Zaw Lin and Wai Phyo v Commissioner of Police for the Metropolis  EWHC 2484 (QB), a judgment of Green J handed down today, is an interesting – if somewhat fact-specific – contribution to the burgeoning body of case law on how subject access requests (SARs) made under the Data Protection Act 1998 (DPA) should be approached, both by data controllers and by courts.
The Claimants are on trial in Thailand for the murder in September 2014 of British tourists Hannah Witheridge and David Miller. They could face the death penalty if convicted.
Under the Police Act 1996, and following high-level discussions (including at Prime Ministerial level), it was agreed that the Metropolitan Police Service (MPS) would send an officer to observe and review – but not assist with – the Thai police investigation. The MPS compiled a detailed Report. They agreed to keep this confidential, except that it could be summarised verbally to the families of the victims so as to reassure about the state of the investigation and proceedings. The Report has never been provided to the families or the Thai authorities.
The Claimants made SARs, seeking disclosure of the MPS’ Report. Green J summarised their objectives as follows (para 29):
“The Claimants have endeavoured to clothe their arguments in the somewhat technical language of the DPA. It seems to me that the bottom line of these arguments, stripped bare of technical garb, can be put in two ways. First, the views of the MPS carry weight. Scotland Yard has an international reputation. If the Report is seen as favourable to the prosecution and contains material supportive of the RTP [Royal Thai Police] investigation (which is in effect how the Claimants say it has been presented in public by the families) then they should have the right to see the personal data so they can correct any misapprehensions. Secondly, that in any event they should be able to use any personal data which is favourable to their defence.”
The Claimants were entitled to request disclosure of at least some of the contents of the Report, though Green J estimated that only a small percentage of its contents constituted their personal data (para 25).
The MPS refused the SARs, relying on the exemption for crime and taxation under section 29 DPA.
In determining the claim under section 7(9) DPA, Green J considered arguments as to the applicability (or not) of Directive 95/46/EC (which contains exceptions for criminal matters: see Articles 3 and 13) and the European Convention on Human Rights. His view was that not much turned on these points here (para 49). At common law, the court’s scrutiny must always be fact- and context-specific. In a life-and-death context, anxious scrutiny would be applied to a data controller’s refusal. See para 69:
“… when construing the DPA 1998 (whether through common law or European eyes) decision makers and courts must have regard to all relevant fundamental rights that arise when balancing the interest of the State and those of the individual. There are no artificial limits to be placed on the exercise.”
Green J expressed his discomfort about the application of section 15(2) DPA, which allows the court – but not the data subject – to view the withheld information. This, together with the prospect of a closed session, raised concerns as to natural and open justice. Given the expedited nature of the case before him, it was not appropriate to appoint a special advocate, but that may need to be considered in future cases where the stakes are very high. Green J proceeded by asking questions and hearing submissions on an open basis in a sufficiently generic and abstract way.
In expressing those procedural misgivings, Green J has touched on an important aspect of DPA litigation which has received little attention to date.
He also took a narrower view of the breadth of his discretion under section 7(9) DPA than has often been assumed. At para 98, he said this of the ‘general and untrammelled’ nature of that judicial discretion:
“If Parliament had intended to confer such a broad residual discretion on the court then, in my view, it would have used far more specific language in section 7(9) than in fact it did. In any event I do not understand the observations in the authorities referred to above to suggest that if I find that the MPS has erred that I should simply make up and then apply whatever test I see fit. If I find an error on the part of the MPS such that I must form my own view then I should do in accordance with the principles set out in the DPA 1998 and taking account of the relevant background principles in the Directive and the Convention. My discretion is unfettered by the decision that has gone before, and which I find unlawful, but I cannot depart from Parliament’s intent.”
Such an approach to section 7(9) could make a material difference to litigation concerning SARs.
Green J then set out and determined the issues before him as follows:
Issue I: Who has the burden of proof of proving both the right to invoke the exemption? What is the standard of proof?
