October 29th, 2010 by jamesgoudie

Legal professional privilege (“LPP”) as an exemption from disclosure under Section 42 of the Freedom of Information Act 2000 (“FoIA”) and Regulation 12 of the Environmental Information Regulations 2004 arose again in West v Information Commissioner, EA/2010/0120.  Bexley Council had transferred a major part of its Council housing stock to a Housing Association.  Mr West is a member of a leaseholders’ group that objected to having to pay service charges for the cost of the maintenance of roads and footpaths within the housing estates.  They said that remained the responsibility of the Council.  They sought to challenge the lawfulness of the stock transfer agreement.  The Council took advice from Counsel.  Mr West sought a copy of Counsel’s Opinion.  The Council refused to provide it, relying on LPP.  The Information Commissioner upheld the Council’s refusal.  The Tribunal dismissed Mr West’s appeal.  Not only might “legal advice privilege” apply.  So too might “litigation privilege”.  Mr West had threatened to bring a case before the Leasehold Valuation Tribunal and/or judicial review proceedings.  The real issue was the Public Interest Test.  The Tribunal duly identified the public interest factors in maintaining the exception, referring to DBERR v O’Brien [2009] EWHC 164, and the public interest factors in disclosure.  Weighing up and balancing the competing public interests, and bearing in mind the presumption in favour of disclosure, the Tribunal (Judge Shanks presiding) agreed with the Commissioner that the public interest in maintaining the LLP exception outweighed the public interest in disclosure.

James Goudie QC


October 11th, 2010 by Rachel Kamm

The Information Commissioner is currently consulting on a draft Data Sharing Code of Practice. Subject to consultation and obtaining the Secretary of State’s approval, this will be a statutory code of practice issued under sections 52A and 52D of the Data Protection Act 1998 which can be used as evidence in any legal proceedings. The draft code is relatively short  (less than 40 pages) and does not include as much practical detail as perhaps might have been expected. It is available on the Information Commissioner’s website (ww.ico.gov.uk)  and the consultation period closes on 5 January 2011.  


October 6th, 2010 by Robin Hopkins

Bath & North East Somerset Council v IC (EA/2010/0045) is the latest application of the ‘commercial confidentiality’ exemption under regulation 12(5)(e) EIR to a request for information on agreements between a local authority and a property developer.


The council and the developer entered into discussions about building homes on 70 acres of brownfield land within a UNESCO World Heritage Site. Only a small proportion of this land was owned by the council, the rest being owned by the developer, who would also bear 100% of the risk of the project. The proposed £500m project would deliver 50% of the council’s new homes target for the next 10 years – the council was therefore acting as both beneficiary and planning authority.


With a potential section 106 agreement in mind, the council and developer reached a co-operation agreement, whereby the developer taking an ‘open book’ approach, i.e. making its financial models and reports available to the council. This was the information at issue before the Tribunal.


The Tribunal found that the public interest favoured maintaining the exemption. In so doing, it distinguished this case from Bristol City Council v ICO and Portland and Brunswick Squares Association (EA/2010/0012) – on which, see my post here and article in the Local Government Lawyer here – where disclosure of the information was ordered. Bristol City concerned a viability assessment designed to show that a hypothetical scheme was not viable; that assessment used generic, industry-level pricing. In contrast, this case concerned detailed and developer-specific financial information about an actual proposal. The commercial sensitivities differed materially.


Disclosure of such information, held the Tribunal, would lead to the developer refusing to provide any further ‘open book’ information, which would stymie this particular development and dissuade developers from future ‘open book’ co-operation. The Tribunal was also impressed by the availability of alternative scrutiny mechanisms in this case. It was less impressed with the council’s argument that disclosure of the disputed information would damage its reputation with developers.


The Tribunal did order the disclosure of consultants’ reports and emails, with commercially sensitive information redacted. The developer’s financial model however, could not be redacted, and could be withheld. On this last point, a notable practical issue emerged: both the council and the Commissioner had interpreted the request as being for a static version of the developer’s financial model. A ‘live’ model – i.e. a spreadsheet containing visible formulae – is another matter. The Tribunal warned that in future cases, clarification should be sought from the requester.

Digital Agenda: EU Commission refers UK to ECJ over privacy and personal data protection

October 4th, 2010 by jamesgoudie

October 4th 2010 by James Goudie QC

The European Commission has decided (IP/10/1215) to refer the United Kingdom to the ECJ for not fully implementing EU rules on the confidentiality of electronic communications such as e-mail or internet browsing. Specifically, the Commission considers that UK law does not comply with EU rules on consent to interception and on enforcement by supervisory authorities. The EU rules in question are laid down in the ePrivacy Directive 2002/58/EC and the Data Protection Directive 95/46/EC. The infringement procedure was opened in April 2009 (IP/09/570), following complaints from UK internet users notably with regard to targeted advertising based on analysis of users’ internet traffic. These complaints were handled by the Information Commissioner’s Office, the UK personal data protection authority, and the police forces responsible for investigating cases of unlawful interception of communications. The Commission previously requested the UK authorities in October 2009 (IP/09/1626) to amend their rules to comply with EU law.

