At the 11KBW Information Law seminar last week, I mentioned the imminent Tribunal decision in the GM Freeze case, which will consider how the term “emissions” is to be construed for EIR purposes. On a related note, readers may be interested to know that the ICO last week issued a decision notice requiring Ofcom to disclose information about electromagnetic radiation from ethernet power line adaptors, on the grounds that this fell within the definition of “information on emissions” under the EIR. Read the DN here.
Those involved in requests for information about compromise agreements between public authorities and departing senior employees will wish to pay careful attention to the Tribunal’s very recent decision in Gibson v IC and Craven District Council (EA/2010/0095). In this case, the Tribunal ordered disclosure of information insofar as it related to the use of public funds; the remainder could be withheld on the basis of s. 40 FOIA. This provides an illuminating contrast with other s. 40 FOIA cases about compromise or severance agreements, such as Wilson v IC (EA/2009/0082) and Waugh v IC and Doncaster College (EA/2008/0038).
The Tribunal found that all information in the requested compromise agreement was personal data. It agreed that generally information on compromise agreements should not be disclosed – but, as ever, context is important. Here the case concerned a very senior employee; further, the Council’s ex-CEO left office with the Council finances “in disarray”, but the auditor had – ultimately – approved the settlement paid under the compromise agreement.
As to the lawfulness of disclosure, it observed that this term is not defined in the DPA, but “seems to mean that information may not be processed when the law does not allow it, as opposed to when two parties have entered into a voluntary agreement not to disclose the information”. In other words, a mere contractual agreement as to confidentiality does not suffice to render disclosure “unlawful”.
As to the fairness of disclosure, the Tribunal distinguished between information on the use of public funds and other information. It noted that compromise agreements are “personnel matters”, generally attracting a strong expectation of privacy. Although “personnel” information comes into existence as part of the employee’s professional (rather than personal) activities, some of it (such as pension contributions and tax arrangements) are “nevertheless inherently private and would attract a very strong expectation of privacy and protection from the public gaze”.
Again, expectations of confidentiality were not decisive on the question of fairness: the Tribunal did “not regard it as reasonable for the ex-CEO (or the council) to expect that certain information relating to the use of public funds, to be hidden from public gaze by virtue of a confidentiality clause agreed between them”. Nor was the Tribunal impressed by submissions that disclosure would have a substantial adverse impact on the ex-CEO’s employment prospects or personal life.
Ultimately, fairness and condition 6 from Schedule 2 DPA were determined in similar terms: the Tribunal found that “the legitimate interests of members of the public [in transparency] outweigh the prejudice to the rights, freedoms or legitimate interests of the ex-CEO only to the extent that the information concerns the use of public funds”.
The British Medical Association has expressed concern this week about the Health and Social Care Bill – in particular, about its approach to data protection and the sharing of patients’ medical information. The Bill proposes a new “information standard” for the NHS which, according to the BMA, shows that “the Government has decided to place its desire for access to information over the need to respect patient confidentiality”. The new law would empower the Secretary of State to obtain such information as he considers it necessary to have; it would also widen the access to medical information by the NHS Commissioning Board, NHS Information Centre and local authorities. More detail on the proposed changes can be found in articles in the Daily Telegraph here, and the Guardian here.
The BMA wants to see the Bill amended: “so that it enshrines the need for explicit patient concent to any disclosure of information, unless the information has been properly anonymised or there is an overriding public interest.” The Department for Health, on the other hand, is confident that the proposals would preserve confidentiality and comply with the data protection law. Presumably, the Department means data protection law as implemented in the UK. At the 11KBW Information Law Seminar last week, I discussed the tension between the narrow approach to data protection that has prevailed under UK common law since Durant, and the considerably wider approach taken at a European level (and favoured domestically by the Information Commissioner).
On this subject, there is a very interesting report on Amberhawk this week, available here. This sets out in some detail the European Commission’s concerns about the UK’s apparently “bare minimum” approach to implementing its data protection obligations. It’s not yet clear what the Commission will do about this, but it appears to be only a matter of time before negotiation or confrontation on this issue comes to a head.
