Category Archives: transparency

FOI – there’s no (jurisdictional) limits

Practitioners tend to have a few mantras about the Freedom of Information Act 2000 (FOIA). Some of those mantras admit of exceptions (“it’s requester and motive blind” may, for instance, fall away where the wider context of the request needs to be considered in “vexatious” cases) but the mantra that “anyone, anywhere can make a request” had never been seriously challenged, until recently.

In conjoined cases, the First tier Tribunal – apparently, one understands, of its own volition – had raised an issue as to whether FOIA did indeed have extra-territorial application – contrary to the standard approach to statutory construction whereby UK legislation applies only to those who are citizens of the UK, or on its territory – such that requests could be made by anyone, anywhere in the world.

If the Tribunal had decided that the standard approach applied, and no extra-territorial effect was in place, there would have been a significant diminution of rights, and a consequent diminution in the accountability of public authorities. More practically, we would have no doubt seen, at least from some public authorities, identity verification measures being directed at requesters.

Thankfully, the Tribunal decided that there was extra-territorial effect, in a decision handed down orally on 27 January (with written reasons to follow).

There are posts about the case(s) on both Cornerstone Barristers’ and Doughty Street’s websites.

Leave a comment

Filed under Freedom of Information, Information Tribunal, transparency

Students challenge International Baccalaureate on data protection grounds

My firm is acting for the students, and there’s a link to the detailed grounds in this explanatory piece.

Leave a comment

Filed under accuracy, Data Protection, fairness, Further education, GDPR, transparency

HMG FOI “Clearing House” – infringing GDPR?

I’ve written a piece for OpenDemocracy questioning the legality of the government’s practice of circulating some FOI requesters’ names across all departments.

Leave a comment

Filed under Cabinet Office, Data Protection, Freedom of Information, transparency

Open by Design, Closed by Default?

The Information Commissioner’s Office (ICO) have published their new access to information strategy. Something strikes me about their “Goal #2”:

Goal #2: Providing excellent customer service to individuals making requests to us and lead by example in fulfilling our own statutory functions

The thing strikes me is that, bizarrely, they seem to have misunderstood the goal they’ve set themselves (I nearly referred to it as their “own goal”, which has a bit of a ring about it). They say

We have a varied range of individuals who request an independent review from us and a diverse range of public authorities within our jurisdiction from large central government departments to very small parish councils.

What they don’t say is “we are a public authority, subject to the Freedom of Information Act, and have to comply with its timescales, and promote observance of it by example”.

And, unfortunately, there is much evidence recently of a failure to do this.

The views in this post (and indeed all posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.

Leave a comment

Filed under Freedom of Information, Information Commissioner, transparency

ICO still breaching law it’s meant to oversee

A month ago I pointed out some rather concerning  failings by the Information Commissioner’s Office (ICO) in its own compliance with Freedom of Information (FOI) law. At the time, the ICO press office told me

We acknowledge that we have fallen short of expectations in these instances but can confirm that the responses to both requests will be issued soon

It’s with some incredulity, therefore, that I see that one of the requests has still not been responded to, despite a further twenty working days having elapsed, and despite the (even greater) incredulity of the requester:

You have missed your own deadline, months after you should have answered this request. Your inability to answer a simple FOI promptly would be a disgrace if you were a local council. The fact that you are the FOI regulator makes your handling of my request a scandal.

I am utterly powerless here – I cannot complain to the regulator about your contempt for FOI because you are supposed to be the organisation I would complain to. Do you have no shame at all? No self respect?

What am I supposed to do now?

The other request I highlighted at the time has had a response, albeit one that was cursory, to say the best, and which is now the subject of a request for internal review.

My own request for the ICO’s compliance figures is now the subject of a formal complaint (with a request for a decision notice under section 50 of the FOI Act), although I am told that there will be, er, a delay in getting to it.

The views in this post (and indeed all posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.

Leave a comment

Filed under Freedom of Information, Information Commissioner, transparency

ICO breaching the law it’s meant to oversee

This may be complete coincidence, but on the WhatDoTheyKnow website, there are two Freedom of Information (FOI) requests, on similar themes, which requesters have made to the Information Commissioner’s Office (ICO), to which – at the time of writing – the ICO appears simply to be failing to respond, way beyond the statutory timescale of 20 working days.