The Commission considers that existing UK law governing the confidentiality of electronic communications is in breach of the UK’s obligations both under the ePrivacy Directive and under the Data Protection Directive in three specific areas:

  •  there is no independent national authority to supervise the interception of some communications, although the establishment of such authority is required under the ePrivacy and Data Protection Directives, in particular to hear complaints regarding interception of communications
  • current UK law authorises interception of communications not only where the persons concerned have consented to interception but also when the person intercepting the communications has ‘reasonable grounds for believing’ that consent to do so has been given. These UK provisions do not comply with EU rules defining consent as “freely given, specific and informed indication of a person’s wishes”
  • current UK law prohibiting and providing sanctions in case of unlawful interception are limited to ‘intentional’ interception only, whereas EU law requires Member States to prohibit and to ensure sanctions against any unlawful interception regardless of whether committed intentionally or not.


October 1st, 2010 by Robin Hopkins

A number of Tribunal decisions have dealt with requests for minutes of cabinet meetings. Section 35 is inevitably relied upon, and arguments about both collective responsibility and confidentiality ensue.


The most famous concerned the decision to go to war in Iraq, which case saw disclosure being ordered by the Tribunal, but vetoed by Jack Straw.


More recently (Cabinet Office v ICO (EA/2010/ 0031)), the Tribunal has ordered disclosure of the cabinet’s meeting on 9th January 1986, in which Michael Heseltine resigned over the Westland Helicopter decision.


The Tribunal agreed that cabinet minutes are of the highest sensitivity, and should only be disclosed in rare cases “where it involves no apparent threat to the cohesive working of Cabinet government, whether now or in the future”. Relevant factors include: the passage of time, the departure of the relevant ministers from active politics, publication of memoirs and ministerial statements describing the meeting, the issue lacking ongoing significance, the ‘objectivity value’ where publicised accounts conflict, and whether the issue is of “particular political or historical significance”.


The last-mentioned factor was one Jack Straw expressly disagreed with when issuing the certificate of veto mentioned above: in other words, his position was that the more momentous a decision, the greater the need for confidentiality.


Many of these factors were, however, at work in the present case: for example, Margaret Thatcher and Michael Heseltine both made (acrimonious) public statements about the meeting at the time, and the meeting has since surfaced in plenty of memoirs. The outcome was that, whilst section 35 was engaged, the public interest favoured disclosure.


No sign of the incumbent Lord Chancellor, Ken Clarke – who, incidentally, was in the cabinet and present for the 1986 Westland Helicopter meeting – reaching for the veto just yet.


The Tribunal concluded its judgment with stringent criticism of the Cabinet Office’s delay in dealing with this request. The Cabinet Office is one of the 33 authorities on the ICO’s first monitoring list – on which, see my post below.


October 1st, 2010 by Robin Hopkins

The Information Commissioner’s Enforcement Team has begun cracking down on public authorities that habitually fail to respond to requests for information within the statutory limits. This morning, it began publishing a list – to be updated quarterly – of authorities whose timeliness will now be subject to specific monitoring by the ICO.


 Those on the list have either (i) been the subject of six or more complaints of delay in the last six months, (ii) exceeded the time limit by a significant margin on at least one occasion, or (iii) appear to respond in time to fewer than 85% of requests.


There are 33 authorities on the first monitoring list.


For the ICO’s statement, click here. For the debut monitoring list, click here.


October 1st, 2010 by Julian Wilson

Scant regard for the principles of data protection and the protection of private information appears to be being paid in the current war being waged between internet file-sharers and copyright enforcers.


We appear to be at a critical point in this most topical saga, both legal and practical. The last few days have seen reports of all of the following: an expression of concern from the court over the use being made by copyright owners of Norwich Pharmacal Orders against Internet Service Providers to identify potential filesharers; a concerted cyber attack mounted against the computer servers of ACS Law, a solicitors’ firm notorious for its mass pursuit of alleged copyright infringing internet file-sharers; the leaking from ACS Law’s servers of the identities and sensitive personal data of ISP subscribers whose IP addresses had allegedly been identified as having been used to download copyrighted material (including pornography); the exposure of the fact that one of the ISPs had disclosed its subscribers’ personal data to that law firm under court order without first encrypting it; the reporting that this data was, allegedly, kept unencrypted; the dissemination of that data and the law firm’s financial and other records revealing the fundamentals of its controversial copyright enforcement processes; and the commencement of the appeal in Sweden of the defendants connected with Pirate Bay, the prominent filesharing enabling web-site.


