Category Archives: Freedom of Information

November 4, 2013 · 2:24 pm

Walberswick Vexatiousness

Back in August of this year I blogged about an interesting decision by the First-tier Tribunal (Information Rights) (FTT) which approached the subject of “vexatiousness” (section 14(1) of the Freedom of Information Act 2000 (FOIA) by observing that what might be an excessively burdensome to a small public authority (such as a rural parish council) might not be so to a large public authority.

The public authority in question was Walberswick Parish Council, and, since that decision, there have been two others, meaning that Walberswick now has more experience in the FTT than most county councils and many other huge public authorities.

All three cases relate to refusals to disclose information on the grounds that the requests were vexatious, and the most recent – McCarthy v IC & Walberswick Parish Council – is no different: and, indeed, they all follow the line of authority on vexatiousness laid down by the Upper Tribunal earlier this year in ICO v Devon County Council and Dransfield GIA/3037/2011. What is noteworthy, however, is the disapproval with which the judge clearly views the continuing vexatious requests being made to Walberswick:

WPC is a parish council, not a department of state. The limits on its resources were well-known to the Appellant and to everybody else involved in this unhappy saga…It is plain that FOIA requests, both those made by the Appellant and the others of which he was concurrently aware, reduced WPC to paralysis…Furthermore, it was perfectly plain to any sensible individual and without doubt to one of the Appellant`s sophistication and social awareness that such pressure would drive elected and ultimately appointed councillors from office, as well as their clerk, who was at the centre of the battle.

Indeed, so concerned was the FTT that, very unusually, it put future requesters on warning on potential costs

WPC will not function as a democratically elected body until this bombardment by FOIA requests ceases. That may well mean that, as here, intrinsically reasonable requests for information are treated as vexatious if part and parcel of a sustained assault motivated by a desire to disrupt. Crippling a parish council by subjecting it to ceaseless interrogation is not a sensible way to improve its service to local residents nor to fulfil its duties under FOIA…it is highly unlikely that any future appeal from this parish council will be decided on different principles or without regard to the outcome of this and earlier appeals relating to Walberswick. Unsuccessful appeals by campaigning requesters may well attract the unusual sanction of orders for costs

(In passing, I would query whether this statement is potentially prejudicial to future cases in the FTT, and could actually deter people from making legitimate requests. In fact, it seems to suggest that any FOIA request to Walberswick could be considered to be prima facie vexatious. In fairness to the FTT though, this is merely the outcome of the “sustained assault” by the current campaigners).

Awards of costs in the FTT are very rare (I can only recall three cases). To put as-yet-unknown requesters, who haven’t yet made requests, on notice is a measure of how seriously the FTT view the harm caused by a campaign such as that experienced by Walberswick. In administrative law we already have the concept of Wednesbury Unreasonableness – one wonders if, in this particular branch of administrative law, we should start using Walberswick Vexatiousness as a term of art?

1 Comment

Filed under Freedom of Information, Information Tribunal, Upper Tribunal, vexatiousness

Tagged as

October 25, 2013 · 4:02 pm

One for the insomniacs – Upper Tribunal on EIRs and commercial confidentiality

In May 2012 I blogged about a case in the First-tier Tribunal (Information Rights) (FTT).  It was an appeal by  Swansea Friends of the Earth against a decision of the Information Commissioner (IC) not to require the Environment Agency to disclose  information relating to financial guarantee arrangements put in place a landfill site operator, as a condition for obtaining a permit to operate a waste landfill site near Swansea.

I was critical of the FTT’s approach to breach of confidence, as it applies to the Environmental Information Regulations 2004 (EIR). However, with the handing down of judgment by the Upper Tribunal, following an appeal by Natural Resources Wales, as successor to the Environment Agency, I see I was wrong on two points (one minor, one major), right on another, and my key point was left undecided. Exciting stuff folks – hold on to your hats!

My minor error was to repeat the FTT’s description of Megarry J’s classic tri-partite breach of confidence test in Coco v A N Clark (Engineers) Ltd [1969] RPC 44 as being a common law doctrine. As the Upper Tribunal points out

That, to be correct, is a decision about the equitable doctrine of confidential communication (not the common law) that may arise otherwise than by contract between the parties

Silly me. Silly FTT.

