Leveson Inquiry Report: spotlight on proposed data protection reforms

November 29th, 2012 by Rachel Kamm

Lord Justice Leveson has today published his eagerly awaited report into the culture, practices and ethics of the press.  The key proposal which will shape the future of press regulation is the recommendation to create an independent self-regulatory body, governed by an independent board. Of particular interest to information lawyers is the discussion of the extent to which the current legal, policy and regulatory framework has failed in relation to data protection. In this respect, the Report considers the lessons that can be learned from the practices of the press in relation to data handling and processing, makes bold recommendations in relation to legislative reform and further considers a bolstering of the Information Commissioner’s role and function.  The principal parts of the report dealing with the Data Protection Act 1998 (“DPA”) and ICO are Volume III, Part H and Volume IV, Appendix 4, Part 4.

Data protection: a key element of privacy rights

A key part of the Leveson Inquiry has been to consider the extent to which the press has unjustifiably interfered with the privacy of individuals in a manner which cannot be justified in the public interest. In this context, invasion of privacy does not mean simply through the publication of articles which intrude into the details of individuals’ private lives, but rights of individuals to keep personal information private, and rights restricting how personal information is processed by journalists. The Inquiry’s Terms of Reference expressly required Lord Justice Leveson to consider the extent to which the current policy and regulatory framework has failed in relation to data protection. The Inquiry provided a fresh and independent perspective for considering the DPA and the role of the ICO.

Historic difficulties in investigating and regulating data protection breaches by the press

Operation Motorman was an investigation by the ICO into the conduct of a private investigator, Steve Whittamore, which revealed that a significant amount of personal data was being sought by journalists working for most of the major newspaper groups. The data was being obtained by Mr Whittamore in breach of s.55 DPA (for example, through payments to public officials for details from a DVLA database, or through the blagging of friends and family telephone numbers from BT) and subsequently supplied to journalists. Mr Whittamore was prosecuted, but no journalist was interviewed by the ICO or subjected to enforcement action or prosecution. The Report highlights that the investigation produced a ‘treasure trove’ of evidence of serious and systemic illegality and poor practice in the acquisition and use of personal information which could have spread across the press as a whole. It also questions why the ICO failed to interview journalists or prosecute journalists for breach of the DPA, and notes that two reports laid before Parliament by the ICO had set out the evidence of a flourishing and unlawful trade in confidential personal information.

The Report highlights that one of the difficulties encountered by the ICO in pursuing breaches of data protection legislation against the press arose from deficiencies in the legal framework, which “puts unnecessary and inappropriate barriers in the way of regulatory law enforcement and the protection of victims’ rights”. Perhaps for this reason, amendments to the legal framework form a key part of the recommendations on data protection reform.

Recommendations to amend data protection legislation

Section 32 of the DPA restricts the circumstances in which the ICO can exercise most of its powers in relation to the press. Section 32 operates by disapplying a number of investigative and enforcement powers in circumstances where the data processing falls within section 32, namely where (i) the processing is undertaken with a view to the publication by any person of any journalistic material; (ii) the data controller reasonably believes that, having regard in particular to the special importance of the public interest in freedom of expression, publication would be in the public interest; and (iii) the data controller reasonably believes that, in all the circumstances, compliance with that provision is incompatible with the special purposes.

The Report recommends that section 32 should be amended so as to make it available only where: (a) the processing of data is necessary for publication, rather than simply being in fact undertaken with a view to publication; (b) the data controller reasonably believes that the relevant publication would be or is in the public interest, with no special weighting of the balance between the public interest in freedom of expression and in privacy; and (c) objectively, that the likely interference with privacy resulting from the processing of the data is outweighed by the public interest in publication. These amendments would render it more difficult for those organisations processing data for the purposes of publication to bring themselves within the scope of s.32. The proposed amendments seek to re-set the balance between the public interest in freedom of expression and the public interest in personal information privacy.

Further, the report recommends that the extent to which s.32 disapplies provisions of the DPA should be reduced and  that the processing of data by the press should be subject to the following obligations (which previously attracted exemption):

  •  the requirement of the first data protection principle to process personal data fairly (except in relation to the provision of information to the data subject under paragraph 2(1)(a) of Part II Schedule 1 to the DPA) and in accordance with statute law;
  •  the second data protection principle (personal data to be obtained only for specific purposes and not processed incompatibly with those purposes);
  • the fourth data protection principle (personal data to be accurate and kept up to date);
  •  the sixth data protection principle (personal data to be processed in accordance with the rights of individuals under the Act);
  •  the eighth data protection principle (restrictions on exporting personal data); and
  • the right of subject access (subject to further investigation and clarification of protection of journalists’ sources).

Recommendations for procedural amendments

The Report recommends:

  • The repeal of certain procedural provisions of the DPA with special application to journalism (namely section 32(4) and (5) and sections 44 to 46). The purpose of this is to give the ICO, and the Courts, greater powers to consider breaches of data protection without procedural hurdles in place, for example repealing section 32(4) would allow Courts to consdier preventing the Courts considering the complaint whilst the ICO determines whether the data controller has been processing the date for the purposes of journalism;
  • In conjunction with the repeal of those procedural provisions, consideration should be given to the desirability of including in the DPA a provision to the effect that, in considering the exercise of any powers in relation to the media or other publishers, the ICO should have special regard to the obligation in law to balance the public interest in freedom of expression alongside the public interest in upholding the data protection regime;
  • Specific provision should be made to the effect that, in considering the exercise of any of its powers in relation to the media or other publishers, the ICO must have regard to the application to a data controller of any relevant system of regulation or standards enforcement which is contained in or recognised by statute; and
  • To further strengthen individuals’ rights, the right to compensation for distress conferred by section 13 of the DPA is not restricted to cases of pecuniary loss, but should include compensation for pure distress.

ICO’s powers of prosecution

In his evidence to the Inquiry, the former Information Commissioner Richard Thomas described the ICO as “primarily not a prosecuting authority. That was almost on the side”. The main formal power in the event of non-compliance was the ‘enforcement notice’, which could specify and require compliance action subject to the back-up sanctions of court enforcement, although this was not frequently used. Prosecution powers were limited to section 55 of the DPA and did not extend, for example, to other offences such as phone hacking (although this might also technically involve a section 55 DPA breach).

