitutional interest and significance. Even with limited resources twelve months is an awfully long time for a qualified solicitor and national Director of Freedom of Information to have to arrive at a decision.

I have a bigger concern though.

Paul is by no means uncritical of the ICO, and he notes that internal quality controls appear to be lacking, but he is perhaps not overly concerned with the act of copying itself (which could potentially be in breach of copyright):

I’m sure there are FOI out there who have copied chunks of the ICO’s decisions into their own FOI responses without citing them where it suited

However, I think the difference here is related to authority, and perception.

It is quite right for an FOI officer to quote ICO decisions in their own FOI responses (although I agree that citations should be given). Common law relies on a system of precedent and judicial authority, and, although the ICO is a regulator, and not a judicial body, the principle is similar: refer to and cite the authoritative statements of those who make decisions on the law in question.

However, the ICO is the one in a position of decision-making authority here, and to cite the website (without attribution) of one of the parties in a case he has to decide, gives rise to a perception of lack of independence, or bias. And that is an extremely important thing for a regulator to avoid doing.

As it is, most of the unattributed quotes are merely of uncontroversial statements of fact, and I am not sure they are clear evidence of any actual bias on the part of the ICO, but perception of bias is corrosive in itself. The classic test, as propounded by Lord Hope in Porter v Magill [2002] 2 AC 357, is

whether the fair-minded and informed observer, having considered the facts, would conclude that there was a real possibility that the tribunal was biased

Maybe I’m not fair-minded (although I do consider myself reasonably informed) so I would have to invite other observers to say whether they would conclude there was a real possibility of bias in this case.

UPDATE: the ICO has now tweeted saying the failure to cite sources was an error. Fair enough, but I’m not sure that changes my views here.

3 Comments

Filed under Environmental Information Regulations, Freedom of Information, Information Commissioner, transparency

March 19, 2013 · 8:34 am

Don’t Panic about the Royal Charter. Panic Now!

Bloggers shouldn’t panic about the proposed Royal Charter, unless they’re already panicking about the current law.

Imagine that a local citizen blogger – let’s call her Mrs B, who is a member of a local church group – decides to let others know, by way of a website, some news and information about the group. She includes information for those about to be confirmed into the church as well as extraneous, light-hearted stuff about her fellow parishioners, including the fact that one of them has a broken leg. Now imagine that a complaint by one of the fellow parishioners that this website is intrusive is upheld and Mrs B is found to have breached domestic law.

The coercive power of the state being brought against a mere blogger would be, you might imagine, unacceptable. You might imagine that any such domestic law, in a country which is a signatory to the European Convention on Human Rights, would be held to be in breach of the free-expression rights under Article 10 of the same.

This sort of outcome, you might say, would surely be unimaginable even under the proposed regulatory scheme by Royal Charter agreed in principle by the main party leaders on 18 March.

But, as anyone who knows about data protection law will tell you, exactly this happened in 2003 in Sweden, when poor Mrs Bodil Lindqvist was prosecuted and convicted under national Swedish legislation on data protection and privacy. On appeal to the European Court of Justice her actions were held to have been the “processing” of “personal data” (and, in the case of the person with the injured leg, of the higher-category “sensitive personal data”) and thus those actions engaged Article 3(1) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data which is given domestic effect in Sweden by the law under which she was convicted. The same Directive is, of course, given domestic effect in the UK by the Data Protection Act 1998 (DPA).

The response to the proposed Royal Charter was heated, and many people noticed that the interpretative provisions in Schedule 4 implied the regulation of web content in general (if said content was “news-related material”), thus potentially bringing the “blogosphere” and various social media activities into jurisdiction. This has caused much protest. For instance Cory Doctorow wrote

In a nutshell, then: if you press a button labelled “publish” or “submit” or “tweet” while in the UK, these rules as written will treat you as a newspaper proprietor, and make you vulnerable to an arbitration procedure where the complainer pays nothing, but you have to pay to defend yourself, and that will potentially have the power to fine you, force you to censor your posts, and force you to print “corrections” and “apologies” in a manner that the regulator will get to specify.