Natural Resources Wales argued before the Upper Tribunal that

there was a statutory obligation in place [militating against disclosure], so that the Agency did not have to rely on equitable grounds

And this goes to my major error, which was to overlook, in striving to make a point of general application about the modern development of the law of confidence, that in this specific case the IC’s original Decision Notice had found that information in question was confidential for the purposes of Regulation 12(5)(e) of the EIR firstly because the provisions of the Pollution Prevention and Control (England and Wales) Regulations 2000 (PPCR) (which were the regulations – since revoked and remade – which applied to the licence in question) effectively made it so, and only secondly because the information and the circumstances by which it came into the Environment Agency’s control met the Coco v Clark tests.

Regulation 12(5)(e) provides that

a public authority may refuse to disclose information to the extent that its disclosure would adversely affect…the confidentiality of commercial or industrial information where such confidentiality is provided by law to protect a legitimate economic interest

The Upper Tribunal held that the FTT had erred in law, saying (paragraphs 51-52), as had the IC in the first instance, that relevant provisions of the PPCR meant that confidentiality was “provided by law to protect a legitimate economic interest”:

disclosure of the relevant information would adversely affect confidentiality “where such confidentiality is provided by law to protect a legitimate economic interest”… Here that must be regarded as a reference across to regulation 31 of the 2000 Regulations. Regulation 31(1)(a) makes an express reference to commercial confidentiality. The factual background to these appeals makes it plain that the figures in question here were figures produced within the 2000 Regulations framework and were subject to the necessary application and ruling to protect confidentiality of them

So it was not necessary to consider whether the information was also covered by the equitable doctrine of confidence.

The point on which I was right (in my original post) was regarding whether, or the extent to which, regulation 12(5)(e) of the EIR was directly comparable to the similar section 41 of the Freedom of Information Act 2000 (FOIA). I said

This extension of the FOIA confidentiality principles into the EIR is controversial…

and the Upper Tribunal judge says

the tests in section 41 and regulation 12 are separate and cannot be read together to include in one something in the other simply because they deal with similar issues

which is pretty unequivocal (and see also Chichester District Council v IC and Friel (GIA 1253 2011), cited as authority for the lack of analogy between the two).

Finally, another point I hadn’t addressed (although Phil Bradshaw did, in the comments to my original post) concerns the failure by the FTT to distinguish between the location of information in documents, with the information itself. The FTT had said

the information came into existence through a process of negotiation between the parties

but this surely was not the case – rather, documents, containing information, came into existence through a process of negotiation. But the information itself was caught by regulation 12(5)(e)

the focus is on this information, not on any particular document or form in which those figures are recorded or any process by which they emerged. I accordingly agree with the challengers that in so far as the First-tier Tribunal concerned itself with the specific location of those figures in specific documents produced as part of the licensing process rather than the information itself it was wrong in law

So there you have it. A rip-roaring convoluted run-through of why an obscure old blog post by me was slightly wrong and slightly right. I aim to please.

Leave a comment

Filed under Confidentiality, Environmental Information Regulations, Freedom of Information, Information Commissioner, Information Tribunal, Upper Tribunal

Tagged as ,

October 10, 2013 · 8:55 am

Let’s Blame Data Protection – the Gove files

Thanks to Tim Turner, for letting me blog about the FOI request he made which gives rise to this piece

On the 12th September the Education Secretary, Michael Gove, in an op-ed piece in the Telegraph, sub-headed “No longer will the quality, policies and location of care homes be kept a secret” said

A year ago, when the first shocking cases of sexual exploitation in Rochdale were prosecuted, we set up expert groups to help us understand what we might do better…Was cost a factor? Did we need to spend more? There was a lack of clarity about costs. And – most worrying of all – there was a lack of the most basic information about where these homes existed, who was responsible for them, and how good they were….To my astonishment, when I tried to find out more, I was met with a wall of silence

And he was in doubt about where the blame lay (no guesses…)

The only responsible body with the information we needed was Ofsted, which registers children’s homes – yet Ofsted was prevented by “data protection” rules, “child protection” concerns and other bewildering regulations from sharing that data with us, or even with the police. Local authorities could only access information via a complex and time-consuming application process – and some simply did not bother…[so] we changed the absurd rules that prevented information being shared

This seemed a bit odd. Why on earth would “data protection” rules prevent disclosure of location, ownership and standards of children’s homes? I could understand that there were potentially child protection concerns in the too-broad-sharing of information about locations (and I don’t find that “bewildering”) but data protection rules, as laid out in the Data Protection Act 1998 (DPA), only apply to information relating to identifiable individuals. This seemd odd, and Tim Turner took it upon himself to delve deeper. He made a freedom of information request to the Department for Education, asking

1) Which ‘absurd’ rules was Mr. Gove referring to in the first
statement?