Both requests are about procurement of external consultants. In the first, the requester asked

Please disclose all current agreements for provision of legal services by outside bodies such as barristers chambers, law firms etc. This should include the rates of pay agreed.

The request was made on the 19th February and more than three months on, has simply had no response (other than an automated acknowledgment).

In the second the (different) requester asked

how many times the Information Commissioner’s Office has engaged consultants, companies or other specialists to deliver services to the ICO without putting the work out to tender or otherwise advertising the opportunity externally

That request was made on the 26th February and, barring some holding responses, which seem to have dried up, it has had no substantive response.

The failure to respond is concerning, and the failure to communicate inexplicable. One wonders where the reluctance comes from.

My own recent experience of making FOI requests to them indicates a less-than-ideal level of compliance with the laws the ICO is meant to regulate. However, when, some time ago, I asked the ICO for compliance figures, they refused to disclose them, saying they would be published soon. Yet approximately six months on they still haven’t done so (which is not in compliance with the best-practice requirements of the section 45 FOI Code of Practice).

I offered the ICO an invitation to comment on this blogpost, and in response a spokesperson said: “We aim to resolve 95% of information requests within the statutory deadline, unless we have sought an extension. We acknowledge that we have fallen short of expectations in these instances but can confirm that the responses to both requests will be issued soon.” No comment was made on the wider point about compliance, and publication of compliance statistics. (I would also make the observation that it’s rather surprising ICO only aims to respond to 95% of requests within the statutory deadline – surely they would (and should) aim to respond to 100% within the timeframe mandated by the law?)

I’ve previously expressed concern about the ICO’s unwillingness to take enforcement action against recalcitrant, if not contemptuous, public authorities for poor FOI compliance. Elizabeth Denham has recently (and unsuccessfully) called for an extension of FOI law, saying

Part of my job is to make sure that the legislation my office regulates fulfils its objectives and remains relevant. When it does not, I will speak out

Will she also speak out about the fact that her office is not itself complying with the legislation it regulates?

The views in this post (and indeed all posts on this blog, unless they indicate otherwise) are my personal ones, and do not represent the views of any organisation I am involved with.

Leave a comment

Filed under Freedom of Information, Information Commissioner, transparency

ICO hasn’t given own staff a GDPR privacy notice

The first principle of GDPR says that personal data shall be processed in a transparent manner. Articles 13 and 14 give details of what information should be provided to data subjects to comply with that principle (and that information should be provided at the time it is collected (if it is collected directly from the data subject)).

As the Information Commissioner’s Office (ICO) says

Individuals have the right to be informed about the collection and use of their personal data. This is a key transparency requirement under the GDPR. [emphasis added]

and

Getting the right to be informed correct can help you to comply with other aspects of the GDPR and build trust with people, but getting it wrong can leave you open to fines and lead to reputational damage

If you read the ICO’s Guide to GDPR, it is largely predicated on the understanding that privacy notices will be made available to data subjects, effectively as a prerequisite to overall compliance.

So, one thing a data controller must – surely – prioritise (and have prioritised, in advance of GDPR becoming applicable in May 2018) is the preparation and giving of appropriate privacy notices, including to its own employees.

With that in mind, I was interested surprised astounded well-and-truly-gobsmacked to see an admission, on the “WhatDoTheyKnow” website, that the ICO itself has – almost a year on from GDPR’s start – not yet prepared, let alone given, its own staff a GDPR privacy notice

I can confirm we do not currently hold the information you have requested. The privacy notice for ICO employees is currently under construction.

As getting the right to be informed wrong can leave one open to fines (as well as reputational damage), one wonders if ICO is considering fining itself for this fundamental infringement of a fundamental right?

The views in this post (and indeed all posts on this blog, unless they indicate otherwise) are my personal ones, and do not represent the views of any organisation I am involved with.

10 Comments

Filed under Data Protection, fairness, GDPR, Information Commissioner, privacy notice, transparency

There’s nothing like transparency…

…and this is nothing like transparency

Those of us with long memories will remember that, back in 2007, in those innocent days when no one quite knew what the Freedom of Information Act 2000 (FOIA) really meant, the Information Commissioner’s Office (ICO), disclosed some of its internal advice (“Lines to Take” or “LTTs”) to its own staff about how to respond to questions and enquiries from members of the public about FOIA. My memory (I hope others might confirm) is that ICO resisted this disclosure for some time. Now, the advice documents reside on the “FOIWiki” pages (where they need, in my opinion, a disclaimer to the effect that some of the them at least are old, and perhaps out-of-date).