But the irony is, that is effectively exactly the position as it currently stands under data protection law. If you publish or submit or tweet in the UK information which relates to an identifiable individual you are “processing” “personal data”. The “data subject” can object if they feel the processing is in breach of the very broad obligations under the DPA. This right of objection is free (by means of a complaint to the Information Commissioner’s Office (ICO)). The ICO can impose a monetary penalty notice (a “fine”) up to £500,000 for serious breaches of the DPA, and can issue enforcement notices requiring certain actions (such as removal of data, corrections, apologies etc) and a breach of an enforcement notice is potentially a criminal offence.

As it is, the ICO is highly unlikely even to accept jurisdiction over a complaint like this. He will say it is covered by the exemption for processing if it is “only for the purposes of that individual’s personal, family or household affairs (including recreational purposes)”. He will say this despite the fact that this position is legally and logically unsound, and was heavily criticised in the High Court, where, in response to a statement from the ICO that

The situation would clearly be impossible were the Information Commissioner to be expected to rule on what it is acceptable for one individual to say about…another individual. This is not what my office is established to do. This is particularly the case where other legal remedies are available – for example, the law of libel or incitement.

Mr Justice Tugendhat said

 I do not find it possible to reconcile the views on the law expressed in the Commissioner’s letter with authoritative statements of the law. The DPA does envisage that the Information Commissioner should consider what it is acceptable for one individual to say about another, because the First Data Protection Principle requires that data should be processed lawfully. The authoritative statements of the law are to be found not only in the cases cited in this judgment (including para 16 above), but also by the Court of Appeal in Campbell v MGN Ltd [2002] EWCA Civ 1373 [2003] QB 633 paras [72] to [138], and in other cases. As Patten J made clear in Murray, where the DPA applies, if processing is unlawful by reason of it breaching the general law of confidentiality (and thus any other general law) there will be a contravention of the First Data Protection Principle within the meaning of s.40(1), and a breach of s.4(4) of the DPA…The fact that a claimant may have claims under common law torts, or under HRA s.6, does not preclude there being a claim under, or other means of enforcement of, the DPA.

The ICO will decline jurisdiction because, in reality, he does not have the resources to regulate the internet in its broadest sense, and nor does he have the inclination to do so. And I strongly suspect that this would also be the position of any regulator established under the Royal Charter.

I’m not normally one for complacency, and I actually think that the fact that the coercive power of the state potentially applies in this manner to activities such as blogging and tweeting is problematic (not wrong per se, note, but problematic). But the fact is that, firstly, the same coercive power already applies, to the extent that such activities engage, for instance, defamation law, or contempt of court, or incitement laws, and secondly – and despite the High Court criticism – no one seems to be particularly exercised by the fact that the current DPA regulator is able to ignore the activities of the blogosphere, so I doubt that the social and legal will exists to regulate these activities. I hope I’m not wrong.

2 Comments

Filed under Data Protection, human rights, Information Commissioner, monetary penalty notice, Privacy

Tagged as ,

March 13, 2013 · 8:25 am

The Right to Unknown Information

It is important to note that there is no requirement in the FOIA that those intending to make requests for information have any prior knowledge of the information they are requesting.

These words of the Information Commissioner (IC) in, Decision Notice FS50465008, are an important statement about the role of the Freedom of Information Act 2000 (FOIA) in investigative journalism and activism. They establish that, at least in the IC’s view, FOIA requests may be made on a speculative basis, without a knowledge of the specific contents of documents.

