Category Archives: Uncategorized

Has an NHS Trust tried wrongly to prevent publication of information under FOI? Or are they just perhaps (naively) internally exploring the options?

Brace yourselves. Hold on to your china. I have a shocking announcement to make: NOT ALL PUBLIC AUTHORITY STAFF FULLY UNDERSTAND FOI!

In fact, some of them don’t even like it – check out some of the submissions made to the Justice Committee when it was conducting its post-legislative scrutiny of the Freedom of Information Act 2000 (FOIA).

Even worse than those who don’t understand it and say so, are those who don’t understand it but think they do. All practitioners have been faced with the person who announces loudly and wrongly which exemption should be claimed, and won’t accept they’re wrong, because “that’s what we always used to say when I worked at [former employer]”.

These observations are prompted by a twitter exchange, and subsequent Telegraph article yesterday, regarding the accidental disclosure of internal emails by NHS Newcastle-upon-Tyne, in which staff there discuss how to respond to an FOI request. The article reports how the staff considered whether they had to disclose a strategy report, and that the following comments were made

The planned preventative maintenance is all my own work for which I can express intellectual rights…

The…strategy is commercially sensitive and subject to executive approval…Can we say that our Strategy is commercially sensitive and refuse to disclose?

We could refer to [other information] which is in the public domain…It would at least make us look slightly helpful

The Trust clearly did not want this exchange disclosed, because after inadvertently doing so, they tried to use an email recall function, which as we all know, hardly ever works. I don’t blame them – this sort of exchange hardly reflects well on the FOI knowledge of and intentions of, certain staff. If it happened in my organisation I’d toddle on down to their office with a rolled-up copy of ICO guidance and bang them on the head with it (or maybe just suggest they have some training).

However, this sort of exchange goes on daily, in hundreds of public authorities, as hard-working, possibly naive staff grapple with complex FOI requests. They’ll mull things over, discuss options, make ridiculous suggestions, until, ultimately – one hopes – an FOI officer pulls it all together and arrives at a reasoned, fair and lawful decision about disclosure.

Of course that doesn’t always happen, and not all organisations have the bulwark of an honest, good FOI officer in place, but disclosure of internal discussions about potential exemptions, before any final decision on disclosure has been arrived at, does not point towards a potential criminal offence, as some were suggesting on twitter, and it doesn’t really make for a good story.

How data security is like a car park. Sort of.

Last Friday I parked in my usual car park. I entered it past the signs informing me of the terms for parking there, and the penalties for breaching them. After parking I walked past the signs reminding me in big letters “HAVE YOU PAID AND DISPLAYED?”, and went in to work.

But when I returned later that day I had a ticket on my windscreen – a penalty charge notice – imposed for failing to display a ticket. I still don’t know how I managed to do this. Every other time I have parked, and bought a ticket, and placed it in the same place on the dashboard. But something went wrong this time.

Ever one to draw a clumsy analogy for the sake of a blog post, it got me thinking about data security. We all know how to avoid enforcement action by the Information Commissioner’s Officer (ICO): train your staff, have good policies and procedures and check regularly they’re being complied with. Then, if something goes wrong, the ICO will determine that there was nothing more as an organisation you could do to prevent the incident, and you are not in breach of the Data Protection Act. (Of course it’s a bit more complicated than that. But not much).

However watertight your policies are though, and however often and loudly you remind people about them, mistakes happen. As Einstein is reported to have said “Two things are infinite: the universe and human stupidity; and I’m not sure about the universe.” All you can do is mitigate the risks, and mitigate them sufficiently to satisfy those who regulate you. Thus, the ICO will (should) not impose a Monetary Penalty Notice if you had taken all the data security precautions you reasonably could have taken but one person made a stupid mistake leading to a data breach.

And, because the car park has clear and fair terms and conditions, I won’t challenge the lawfulness of imposing a penalty charge notice just because one stupid individual failed to check that his stupid car had a stupid $%*&ing ticket on the stupid dashboard last Friday morning.

 

How the Campaign for Freedom of Information was integral to the original enactment of the Freedom of Information Act, and continues to lead on the subject. Support it.

In the mid-1990s my understanding of the concept of Freedom of Information was limited to two points: first, that it was heavily pushed by an organisation called the Campaign for Freedom of Information, and its director, Maurice Frankel and late Chairman, James Cornford and second, that FOI was, surely, unarguably a Good Thing.

In the heady months after Labour’s 1997 election victory it was easy simply to assume that the manifesto commitment to introducing a Freedom of Information Bill would be honoured. While those with more than a passing interest in the subject noted over the following months, with concern, a major retreat from David Clark‘s White Paper Your Right to Know, the Freedom of Information Act 2000, as passed, was still a piece of progressive legislation, very much to be welcomed.