Since 2007 a number of further FOIA requests have been made for more recent LTTs – for instance, in 2013, I made a request, and had disclosed to me, a number of LTTs on data protection matters.

It is, therefore, with some astonishment, that I note that a recent FOIA request to ICO for up-to-date LTTs – encompassing recent changes to data protection law – has been refused, on the basis that, apparently, disclosure would, or would be likely to, inhibit the free and frank exchange of views for the purposes of  deliberation, and would otherwise prejudice, or would be likely otherwise to prejudice, the effective conduct of public affairs. This is problematic, and concerning, for a number of reasons.

Firstly, the exemptions claimed, which are at section 36 of FOIA, are the statute’s howitzers – they get brought into play when all else fails, and have the effect of flattening everything around them. For this reason, the public authority invoking them must have the “reasonable opinion” of its “qualified person” that disclosure would, or would be likely to, cause the harm claimed. For the ICO, the “qualified person” is the Information Commissioner (Elizabeth Denham) herself. Yet there is no evidence that she has indeed provided this opinion. For that reason, the refusal notice falls – as a matter of law – at the first hurdle.

Secondly, even if Ms Denham had provided her reasonable opinion, the response fails to say why the exemptions are engaged – it merely asserts that they are, in breach of section 17(1)(c) of FOIA.

Thirdly, it posits frankly bizarre public interest points purportedly militating against disclosure, such as that the LTTs “exist as part of the process by which we create guidance, not as guidance by themselves”, and “that ICO  staff should have a safe space to provide colleagues with advice for them to respond to challenges posed to us in a changing data protection landscape”, and – most bizarre of all – “following a disclosure of  such notes in the past, attempts have been made to utilise similar documents to undermine our regulatory procedures” (heaven forfend someone might cite a regulator’s own documents to advance their case).

There has been such an enormous amount of nonsense spoken about the new data protection regime, and I have praised ICO for confronting some of the myths which have been propagated by the ignorant or the venal. There continues to be great uncertainty and ignorance, and disclosing these LTTs could go a long way towards combatting these. In ICO’s defence, it does identify this as a public interest factor militating in favour of disclosure:

disclosure may help improve knowledge regarding the EIR, FOIA or  the new data protection legislation on which the public desire information as evidenced by our increase in calls and enquiry handling

And as far as I’m concerned, that should be the end of the matter. Whether the requester (a certain “Alan Shearer”) chooses to challenge the refusal is another question.

The views in this post (and indeed all posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.

Leave a comment

Filed under Data Protection, Freedom of Information, GDPR, Information Commissioner, transparency

The Reading of the 30,000

There is some irony in the quite extraordinary news that the Independent Commission on Freedom of Information received 30,000 submissions in response to its public call for written evidence: one of the considerations in the call for evidence was the fact that “reading time” cannot currently be factored in as one of the tasks which determines whether a request exceeds the cost limit under section 12 of the FOI Act. 

Lord Burns has now announced that

Given the large volume of evidence that we have received, it will take time to read and consider all of the submissions

Well, yes. The Commission originally planned to report its findings “before the end of the year” (that is, the parliamentary year, which ends on 17 December). It also planned to read all the evidence which was before the Justice Committee when it conducted its post-legislative scrutiny of FOIA in 2012, and there was a fair amount of that. But let us put that to one side, and let us estimate that reading and where necessary taking a note of each of the current 30,000 submissions will take someone ten minutes (as some submissions were 400 pages long, this is perhaps a ridiculously conservative estimate). That equates to 300,000 minutes, or 5000 hours, or 208 days of one person’s time (assuming they never slept or took a break: if we imagine that they spent eight hours reading every day, it would be 625 days).

I don’t know what sort of administrative support Lord Burns and his fellow Commission members have been given, but, really, to do their job properly one would expect them to read the submissions themselves. There are five of them, so even assuming they shared the reading between them, we might expect they would between them take 125 days (without a break, and with little or no time to undertake their other jobs and responsibilities) to digest the written evidence.

Lord Burns has sensibly conceded that the Commission will not be able to report by the end of the year, and he has announced that two oral evidence sessions will take place in January next year (although who will participate has not been announced, nor whether the sessions will be broadcast, nor even whether they will take place in public).