To many users and practitioners they are probably also an obvious statement about the right to information conferred by FOIA. If someone is asking for information from a public authority, it is self-evident that, at least in the large majority of cases, they do not know what the information specifically consists of – otherwise, why request it? As the IC goes on to say

The idea of a requirement of prior knowledge that the relevant information exists is itself contrary to the very purpose of the legislation, let alone prior knowledge as to what it comprises

The request in question, made – as those who followed the “Govegate” imbroglio might have guessed – by the impressively dogged journalist Christopher Cook (who has given me permission to identify him as the requester), was to the Cabinet Office for

the last email received by the [Prime Minister] personally on government business via a private non-GSI account. I also want the last government email sent by the PM via such an account

It was made in the context of suspicions that attempts might have been made to circumvent FOIA by conducting government business using private email accounts. For obvious reasons Chris was unlikely to be able to identify the specific type of information he sought, and the Cabinet Office knew this, telling the IC that

he has no idea of the nature of the information that may be contained in such emails, if indeed such emails even exist…For a request for a document to be valid, it needs to describe (if it would not otherwise be apparent) the nature of the information recorded in the document. The Cabinet Office does not accept that asking a public authority to undertake a search for emails without any subject matter, or reference to any topic or policy, sent using a particular type of account can satisfy the requirement on the application to ‘describe the information requested’

However, the IC rejected this, splendidly demolishing the Cabinet Office’s position with an argument by analogy

a request for the minutes of the last Cabinet meeting would clearly describe the information requested, even though it does not describe the content by reference to the matters discussed

I think this decision is particularly important because it accepts that, sometimes, a person contemplating requesting information from a public authority might not have a fully-formed view of what it is she wants, or expects to get. Authorities sometime baulk at requests which they see as “fishing expeditions”, but the practice of investigative journalism (in de Burgh‘s classic formulation “…to discover the truth and to identify lapses from it in whatever media may be available…”) will often involve precisely that, and the IC recognises this

Whilst public authorities might find such requests irritating, the FOIA does not legislate against so-called ‘fishing expeditions’

 The Cabinet Office must now treat Chris’s request as properly-made under FOIA. That does not mean that they will necessarily disclose emails from the PM’s private email account (in fact I’d be amazed if they did), but no one ever suggested the trade of investigative journalism was easy.

4 Comments

Filed under Cabinet Office, enforcement, Freedom of Information, Information Commissioner, transparency, Uncategorized

Tagged as , ,

March 8, 2013 · 1:10 pm

Why bother?

It is a statutory duty to comply with the 20-working-day response time to a request made under the Freedom of Information Act 2000 (FOIA). It is breach of the Code of Practice issued by the Secretary of State to fail to respond promptly to a request for internal review of a FOIA refusal (and the IC recommends 20 working days for this as well). It is a statutory duty, breach of which is potentially a criminal offence, to fail to comply with an Information Notice or a Decision Notice issued by the Information Commissioner (IC).

With all this in mind, and with acknowledgement that this is copied in total from an IC Decision Notice FS50427906, read the following comments by the IC, on how the Cabinet Office (who, er, have poor FOI history) handled a specific request, and weep.

73. At every stage during the handling of these requests and the investigation of this case, the Cabinet Office has been responsible for causing severe delays. As noted above, the complainant did not receive a substantive response to his requests until more than a year had passed following his first request, and over eight months following the second.

74. These responses were only forthcoming after the Cabinet Office was ordered to provide these in the earlier decision notice issued by the Commissioner. Even then, the Cabinet Office did not respond within the time limit specified in the notice. The internal review was also late and again was only provided following the intervention of the ICO.

75. During the Commissioner’s investigation the responses provided to his office were frequently late and incomplete. This necessitated the issuing of an information notice, which the Cabinet Office also failed to comply with within the specified time.

76. Given this background, the Commissioner trusts that the Cabinet Office will view the steps required in this notice as providing an opportunity to demonstrate to the complainant its commitment to its obligations under the FOIA and to providing a better service than the complainant has received thus far.

77. A record of the various issues that have arisen in relation to these requests and during this investigation has been made by the ICO. Issues relating to responding to requests in accordance with the FOIA and about responding promptly to correspondence in section 50 investigations have been raised with the Cabinet Office by the ICO in the past. The Commissioner is concerned that, despite this, issues of such severity have arisen in relation to the requests in this case. It is essential that the Cabinet Office ensures that there is no repetition of these issues in relation to future requests.