It is interesting, then, to read, in Jack Straw’s recently published, and sometimes rather mean-spirited memoirs, potentially just how little is owed to those who are now seen as the key figures in that Labour administration, and how much is owed to the Campaign for Freedom of Information. Straw describes how the manifesto commitment resulted in a White Paper to parts of which he and Tony Blair were fundamentally opposed:

Tony himself was by now getting extremely worried about the eccentric FOI policy to which his government, in a trance, had seemingly committed itself

and how

I had half a thought that the best thing might to be bin the whole bill, or kick it into the long grass with a Royal Commission

But ranked against him were “all the enthusiasts for FOI-max, ably briefed by the indefatigable Maurice Frankel”.

(Straw effectively, by his account, found himself fighting his own bill. His victory, as he sees it, was to ensure that a power for ministers ultimately to veto disclosure was included. The unsavoury picture painted is of an over-eager administration – committed by its manifesto – unwillingly enacting a progressive law, but ham-stringing it in the process. And of course, we have since had several instances where that ministerial veto has been exercised (twice by Straw himself),, most recently and worringly to prevent disclosure of lobbying correspondence by the Prince of Wales, despite an extraordinarily thorough ruling in favour of disclosure in the Upper Tribunal.)

But this blog post is not about Jack Straw, now sniping from the opposition back benches, and not about the illiberal ministerial veto. It is about what a debt we all have to the Campaign for Freedom of Information, which has continued to argue for a more robust FOI Act, while defending it against threats of diminution. Regarding the latter, it is difficult to over-emphasise the significance of a late submission by the Campaign to the Justice Committee’s post-legislative scrutiny of the Act, which demolished many of the more specious arguments made by those criticising the Act. (Let us hope that the Committee’s welcome final report is accepted by the government, and that those of us who defend the Act can breathe easily, for a time at least.)

I have no personal interest in the Campaign (although I should perhaps declare that Maurice once gifted me a very-well-used-but-broken La Pavoni espresso machine) but it needs celebrating, and cherishing, and supporting (funding will always be an issue with an organisation like this). Everyone who uses and champions FOI should recognise this.

 The Guardian has published an article suggesting court lists should be freely available as part of a drive towards open data. William Perrin, in his own words a local active citizen, proposes (“with the government’s drive to transparency and open data “) a charter for transparency in the courts under which

people should be able to find out easily, on the internet:
what cases are expected to come up in a court from the time that they are scheduled
name, address and specific charges in all cases available from the time the case is scheduled (see footnote)
the full names, including first names, of judges, prosecution and defence lawyers, witnesses, and other professionals who speak during proceedings (e.g. magistrates’ clerks giving legal advice) from when they are known
judgements handed down from the end of the working day on which the case is concluded

Footnote

In criminal cases, the following basic information should be readily available
The full spelling of a defendant’s name
Their date of birth and full home address, including door number and postcode
The charges against them (including an opportunity to read them)
Written copies of any reporting restrictions applicable in the case

Perrin appreciates some of the risks

All the above is subject to contempt of court and protection of vulnerable defendants and witnesses

but

The longstanding openness of courts must not be compromised by data protection. In particular, well meaning but misplaced concerns about the data protection act and copyright must not stop the recording and transmission of information presented in open court.

(In passing, I struggle to understand his contrasting of “codified” data protection and copyright and “uncodified” open justice. If by “codified” he is referring to written laws and procedures then I would refer him to, in particular,  rule 39.2(1) of the Civil Procedure Rules, which provides that “The general rule is that a hearing is to be in public”. This is reinforced by our Convention rights, given full domestic effect in the Human Rights Act 1998. Article 6 says

In the determination of his civil rights and obligations or of any criminal charge against him, everyone is entitled to a fair and public hearing within a reasonable time by an independent and impartial tribunal established by law. Judgement shall be pronounced publicly by the press… (emphasis added))

Justice certainly should be, as a general principle, open. It is an ancient concept – it goes to the heart of the judicial system.  Lord Halsbury famously said, in 1913

Publicity is the very sole of justice…and the surest of all guards against improbity (Scott v Scott 1913 AC 417)

and Lord Diplock, in 1979

The application of this principle of open justice has two aspects: as respects proceedings in the court itself it requires that they should be held in open court to which the press and public are admitted and that, in criminal cases at any rate, all evidence communicated to the court is communicated publicly. As respects the publication to a wider public of fair and accurate reports of proceedings that have taken place in court the principle requires that nothing should be done to discourage this (Attorney-General  v Leveller Magazine Ltd. and Others [1979] A.C. 440)

At the recent Justice Wide Open event at CityUniversity, I saw Perrin speak eloquently about his experiences of trying to engage as a member of public in his local courts. He and other speakers gave dispiriting accounts of misinformed court staff and the paucity of reporters covering court news.  Addressing these shortfalls is a worthy aim, and I would not want to be seen as in any way criticising someone for doing that. Perrin, however, appears to see data protection (and perhaps to a lesser extent, the law of copyright) as contributing to an erosion of open justice.