The Report recommends that:

  • The necessary steps should be taken to bring into force the amendments made to section 55 of the DPA by section 77 of the Criminal Justice and Immigration Act 2008 (increase of sentence maxima) to the extent of the maximum specified period; and by section 78 of the 2008 Act (enhanced defence for public interest journalism);
  • The prosecution powers of the Information Commissioner should be extended to include any offence which also constitutes a breach of the data protection principles.
  • A new duty should be introduced (whether formal or informal) for the ICO to consult with the Crown Prosecution Service in relation to the exercise of its powers to undertake criminal proceedings;
  • The ICO should immediately adopt the Guidelines for Prosecutors on assessing the public interest in cases affecting the media, issued by the Director of Public Prosecutions in September 2012; and
  • The ICO should take immediate steps to engage with the Metropolitan Police on the preparation of a long-term strategy in relation to alleged media crime with a view to ensuring that it is well placed to fulfil any necessary role in this respect in the future, and in particular in the aftermath of Operations Weeting, Tuleta and Elveden.

Recommendation to issue guidance

The Report includes a number of recommendations directed at the ICO in relation to its provision of guidance and advice. In particular, it recommends that the ICO should issue good practice guidelines and advice on appropriate principles and standards to be observed by the press in the processing of personal data. Further, it should issue guidance to the public on their individual rights in relation to the press and their personal data and also advice for data subjects who are concerned that their data may have been processed by the press unlawfully or otherwise than in accordance with good practice. In full:

  • The ICO should take immediate steps to prepare, adopt and publish a policy on the exercise of its formal regulatory functions in order to ensure that the press complies with the legal requirements of the data protection regime.
  • In discharge of its functions and duties to promote good practice in areas of public concern, the ICO should take immediate steps, in consultation with the industry, to prepare and issue comprehensive good practice guidelines and advice on appropriate principles and standards to be observed by the press in the processing of personal data. This should be prepared and implemented within six months from the date of this Report.
  • The ICO should take steps to prepare and issue guidance to the public on their individual rights in relation to the obtaining and use by the press of their personal data, and how to exercise those rights.
  • In particular, the ICO should take immediate steps to publish advice aimed at individuals (data subjects) concerned that their data have or may have been processed by the press unlawfully or otherwise than in accordance with good practice.
  • The ICO, in the Annual Report to Parliament which it is required to make by virtue of section 52(1) of the DPA, should include regular updates on the effectiveness of the foregoing measures, and on the culture, practices and ethics of the press in relation to the processing of personal data.

Strengthening the ICO

The Report recommends that the opportunity should be taken to consider amending the DPA formally to reconstitute the ICO as an Information Commission, led by a Board of Commissioners with suitable expertise drawn from the worlds of regulation, public administration, law and business, and active consideration should be given in that context to the desirability of including on the Board a Commissioner from the media sector.

The Report recommended to the ICO that:

  • It should take the opportunity to review the availability to it of specialist legal and practical knowledge of the application of the data protection regime to the press, and to any extent necessary address it; and
  • It should take the opportunity to review its organisation and decision-making processes to ensure that large-scale issues, with both strategic and operational dimensions (including the relationship between the culture, practices and ethics of the press in relation to personal information on the one hand, and the application of the data protection regime to the press on the other) can be satisfactorily considered and addressed in the round.

Conclusion

The recommendations in the Report seek to significantly strengthen the ICO’s powers to investigate and enforce against poor press practices and, if enacted, would represent a marked change in the relationship between the ICO and the press.

Rachel Kamm

(11KBW’s Heather Emmerson was instructed by the Treasury Solicitor as part of the team of Counsel to the Leveson Inquiry.)

Court of Appeal considers whether the Enhanced Criminal Records Certificate regime infringes Article 8

November 28th, 2012 by Hannah Slarks

This week, the Court of Appeal heard the cases of R (T) v Chief Constable of the Greater Manchester Police and others and R (JB) v the Secretary of State for the Home Department.  These are the latest in a series of cases challenging whether the criminal records checks regime is compatible with the Convention.  Unlike previous cases, which have concerned the disclosure of “soft information” held on local police computer systems, these cases raise in stark terms the compatibility of s.113B(3)(a) of the Police Act 1997 with Article 8.  This requires the disclosure of all convictions, cautions, warnings and reprimands on an Enhanced Criminal Records Certificate (“ECRC”).  In T’s case, his ECRC disclosed a warning he had been given for stealing a bicycle when he was 11.  In JB’s case, her ECRC disclosed a caution for shoplifting given eight years before the check.

Was there an interference?

The first issue to be considered by the Court is whether there is any interference with Article 8.  Following R (L) v Commissioner of Police for the Metropolis [2010] 1 AC 410 M.M. v United Kingdom (Application no. 24029/07), it is clear that a person’s Article 8 rights will be engaged by disclosure of their past convictions in two situations:  if the disclosure has a direct effect on their employment opportunities; or if their convictions are sufficiently long ago that they have become part of their private life.

Neither T nor JB lost employment opportunities as a direct result of the ECRC.  T risked losing a place on his degree course, but was eventually permitted to finish.  JB was told that one agency would not put her forward for work as a carer.  However, she may be able to work with other agencies.

The question is whether the disclosure of this information on an ECRC will necessarily interfere with the right to respect for private life, even if it does not affect the subject’s employment opportunities.  In favour of this proposition, it was argued that because a caution or warning is given in private, as it recedes into the past, it becomes part of the subject’s private life.  Similarly, as a conviction recedes into the past, it could also become part of the subject’s private life.  Against it, it was argued that the conviction and warning were too recent to have become part of the Claimants’ private lives.

Was any interference justified?

The question of whether any interference was justified turns on both principled arguments and the effect of a number of key decisions in this area.

As to the principles, the Claimants, Liberty and the EHRC argued that it was disproportionate to require blanket and indiscriminate disclosure of all convictions, cautions, warnings and reprimands, no matter how old and how relevant to the purpose for which the ECRC was obtained.  Counsel for the Secretary of State argued that designing the criminal record checks regime involves striking a balance between important and conflicting interests. This is a matter for Parliament.  Parliament has resolved to leave it up to employers to decide whether an offence is minor or irrelevant.  This solution allows for an automated, rule-based process for undertaking the ECRC.  Therefore, he argued, this is a reasonable solution.

