STOLEN PRIVATE AND CONFIDENTIAL INFORMATION

November 30th, 2010 by jamesgoudie

In KJH v HGF [2010] EWHC 3064 (QB) Sharp J held that it was appropriate to continue an interim injunction and grant anonymity to protect the victim of blackmail which involved the threat of the revelation of stolen private and confidential information.  The evidence established to a high degree of probability that H was the victim of blackmail involving the threat of the revelation of stolen private and confidential information.  H was therefore likely to establish at trial that publication of the information should not be allowed.  There had also been no waiver of H’s privacy rights and there was no public interest justification for the publication of the information. The privacy interests engaged and the claim in breach of confidence were strong.  There was also a continuing risk that the private and confidential information stolen from H would be made public.  Strong public policy considerations which justified the protection of the identity of victims of blackmail arose in criminal and civil proceedings: such persons should not be deterred from seeking the courts’ protection for fear that the information which the blackmailer had threatened to reveal would be exposed or that their identity as the victim of blackmail would be made known.  A final determination of the matter had to await trial, granting anonymity at the interim stage served the interest of such an applicant in protecting his or her rights under ECHR Art 8 and the public interest in promoting the prevention and punishment of blackmail.  As a result it had also been necessary to derogate from the principle of open justice by holding the hearing in private and to anonymise the names of H and F.

James Goudie QC

WATER UTILITY COMPANIES NOT ‘PUBLIC AUTHORITIES’ UNDER THE EIR

November 25th, 2010 by Anya Proops

The Upper Tribunal has this week handed down an important decision on the question of whether privatised water utility companies are ‘public authorities’ for the purpose of the Environmental Information Regulations 2004 (EIR): Smartsource v IC & 19 Water Companies (case no. GI/2458/2010). The background to the appeal was that Smartsource had submitted near identical requests for disclosure of information to some 19 water utility companies. It was not in dispute that the requests fell to be addressed under the EIR. The companies refused to provide the requested information on the basis that they were not ‘public authorities’ for the purposes of r. 2(2) EIR and, hence, were not subject to the disclosure obligations provided for in r. 5 EIR. The Commissioner rejected Smartsource’s complaint about the refusal on the basis that he accepted that the companies were not public authorities under r. 2(2). Smartsource appealed the Commissioner’s decision to the tribunal. The importance of the issues at stake in the case resulted in the appeal being transferred to the Upper Tribunal. The central issues which the Upper Tribunal was called upon to determine were as follows: (1) did the companies ‘carry out functions of public administration’ such that they fell within limb 2(2)(c) of the r. 2 definition of public authority; (2) alternatively, were they ‘under the control’ of a relevant public authority such that they fell within limb 2(2)(d) of the r. 2 definition.

With respect to the first issue, the Tribunal held that the companies did not carry out functions of public administration. It reached this conclusion applying a multifactoral approach akin to the approach adopted in the earlier cases of Network Rail v IC (EA/2006/0061) and Port of London Authority v IC & Hibbert (EA/2006/0083). Notably, the Tribunal rejected arguments advanced by Smartsource that the companies fell within limb 2(2)(d) of the definition because they: were appointed as statutory undertakers; were subject to a range of conditions imposed under statute; were subject to a comprehensive regulatory regime; were unable to choose their own customers or set their own prices; were obliged to provide a universal service; and would be subject to State intervention in the event that they failed. With respect to the second issue, the Tribunal held that that the companies were not ‘under the control’ of a relevant public authority for the purposes of r. 2(2)(d). In reaching this conclusion, the Tribunal accepted arguments advanced on behalf of the Commissioner and the companies that: the concept of ‘control’ in this context meant something more than that the body in question was merely subject to a stringent regime of statutory regulation; the aim of r. 2(2)(d) was to capture State/Executive functions in all their various guises and not the activities of privatised companies of the sort which were in issue in the instant case.

Importantly, the Tribunal also rejected ‘hybridity’ arguments to the effect that a body can be a public authority under the EIR for some purposes but not for others. According to the Tribunal, the way in which r. 2 was formulated meant that the body either was or was not a public authority (cf. the approach adopted in Port of London v IC).

COMMISSIONER HANDS DOWN FIRST MONETARY PENALTIES FOR DPA BREACHES

November 24th, 2010 by Robin Hopkins

Up to now, the Commissioner has not exercised his powers under sections 55A-E of the Data Protection Act 1998 to impose monetary penalties on data controllers for breaches of the Act. Today, he imposed his first two financial penalties.