The DPA has its origins – in part – in concerns about the potential for harm caused by electronic processing of personal information. As far back as 1972 the Younger Committee on Privacy had recognised public concerns about the accumulation by the state of electronic databanks. Electronic processing power has increased immeasurably since then, and it is in the light of that increase that we must consider proposals to open up the personal data of those appearing in court.

The DPA gives effect to theUK’s obligation under Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data. In very broad terms it requires that those who “process” “personal data” in the role of “data controller” do so in compliance with the Act and specifically with eight data protection principles (at Schedule 1). Failure to do so can in some circumstances constitute a criminal offence. The DPA is enforced primarily by the Information Commissioner (IC) who has various powers, including one to impose monetary penalties (to a maximum of £500,000 for serious breaches of the Act).

Personal data are

data which relate to a living individual who can be identified from that data

so, clearly, someone’s name, address and criminal charge would be personal data

“Processing” is defined as

obtaining, recording or holding the information or data or carrying out any operation or set of operations on the information or data

Publishing court listings on the internet would be classed as “carrying out an operation on the data”. Under Perrin’s proposals it would appear to be, at least in the first instance, the courts themselves which would be disclosing. The courts would certainly be classed as data controllers (the “person who…determines the purposes for which and the manner in which any personal data are…processed”). They would, therefore, have to process the personal data in accordance with the Act.

Just because personal data are or might be considered to be in the public domain, this does not necessarily authorise further processing. In R (on the application of Robertson) v City Of Wakefield Metropolitan Council [2001] EWHC Admin 915 the High Court held that the sale of the electoral register to commercial concerns was in breach of section 11 of the DPA (which gives data subjects the right to object to direct marketing based on their personal data) and of their Article 8 rights. Kay J rejected a submission that because an individual could not object to public right of inspection of the electoral register, there was not an actionable breach of these Article 8 rights arising from the sale of the same (and he could have equally rejected a similar submission on DPA grounds). The collection and publishing of personal data in the form of an electoral register available for physical public inspection was prescribed in law, and was a legitimate form of processing; its sale to commercial interests was not.

For similar reasons the Information Commissioner advises planning authorities that, although they may have a statutory duty to maintain, and make available for physical public inspection, a register of planning applications including objections

Extreme care should be taken to avoid any unnecessary disclosure of telephone numbers, email addresses and signatures. The need for the local authority to hold such information is obviously of benefit to all parties. However, there is no requirement to make it publicly available on the Internet… The recommendation…is that the applicant’s telephone number, email address and signature should not be visible via a website or other online system.

The DPA says that information about criminal offences will almost certainly be “sensitive personal data”, which includes

Personal data consisting of information as to… the commission or alleged commission by [the data subject] of any offence, or…any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings.

Such data must be processed fairly and lawfully, but also at least one condition in Schedule 3 must be met. In simple terms, Schedule 3 will, broadly, for the current purposes, only permit processing of sensitive personal data if the data subject has explicitly consented to it,  if it is required by law or if it is necessary for the purposes of legal proceedings or the administration of justice.

Even the posting outside the court room of lists is processing of sensitive personal data, and, although there is some inconsistency (I have heard, for instance, that some courts tweet the names of defendants) the general approach is that these lists are not published widely by the court service. (To the limited extent that they are published I would suggest that the processing would be justified by an argument that it is necessary for the purposes of legal proceedings or the administration of justice.)

The problem with publishing, on the internet, the sort of information Perrin’s charter proposes, is that the internet has few limits, whether special, technological or temporal.

Anyone, in any country, could harvest the data published. They could amass huge data banks not just of criminals, but those who have merely been charged with an offence, as well as witnesses. If that information is then tied to their address (and date of birth) hugely sensitive databases could be created, about which there might be little knowledge, and over which there might be little control. In 2009 the Information Commissioner prosecuted a man called Ian Kerr for running a secret blacklist of containing information about construction workers’ personal relationships, trade union activity and employment history. Kerr created the blacklist on behalf of an organisation called The Consulting Association. The Commissioner only had jurisdiction because this processing of personal data took place in theUK. A blacklist amassed from court data, and hosted outside the EU, could be hugely damaging to the employment prospects of countless people, whether they be convicted, charged and not convicted, or even merely witnesses.