In addition to this analysis of the principles, arguments on justification focused on the effect of three key authorities:

  1. R (L) v Commissioner of Police for the Metropolis [2010] 1 AC 410.  The Court of Appeal was asked to consider whether the majority of the Supreme Court in L had decided that the Act was compatible with Article 8 insofar as it required disclosure of all convictions and cautions.  There was also debate as to whether L is incompatible with the later Supreme Court decision that the notification obligations on sex offenders were incompatible with Article 8 (R (F) v Justice Secretary [2011] 1 AC 331).
  2. Chief Constable of Humberside Police and others v Information Commissioner [2010] 1 WLR 1136:  A week before the decision in L, the Court of Appeal had held that the retention of information regarding criminal convictions was justified.  The question for the Court of Appeal now is whether this decision is distinguishable on the grounds that it concerned retention, rather than disclosure, of information.
  3. M.M. v United Kingdom (Application no. 24029/07):  Only two weeks ago, the Strasbourg Court held that the arrangements in Northern Ireland for the indefinite retention of data relating to a person’s criminal caution infringe Article 8 of the ECHR (read Charles Bourne’s blog post on this case here).  The disclosure of this data in criminal record checks was also found to infringe Article 8, as the statutory scheme did not provide sufficient safeguards to protect the data from disclosure in breach of Article 8.  Therefore, the interference with the Applicant’s Article 8 rights was ‘not in accordance with the law’.  Before the Court of Appeal, it was argued by the Government that MM: was wrongly decided; was distinguishable on its facts; does not embody any clear constant jurisprudence of the Strasbourg Court and cannot in any event be followed because of the effect of the Supreme Court’s decision in L.

Is the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975 (SI 1975/1023) ultra vires?

This additional issue was only raised in T.  Applicants for jobs covered by the Order have to answer truthfully any questions from prospective employers about their spent convictions and cautions.  Applicants for jobs falling outside the scope of the Order are permitted to answer untruthfully.  The question is whether the Order is ultra vires because it is incompatible with Article 8 to (in effect) require prospective employees for certain positions to disclose all of their convictions and cautions.  There was argument as to whether striking down the Order would improperly impose a positive obligation on the State to permit employees to give untruthful answers.  The Court is also asked to consider whether the compatibility of the Order is really a distinct issue from the compatibility of s.113B(3)(a) of the Police Act.

Judgment is awaited.

Jason Coppel represented the Home Secretary in both cases and the Justice Secretary in T.  Tim Pitt-Payne QC represented Liberty, intervening in T.

 

Hannah Slarks

Norwich Pharmacal Relief

November 28th, 2012 by jamesgoudie

If through no fault of his own a person gets  mixed up in the tortious acts of others so as to facilitate their wrong-doing he may incur no personal liability but he comes under a duty to assist the person who has been wronged by giving him full information and disclosing the identity of the wrongdoers.  Justice requires that he should co-operate in righting the wrong if he unwittingly facilitated its perpetration.  This is the principle recognized by the House of Lords in Norwich Pharmacal Co v Customs and Excise Commissioners [1974] AC 133.

This principle has been considered by the Supreme Court in Rugby Football Union v Consolidated Information Services Ltd (formerly Viagogo Ltd) [2012] UKSC 55.  This case arose in the following way. 

The Rugby Football Union (RFU) is of course the governing body for Rugby Union in England. It owns Twickenham Stadium.  It is responsible for issuing tickets for matches played at the Stadium. It is the RFU’s policy to allocate tickets so as to develop the sport and enhance its popularity. Most tickets are distributed via affiliated rugby clubs and other bodies. The distribution thereafter is subject to different rules depending on the nature of the body in question. Member clubs are permitted to sell some or all of their ticket allocation to official licensed operators for use in corporate hospitality packages. The RFU’s terms and conditions stipulate that any resale of a ticket or any advertisement of a ticket for sale at above face value will constitute a breach of contract rendering the ticket null and void. This condition is printed on the tickets and applicants are warned of it on ticket application forms. A further term stipulates that the tickets are property of the RFU at all times.

Viagogo (now in liquidation) operated a website which provided the opportunity for visitors to the site to buy tickets online for a number of sporting and other events. Sellers would register their tickets with Viagogo and a price would be suggested based on current market data. Viagogo received a percentage of the sale. The RFU monitors ticket re-sale websites in an attempt to discover whether and by whom tickets were being sold above face value. This effort was frustrated, however, in many instances by the anonymity offered by websites including Viagogo.

In the run up to the international rugby matches in autumn 2010 and the Six Nations Tournament, the RFU discovered that Viagogo had been used to advertise thousands of tickets for the matches at Twickenham. Tickets with a face value of £20 to £55 were being advertised for sale at up to £1300. After a request for information about the identity of those selling the tickets was refused, the RFU issued proceedings against Viagogo seeking information which it required in order to take action to protect its policy in relation to tickets.

The High Court granted the RFU a Norwich Pharmacal order requiring Viagogo to disclose the identities of those involved in the sales. The order was made on the grounds that the RFU had a good arguable case that those selling and purchasing the tickets had been guilty of breach of contract and that it was appropriate to grant the order for them to obtain redress.

Before the Court of Appeal, Viagogo introduced a new ground of appeal to the effect that granting the order represented a disproportionate interference with the rights of the potential wrongdoers under Article 8 of the Charter of Fundamental Rights of the European Union. Article 8 guarantees the protection of personal data. The Court of Appeal [2011] EWCA Civ 1585 upheld the decision of the High Court and decided that the RFU had no readily alternative means of pursuing the wrongdoers. On the new ground the Court of Appeal held that interference with the personal data rights of the individuals was proportionate in light of the RFU’s legitimate objective in obtaining redress for arguable wrongs.

The issue before the Supreme Court was whether the grant of the order involved a breach of Article 8 of the Charter.  The Supreme Court unanimously dismissed the appeal.  

The Supreme Court observed that cases since Norwich Pharmacal itself have emphasized the need for flexibility and discretion in considering whether the remedy should be granted.  It is not necessary that an applicant intends to bring legal proceedings in respect of the arguable wrong.  Any form of redress (for example disciplinary action or the dismissal of an employee) will suffice to ground an application for the order.  The need to order disclosure will be found to exist only if it is a necessary and proportionate response in all the circumstances.  The test of necessity does not require the remedy to be one of last resort.  The essential purpose of the remedy is to do justice.  This involves the exercise of discretion by a careful and fair weighing of all relevant factors.

Various factors have been identified in the authorities as relevant.  These include: (i) the strength of the possible cause of action contemplated by the applicant for the order;  (ii) the strong public interest in allowing an applicant to vindicate his legal rights;  (iii) whether the making of the order will deter similar wrongdoing in the future;  (iv) whether the information could be obtained from another source;  (v) whether the respondent to the application knew or ought to have known that he was facilitating arguable wrongdoing; (vi) whether the order might reveal the names of innocent persons as well as wrongdoers, and if so whether such innocent persons will suffer any harm as a result;  (vii) the degree of confidentiality of the information sought; (viii) the privacy rights under Article 8 of the ECHR of the individuals whose identity is to be disclosed; (ix) the rights and freedoms under the EU data protection regime of the individuals whose identity is to be disclosed; and (x) the public interest in maintaining the confidentiality of journalistic sources, as recognized in s10 of the Contempt of Court Act 1981 and Article 10 of the ECHR.