2) What changes were made that Mr. Gove referred to in the second
statement?

3) Mr Gove referred to ‘Data Protection’ rules. As part of the
process that he is describing, has any problem been identified with
the Data Protection Act?

Fair play to the DfE – they responded within the statutory timescales, explaining

Regulation 7(5) of the Care Standards Act 2000 (Registration) (England) Regulations 2010 …prohibited Ofsted from disclosing parts of its register of children’s homes to any body other than to a local authority where a home is located. Whatever the original intention behind this limitation, it represented a barrier preventing Ofsted from providing information about homes’ locations to local police forces, which have explicit responsibilities for safeguarding all children in their area…we introduced an amendment to Regulation 7 with effect from April 2013

But their response also revealed what had been very obvious all along: this had nothing to do with data protection rules:

the reference to “data protection” rules in Mr Gove’s article involved the Regulations discussed above, made under section 36 of the Care Standards Act 2000. His comments were not intended as a reference to the Data Protection Act 1998

This is disingenuous: “data protection” has a very clear and statutory context, and to extend it to more broadly mean “information sharing” is misleading and pointless. One could perhaps understand it if Gove had said this in an oral interview, but his piece will have been checked carefully before publication, and personally I am in no doubt that blaming data protection has a political dimension. The government is determined, for some right reasons, and some wrong ones, to make the sharing of public sector data more easy, and data protection does, sometimes – and rightly – present an obstacle to this, when the data in question is personal data and the sharing is potentially unfair or unlawful. Anything which associates “data protection” with a risk to child safety, serves to represent it as bureaucratic and dangerous, and serves the government agenda.

And the rather delicious irony of all this – as pointed out on twitter by Rich Greenhill – is that the “absurd rules” (the Care Standards Act 2000 (Registration) (England) Regulations 2010) criticised by Gove were made on 24 August 2010. And the Secretary of State who made these absurd rules was, of course, the Right Honourable Michael Gove MP.

How absurd.

Leave a comment

Filed under Data Protection, data sharing, Freedom of Information, Let's Blame Data Protection, transparency

October 3, 2013 · 2:34 pm

Two more years for Chris Graham?

I think one mark of a true information rights nerd is whether they read minutes of meetings at the Information Commissioner’s Office (ICO), which are published, with a generally admirable commitment to transparency, on their website.

While browsing some recent minutes (of the Management Board meeting of 22 July) I noticed something interesting, which I wasn’t aware of (and haven’t seen anyone else pick up on?). Under a heading of “Major issues affecting the ICO” is

The Ministry of Justice has confirmed the Government’s intention to recommend to HM The Queen that Christopher Graham is reappointed as Information Commissioner [IC] for a period of two years following his current tenure ending in June next year.

The IC is a Crown appointment and his or her tenure is set at five years (paragraph 2(1) of Schedule 5 of the Data Protection Act 1998) but, by virtue of paragraph 2(5) he or she may be reappointed, provided he or she is not over 65, or has not already served for fifteen years. The reappointment of Christopher Graham (born 1950) will (if it happens) take him to that retirement age of of 65.

This is hardly shock news: all three of Graham’s predecessors as IC (formerly “Data Protection Registrar”) were reappointed after their initial terms of office, and he has, on most objective analyses, performed well in office: he got rid of the appalling backlog of Freedom of Information cases he inherited, and has been an effective stern-faced enforcer of data protection breaches. What he hasn’t done, yet, is see the implementation of the General Data Protection Regulation – the updating of the creaking 18-year-old current European data protection regime. But, given the apparently interminable wrangling about that instrument, one wonders whether an extra two years, starting in June 2014, will even help him achieve that.