Hertfordshire County Council has been handed a penalty of £100,000 for twice sending faxes containing sensitive personal data to members of the public in error. The first fax, which is the subject of an injunction preventing further details being disclosed, was intended for a barrister but sent to a member of the public. The second fax, which concerned child protection matters, was intended for a County Court. The errors both occurred in June 2010, and were both reported to the Commissioner by the Council itself.

Secondly, the employment services company A4e has been fined £60,000 after an unencrypted laptop containing personal details of 24,000 users of community law centres was stolen from an employee’s home. This too was reported to the Commissioner by A4e itself.

THE FREEDOM OF INFORMATION (TIME FOR COMPLIANCE WITH REQUEST) REGULATIONS 2010

November 24th, 2010 by Rachel Kamm

These Regulations are made under FOIA and extend the time limit for Academies to respond to requests for information. The normal time limit for responding is twenty working days of date of receipt of the request. However, where the information is requested from an Academy, then any working day which is not a school day for that Academy is disregarded (subject to a long stop of sixty working days). These are  the same timeframes as apply to schools covered by The Freedom of Information (Time for Compliance with Request) Regulations 2004 (S.I. 2004/3364) and The Freedom of Information (Time for Compliance with Request) Regulations 2009 (S.I. 2009/1369).

This post is also on 11KBW’s education blog: http://www.education11kbw.com/.

DISCLOSING DATA FOR PURPOSES OF MEDICAL RESEARCH – NEW ECHR JUDGMENT

November 23rd, 2010 by Anya Proops

Many readers of this blog will be familiar with the stringent protections which the Data Protection Act 1998 (DPA) affords in respect of personal health data (see further the definition of ‘sensitive personal data’ in s. 2 DPA). Thus, for example, if a data controller wishes to avoid contravening the first data protection principle (the fair and lawful processing principle) as and when it is processing health data, it must ensure that: (a) the particular processing is fair and lawful; (b) that it meets one of the conditions provided for in schedule 2 to the DPA and (c) that it meets one of the very narrowly drawn conditions provided for in schedule 3 to the DPA. If the processing is intended to serve the interests of medical research, the data controller will doubtless wish to look in particular at the condition provided for in paragraph 8 of schedule 3. That condition stipulates that the processing must be ‘necessary for medical purposes’ (which includes the purposes of medical research) and be undertaken either be ‘a health processional’ or ‘a person who in the circumstances owes a duty of confidentiality which is equivalent to that which would arise if the person were a health professional’. Of course, the principle which underpins this particular condition is that it is very much in the public interest that, subject to the test of necessity, health data be shared by medical researchers. A recent judgment of the European Court of Human Rights (ECHR) has highlighted the importance of this particular public interest: Gillberg v Sweden (application no. 41723/06).

In Gillberg, two researchers requested access to health data which had been accumulated by Professor Gillberg as part of a long-term project on hypheractivity and attention deficit disorders in children which he was running out of the University of Gothenburg in Sweden. The University refused access on the basis that assurances had been given to the parents of the children and later the children themselves concerning the confidentiality of the data. The researchers challenged the University’s decision relying on Sweden’s long-established and generous rules on access to official documents. The Swedish administrative court upheld the researchers’ claim and ordered that the University disclose the data to them, subject to the imposition of strict conditions on their handling and use of the data. In reaching the conclusion that the data should be disclosed to the researchers, the Swedish court took into account not least the public interest in ensuring the independent and critical evaluation of medical research in the important field of neuropsychiatry. The data was subsequently destroyed by certain of Professor Gillberg’s colleagues. Thereafter, Professor Gillberg was convicted of misuse of office by the Swedish Parliamentary Ombudsman. Having lost his appeals against conviction in the national courts, Professor Gillberg took his case to the ECHR claiming that the conviction breached his Article 8 and 10 rights, particularly in view of the assurances of confidentiality which he had given to the data subjects and their parents. The ECHR dismissed Professor Gillberg’s appeal. It found that, even if the conviction interfered with Professor Gillberg’s Article 8 right to privacy (i.e. his right to privacy in the context of his professional affairs), that interference was justified in the circumstances. It also found that there was no interference with Professor Gillberg’s Article 10 right to freedom of expression as he was convicted not for giving assurances of confidentiality but rather because he misused his office in response to the judgments of the court.