As Lord Kerr stated (para 18), many of these factors are self-evidently relevant to the question of whether the issue of a Norwich Pharmacal order is proportionate in the context of Article 8 of the Charter of Fundamental Rights of the European Union.  Article 8 of the Charter was applicable as the order of the High Court involved disclosure of private data and thus was in the material scope of European Law.

The Supreme Court held that the appropriate test of proportionality under Article 8 of the Charter involved weighing the benefit of the information being sought by the RFU against the impact that disclosure was likely to have on the individual concerned. The appellant was wrong to suggest, however, that the assessment had to be carried out solely by reference to the particular benefit that obtaining information in relation to an individual might bring.  It was artificial and unrealistic to suggest that the RFU’s aim of discouraging others in the future from flouting its rules should not be considered.  The facts of each case must be considered individually, but there was nothing in the European cases cited or otherwise which supported the notion that the wider context for which the RFU wished to have the information should be left out of account.

While there should be an intense focus on the rights claimed by the individuals concerned, this was not a case where disclosure would result in oppressive or unfair treatment. The only information sought was the names and addresses of individuals who had bought and sold tickets in clear breach of the RFU’s ticket policy. The particular circumstances affecting a person whose data were sought may in some limited cases displace the interests of the applicant for disclosure even where there was no feasible alternative way of getting the information. This was not such a case, however.

New Code of Practice on anonymisation

November 22nd, 2012 by Rachel Kamm

The Information Commissioner has published a new code of practice on “Anonymisation: managing data protection risk“.

Under the Data Protection Act 1998, the definition of personal data does not include information relating to an individual if that individual cannot be identified from that information together with all other information which is in the possession of, or is likely to come into the possession of, the data controller. It follows that where an organisation holds data relating to individuals which is anonymised, or where it is deciding whether or not to anonymise its data, it will need to consider carefully whether the anonymisation method means that the information falls outside the scope of the DPA or not.  The 100+ page code includes guidance and practical examples to assist organisations in assessing their options in relation to anonymisation. This guidance will not only be useful in relation to DPA obligations, but also where an organisation is considering anonymising data in order to respond to a Freedom of Information request. Note that whilst the code gives advice on good practice, it is not mandatory to comply with its recommendations where they go beyond the obligations under the DPA; it  is issued under section 51 of the DPA, but it is not legally enforceable.

In addition to the new Code of Practice, the ICO has announced that “a consortium led by the University of Manchester, with the University of Southampton, Office for National Statistics and the government’s new Open Data Institute (ODI), will run a new UK Anonymisation Network (UKAN). The Network will receive £15,000 worth of funding from the ICO over the next two years to enable sharing of good practice related to anonymisation, across the public and private sector. The network will include a website, case studies, clinics and seminars“.

Rachel Kamm

Retention and disclosure of police caution data infringe Article 8

November 14th, 2012 by Charles Bourne

The European Court of Human Rights yesterday handed down a Chamber judgment in M.M. v United Kingdom (Application no. 24029/07) declaring that the arrangements for the indefinite retention of data relating to a person’s caution in a criminal matter and for the disclosure of such data in criminal record checks infringe Article 8 of the ECHR. Although the Court recognised that there might be a need for a comprehensive record of data relating to criminal matters, the indiscriminate and open-ended collection of criminal record data was unlikely to comply with Article 8 in the absence of clear and detailed statutory regulations clarifying the safeguards applicable and governing the use and disposal of such data, particularly bearing in mind the amount and sensitivity of the data. 

The case arose from a family dispute in Northern Ireland in the course of which the applicant, a grandmother, took her grandson away from his parents for two days before returning him unharmed. This resulted in her receiving a caution for child abduction in November 2000. In 2003 the police advised her that her caution would remain on record for only five years, i.e. until 2005. However, following the Soham murders and the Bichard report, there was a change of policy whereby any convictions and cautions where the victim was a child would be kept on record for the offender’s lifetime. 

Until 1 April 2008, requests for disclosure of criminal record data in Northern Ireland were made on a consensual basis. Disclosure took place in accordance with well-established common law powers of the police. Provisions of the Police Act 1997, introduced in England and Wales in 2006, were applied to Northern Ireland in 2008. Section 113A required a criminal record certificate to be issued on request and payment of a fee, to include details of all cautions and convictions whether spent or not, if the request was for stated purposes including that of assessing the suitability of persons to work with children and vulnerable adults.

Disclosure of the applicant’s caution caused her to be turned down for jobs as a family support worker in the social care field. She complained that the indefinite retention and disclosure of the caution data infringed her ECHR rights.

The Court noted that both the storing of information relating to an individual’s private life and the release of such information come within the scope of Article 8 § 1. The question was whether the police records contained data relating to the applicant’s “private life” and, if so, whether there had been an interference with her right to respect for private life. The data was both “personal data” and “sensitive personal data” within the meaning of the Data Protection Act 1998 and “personal data” in a special category under the Council of Europe’s Data Protection Convention. Although a person’s criminal record was public information, systematic storing of data in central records made them available for disclosure long after the event. As a conviction or caution receded into the past, it became a part of the person’s private life which had to be respected. The applicant’s voluntary disclosure of the caution to her prospective employer did not deprive her of the protection afforded by the Convention where employers were legally entitled to insist on disclosure. Thus Article 8 applied, and the retention and disclosure of the caution amounted to an interference.

To decide whether the interference could be justified under Article 8 § 2, the Court considered the legislation and policy applicable at the relevant time and since. It highlighted the absence of a clear legislative framework for the collection and storage of data and the lack of clarity as to the scope, extent and restrictions of what in Northern Ireland were originally common law powers of the police to retain and disclose caution data. There was also no mechanism for independent review of a decision to retain or disclose data. The provisions of the Police Act 1997 which came into force in Northern Ireland on 1 April 2008 created some limited filtering arrangements in respect of disclosures. However, in providing for mandatory disclosure under section 113A, no distinction was made on the basis of the nature of the offence, the disposal in the case, the time which had elapsed since the offence or the relevance of the data to the employment sought.

 The Court decided that the cumulative effect of these matters was an insufficiency of safeguards in the system to ensure that data relating to the applicant’s private life had not been, and would not be, disclosed in violation of her right to respect for her private life, and therefore the retention and disclosure of data was not “in accordance with the law” for the purpose of Article 8 § 2. The Court therefore did not go on to determine whether the interference was “necessary in a democratic society” for one of the stated aims, or whether there had been any infringement of Articles 6 and 7.

 Charles Bourne

 

Update on recent Tribunal decisions part 4: qualified exemptions and the public interest

November 13th, 2012 by Robin Hopkins

In the final part of our round-up of recent decisions of the First-Tier Tribunal, Panopticon looks at the qualified exemptions, the public interest and a few other loose ends.