Leave a comment

Filed under Data Protection, Freedom of Information, Information Commissioner

Tagged as ,

October 3, 2013 · 12:35 pm

Unintended FOI consequences

A nice little example of how a Freedom of Information (FOI) request can sometimes bring about an unexpected change, and advance a cause which has little to do with FOI.  Although in this instance I’m undecided whether this was a good thing or not.

On 3 January this year the Information Commissioner’s Office (ICO) issued a decision notice in respect of two requests for information made to Thames Valley Police (TVP) relating to

an incident in which the complainant’s driveway was blocked by the vehicle of someone he believes was visiting TVP headquarters

The ICO was satisfied, on the correct test of the balance of probabilities that TVP did not hold this information.

Nonetheless, the requester appealed that decision to the First-tier Tribunal (Information Rights), which has just issued a decision, in the form of a Consent Order disposing of the proceedings. The Schedule to the Consent Order explains

Thames Valley Police will give full and reasonable consideration to the reinstatement of 6 monthly liaison meetings with residents living in the vicinity of TVP HQ South with the objective of avoiding any unreasonable impact of operational activities on local residents

In consequence of this (and the agreement of the ICO) the request and the appeal have been withdrawn by the requester. So, a satisfactory outcome for the parties was achieved (although one notes that if the meetings are not arranged to the satisfaction of the requester, he will submit a further FOI request about the original incident!).

Of course, it would be have been preferable if this compromise could have been agreed in February 2011, when the requests first started. And a large amount of public money has been expended on something which is only very loosely, if at all, related to the aim of FOI (as stated in the explanatory notes to the Act): to provide a right of access to recorded information held by public authorities.

Leave a comment

Filed under Freedom of Information, Information Commissioner, Information Tribunal

Tagged as ,

September 28, 2013 · 8:44 am

It’s our Right to Know, Mr ICO

On 29 August the Information Commisioner’s Office (ICO) served a monetary penalty notice (MPN) of £100,000 on Aberdeen City Council. MPNs can be served on a data controller under section 55A of the Data Protection Act 1998 (DPA) for a serious contravention of the Act of a sort likely to cause serious damage or serious distress. In this instance, the ICO explained

sensitive information relating to social services involvement with several individuals [was] published online. The information included details relating to the care of vulnerable children.

The circumstances under which this happened were

a council employee accessed documents, including meeting minutes and detailed reports, from her home computer. A file transfer program installed on the machine automatically uploaded the documents to a website

Many people in the field of information rights have concerns that there is a significant lack of understanding on the part of many about the risk of inadvertently disclosing personal data on the web. In view of this, I though I would simply ask the ICO, and the Council, what website was involved, in order to inform my understanding. So I tweeted

What “website” were the files uploaded to?

I reminded the ICO and the Council on several occasions about this, and pointed out it was a valid request under the Freedom of Information Act 2000 (FOIA) and Freedom of Information (Scotland) Act 2002 (FOI(S)A), even though I had really only wanted a quick factual reply. The Council have asked me to contact them separately to make the FOI(S)A request, and I’m aware the Scottish Information Commissioner takes a different view on tweeted requests to her counterpart for the rest of the UK, so I’ve banged in a request at WhatDoTheyKnow. The ICO, by contrats, did treat my tweet as a valid request (although I got no acknowledgment of this, contrary to their good practice guidance) and responded yesterday on the twentieth working day, with a link to their disclosure log

Those who know me will be unsurprised to know that I don’t accept the refusal, and also unsurprised to know that, on International Right to Know Day 2013 I’ve submitted a crashingly pompous request for ICO to conduct an internal review. Here it follows, in all said crashing pomposity:

Please review your refusal to disclose information.

On 29 August you served a Monetary Penalty Notice on Aberdeen City Council

“after a council employee accessed documents, including meeting minutes and detailed reports, from her home computer. A file transfer program installed on the machine automatically uploaded the documents to a website, publishing sensitive information about several vulnerable children and their families, including details of alleged criminal offences”

I asked, on 30 August, “What ‘website’ were the files uploaded to?”