The ECHR’s judgment is interesting not least because it confirms that, at least for the purposes of human rights jurisprudence, the fact that promises of confidentiality have been given to individual patients/research subjects does not create an automatic bar on disclosures which may breach those promises, particularly where the disclosures serve important public interests such as the interests in protecting the integrity and progress of medical research. Query whether the same result would have obtained on an application of the principles embodied in the DPA, particularly in view of the relatively permissive approach to disclosures for the purposes of medical research contained in paragraph 8 of schedule 3.

ICO SIGNS UNDERTAKING WITH GOOGLE AND DEFENDS ITS STANCE

November 22nd, 2010 by Robin Hopkins

I reported in a recent post that the Information Commissioner had instructed Google to sign an undertaking aimed at any repeat of the breaches of the Data Protection Act 1998 committed during Google’s information-gathering for its Street View feature. That undetaking has now been signed, and a copy can be viewed here. It requires Google engineers to maintain a “privacy design document” for each new Google project prior to launch. It provides for further training and data protection awareness for Google engineers and other employees. The undertaking also assures the deletion of all personal data which had been gathered unlawfully, and provides for the Commissioner to audit Google’s revamped data protection procedures nine months from now. Interestingly, the undertaking applies to Google’s global activities and not just its UK ones.

The ICO has come under fire for being soft on Google. The Commissioner, Christopher Graham, has defended his stance, including in an interview with the Daily Telegraph which can be found here. In that interview, the Commissioner remarks that “a lot of people out there want somebody – probably not me – to be the privacy tsar. But that’s not what the Information Commissioner is”. Recent indications suggest, however, that the ICO could potentially take on a “privacy tsar” role – see the recommendations from its recent surveillance report, summarised here.

Application of the first data protection principle

November 19th, 2010 by Edward Capewell

Ms Alison Ince worked in a further education institute in Northern Ireland. She was dismissed from her employment in June 1999 and, from around 2002, had alleged on a number of occasions that her managers had been engaged in a fairly widespread fraud against the public purse in 1997. These allegations were investigated first by the Department for Education and Learning (DEL), and then by the Police Service of Northern Ireland. No criminal or disciplinary charges were brought and the investigation was not taken any further. Ms Ince had also raised the matter with her local MLA, with the chairman of the public accounts committee in Westminster and before an Industrial Tribunal (as they are still called in Northern Ireland). The IT held that there were no grounds for finding that any fraud had been committed.

Ms Ince was not satisfied with this finding. In October 2007 she made a request for information from the DEL with respect to her allegations of fraud at the institute. The information she sought included the transcripts of certain interviews held with other employees during the fraud investigation by the DEL. DEL provided some of the information, but withheld the transcripts pursuant to the personal data exemption in section 40(2) FOIA. The Information Commissioner agreed with DEL’s reliance on the exemption.

The Information Tribunal in Ince v Information Commissioner (EA/2010/0089) agreed – for the most part – with the Commissioner’s decision. Save in respect of one of the transcripts – that belonging to a friend of Ms Ince who gave evidence at a late stage in the hearing in which he consented to disclosure – the Tribunal found that it would not be fair for DEL to disclose the information and that disclosure would therefore breach the first data protection principle. Ms Ince had made four contentions in respect of the information:

(i)                  That because it related to the individual’s employment for a public sector organisation it related to their public, not private life;

(ii)                That no harm or distress would have been caused to the individuals by disclosure of the transcripts;

(iii)               That the interviewees’ objections to disclosure were outweighed by other considerations; and

(iv)              That the interviewees did not have a reasonable expectation of privacy in respect of the transcripts

The Tribunal disagreed on all counts. As to (i), following the reasoning in Corporate Officer of the House of Commons v IC and Baker it unanimously rejected the notion that anything said or done by a public sector employee was public information and could therefore be disclosed. It found by a majority that “the disputed information in the case related to the individual’s employment but was not information so directly connected with their public role that its disclosure would automatically be fair”. As to (ii), the Tribunal found that harm or distress would be caused by disclosure generally, and would also be caused by Ms Ince’s own ‘disproportionate’ method of pursuing her allegations –  which included threatening to bring private prosecutions for fraud against certain individuals. The Tribunal further considered that the Commissioner had given appropriate weight to the interviewees’ clearly expressed objections, and that they also had a reasonable expectation of privacy in respect of the transcripts. There was moreover no common law public interest in disclosure – fraud in the education sector generally was obviously of legitimate concern, but would not be helped by disclosure of the information sought by Ms Ince.