Section 36: Cherie Booth, Ryanair and Council emails

Sutton v IC and Nottingham City Council (EA/2012/0044) concerned the Council’s decision to amend its internal ‘sign off’ procedures for responses to FOIA requests, following an incident in which its response to a request about the cost of Councillors’ refreshments was considered to have been inadvertently misleading and lacking in context. The requester asked for internal emails about the proposed change. The Council withheld some of those emails, contending that they contained the sort of robust, free and frank exchange of views for which a safe decision-making space was needed. In a decision which many local authorities will find heartening, the Tribunal agreed.

The background to Sittampalam v IC and Ministry of Justice (EA/2011/0277) is the comments made by Cherie Booth QC, sitting as a recorder, when sentencing a Muslim defendant. Her comments appeared to suggest that his faith was a mitigating factor in his defence. They caused a stir, were reported in the media and attracted complaints, including by the National Secular Society, to the Office for Judicial Complaints. The OJC concluded that Ms Booth’s comments did not constitute judicial misconduct, though she was to receive “informal advice” on the issue.

A request under FOIA was made for all information about this OJC investigation and any action taken. The public authority relied on s. 36 – prejudice to the free and frank exchange of views, provision of advice or conduct of public affairs. The ‘reasonable opinion of the qualified person’ (the prerequisite for engaging s. 36) was obtained after the public authority’s holding reply to the request and after the statutory time for compliance – but before the public authority’s formal notice of refusal. The Tribunal rejected the requester’s contention that s. 36 was not engaged because of the timing of the opinion. As to the public interest, the Tribunal was satisfied us that the requester’s suspicions about the OJC ‘covering up’ the complaint or trying to minimise the impact of its conclusions on account of Ms Booth being the wife of Tony Blair were unfounded. Nor were the OJC’s press statements inconsistent with its letters to the National Secular Society. The appeal was dismsised.

Whereas alleged ‘late reliance’ on s. 36 succeeded in Sittampalam, it was unsuccessful before the Tribunal (at the preliminary hearing stage) in Ryanair v IC and Office of Fair Trading (EA/2012/0088). The opinion was obtained prior to the internal review. The Tribunal concluded that:

“Considering issues of reasonableness it is difficult for the Tribunal to be satisfied that the section 36 opinion of the qualified person – given its timing in respect of this appeal – is not an ex post facto conclusion or, more accurately, not tainted with the perception that that could be the case. That goes to the heart of its reasonableness.”

Sections 41 and 43: casinos and vikings

London Borough of Newham v IC (EA/2011/0288) concerned the Council’s award of the licence to operate a large casino at Westfield shopping centre in Stratford. The requester, a law firm acting on behalf of the unsuccessful bidder, made a request under FOIA for documents relating to the successful bid. The Council withheld some of those, relying on s. 44 (statutory bar on disclosure under the Code of Practice for the Gambling Act 2005), s. 41 (information obtained in confidence) and s. 43 (prejudice to commercial interests). The Commissioner was unpersuaded and ordered disclosure.

The Council’s appeal was partially upheld and partially dismissed. The statutory bar was held not to extend beyond the conclusion of the tender process. S. 43(2) was engaged, with the public interest favouring disclosure of some (relating for example to security arrangements and the financial guarantee offered by the winning bidder, as well as records of some of the negotiation discussions, which the Tribunal found would be unsurprising to any commercial rival) but not others (tender details which were deemed more commercially sensitive). Similarly, s. 41 succeeded for some information but not all (some, for example, was effectively in the public domain; some had not been obtained from outside the Council). Bidders could reasonably expect confidentiality not permanently, but for a reasonable time following the bidding process – here the request was made within that reasonable time, which counted in the Council’s favour.

The disputed information in Pim v IC and Down DC (EA/2012/0078) was a business plan submitted by the Magnus Viking Association in respect of their proposed Viking re-enactment centre, and correspondence between the Council and Magnus. The Council relied on regulation 12(5)(e) of the EIR (confidentiality of commercial or industrial information where such confidentiality is provided by law to protect a legitimate economic interest). The Commissioner and Tribunal agreed: extensive research and consultation had gone into the specialist information, which could be used by Magnus’ competitors in a viking re-enactment market which, while not flooded with competition, was growing. There was a strong interest in maintaining trust between the commercial parties.

Prejudice to the course of justice

In McCullough v IC and Northern Ireland Water (EA/2012/0082), the requester sought detailed technical information about vibrations measurements relating to sewer upgrade works in Belfast. The Commissioner agreed with the public authority that regulation 12(5)(b) of the EIR (adverse effects on the course of justice) was engaged and that the public interest favoured its maintenance. A key issue was that disclosure, it was argued, would prejudice NI Water’s position when defending prospective legal claims about the sewer works vibrations, including by the requester (though there was a dispute as to whether the requester did in fact intend such proceedings).

The Tribunal disagreed. It was “not persuaded that purely factual information such as this could ever adversely affect the course of justice” and did “not accept that early disclosure of this technical information would prejudice NI Water in any way that they would not be prejudiced in the normal course of discovery in litigation by such information”. Regulation 12(5)(b) was therefore not engaged, in the Tribunal’s view.

It also did not think that information could be withheld just because of potential prejudice to a public authority’s litigation position: “The implications of implementing such a policy could, in some circumstances amount to a cover up, and in our view would be contrary to the spirit and intent of the FOIA and EIR legislation and further, contrary to the public interest. We are of the view that it is in the public interest that justice is done and that the correct result emerges from litigation, not that a public authority should necessarily be successful, just because it is a public authority.” The exact meaning of these last words is not clear, but the decision will nonetheless raise many a public authority eyebrow.

Robin Hopkins

Update on recent Tribunal decisions part 3: personal data of public officials and relating to court proceedings

November 13th, 2012 by Robin Hopkins

I posted a few days ago about some recent decisions of the First-Tier Tribunal on requests under FOIA and the EIR for personal data. There have been a number of decisions on this issue of late. The following are of note, as they illustrate the types of issues very frequently encountered by public authorities. They also illustrate the nuanced and forensic approach taken by some Tribunals. There may not be a presumption in favour of disclosing personal data, but public authorities should beware assuming that Tribunals will be equally cautious about disclosing all types of personal data.

Chief Constable appointments: partial disclosure ordered

The Appointments Committee of Dyfed Powys Police Authority assessed and interviewed the candidates for the office of Chief Constable. There were two candidates. The Committee was advised by a representative from HM Inspector of Constabulary who was very critical of one of the candidates, leaving the Committee feeling that it had no option but to appoint the other. Committee members complained about the HMIC representative, including to the Home Office. The issue entered the public domain. The unsuccessful candidate requested copies of relevant correspondence.