You have refused to disclose, claiming the exemption at section 44 of the Freedom of Information Act 2000, which provides an exemption “if disclosure [of the information] (otherwise than under this Act) by the public authority holding it…is prohibited by or under any enactment”. You say disclosure is prohibited, because “the information was provided to the ICO in confidence as part of our regulatory activities” and that the provisions of section 59(1) of the Data Protection Act 1998 forbid disclosure. Section 59(1) says

“No person who is or has been the Commissioner, a member of the Commissioner’s staff or an agent of the Commissioner shall disclose any information which—

(a)has been obtained by, or furnished to, the Commissioner under or for the purposes of the information Acts [of which FOIA is one],

(b)relates to an identified or identifiable individual or business, and

(c)is not at the time of the disclosure, and has not previously been, available to the public from other sources

unless the disclosure is made with lawful authority”

I am happy to concede that a) and b) are met here, but not c). This is because section 59(2) explains what “with lawful authority” means. Firstly, and largely as an aside, section 59(2)(a) says that a disclosure is made with lawful authority if

“the disclosure is made with the consent of the individual or of the person for the time being carrying on the business”

I am surprised you do not feel that, in your role as a public authority but also as the regulator for Freedom of Information, it would be prudent and transparent simply to ask the Council whether it consents. Nonetheless, on a strict reading of the law, I concede that you do not have an obligation to do so.

Secondly (and I note you do not even address this important provision), section 59(2)(e) says that disclosure is made with lawful authority if

“having regard to the rights and freedoms or legitimate interests of any person, the disclosure is necessary in the public interest”

I would argue that analysis of whether this provision permits disclosure requires a two-fold test. Firstly, is disclosure necessary in the public interest? Secondly, if it is, do the rights and freedoms or legitimate interests of any person militate against this public-interest disclosure?

On the first point, I am not aware of any direct authority on what “necessary” means in section 59(2)(e) of DPA, but I would argue that it imports the meaning adopted by leading European authorities. Thus, as per the high Court in Corporate Officer of the House of Commons v The Information Commissioner & Ors [2008] EWHC 1084 “‘necessary”…should reflect the meaning attributed to it by the European Court of Human Rights when justifying an interference with a recognised right, namely that there should be a pressing social need and that the interference was both proportionate as to means and fairly balanced as to ends”. It is my view that there is a pressing social need to recognise the risks of indavertent uploading to the internet, by public authorities and others, of sensitive personal data, especially when this is by automatic means. Other examples of recent incidents and enforcement action illustrate this. For instance, as your office is aware, there have been reports that a regional Citizens’ Advice Bureau has indavertently made available on the internet very large amounts of such data, probably because of a lack of technical knowledge or security which resulted in automatic caching by Google of numerous files https://informationrightsandwrongs.com/2013/09/24/citizens-advice-bureaucracy/. Also for instance, as you are aware, there have been many many examples of indavertent internet publishing of personal data in hidden cells in spreadsheets http://www.ico.org.uk/news/blog/2013/the-risk-of-revealing-too-much. There is a clear lack of public understanding of the risks of such indavertent disclosures, with a consequent risk to the privacy of individuals’ often highly sensitive personal data. Any information which the regulator of the DPA can disclose which informs and improves public understanding of these risks serves a pressing social need and makes the disclosure “necessary”.

On the second point, I simply fail to see what rights and freedoms or legitimate interests of any person can be engaged, let alone suffer a detriment by disclosing what public website the Council employee uploaded this to. If there are any, it would be helpful if your response to this Internal Review could address this. It may be that you would point to the information having been provided to you in confidence, but I similarly fail to see how that can be: was this an express obligation of confidence, or have you inferred it? In either case, I would question (per one the elements of the classic formulation for a cause of action in breach of confidence given by Megarry J in Coco v A.N.Clark (Engineers) Ltd [1969] R.P.C. 41) whether the information even has the necessary quality of confidence (this was a public website after all).

I hope you can reconsider your decision.

best wishes

1 Comment

Filed under Confidentiality, Data Protection, FOISA, Freedom of Information, human rights, Information Commissioner, monetary penalty notice, transparency

Tagged as , ,

September 4, 2013 · 1:34 pm

Pornography and its Frustrations

For those who have never worked with “basic” versions of web-filtering software, let me describe typical frustrations.