What is more, a decision of the Administrative Court is expected imminently on the application of 2 ISPs for permission to judicially review the provisions of the Digital Economy Act 2010 governing online infringement of copyright (sections 3 to 18) in R, on the application of British Telecommunications Plc and Talktalk Telecom Group Plc –v-The Secretary Of State For Business, Innovation And Skills.


Those provisions of the Digital Economy Act were intended to bring an element of regulation into this present “Wild West”. Although the Act received Royal Assent on 8 April 2010, it was only debated, as a Bill, at a brief committee stage during the “wash up” period after the announcement of the general election.  Its provisions contemplate that those whose internet connections are used for repeated file-sharing of copyright material will be disallowed access to the internet by their ISP.  On 27 September 2010, the inventor of the internet, Sir Tim Berners-Lee likened being forced offline in this way to ‘imprisonment’ and attacked the Digital Economy Act’s lack of ‘due process’ as contrary to the Magna Carta.  High time then, to take stock.


File-sharing software (such as BitTorrent) enables internet users to share files and material stored on each other’s computers when they are connected to the internet. The software has many legitimate uses but it is also employed to upload and share digital media in breach of copyright protection. The software is available on the internet at file-sharing sites such as Pirate Bay. Internet monitoring technology cannot specifically identify those who engage in uploading and downloading files for unlawful sharing. The nearest it gets is the identification of the internet protocol address utilised by a file-sharer. This IP address belongs to the person who subscribes for the broadband internet connection which is utilised in the file-sharing. The IP address identifies the ISP and can be used by the ISP itself to identify its subscriber. 


Obviously, however, the internet connection may not be in the sole use of the subscriber himself and the subscriber may not be the file-sharer. A local wireless network may utilise the  internet connection and if the network is unsecured  access can be gained to the connection by anyone. Internet connections are also reported to be susceptible to hacking by serial file-sharers.


Copyright owners use monitoring agents to go on to the internet and search for their material to identify unauthorised sources, that is uploaders. The monitoring agents download the copyrighted material from such sources and thereby identify the IP address of the uploader. (According to the file-sharers, there are unscrupulous monitoring agents linked to copyright enforcers who incite unlawful downloading by themselves uploading the material so as to catch downloaders, and incompetent monitoring agents who misinterpret data and wrongly identify IP addresses as being involved in copyright infringement).


Armed with the IP addresses identified by the monitoring agents, law firms such as ACS Law and Gallant McMillan make applications in the Chancery Division for Norwich Pharmacal Orders against the ISPs requiring the ISPs as persons mixed-up in the wrongdoing of others to identify the names and addresses of the subscribers for the IP addresses used in the file sharing.  Most ISPs do not oppose the making of the Orders sought.  It is said that ISPs who have expressed an intention to oppose such Orders are never made respondents to avoid opposition being mounted. The court cannot gainsay the evidence of the monitoring agents on these applications; it does not have the requisite technical understanding. The Orders are therefore made without challenge. In response to the Orders, the ISPs disclose the identities and physical addresses of the subscribers.  As the identities of hundreds or even thousands are sought at one time, the court tends to order the ISP to disclose them by sending an encrypted disk. Some of the private information that recently leaked from ACS Law appears to have included BT PlusNet subscriber identities and addresses which BT PlusNet had allegedly disclosed to ACS Law pursuant to one such court order without putting it into encrypted form.


The law firms then make mass mailings of standard letters before action to the identified subscribers alleging copyright infringement and demanding the payment of damages under threat of legal action. ACS Law had written such letters to Sky subscribers whose connections had allegedly been used to view pornographic material. There are at least 3 aspects of these types of letters which are controversial. First, the demand is made of the subscriber even though he may not have been the file-sharer or have known of the file-sharing activity. There is no proof available at the time of sending the letters that the subscriber was the person who used the broadband connection to access the copyright material. Second, the threat of legal action which is used to require payment is not a real one: actions are not, in practice, being brought. Third, the sums demanded in compensation are said to be disproportionate to any possible loss suffered by the copyright holders.


There is much internet space given over to recipients of such letters complaining of the distress they cause to them and their families. Some of the private information belonging to ACS Law recently leaked and disseminated shows that a substantial sum of money has been collected from those recipients of these letters who pay up. The so called compensation was  shared between the copyright holders, the monitoring agents and the law firm. Some subscribers who paid up by credit card have had their credit card details, allegedly kept on ACS’ server, disseminated. Some subscribers did not respond to the letters. Others challenged the allegations (some using standard form defence material available on the internet). Some recipients of the letters claim they are the innocent victims of harassment. Another law firm is reportedly now preparing a group harassment action against ACS Law. ACS Law is already the subject of investigation by the SRA and now the Information Commissioner. 