The issues in Roberts v IC and Dyfed Powys Police Authority (EA/2012/0032) were whether s. 40(1) or alternatively s. 40(2) applied.

The IC raised s. 40(1) belatedly, arguing that the withheld documents were the requester’s own personal data: the lateness “vexed” the Tribunal, and in any event the s. 40(1) argument was rejected, as the Durant conditions of biographical significance and focus were not met. The IC had sought to apply the definition of “personal data” too widely in a way that went beyond the Durant restrictions.

The s. 40(2) argument concerned the personal data of (a) members of the Appointments Committee (the Tribunal’s answer: disclosure would breach the data protection principles, as they were unpaid public representatives who were not at fault), and (b) the HMIC representative (the Tribunal’s answer: disclosure was for the most part ordered, given the representative’s role, the publicised allegations about her conduct and the fact that disclosure would result in minimal incremental distress).

The case illustrates the ongoing dominance of Durant, the need to distinguish between types of data subject and the relevance of well-founded allegations of wrongdoing or poor conduct by public officials.

Redacting officials’ names: lack of legitimate interest in disclosure

Armit v IC and Home Office (EA/2012/0041) is one of two appearance by the UK Border Agency in this post. The request was for copies of guidance relating to which light vehicles/drivers should be stopped and interviewed and what circumstance should lead to the vehicle being detained whilst a search is undertaken and identity checks undertaken, as well as for statistics about such ‘stops and searches’ carried out at Dover Port. UKBA’s refusal was based in part on s. 40(2): it sought to redact the names of the officials in a document entitled ‘Tourist Selection Indicators and Selection Techniques’. The Tribunal was not very impressed by the arguments that officials would not have expected public disclosure of their names. However, fatal to the requester’s case was the failure to identify a legitimate interest in public disclosure of the names of those officials. The Tribunal concluded that:

“We do not accept the argument that the officials would not have expected their names within the document to be made public and were not given compelling evidence of this. We were given no information as to their specific grading but they were described in the document as ‘lead contributer’ and ‘lead postholder’. They clearly have some responsibility in relation to the work.  We were given no compelling evidence that disclosing their names would result in victimisation, insult or any form of danger.  However, we do accept that the officials would prefer not to have their names identified and that might in itself represent a certain right and freedom or legitimate interests in itself. In any event, to process personal data, it needs to be necessary to pursue the purposes of legitimate interests pursued by others.  In this case, we do not find that the Appellant has shown any legitimate interest in the names of the officials being disclosed to the public under FOIA. We conclude that the information is therefore exempt from disclosure.”

The case illustrates the importance of requesters making out a legitimate public interest in knowing the identity of officials whose names appear in requested documents where those officials are not obviously senior enough for a general accountability argument to suffice.

Neither confirm nor deny: involvement in court proceedings

In Mahajan v IC (EA/2011/0240), the requester sought information about the conduct of criminal proceedings in which he was involved, in particular relating to note-taking, recording, legal aid payments, contributions made by the judge during the hearing and communications between the requester and the court’s administrative staff.

The IC found that the request could be refused on the grounds of s. 40(5) FOIA, the “neither confirm nor deny” exemption for personal data. The argument was that the individuals identified in the requested information would have a legitimate expectation that information that might or might not confirm whether they had been part of an investigation and/or court proceedings would not be released.  A confirmation or denial would, it was argued, reveal some information which was not already in the public domain and was not reasonably accessible to the general public. It would also publicise the existence or otherwise of an investigation and court proceedings involving those named parties.

For some parts of the request, the Tribunal agreed: any answer would reveal personal data the public disclosure of which would breach a data protection principle. For the most part, however, the Tribunal disagreed with the IC. A major aspect of its reasoning was that much of the information related to a public court hearing: therefore, disclosing that an individual had been a judge in that hearing, or had appeared as an advocate would not breach any of the data protection principles. In addition, some of the “data subjects” were in fact not living individuals but commercial entities.

This case illustrates the importance, when taking a “neither confirm nor deny” stance, of assessing why mere confirmation or denial of whether the requested information is held (as opposed to disclosure of that information itself, if held) would breach a data protection principle.

Interestingly, while the Tribunal disagreed with the IC on a number of the s. 40(5) FOIA arguments, it went on to agree with the public authority that those parts of the request were plainly vexatious and could be refused on s. 14(1) FOIA grounds.

Qualifications of legal advisor

In Hodson v IC (EA/2012/0084), the Tribunal decided that information about the professional qualification of an individual fulfilling the role of Legal Adviser to Scunthorpe Magistrates’ Court should be disclosed but that he was not entitled to receive information about the Adviser’s other academic qualifications. Its nuanced approach (i.e. approaching different types of personal data differently) is summarised at its paragraphs 18 and 19:

“In view of the functions performed by Legal Advisers in a Magistrate’s Court, and the impact they are capable of having on those appearing before the court, we believe that there is a strong public interest in knowing that anyone fulfilling the role has the qualification of barrister or solicitor. That is to say the qualification that the Ministry of Justice holds out Legal Advisers as possessing. We believe that, were that information not to be a matter of public record, there would be strong public interest in its disclosure and that this would outweigh the individual’s right to privacy.

It follows that, were the position of Legal Adviser to be held by a person having any other qualification, there would be an equally strong public interest in that qualification also being publicly known. And that would apply whether the qualification was a non-legal one or a legal one that was less than full qualification as a barrister or solicitor. Examples of the latter would include a law degree, Chartered Institute of Legal Executives qualification, or completion of a Legal Practice Course or Bar Professional Training Course. But if the Legal Adviser holds the professional qualification of barrister or solicitor then the public interest in information about any other qualification, whether legal or non-legal, academic or professional, is greatly reduced. Disclosure, in those circumstances would constitute an unwarranted interference with the individual’s rights and freedoms.”

Nationality of opponent in litigation

Someone referred to as AF brought legal proceedings against Mr Philip Brown. Mr Brown incurred considerable costs as a result. He hoped to recover those costs if he won the case. In practice, he could only do so if AF was a British national; if he was a Nigerian national, he was thought likely to return there, putting him effectively beyond the reach of UK jurisdiction for enforcing any costs order. Mr Brown asked the UK Border Agency for “official information showing whether or not [Mr AF] is a UK citizen, or whether he is a Nigerian citizen who is in the UK on some sort of temporary permission”. The request was refused on s. 40(2) FOIA grounds; the Commissioner agreed.