Roy Greenslade has posted a very interesting piece this afternoon on his blog on the Guardian website about a purported instance of “contracting out” of FOIA and DPA rights. According to his piece, Cheshire West and Chester Council has signed a compromise agreement with a former employee in which he or she contracts not to make requests to the Council under FOIA or the DPA (the EIR is not mentioned). The Council is confident that these provisions are effective. The ICO takes the opposite view – I suspect it will not be alone in doing so. Click here to read the piece.
The FOIA update paper given at last week’s 11KBW Information Law Seminar provides a roundup of recent caselaw in a few of the most common areas of Tribunal litigation.
One is commercially sensitive or confidential information: in particular, Veolia and its aftermath.
Another is information on planning applications and property developments: in particular, those cases subsequent to South Gloucestershire, namely Bristol City, Bath & North East Somerset and Elmbridge.
A third area is personal data: here the recent cases of Dun, Bryce, Ferguson and Ince have all – like the cases mentioned above – been covered in Panopticon posts. Two others to take note of, however, both in the context of public sector pay (other than salaries).
One concerns bonus payments to public sector employees. Davis v IC and Olympic Delivery Authority (EA/2010/0024) saw the Tribunal distinguish between bonus information and performance assessment information. It ordered disclosure of certain information relating to the bonuses of senior employees of the ODA: the maximum performance-related bonuses to which the chief executive and communications director were contractually entitled, and the percentage of the maximum available bonus actually paid to certain other members of senior management. The Tribunal decided, however, that details of the performance targets which individuals failed to hit to 100% satisfaction should not be disclosed.
The other recent case on the personal data exemption is Pycroft v IC and Stroud District Council (EA/2010/0165). The context was an auditor’s report which observed that the local authority’s former Strategic Director of Housing “did not ensure that staff had taken ownership of managing the budgets”. The applicant requested the details of this Director’s early retirement package. The Commissioner found that disclosure of this information would not be fair, and the Tribunal agreed. It should be noted by those dealing with requests for information about payments to allegedly poorly-performing public sector employees.
My paper from last week’s 11KBW Information Law Seminar contains a number of updates on important developments – both recent and imminent – at Upper and First-Tier Tribunal levels.
One of the most important concerns the contentious question of late reliance: in particular, is a public authority entitled to rely as of right on an exemption it raises for the first time before the Commissioner or even the Tribunal? The Upper Tribunal has recently answered with a firm “yes”: the decision in the joint appeals from the Tribunal decisions in Home Office v IC, and DEFRA v IC and Birkett (GIA/1694/2010 and GIA/2098/2010) can be downloaded here; see also commentary by FOI Man on his blog here. As I mention in my paper, however, the Upper Tribunal may have more to say on this matter very shortly (in an appeal involving the All Parliamentary Group on Extraordinary Rendition) – so watch this space for updates.
Another imminent Upper Tribunal decision to look out for is the case of Gaskell. concerns an appeal against a Decision Notice involving the Valuation Office Agency. In that Decision Notice, the Commissioner found that – notwithstanding the public authority’s unlawful withholding of the requested information – he would not be ordering disclosure because of events (in this case, the coming into force of new legislation) arising after the time at which the request was handled. The appeal invites the Upper Tribunal to find that the Commissioner has no discretion to make such a decision based on events subsequent to the relevant time for his assessment.
The High Court has recently confirmed that the “costs of compliance” for FOIA purposes does not include the costs of redaction: see Chief Constable of South Yorkshire v IC ( EWHC 44 (Admin)).
Two notable EIR decisions are expected shortly, one at first instance in the GM Freeze case (which is expected to provide much-needed guidance on how widely the concept of “emissions” should be construed), the other by the Upper Tribunal in the Kirklees case (which is expected to clarify the question of imposing charges following a request to inspect information).
The latter case also saw this argument raised before the Upper Tribunal: a “purposive request” (i.e. one that takes the form “please provide me with the information I would need to answer the following questions”) is not a valid request for EIR and FOIA purposes.