Researching the subject of malicious communications? Found what looks like a helpful search return via google? *CLICK*…

Access Blocked

Access to the requested web page (http://www.helpfullookingcommentary.com/) has been blocked as it is categorised as PROFANITY, which is considered unsuitable for access using this equipment. If you have any queries, please contact your system administrator

 Researching defamation? Found what looks like a helpful search return via google? *CLICK*…

Access Blocked

Access to the requested web page (http://www.interestinganalysis.com/) has been blocked as it is categorised as GAMBLING, which is considered unsuitable for access using this equipment. If you have any queries, please contact your system administrator

Doing some local history research on Scunthorpe? Found what looks like a helpful search return via google? *CLICK*…

Access Blocked

Access to the requested web page (http://www.scunthorpematters.com/) has been blocked as it is categorised as PORNOGRAPHY, which is considered unsuitable for access using this equipment. If you have any queries, please contact your system administrator

Each of these failed hits will be logged by some sysadmins as “attempt to access PROFANITY/GAMBLING/PORNOGRAPHY”. 

I suggest people bear this in mind when reading the numerous delighted shocked commentators who have picked up on the Huffington Post story which says that a Freedom of Information request apparently revealed that

MPs, Lords and parliamentary staff have been trying to access porn websites potentially thousands of times, official figures reveal.

The story goes on to say that users of the parliamentary network, over a period of one year

have repeatedly attempted to access websites classed on Parliament’s network as pornographic [emphasis added]

So, they haven’t tried to access pornography; they’ve tried to access sites that web-filtering software classes as pornography. A further clue to the fact that this outrageous story of parliamentary loucheness might not be as it’s being presented is the fact that in October 2012 there were 3391 “attempts”, in the following month there were 114,844 and in the month after that there were 6918. Either November that year coincided with rampant horniness on the part of politicians and their staff, or there’s another reason for the spike.

I suspect some new definitions were added to the software, which drastically increased the “false positive” hits, and these crappy new definitions were tweaked for the following months.

In fact, as I drafted this post Sky News’ Roddy Mansfield, and the Guardian’s James Ball have pointed out on twitter that that November 2012 spike coincided with intense political and media interest in the topic of sexual offences, following as the scandal involving Jimmy Savile broke. This is very plausible, and suggests that, far from users of parliamentary systems shirking their responsibilities by browsing for smut, they were actually trying – apparently unsuccessfully, and probably with no small frustration – to find out more about a serious and current news item.

But that makes for a dull story.

UPDATE:

As several people have pointed out, if this is a case of poor filtering, it provides a nice lesson in irony for those who propose ISP filtering as some sort of solution to the alleged “corroding” influence of online pornography.

4 Comments

Filed under Freedom of Information, journalism, parliament

Tagged as

August 23, 2013 · 6:56 am

Pivot tables and databreaches

About a year ago I first became aware of reports of disturbing inadvertent disclosures of personal data (often highly sensitive) by public authorities who had intended only to disclose anonymous and/or aggregate data. These incidents were occurring both in the context of disclosures under the Freedom of Information Act 2000 (FOIA) and in the context of proactive disclosure of datasets. Mostly they were when what had been disclosed was not just raw data, but the spreadsheet in which the data was presented. Spreadsheet software is often very powerful, and not all users necessarily understand its capabilities (I don’t think I do). By use of pivot tables data can be sorted, summarised etc, but also, from the uninitiated or unwary, hidden. If the person who created or maintained a spreadsheet containing a pivot table is not involved in the act of publicly disclosing it it is possible that an apparently innocuous disclosure will contain hidden personal data.

Clearly such errors are likely to constitute breaches – sometimes very serious breaches – of the Data Protection Act 1998 (DPA) Those of us who were aware of a number of these inadvertent breaches were also aware that, if public authorities were not alerted to the risk a) the practice would continue and b) potentially large numbers of “disclosive” datasets would remain out in the open (in disclosure logs, on WhatDoTheyKnow, in open data sets etc). But we were also aware that, if the situation was not managed well and quietly, with authorities given the opportunity to correct/withdraw errors, inquisitive or even malicious sorts might go trawling open datasets for disclosures which could potentially be very damaging and distressing to data subjects.

It was with some relief, therefore that, following an earlier announcement by WhatDoTheyKnow, the Information Commissioner’s Office (ICO) finally gave a warning, and good guidance, on 28 June (although this relief was tempered by finding out, via Tim Turner, that the ICO had known about, and apparently done nothing about, the problem for three years). At the same time the ICO announced that it was “actively considering a number of enforcement cases on this issue”.