What is clear though is that someone or ones has a heck of a job ahead of them. I doubt that the Commission, as an advisory non-departmental public body, would be amenable to judicial review, so it is probably not strictly bound by public law duties to take all relevant evidence into account when arriving at its decisions and recommendations, but, nonetheless, a failure so to do would open it up to great, and justified, criticism.

And, one final point, as Ian Clark noticed when submitting his evidence, the web form was predicated on the assumption that those making submissions would only be from an “organisation”. Surely the Commission didn’t assume that the only people with views on the matter were those who received FOI requests? Surely they didn’t forget that, ultimately, FOIA is for the public?

The views in this post (and indeed all posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.

4 Comments

Filed under Freedom of Information, transparency

Talk on the future of FOI

Mostly because I haven’t posted much on this blog recently, I’m uploading a version of a talk I gave at the recent conference of the National Police Chiefs Council (NPCC). I was asked to talk, alongside FOIKid Bilal Ghafoor, and tribunal judge David Farrer QC, about what the teenage years of the Freedom of Information Act 2000 might look like. After I’d reflected on this, I ended up rather more optimistic than I expected. YMMV, as they say.

Before I talk about the future, and FOI as it enters those awkward teenage years, I wanted to reflect a bit on its early infanthood. Has it achieved what it was hoped it would achieve? Has it worked well?

As is sometimes overlooked, Parliament declined to enact a purpose clause into the 2000 Freedom of Information Act (against the urging of the then Information Commissioner Elizabeth France). So when we talk about whether FOIA has achieved its aims, we are, to an extent, second guessing what Parliament intended. However, in 2012 the Justice Committee conducted post-legislative scrutiny of FOIA, and the Ministry of Justice (drawing on the original White Paper which preceded the Act) identified four objectives for it:

  • openness and transparency;
  • accountability;
  • better decision making;
  • and public involvement in decision making, including increased public trust in decision making by government

And the committee felt that FOIA has achieved the first three but the secondary objective of enhancing public confidence in Government had not been achieved, and was unlikely to be achieved.

And I think this is broadly right: we have seen more openness and transparency – when working well together FOIA feeds into the Transparency Agenda and vice versa. Huge amounts of public sector information have been made available where once it wasn’t. And with openness and transparency come, or should come more accountability and better decision making. But that final objective, involving increasing public trust in decision making, has almost been achieved in the negative – and that is partly to do with how the public hear about FOIA. Many, probably most, major FOIA stories run by the media almost inevitably involve scandal or highlight wasteful practice, and often go hand in hand with litigation aimed at preventing disclosure. The MPs expenses scandal was one of FOIA’s major victories (although, let us not forget, it was a leak to the Telegraph, rather than a final FOIA disclosure, that led to the full details coming out) but while it enhanced FOIA’s status, it’s hard to say it did anything but greatly damage public trust in government, and more widely, politicians.

But the Justice Committee report identified something else, and something very relevant when we start to look to the future of FOIA. It stated that “the right to access public sector information is an important constitutional right” – something which Lady Justice Arden also recognised in her recent Court of Appeal judgment in the Dransfield case. And when something is identified as part of our constitution, it becomes pretty hard to remove it, or amend it to any great extent. The Conservative government appear to be experiencing this at the moment, as their plans to repeal the Human Rights Act have been stalled. The Human Rights Act can also be said to have achieved constitutional status – by incorporating the European Convention on Human Rights into the domestic law of the UK, it represented a major shift in how individual rights are protected under British law. It may well end up being the case that the only way the Act could be repealed would be by replacing it with something essentially the same (or by pulling out of the Convention, and pulling out of Europe) and even then, as Lord Bingham said

“Which of these rights…would we wish to discard? Are any of them trivial, superfluous, unnecessary? Are any them un-British?”

The rights enshrined in the European Convention are fundamental, and they’re not going to go away, and when one considers that one of them – Article 10 – contains not just the right to freedom of expression, but the right to receive and impart information (subject to necessary and lawful conditions) one can begin to perceive that a Freedom of Information Act helps give effect to this fundamental right.

A majority of the Supreme Court, in the Kennedy judgment last year, went even further, and said that a (qualified) right to receive information from a public authority was not just enshrined in the Convention Rights, but existed (and always has existed) under the Common Law.