The Tribunal in Philip Brown v IC (EA/2012/0094) also agreed. The requester argued that this was not “personal data”: Mr AF cannot be identified by his immigration status alone since that simply discloses whether he is one of 60  million people (if he is a UK national), or one of 120 million people (if he is a Nigerian national). The Tribunal rejected this as misconceived:

“What he is saying, in effect, is that if an individual is already known to the requester and

can be identified by him through information already held, then any additional information such as his immigration status, cannot be personal data because that does not identify him. Taken to its logical conclusion, it would mean that the Appellant could ask a public authority to disclose a range of information about Mr AF (for example, whether he is gay or straight, a Christian or a Muslim, divorced or single), on the basis that such information would only disclose the category of people to which Mr AF belongs and would not itself identify him.”

The requested information was “personal data” in Durant terms.

The requester also sought to rely on s. 35(2)(a) of the DPA, arguing that disclosure is “necessary for the purposes of, or in connection with, legal proceedings” and therefore that the data protection principles would not be breached. He said he needed the information in order to seek a protective costs order in accordance with the CPR.

The Tribunal considered the meaning of “necessary” in this context: it rejected the IC’s argument that “necessary” means “relevant and proportionate”, preferring Mr Brown’s view that it meant “indispensable, requisite, needful, that which cannot be done without”. The problem was that the requested information would not help with any application for a protective costs order. Condition 6(1) would not be met and s. 40(2) was upheld.

Robin Hopkins

Update on recent Tribunal decisions part 2: personal data of “low inherent sensitivity”

November 8th, 2012 by Robin Hopkins

The “personal data” provisions under s. 40(2) FOIA and regulation 13 EIR can often be very difficult to apply, particularly in light of the Durant “notions of assistance”, namely biographical significance and focus. It is correspondingly difficult to predict how such arguments will fare before the Tribunal. Two recent cases offer good illustrations. Both saw the Tribunal order disclosure of property-related personal data which was deemed to be of “low inherent sensitivity”.

Council housing

Exeter CC v IC and Guagliardo (EA/2012/0073) concerned a request for the addresses of all residential properties owned by or leased or rented to the Council. The Council refused the request. It was accepted that addresses constitute “personal data”, but the Commissioner considered it to be personal data of “low inherent sensitivity”. He found that disclosure would not breach any of the data protection principles. He ordered disclosure, subject to an exemption for addresses of properties allocated for housing those in need of protection.

The decision notice was upheld on appeal. The following aspects of its decision are notable (Tribunal comments appearing in italics).

As to the Council’s arguments for withholding the addresses:

  • The Council had conducted a survey of residents’ attitudes to such disclosures, but the particular questions and answers did not assist the Tribunal.
  • There was no clear evidence on the extent to which Council properties were already visually identifiable as such.
  • “The Tribunal observes that who owns property is not a private  matter. It has to be publicly recorded and available by way of Land Registry Records (although there is a fee for this information). There are many other ways that the ownership becomes public (e.g. local knowledge, press articles when properties are constructed, news articles and planning records).The Tribunal is satisfied that a tenant cannot therefore have a legitimate expectation that this information would not be disclosed.”
  • The Council argued that disclosure of the list of addresses would identify the residents as Council tenants and, as such, vulnerable, for example to being targeted by those wishing to prey upon individuals who were in financial difficulty. There was, however, no evidence before the Tribunal that disclosure would add to the pre-existing risk of such behaviour.
  • The only information (additional to the fact of the address) that can be discerned about any particular data subject by the disclosure of the disputed information was that they or their predecessor may have been financially unable to meet their housing needs at some time.

As to the arguments for disclosure:

  • “Additionally we are satisfied that there is a proper distinction to be drawn between those living in a Council owned asset and private accommodation, because the Council are accountable to the public for the way  they manage those assets and execute housing policy whereas a private landlord has no such additional public responsibility and that this must impact upon the reasonableness of any expectation that the Council would not publish this information.”
  • Disclosure would enhance transparency in allowing the public to be aware of the Council’s assets (i.e. its housing stock). By knowing how many properties the Council owns and where, the public would be enabled to scrutinise the distribution of Council properties between localities, analyse whether factors (such as levels of educational attainment) are correlated with the extent of Council owned housing in a given area.
  • Knowing the individual addresses would enable the public to see how Council properties are maintained, their state of repair and assess whether areas are under or over provided for.
  • “The Tribunal adds that such disclosure would also enable the public to review the type of housing stock owned and used by the Council and ascertain whether it could be used more efficiently to meet better the      needs of those in housing need. Analysis of the extent to which private      rentals are over or under used and whether this provides value for money      would also be enabled by disclosure of this information.”

Overall, the Tribunal agreed that addresses constitute personal data of “low inherent sensitivity”.

This is the second such case before the Tribunal. The Tribunal in Neath Port Talbot v IC (EA/2011/0037) ordered disclosure of the same type of information in another, less fully reasoned decision last year. While no First-Tier Tribunal decision is binding, the case for withholding such information seems nonetheless increasingly difficult to make out.

Building control applications

Martin and Karen Sharples v IC (EA/2012/0076) is a second recent case in the disclosure of personal data has been ordered in light of its “low inherent sensitivity”. The requesters sought information about building control applications made to Bolton MBC relating to roof conversions to residential properties in a specific cul-de-sac. The Council refused to provide the building control records and site visit notes, relying upon regulation 13 EIR (personal data). The issue was whether the residents/owners involved in those applications could be identified from the redacted records and notes and, if so, whether disclosure would breach any of the data protection principles.

The requesters argued that while they knew enough to identify the property owners from the requested information, a member of the public would not. The Tribunal was satisfied, however, that the owners could be identified – particularly given the availability of Land Registry searches, Google Earth and other ways to find out who lives where.

Like the Council residence addresses in the Exeter CC case however, this application information was considered to be personal data of “low inherent sensitivity”. Disclosure would not breach the data protection principles, in light of the following factors:

  • The information was similar to the sort of information routinely provided to estate agents and in planning applications (which are made public)
  • It would be discernible to a surveyor when the house changes hands
  • Some of the information was visible to the naked eye
  • Much of the information constituted confirmation of normal practice of construction to a fixed standard
  • The data subjects had not been told they could expect confidentiality
  • There was a legitimate public interest in transparency, in particular in being assured that the Council had properly assessed compliance whether the relevant regulations had been complied with

Many requests for personal data fail because the requester has not made out any or any sufficient legitimate interest in public disclosure of information impacting upon privacy. Sharples is interesting in that the emphasis worked the other way: the public interest does not appear to have been very pressing, but the personal data was sufficiently anodyne for disclosure to be the order of the day.

Robin Hopkins

Update on recent Tribunal decisions part 1: the evolving approach to vexatiousness and manifest unreasonableness

November 4th, 2012 by Robin Hopkins

In recent months, the major information law issues have involved the government’s vetoing disclosure of the Prince Charles ‘black spider’ letters, its response to the draft new EU Data Protection Regulation, a number of Article 8 decisions concerning police and criminal records and changes to RIPA. On this last point, note that as of last Thursday, local authorities require a magistrate’s approval for authorising directed surveillance.