It appears that, according to an announcement on its own website, Islington Council is the first recipient of this enforcement. The Council says it has

accepted a £70,000 fine from the Information Commissioner’s Office (ICO) after a mistake led to personal data being released

after it

responded to a Freedom of Information (FOI) request asking for information including the ethnicity and gender of people the council had rehoused. The response, in the form of Excel spreadsheet tables, included personal information concealed behind the summary tables

Fair play to Islington for acknowledging this and agreeing immediately to pay the monetary penalty notice. And if some of the other reported breaches I heard about were as bad as they sounded £70,000 will be at the lower end of the scale.

(thanks to @owenboswarva on twitter for flagging this up)

UPDATE:

The ICO has now posted details of the MPN, and this clarifies that the disclosure was made on WhatDoTheyKnow and was only identifed when one of their site administrators noticed it.

Leave a comment

Filed under Breach Notification, Data Protection, Freedom of Information, Information Commissioner, monetary penalty notice, transparency

Tagged as , ,

August 22, 2013 · 5:28 pm

Academic Freedom and FOI

Pointed observations in a judgment which are not directly related to the matters pleaded are usually worth noting. Those in a recent case involving the PACE trial and Queen Mary, University of London, are essential reading for academics and support staff who deal with FOI

In a ruling handed down this week the First-tier Tribunal (Information Rights) (“FTT”) has upheld the Information Commissioner’s (IC) decision that Queen Mary, University of London, was entitled to rely on the exemption at section 36(2)(b)(1) and (2) of the Freedom of Information Act 2000 in refusing to disclose minutes of the Trial Steering Committee and Trial Management Groups of the Pace Trial. The trial had been set up to compare and test the effectiveness of four of the main treatments currently available for people suffering from chronic fatigue syndrome (CFS), also known as myalgic encephalomyelitis (ME), but it attracted considerable criticism from some quarters. In the words of the FTT

There has been a storm of comments about this study. There had been deeply wounding personal criticisms of individuals concerned and over the years individuals in this field of research and treatment have withdrawn from research in the face of hostile irrational criticism and threats.

The FTT found that the exemption was engaged:

it is pellucidly clear that the progress and conduct of research in this area would be hampered by the publication of minutes of meetings such as sought by this request because individuals would be less willing to engage in research, participate in steering committees, provide guidance, debate issues about the conduct of research as fully and frankly as they otherwise would; as fully and frankly as would most benefit the research and the patients it is intended to help

and the public interest favoured maintaining the exemption:

the appellant’s arguments in favour of disclosure of the minutes when so much has been made available publicly in relation to this research and been subjected to such high levels of independent scrutiny do not outweigh the considerable weight to be given to the public interest in maintaining the safe space for academic research

But the FTT then made wide-ranging and significant observations about the concept of academic freedom and its relation to FOI. The decision cites Article 13 of The Charter of Fundamental Rights of the European Community:

Freedom of the arts and sciences The arts and scientific research shall be free of constraint. Academic freedom shall be respected.

and section 202 of the Education Reform Act 1988 which places an obligation on the University Commissioners to

ensure that academic staff have freedom within the law to question and test received opinion, and to put forward new ideas and controversial or unpopular opinions, without placing themselves in jeopardy of losing their jobs or privileges they may have their institutions

and the FTT stresses the “profound importance” of academic freedom, noting that the IC has an obligation, as an emanation of the state, to give effect to Article 13. The judgment notes that the purpose of universities is to disseminate and generate knowledge and that disclosure of information is their primary purpose (“the activity which imbues the University with its moral significance”). In rather remarkable terms, the seeking of and disclosure of information (from academic institutions) under FOIA is unfavourably compared to this academic dissemination:

A parallel process of dissemination through FOIA is unlikely to be as effective or robust as the process of lectures, seminars, conferences and publications which are the lifeblood of the University. They are likely to be a diversion from the effective evaluation, publication and scrutiny of research through the academic processes. All too often such requests are likely to be motivated by a desire not to have information but a desire to divert and improperly undermine the research and publication process – in football terminology – playing the man and not the ball

One might pause to question whether this unfairly overplays the likelihood of FOIA requests being detrimental to academia, and also overstates the amount of information which is disseminated to the general public through academic research. Part of the reason for FOIA is that it enables the public to access information that public authorities specifically choose not to proactively disclose. One sees similar arguments at play in the apparent prioritising of the “transparency agenda” over FOIA disclosure.