Following R (Lord) v Secretary of State of the Home Department  EWHC 2073 (Admin), the answer is that the data controller bears the burden. “The burden of proof is thus upon the MPS in this case to show its entitlement to refuse access and it must do this with significant and weighty grounds and evidence” (para 85).
Issue II: Was the personal data in the MPS report “processed” for purposes of (a) the prevention or detection of crime or (b) the apprehension or prosecution of offenders?
Green J’s answer was yes. Although the purposes behind the Report differed from the usual policing context, there should be no artificially narrow interpretation of the ‘prevention and detection of crime/apprehension or prosecution of offenders’.
Issue III: Would granting access be likely to prejudice any of those purposes?
This required a balancing exercise to be performed between the individual’s right to access and the interests being pursued by the data controller in refusing disclosure. This called for a “classic proportionality balancing exercise to be performed” (para 78).
Here, the starting point was the Claimant’s prima facie right to the personal data. This was bolstered by the life-and-death context of the present case.
The MPS’ refusal, however, pursued legitimate and weighty objectives. In assessing those objectives, it was relevant to consider what precedent would be set by disclosure: the “focus of attention was not just on the facts of the instant case but could also take account of the impact on other cases” (as per Lord).
On that basis, and in light of the evidence, the MPS’ ‘chilling effect’ argument was powerful. See para 107:
“… I accept their judgment and opinion as to the risks that release of the Report would give rise to and in particular, their position on: the considerable benefit to the public interest (in relation to crime enforcement and public security) generally in the MPS (and other relevant police authorities) being able to engage with foreign authorities; the high importance that is attached by foreign authorities to confidentiality; and the risk that not being able to give strong assurances as to confidentiality would pose to the ability of the MPS and others to enter into meaningful working relationship with such overseas authorities.”
It was also important to avoid any potential interference with a criminal trial in a foreign country.
The Claimants’ SARs were not made for any improper purposes, i.e. for purposes other than those which Directive 95/46/EC sought to further. In that respect, the present case was wholly unlike Durant.
The balancing exercise, however, favoured the MPS. Having considered each item of personal data, Green J said his “ultimate conclusion is that there is nothing in the personal data which would be of any real value to the Claimants” (para 125). He expressed his unease with both the procedure and the outcome. Permission to appeal was granted, though Panopticon understands that an appeal is not being pursued by the Claimants.
Anya Proops and Christopher Knight acted for the Defendant.
Robin Hopkins @hopkinsrobin
August tends to be a quiet month for lawyers. There has, however, been little by way of a summer break in privacy and data protection developments. Here are some August highlights.
Privacy injunction: sexual affairs of sportsman (not philosophers)
Mrs Justice Laing’s August does not appear to have begun restfully. Following a telephone hearing on the afternoon of Saturday 1 August, she granted what became a widely-reported privacy injunction (lasting only until 5 August) restraining the publication of a story about an affair which a prominent sportsman had some years ago: see the judgment in AMC and KLJ v News Group Newspapers  EWHC 2361 (QB).
As usual in such cases, Article 8 and Article 10 rights were relied upon to competing ends. There is no automatic favourite in such contests – an intense focus on the facts is required.
In this case, notwithstanding submissions about the extent to which the affected individuals ‘courted publicity’ or were not ‘private persons’ – there was a reasonable expectation of privacy about a secret sexual affair conducted years ago. The interference needed to be justified.
The right to free expression did not constitute adequate justification without more: “I cannot balance these two incommensurables [Articles 8 and 10] without asking why, and for what purposes, X and R seek to exercise their article 10 rights… The public interest here is, I remind myself, a contribution to a debate in the general interest”.
On the facts, there was insufficient public interest to justify that interference. The sportsman was not found to have hypocritically projected himself as ‘whiter than white’, and his alleged deceits and breaches of protocols in the coducting of his affair were not persuasive – especially years after the event. In any event, the sportsman was a role model for sportsmen or aspiring sportsmen: “he is not a role model for cooks, or for moral philosophers”. The latter point will no doubt be a weight off many a sporting shoulder.
Subject access requests: upcoming appeals
Subject access requests have traditionally received little attention in the courts. As with data protection matters more broadly, this is changing.