Moreover, this information could be kept indefinitely. Rehabilitation of offenders, and the laws that underpin the rehabilitation could be greatly compromised if this sort of court data is openly available for anyone to retain and archive. In S and Marper v United Kingdom 30562/04 [2008] ECHR 1581 the European Court of Human Rights held that the indefinite retention of DNA samples of people who had been arrested or charged, but not convicted of an offence, was a violation of Article 8 of the Convention, and observed that

The protection of personal data is of fundamental importance to a person’s enjoyment of his or her right to respect for private and family life, as guaranteed by Article 8 of the Convention. The domestic law must afford appropriate safeguards to prevent any such use of personal data as may be inconsistent with the guarantees of this Article

Marper was concerned with the indefinite retention of sensitive information under a state measure authorising its retention. Perrin’s charter is silent on how long the information it describes should be retained, or remain published, and it would be interesting to see how it would fit into the proposed new European data protection framework [pdf] which proposes a “right to be forgotten” (a right which in fact arguably already exists under principle 3 and 5 of the DPA), but even if the state or an emanation of the state deleted the data at a later date, it is difficult to see how any restrictions could be imposed on the information which would prevent its retention (even if such retention was unlawful) by private individuals, or organisations, or even other emanations of the state.

The permanence of internet-published information, and the ease with which it can be harvested and disseminated, could also greatly increase the risk of witness (and judge, and lawyer, and court official) intimidation or retribution, and most strategies for prevention [pdf] of this understandably focus on restricting the amount of information.

And, ultimately, mistakes and crimes often occur with the electronic processing of personal data. Given the huge financial pressures the court system is currently experiencing, it is very difficult to imagine that there could never be a data breach, and if one occurred it would potentially involve the personal data of vulnerable victims of crime, as well as witness, and those accused.

For these reasons, and absent any major change in the UK data protection statutory scheme (which in turn would suggest there would have had to have been a major change in the European framework) I have doubts that Perrin’s charter, as currently presented, could operate without the people acting under it being at risk of breach of the DPA, and potentially in violation of Article 8.

Those who work in the field of data protection are often accused of putting barriers in the way of progress, and of effective working. I don’t accept this: I’m an advocate of good data protection, but I’m also an advocate of freedom of information, transparency and open justice. It seems clear that the court system could be better at promoting open justice without disproportionately infringing private rights. However, I don’t think that Perrin’s charter is the way forward, because I do not feel it goes anywhere near far enough in adequately protecting the personal information of those who would be publicised under it.

Addendum 9 May 2012

Since writing this blog post my attention has been drawn to the Magistrates Court Act 1980 (thanks @Greg_Callus on twitter). Section 8 deals with restrictions on reporting of commital proceedings, and, by way of s8(4) permits publication of

(a)the identity of the court and the names of the examining justices;

(b)the names, addresses and occupations of the parties and witnesses and the ages of the accused and witnesses;

(c)the offence or offences, or a summary of them, with which the accused is or are charged;

(d)the names of the legal representatives engaged in the proceedings;

(e)any decision of the court to commit the accused or any of the accused for trial, and any decision of the court on the disposal of the case of any accused not committed;

(f)where the court commits the accused or any of the accused for trial, the charge or charges, or a summary of them, on which he is committed and the court to which he is committed;

(g)where the committal proceedings are adjourned, the date and place to which they are adjourned;

(h)any arrangements as to bail on committal or adjournment;

(i)whether a right to representation funded by the Legal Services Commission as part of the Criminal Defence Service was granted to the accused or any of the accused.

These provisions of the MCA appear to have been drafted in order to prevent the risk of prejudice to forthcoming trials, rather than with a view to protecting any privacy rights of accused. Nonetheless, they clearly, in general terms, permit publication of the sort of information proposed by Will Perrin’s Open Justice Charter. Whether the ICO would consider that they were sufficient to mean that a Schedule 3 DPA condition were met is another matter. The Data Protection (Processing of Sensitive Personal Data) Order 2000 does provide a Schedule 3 condition if the disclosure “is in the substantial public interest…[and]…is in connection with…the commission by any person of any unlawful act (whether alleged or established)…[and]…is for the special purpose [of journalism]”. However, can a blog, even one as clearly public-focussed as Perrin’s, be classed as “journalism”?

The MCA was enacted long before the internet as we know it was even conceived (it was amended in 1990 to encompass television broadcasts) and the DPA was enacted in the modern internet’s infancy. “Journalism” has no fixed definition, probably for very pragmatic reasons, but modern technology means that many people, such as bloggers, social commentators, twitter users, etc, are engaging, to a greater or lesser extent, in activities which might broadly be defined as journalism.

This leads on to wonder, in an age when “we are all journalists”, might we all benefit from the common law and statutory protections afforded to journalism? And, if so, in what way could journalism benefit from being a special category under laws such as the DPA?