Leave a Comment

Filed under Cabinet Office, Freedom of Information, Information Commissioner, transparency

Tagged as ,

March 7, 2013 · 2:13 pm

Google Streetview and “Incidental” Processing

Someone I follow on twitter recently posted a link from Google Streetview of the interior of a pub, in which he could identify himself and a friend having a quiet pint. I must confess this addition of building interiors to the Streetview portfolio had passed me by. It appears that businesses can sign-up to have “Google Trusted Photographers and Trusted Agencies” take photographs of their premises, which are uploaded to the web and linked to Streetview locations.

When it was launched Streetview caused some concern in privacy circles, and this was prior to, and separate from, the concerns caused by the discovery that huge quantities of wifi payload data had been gathered and retained during the process of capture of streetview data. These more general concerns were partly due to the fact that, in the process of taking images of streets the Google cameras were also capturing images of individuals. Data protection law is engaged when data are being processed which relate to a living individual, who can identified from the data. To mitigate against the obvious potential privacy intrusions from Streetview, Google used blurring technology to obscure faces (and vehicle number plates). In its 2009 response to Privacy International’s complaint about the then new service the Information Commissioner’s Office said

blurring someone’s face is not guaranteed to take that image outside the definition of personal data. Even with a face completely removed, it will still be entirely likely that a person would recognise themselves or someone close to them. However, what the blurring does is greatly reduce the likelihood that lots of people would be able to identify individuals whose image has been captured. In light of this, our analysis of whether and to what extent Streetview caused data protection concerns placed a great deal of emphasis on the fact that at its core, this product is in effect a series of images of street scenes…the important data protection point is that an individual’s presence in a particular image is entirely incidental to the purpose for capturing the image as a whole. (emphasis added)

One might have problems with that approach (data protection law does not talk in terms of “incidental” processing of personal data) but as an exercise in pragmatism it makes sense. However, it seems to me that the “business interiors” function of Streetview takes things a step further. Firstly, these are not now just “images of street scenes”, and secondly, it is at least arguable that an individual’s presence in, for instance, an image of an interior of a pub, is not “entirely incidental” to the image’s purpose.

Google informs the business owner that “it would be your responsibility to notify your employees and customers that the photo shoot is taking place” but that “Google may use these images in other products and services in new ways that will make your business information more useful and accessible to users”. It seems likely to me therefore that, to the extent that personal data is being processed in the publishing of these images, Google and the business owner are potentially both data controllers (with consequent responsibilities and liabilities under European law).

It would be interesting to know if the Information Commissioner’s assessment of this processing would be different given that a factor he previously placed a “great deal of emphasis on” (the fact that Streetview was then ”just images of street scenes”) no longer applies.

1 Comment

Filed under Data Protection, enforcement, Information Commissioner, Privacy

Tagged as ,

February 26, 2013 · 2:57 pm

ICO cites Upper Tribunal on “vexatiousness”

The Information Commissioner has issued his first decision notice citing the Upper Tribunal’s judgments on “vexatiousness” since the latter were handed down

On 7 February 2013 the Upper Tribunal handed down judgment in three appeals relating to requests for information which had been refused either under section 14(1) of the Freedom of Information Act 2000, or regulation 12(4)(b) of the Environmental Information Regulations 2004. These two provisions provide, respectively, that the general obligation on public authorities to disclose information on requests is disapplied if the request is “vexatious” or “manifestly unreasonable”. Until the Upper Tribunal ruled on these cases there had been no authority from a relevant appellate court, and there was considerable variation in how the Information Commissioner and the First-tier Tribunal (Information Rights) approached these cases – I recently wrote about this position of uncertainty for PDP’s FOI Journal.