It is reported that, on 20 September 2010, at the hearing of a Norwich Pharmacal application made by Gallant McMillan on behalf of Ministry of Sound in Ministry of Sound Recordings Ltd v Plusnet Plc, Chancery Master Winegarten expressed provisional concerns that the process followed after the making of these orders was leading to mis-accusations and that whilst thousands of letters before action were being despatched to internet subscribers, no-one was being sued.

In order to obtain Norwich Pharmacal relief, it is not necessary to undertake to bring an action only to show that no action could be brought without the information sought. The relief is available if the interests of justice require it even where at the time of the application, without  the disclosure, the applicant cannot yet establish that the source has committed the wrong suspected: P-v-T Ltd [1997] 1 WLR 1309.


Master Winegarten reportedly stated the view that the Digital Economy Act would shortly change the present unsatisfactory landscape. What will the new DEA landscape look like?   


Section 3 of the DEA 2010 inserts a new section 124A into the Communications Act 2003 and applies if it appears to a copyright owner that a subscriber to an internet access service has infringed the owner‘s copyright by means of the service; or has allowed another person to use the service, and that other person has infringed the owner‘s copyright by means of the service. It provides for the owner to make a copyright infringement report to the internet service provider who provided the internet access service. A copyright infringement report is a report that states that there appears to have been an infringement of the owner‘s copyright; includes a description of the apparent infringement and evidence of the apparent infringement that shows the subscriber‘s IP address and the time at which the evidence was gathered.


The internet service provider who receives the copyright infringement report must notify the subscriber of the report and include a statement that the notification is sent under this section in response to a copyright infringement report; the name of the copyright owner who made the report;  a description of the apparent infringement; evidence of the apparent infringement that shows the subscriber‘s IP address and the time at which the evidence was gathered;  information about subscriber appeals and the grounds on which they may be made; and advice, or information enabling the subscriber to obtain advice, about steps that a subscriber can take to protect an internet access service from unauthorised use.


The ISP may (under an initial obligations code to be promulgated by Ofcom) also be required to state that information about the apparent infringement may be kept by the internet service provider; that the copyright owner may require the provider to disclose which copyright infringement reports made by the owner to the provider relate to the subscriber; and that following such a disclosure, the copyright owner may apply to a court to learn the subscriber‘s identity and may bring proceedings against the subscriber for copyright infringement.


The new s.124B provides that an internet service provider must provide a copyright owner with a copyright infringement list for each subscriber for whom there are multiple (amount yet to be defined) copyright infringement reports made by the owner to the provider.


The new s.124G permits the Secretary of State to direct Ofcom to assess whether one or more technical obligations should be imposed on internet service providers to take a technical measure (limiting the speed of the broadband service provided or limiting access) against subscribers to its service for the purpose of preventing or reducing infringement of copyright by means of the internet.


Section 124K provides for subscriber appeals. A non-exhaustive list of grounds of appeal includes: that the apparent infringement to which the report relates was not an infringement of copyright; and that the report does not relate to the subscriber’s IP address at the time of the apparent infringement. Section 124K(5) provides that an appeal on any grounds must be determined in favour of the subscriber unless the copyright owner or internet service provider shows that the apparent infringement was an infringement of copyright, and  the report relates to the subscriber’s IP address at the time of that infringement. Section 124K(6) provides that the appeal must be determined in favour of the subscriber if the subscriber shows that the act constituting the apparent infringement to which the report relates was not done by the subscriber, and the subscriber took reasonable steps to prevent other persons infringing copyright by means of the internet access service.


2 things are clear: the subscriber will be held to account for any misuse of the internet connection through his IP address and the onus will be on him to appeal and prove that he was not the file-sharer and took adequate steps to prevent his internet connection from being used for copyright infringing file-sharing.

By their judicial review application, BT and TalkTalk contend that the provisions of the DEA represent a disproportionate response to concerns over unlawful peer-to-peer file sharing and are likely to have a significant impact on internet users, many of whom are likely to be wholly unconnected with any form of digital piracy on a commercial scale and that the requirements imposed by the DEA 2010 raise very serious concerns about the impact on the privacy of internet users and the confidentiality expected by subscribers in their dealings with ISPs.

Naturally, the main focus of the ISP’s JR application is the requirement the DEA 2010 places on ISPs set up and administer costly schemes in relation to the internet use of their subscribers, to amend substantially their existing data processing practices and to incur potential liability to their subscribers as a result of their actions. BT and TalkTalk state that they are disconcerted at the prospect of their being required to discharge an enforcement function on behalf of copyright owners in circumstances where no, or no adequate, provision has been made for the costs of doing so.