What I’m saying, by going off on a somewhat legalistic tangent, is that the right to request and receive public sector information is so fundamentally embedded in our legal and constitutional landscape, that I don’t see any realistic challenge to the principle (and I doubt any of you would). But it also means that any tinkering with the right becomes correspondingly difficult. And this is why although I think FOI will have some teenage tantrums, it won’t have a huge teenage meltdown and emerge from its bedroom a completely different individual.

But with that important caveat, what might we see?

Well, under Francis Maude in the Cabinet Office and Chris Grayling at the Ministry of Justice (although Lib Dem Simon Hughes had the actual FOI brief) we saw significant strides, and a lot of fine words, about the importance of transparency, with Maude even saying in 2012

“I’d like to make Freedom of Information redundant, by pushing out so much data that people won’t have to ask for it”

But they have all gone on to other things – Maude to the Lords, Grayling to Leader of the Commons and Simon Hughes back to his day job, after losing his seat last month. Will this lead to changes? Well, still very much in post is David Cameron, and he has spoken before about his concerns about FOI “furring up the arteries of government” and of FOI’s “buggeration factor”, which doesn’t bode well for those of us who support the Act. And minister with responsibility for FOI (under Michael Gove as Justice Secretary) is Dominic Raab. Raab is strong on civil liberties and is known to be a frequent user of FOI in his parliamentary and constituency work. One of his targets was the Police Federation – in 2011 he sent requests to all forces asking for figures on the number of police staff working full-time for the Federation. But Gove is reputed not to be so keen on FOI – indeed, in 2011 his then Department of Education was found to have used private email accounts to conduct government business, apparently in the belief that this took them outside FOIA.

It does seem clear that any changes to FOIA are not high on the government’s list of priorities: there was nothing in the Conservatives’ election manifesto, and there have been no obvious pronouncements in the early days.

For a flavour though of what might be on the cards it’s instructive to go back to the government response to the post-legislative scrutiny. On the subject of FOI cost limits there was a suggestion that further factors might be taken into account – so, added to the costs of locating and retrieving information it might become possible to take into account consideration and redaction time. This could have more profound effects that is immediately apparent – as most of you will know, those two activities can take up a large amount of time, and if that change were brought in I think we would see a huge increase in cost refusals.

Another related suggestion was that for costs purposes requests from the same person or group of persons could be aggregated EVEN where there was no similarity between the subject of the requests. It is not hard to see how this would be devastating for some journalists who make use of FOI.

And a further suggestion was the introduction of fees for appealing a case to the Information Tribunal. This would be unlikely to affect public authorities, but requesters could well be dissuaded. No doubt some of those would be the more speculative, persistent or frivolous of requesters, but I would be concerned that some well-intentioned requesters would decide not to exercise their rights if such a change were made.

On the more “pro-FOI” side, we are likely to see further public authorities made subject to FOIA. ACPO of course came in in 2012, Network Rail this year, and Theresa May has made clear that she would like to see the Police Federation covered.

But also discussions need to be had about the extent to which private contractors performing public functions are caught by FOI. The government has previously indicated that it thinks this can be achieved through appropriate contractual provisions, but I’m dubious – without a clear legal obligation, and associated enforcement mechanism, I struggle to see why this would happen.

So, despite my optimism that the fundamental principles of FOI are now constitutionally embedded, I don’t necessarily think there will be no changes. But I continue to think they will be essentially minor, and this is because I think there is a further factor which protects those fundamental principles. As I said, Dominic Raab has traditionally used FOI to gather information to better help him in his job. And thousands and thousands of other people do so. Journalists are the most obvious example (and when it comes to defenders of the right to receive information you couldn’t ask for a more vocal group) but campaign groups, other public authorities, academics and private citizens do so. And for this reason FOI is popular. Unlike the Human Rights Act there are no (or very few – I don’t know of any) journalists campaigning for FOIA’s repeal. Politicians don’t campaign on a platform of opposition to the right to receive public information.

FOI does promote better openness and transparency; better accountability; better decision making, and even if it hasn’t yet, and probably never will, improve the public trust in government decision-making, one thing which would further destroy that trust would be changes to make public authorities less accountable. And the media and campaigners would be lined up to make the point vociferously.

FOI may, in its teenage years, suffer from its own equivalent of angst, anger and acne, but it will have strong friends to support it.

The views in this post (and indeed all posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with..

4 Comments

Filed under Freedom of Information, transparency