There follows, though, a sensible suggestion for what researchers might consider at the outset of projects. With a view to the obligation to publish and maintain a publication scheme, institutions are advised that

it might well be worth considering at the start of a major project such as this setting out a publication strategy identifying what materials will be produced in the course of the project, which materials will be published and when (this will enable s22 to be considered if FOIA requests are received for such material), and which are unlikely to be published under FOIA as exemptions may be engaged

and the IC is (again with a nod to his Article 13 obligations) prompted to issue guidance on this.

Finally, the judgment suggests that the University missed a trick with this specific request

properly viewed in its context, this request should have been seen as vexatious- it was not a true request for information-rather its function was largely polemical and as such in the light of recent Upper Tribunal judgements might have been more efficiently and effectively handled if treated as vexatious

The Tribunal Judge, Christopher Hughes, has a wealth of experience in the field of academic and medical research. These are crucial observations about the relationship between FOI and academia. We already have a new exemption on its way specifically for academic research (by way of clause 19 of the Intellectual Property Bill) but this decision appears to reinforce the protection that academic research and associated information will be given from FOIA disclosure.

Postscript:

The BMJ has an article on this judgment (behind the paywall, but letters in response are here (thanks to Zuton who has commented below for drawing this to my attention).

8 Comments

Filed under Freedom of Information, Further education, Information Commissioner, Information Tribunal, Uncategorized

Tagged as ,

August 14, 2013 · 8:00 am

Poor judgement?

Public authorities need to be cautious when disclosing performance figures of their staff under Freedom of Information (FOI) laws. They need to be even more cautious when disclosing performance figures of third parties.

Imagine if your employer, or, worse, a third party, disclosed under FOI that, of all your peers, you made the most decisions in the exercise of your employment which were subsequently found to be wrong, and which had to be overturned. If in fact those figures turned out to be incorrect, you would probably rightly feel aggrieved, and perhaps question whether the failure of data quality was in fact a breach of your rights under the Data Protection Act 1998 (DPA) and of your employment rights.

That is what appears to have happened to certain judges in Scotland, according to a letter in The Scotsman today, from the Chief Executive of the Scottish Court Service. The letter points out that a previous (29 July) article in The Scotsman – “Meet the judge with the highest number of quashed convictions” (now no longer available, for obvious reasons) – was, although published in good faith, based on inaccurate information disclosed to the paper under FOI. The letter contains an apology to

Lord Carloway and Lord Hardie, who featured prominently in 
this article, for misrepresenting their position in relation to 
appeal decisions

because the erroneous disclosed statistics suggested they had had more judgments overturned on appeal than was actually the case.

Of course, the principle of judicial independence means that judges are, strictly, not employed. But as Carswell LCJ said

All judges, at whatever level, share certain common characteristics. They all must enjoy independence of decision without direction from any source, which the respondents quite rightly defended as an essential part of their work. They all need some organisation of their sittings, whether it be prescribed by the president of the industrial tribunals or the Court Service, or more loosely arranged in collegiate fashion between the judges of a particular court. They are all expected to work during defined times and periods, whether they be rigidly laid down or managed by the judges themselves with a greater degree of flexibility. They are not free agents to work as and when they choose, as are self-employed persons. Their office accordingly partakes of some of the characteristics of employment . .. [Perceval-Price v Department of Economic Development [2000] IRLR 380]

and the Supreme Court took this further in O’Brien v Ministry of Justice [2010] UKSC 34 by saying “Indeed judicial office partakes of most of the characteristics of employment” (emphasis added).

Whatever their employment status, judges’ performance figures are clearly an important matter to them, and the Scottish Court Service has a duty to maintain accurate figures (particularly when disclosing them publicly). As Wodehouse said, “it has never been difficult to distinguish between a Scotsman with a grievance and a ray of sunshine”. I imagine that the office of Mr McQueen, the day after the first article, was not filled with sunshine.

Leave a comment

Filed under Data Protection, employment, FOISA, Freedom of Information, Uncategorized

Tagged as ,