ICO’S SURVEILLANCE REPORT 2010: ‘SLEEPWALKING’ RISK REMAINS; ‘PRIVACY IMPACT ASSESSMENTS’ PROPOSED FOR NEW LEGISLATION

November 15th, 2010 by Robin Hopkins

The Information Commissioner has delivered his latest report to the Home Affairs Select Committee on “the state of surveillance” in the UK. The report traces privacy-related developments since the Commissioner’s 2006 report on the same theme, which memorably observed that the UK may be “sleepwalking into a surveillance society”. According to the November 2010 report, that warning

 “… is no less cogent in 2010 than it was several years ago. It is not being suggested that the UK is a ‘police state’ or that there are surveillance conspiracies afoot against the public. Neither the 2006 report nor this one supports such an assumption, and evidence for it is lacking. Much of what is taken to be surveillance is done for benign reasons and has beneficial effects on individuals and society. But much surveillance also goes beyond the limits of what is tolerable in a society based on the rule of law and human rights, one of which is the right to privacy.”

The report provides an illuminating summary of trends in (amongst others) the use of CCTV, body scanning and border control (including ‘ethnic targeting’ for security searches), workplace monitoring, social networking, ‘crowdsourcing’, the monitoring of protest activities and even the use of unmanned drones. Scrutiny is also given to a number of governmental policy tools, such as databases and the use of ‘social sorting’ (eg into groups such as ‘high cost, high risk’ social groups who are vulnerable to social exclusion’) to develop targeted welfare strategies.

As regards private-sector online commerce, the Commissioner recommends a number of measures to correct what he describes as the “worrying trend particularly with those who provide on-line services not to have thought through the privacy implications of their activities and given users robust privacy settings as a default”.

What to do about the risks identified in the report? The ICO’s recommendations focus principally on overhauling the legislative process insofar as it affects privacy, by introducing: 

  • a requirement for a privacy impact assessment to be presented during the parliamentary process where legislative measures have a particular impact on privacy;
  • an opportunity for the Information Commissioner to provide a reasoned opinion to Parliament on measures that engage concerns within his areas of competence, and
  • a legal requirement to make sure all new laws that engage significant privacy concerns undergo post-legislative scrutiny to ensure they are being implemented and used as intended by Parliament.

If implemented, these measures would add substantially to the ICO’s clout as the guardian of privacy.

The report can be found here, with the accompanying press release from the ICO here.

Digital Economy Act to be judicially reviewed for compliance with EU privacy law

November 10th, 2010 by Julian Wilson

Internet Service Providers Talk Talk and Virgin were today granted permission by the High Court for a judicial review of whether the Digital Economy Act 2010 complies with existing EU legislation on data protection and privacy. For more on their application, see Julian Wilson’s earlier post: Privacy of internet users, internet file-sharing and copyright: the present “Wild West” and the Digital Economy Act 2010

EC COMMISSION PROPOSES STRENGTHENING EU DATA PROTECTION LEGISLATION

November 9th, 2010 by Anya Proops

On 4 November 2010, the European Commission published a communication in which it set out its vision for the future of EU data protection legislation. The communication makes clear that the Commission is intending to propose new legislation in 2011. You can find the communication here. Notable points emerging from the communication include that the Commission is considering:

-       introducing a ‘general principle of transparent processing’ aimed at ensuring that data controllers are more transparent as to how they are processing personal data;

 

-       whether the definition of sensitive personal data should be expanded so that it includes for example genetic data;

 

-       clarifying and strengthening the rules on consent so that it will be clearer when a data subject can be taken to have consented to processing of his or her personal data;

 

-       extending powers of enforcement to civil society associations as well as other associations representing the interests of data subjects;

 

-       strengthening existing sanctions for non-compliance, including providing explicitly for criminal sanctions in the case of serious violations;

 

-       requiring data controllers to appoint independent data protection officers (subject to a recognition of the need not to overburden small enterprises);

 

-       requiring data controllers to carry out data protection impact assessments in certain cases; and

 

-       imposing new rules designed to strengthen, clarify and harmonise the status and powers of national data protection authorities.