Both Paul Gibbons and Robin Hopkins have written, comprehensively, about the Upper Tribunal’s decisions, and the NADPO Spring Seminar will feature James Cornwell, of 11KBW, talking about the subject, so I merely blog now to observe that the Information Commissioner (IC) has correctly also taken note of them. In upholding a decision to refuse to disclose information, in decision notice FS50459595 (regarding a request to the Chief Constable of Surrey Police) he says

In reaching a conclusion in this case the Commissioner is also assisted by the Upper Tribunal’s comments in the case of Wise v Information Commissioner: “Inherent in the policy behind section 14 (1) is the idea of proportionality. There must be an appropriate relationship between such matters as the information sought, the purpose of the request and thetime and other resources that would be needed to provide it.”

It is interesting to note the IC’s reliance on this passage. What is also interesting (and not to be criticised) given the timing, is that the IC continues to refer to his own guidance (“When can a request be considered vexatious or repeated?”) in determining these sort of cases. The Upper Tribunal, while saying that “there is much to commend in the IC’s Guidance” (¶41 of the Dransfield judgment) did go on to give strong hints that it might need revising

in accordance with the thrust of this decision, it may be that the Guidance needs to place greater weight on the importance of adopting a holistic and broad approach to the determination of whether a request is vexatious or not, emphasising the attributes of manifest unreasonableness, irresponsibility and, especially where there is a previous course of dealings, the lack of proportionality that typically characterise vexatious requests

The fact that the IC honed in on the concept of a proportionality approach in this recent decision notice suggests the revised guidance might be appearing sooner rather than later.

3 Comments

Filed under Environmental Information Regulations, Freedom of Information, Information Commissioner, Information Tribunal, vexatiousness

February 22, 2013 · 5:18 pm

Practice makes perfect

Wirral borough council is on the watch list at the moment. I would really like to send in a good practice squad to Wirral borough council, but I do not have the powers do that. I am not picking on Wirral; it is just an example that comes to mind

So said Commissioner Christopher Graham in evidence to the Justice Committee during a recent one-off session on the work of the Information Commissioner’s Office (ICO).

The rather self-contradictory observation that he was not picking on that particular public authority is not the most interesting point about his comments (although it does seem a bit hard on Wirral, when the Department for Education, the Department for Work and Pensions and the Office of the First Minister and Deputy First Minister of Northern Ireland are all also currently subject to formal monitoring for especially poor compliance with the Freedom of Information Act 2000 (FOIA)).

What does strike me, though, is his complaint that he lacks powers to “send in a good practice squad”. Although strictly true, there is an enforcement power which he does have, which equates to the power to send in a “good practice squad”, albeit with the consent of the public authority concerned. To my knowledge, however, this is a power he and his predecessor have never exercised.

Section 47(3) of FOIA says

The Commissioner may, with the consent of any public authority, assess whether that authority is following good practice

 In the ICO’s own guidance on his FOIA regulatory action policies, he says

 An assessment may be conducted with the consent of a public authority. It is designed to determine whether an authority is following good practice – and specifically, to assess its conformity to the codes of practice [made under sections 45 and 46 of FOIA]

A Standard Operating Procedure document (disclosed, ironically enough, by the ICO in response to a FOIA request) suggests that the ICO sees his policy of monitoring FOIA compliance in specific poorly-performing authorities as constituting a s47(3) assessment. However, my feeling is that this does not restrain him from extending his actions under this section to physically sending in ”good practice” teams. Certainly the Scottish Information Commissioner sees his equivalent powers under section 43(3) of the Freedom of Information (Scotland) Act 2002 as a means of conducting such good practice visits, and he does approximately twelve of them a year.

I appreciate that the ICO prefers to take a more informal route towards enforcing FOIA compliance, by means, for example, of monitoring at a distance, or by issuing undertakings (“The culmination of negotiated resolution, [committing] an authority to a particular course of action in order to improve its compliance”). But there is doubt about how seriously some public authorities treat this informal approach. If he really did want to send in “good practice squads” I think he could certainly do so (and if an authority were to refuse consent, it could potentially trigger stronger powers, like practice recommendations and enforcement notices).

1 Comment

Filed under Cabinet Office, enforcement, Freedom of Information, Information Commissioner, practice assessment