Finally, the First-Tier Tribunal has recently heard an appeal by Channel 4, in which the appellant argued that contracts should be treated as whole, rather than severable documents, meaning that if part of the contract can be withheld, then the whole contract can also be withheld. The implications of this position would be substantial, so again – watch this space.
In my post yesterday about the Protection of Freedoms Bill I referred to the provisions about biometric information in schools. I asked why this subject had been singled out for attention in the Bill, and whether there was any evidence that the current situation was unsatisfactory.
Action on Rights for Children (ARCH) have just posted on their website a very interesting briefing on the subject: see here. This is clearly an issue that has been of concern to ARCH for some years, and their paper gives an overview of developments since 2001. ARCH welcome the proposal to introduce consent into the process of taking children’s biometric data, but suggest that ensuring any consent is valid and informed will present a considerable challenge.
The papers from this week’s Information Law seminar are now on the 11KBW website here and here. Many thanks to all of those who attended. Thanks also to UK Human Rights Blog for reposting my post yesterday about the Protection of Freedoms Bill, and to those who have commented on Twitter about the seminar (searchable under #11kbw).
This post is an extract from my presentation at 11KBW’s Information Law seminar last night.
The Coalition Government’s Programme for Government, launched on 20th May 2010, made a number of commitments relating to information law, including issues about privacy and data protection. It also stated that the Government would introduce a Freedom Bill. On Friday last week (11th February) the Protection of Freedoms Bill was duly published, with lengthy explanatory notes stating that it implemented 12 specific commitments in the Programme for Government.
As well as extending the Freedom of Information Act (“FOIA”) and giving effect to the hitherto mysterious “right to data” promised in the Programme for Government, the Bill addresses a number of other information law issues:
(i) the taking and retention of DNA samples and profiles and other biometric data;
(ii) use of biometric data in schools;
(iii) regulation of CCTV and other surveillance camera technology;
(iv) the use of RIPA by local authorities;
(v) the employment vetting system, in particular the role of the ISA and the system of CRB checks;
(vi) the retention of information regarding convictions or cautions for offences involving consensual gay sex with a person aged 16 or over; and
(vii) the appointment and tenure of the Information Commissioner.
On the face of it the Bill appears to be a privacy-friendly piece of legislation, with a number of provisions that reduce the amount of information held by public authorities or that limit various manifestations of the “surveillance society”. However, the approach has its limitations.
First, the Bill is something of a rag-bag. For instance, why has the use of biometric technology in schools been singled out for attention? Is there actually any evidence that the existing DPA framework has not been coping with this adequately? There is little evidence in the Bill of a comprehensive attempt to think through issues about privacy: the impression is more of an attempt to address specific issues that have caused public controversy (e.g. employment vetting), created legal problems in Strasbourg (e.g. DNA retention), or otherwise caught the eye of politicians. Contrast the approach in New Zealand, for instance, where the Law Commission is conducting a comprehensive review of the law of privacy.
A second, related point is that the regulatory framework in this area is becoming increasingly fragmented. The Information Commissioner is responsible for the DPA. Other regulators deal with different aspects of privacy. The Office of the Surveillance Commissioners oversees the use of covert surveillance and covert human intelligence sources. The Interception of Communications Commissioner reviews the interception of communications, the acquisition of communications data and related issues. The Equality and Human Rights Commission also has a role to play in relation to article 8 of the Convention. Now in addition we are to have a Commissioner for the Retention and Use of Biometric Material and a Surveillance Camera Commissioner. A less scattergun and more considered approach to reform in this area might begin by looking at whether the time has come to introduce a Privacy Commissioner (perhaps by expansion of the existing ICO) to bring all of these various functions under a single roof. See here for discussion along similar lines.
A third point is that the Bill is very much focused on the activities of the public sector as a potential threat to privacy. For instance, the focus is on public sector rather than private operators of CCTV systems. There is nothing that reflects contemporary debates about the use of personal information by credit reference agencies or social networking sites.