There have also been a number of First-Tier Tribunal decisions of late, touching on some of the issues most commonly encountered by public authorities and requesters. Over the next week, Panopticon brings you a summary of these recent decisions, beginning with insights into “vexatious” (s. 14(1) of FOIA) or “manifestly unreasonable” requests (regulation 12(4)(b) of the EIR). These are cases in which the underlying concepts appear straightforward, but their practical application can often be tricky. These provisions are important for those – local authorities in particular – who need to make robust judgment calls about persistent and burdensome exercises of rights to information.

Requests by members of groups: aggregate with caution

The potential pitfalls for public authorities are illustrated by Pringle v IC and Bury MBC (EA/2012/0062), where the Tribunal overturned a s. 14(1) decision. The case concerned a prominent site, the Longfield Suite in Prestwich, to which the local “Save our Suite” group was committed. Mr Pringle was a member of that group; his one and only request for information had 11 parts, some of which apparently chimed with the group’s history of requests about business plans for the Suite.

The Council’s s. 14 decision was based on this collective pattern of requests and its resultant burden. On the evidence, however, the Tribunal found that the Council and the IC had too readily treated Mr Pringle’s requests together with those of the campaign group, and had given too much weight to questions asked through other fora, such as public meetings, the Audit Commission and the local MP. These were “legitimate avenues of enquiry, outside of the Freedom of Information Act and necessary in a democratic society.” The Council had also failed to ask Mr Pringle to narrow his request, and had not sought to answer as much of the 11-part request as possible.

One-man investigations can cross the line

In contrast, in Bragg v IC and Babergh DC (EA/2012/0107), the Tribunal upheld a refusal based on regulation 12(4)(b) of the EIR. The Council had taken enforcement action, culminating in an injunction and consent order, against a landowner (not the requester) for impermissible use of a private airfield.

The requester sought information about the enforcement and associated legal actions, his belief being that information was improperly withheld during disclosure for a planning inquiry. He questioned the “honesty and integrity” of the witnesses and argued that there was nothing in the EIR to prevent it being used as an investigative tool for the exposing of what the requester alleged was unlawful conduct which the public authority had covered up.

The Tribunal was unimpressed by his allegations. It concluded that:

“The Appellant has not challenged the High Court decision… by way of any of the routes of challenge such as judicial review or even direct complaint to the police and/or the Crown Prosecution Service. He appears to have set himself up as an investigator of wrongdoing that he perceives but he has not allowed other more appropriate bodies to investigate and consider any of the issues he believes lie at the heart of his information requests.”

The Tribunal found that he had crossed the thin line between persistence and obsession, straying into unreasonableness and becoming hectoring in his tone of enquiry in his 14 requests to the Council.

The Tribunal also took into account that Babergh District Council is a small public authority, with limited resources to devote to information requests.

Interestingly, the Commissioner submitted that, because this request was vexatious, the requester was not entitled to seek the same information in future requests. Here the Tribunal disagreed: “If the request is made several years from the date of the original there may well be entirely different considerations in play. At the very least, whether the request could be regarded as manifestly unreasonable after the passage of several years without other requests on the same matter in the intervening period would have to be re-examined and judged on the facts at that time”.

Conspiracy theories: groups and individuals

The Tribunal’s decision in Beswick v IC and Thames Valley Police (EA/2012/0040) draws together some of the themes discussed above. The requester sought information about the position in which the body of Dr David Kelly, the weapons inspector whose death in 2003 was investigated by the Hutton Inquiry, was found. He contributed to online discussion groups focusing on suspicions about Dr Kelly’s death and dissatisfaction with the conclusions of the Hutton Inquiry. Some other members of those groups had also made requests for related information to the same police authority. It contended that these requests were made in concert, and that this reinforced its reliance on s. 14 in refusing Mr Beswick’s request.

The Tribunal’s approach was first to consider Mr Beswick’s request in isolation. It noted the Commissioner’s long-standing five-part guidance on applying s. 14, but “felt that there was a compelling counter-argument that the Commissioner’s guidance should not even guide the Tribunal’s deliberations since this might have the appearance of giving  the approach of one party a higher status than those from the other parties”. The same point was made by the Tribunal in E Rex Makin v IC and Legal Services Commission (EA/2011/0163).

The Tribunal in Beswick did, however, derive assistance from the sorts of questions considered by the Tribunal in the oft-cited case of Rigby v IC and Blackpool NHS Trust (EA/2009/0103); [2011] 1 Info LR 643. These questions include: whether the request formed part of an extended and unfounded campaign to expose alleged improper or illegal behaviour, whether there was a tendentious and haranguing tone, whether the request indicated obsessiveness and the overall burden imposed (by Mr Beswick’s requests only, excluding those of the other members of the online discussion groups). By applying these factors and in light of the Hutton Inquiry’s conclusions, the police’s reliance on s. 14 was upheld.

Unreasonable burden can suffice for a s. 14 finding

Historically, the Commissioner and Tribunal have been reluctant to support reliance on s. 14(1) for reasons solely attributable to the cost and burden of compliance with the request. It was felt that s. 12 was intended to cater for those concerns. The costs of redaction, however, cannot be taken into account for s. 12 purposes. In Salford CC v IC and TieKey Accounts (EA/2012/0075), the Council sought to rely on s. 14 to argue that the burden imposed by the redactions that were likely to be required in order to comply with the request was unreasonable and disproportionate. The Commissioner initially disagreed, but – following the decision Independent Police Complaints Commission v IC (EA/2011/0222) – agreed that cost burden alone could support reliance on s. 14. The Tribunal in Salford agreed, and the Council’s appeal was allowed.

The evolving approach

As the above decisions illustrate, there is no uniform approach to s. 14 at a Tribunal level. The Commissioner’s five guiding questions remain helpful, but Tribunals are increasingly disinclined to give them much weight at all. A broader, dictionary-definition approach is preferred by some Tribunals, who ask simply whether the request tends to cause unjustified trouble or interference (see for example Graham and Ainslie). The questions posed in Rigby can, depending on the case, be very instructive. There is an increasingly strong case for giving the cost burden serious weight under s. 14.

Two upcoming developments should be followed with care. First, the Commissioner is in the process of revising his guidance on how to approach s. 14. Secondly, the Upper Tribunal is to hear a number of appeals on these issues together in the coming weeks: Ainslie, Dransfield and Craven. Its decision will hopefully bring some clarity to these issues.

In general however, most cases of this type turn on the quality of the evidence and the public authority’s efforts to be reasonable. That is likely to remain true whatever these new developments bring.

Robin Hopkins