Holly Stout blogged earlier this month about the High Court’s judgment in Dawson-Damer and Ors v Taylor Wessing and Ors  EWHC 2366 (Ch). The case concerned legal professional privilege, manual records and relevant filing systems, disproportionate searches and the court’s discretion under section 7(9) DPA. That case is on its way to the Court of Appeal.
So too is the case of Ittihadieh  EWHC 1491 (QB), in which I appeared. That case concerned, among other issues, identification of relevant data controllers and the domestic purposes exemption. It too is on its way to the Court of Appeal.
Subject access requests: the burden of review and redaction
There has also been judgment this month in a County Court case in which I appeared for the Metropolitan Police Service. Mulcahy v MPS, a judgment of District Judge Langley in the Central London County Court, deals in part with the purposes behind a subject access request. It also deals with proportionality and burden, which – as Holly’s recent post discusses – has tended to be a vexed issue under the DPA (see Ezsias, Elliott, Dawson-Damer and the like).
Mulcahy deals with the proportionality of the burden imposed not so much by searching for information within the scope of a subject access request, but for reviewing (and, where necessary, redacting) that information before disclosure. This is an issue which commonly concerns data controllers. The judgment is available here: Mulcahy Judgment.
Privacy damages: Court of Appeal to hear Gulati appeal
May of 2015 saw Mr Justice Mann deliver a ground-breaking judgment on damages awards for privacy breaches: see Gulati & Ors v MGN Ltd  EWHC 1482 (Ch), which concerned victims of phone-hacking (including Paul Gascoigne and Sadie Frost). The awards ranged between £85,000 and £260,250. The judgment and grounds of appeal against the levels of damages awards are explained in this post by Louise Turner of RPC.
Earlier this month, the Court of Appeal granted MGN permission to appeal. The appeal is likely to be expedited. It will not be long before there is a measure of certainty on quantum for privacy breaches.
ICO monetary penalties
Lastly, I turn to privacy-related financial sanctions of a different kind. August has seen the ICO issue two monetary penalty notices.
One was for £50,000 against ‘Stop the Calls’ (ironically, a company which markets devices for blocking unwanted marketing calls) for serious contraventions of regulation 21 of the Privacy and Electronic Regulations 2003 (direct marketing phone calls to persons who registered their opposition to such calls with the Telephone Preference Service).
Another was for £180,000 for a breach of the seventh data protection principle. It was made against The Money Shop following a burglary in which an unencrypted server containing customers’ personal information was stolen.
Robin Hopkins @hopkinsrobin
Refusing to respond to subject access requests – legal professional privilege, disproportionate effort and collateral purposesAugust 12th, 2015 by Holly Stout
The Information Commissioner’s Code of Practice on Data Protection steadfastly maintains that data controllers cannot refuse to respond to a subject access request unless one of the specific exceptions in the Data Protection Act 1998 (“DPA”) applies. However, there is a growing body of case law on the circumstances in which the courts will refuse to enforce compliance with subject access requests under s 7(9) of the Act, even where one of the specific exceptions under the Act does not apply. See previous Panopticon posts on this subject here and here.
In a judgment handed down on 6 August 2015, HHJ Behrens (sitting as Judge of the High Court) considered a refusal by Taylor Wessing LLP (“TW”) and two individual defendants to respond to a subject access request made by a family involved in legal proceedings in the Bahamas concerning a discretionary settlement known as the Glenfinnan Settlement. TW’s client (Grampian) is the sole trustee of that Settlement.
TW resisted the family’s application for an order under s 7(9) requiring compliance with the subject access request on the following bases:
- The data in question was covered by legal professional privilege as it is only processed by TW in connection with their capacity as legal advisors;
- Some of the information was held in manual files and not in a relevant filing system for the purposes of the DPA;
- It was not reasonable or proportionate to expect TW even to carry out a search for the information and to assess what was covered by privilege and what was not;
- As a matter of discretion the Court should refuse to make an order under s 7(9) because the application had been made for improper purposes.
The Court’s ruling on each of these issues is worthy of note. The full judgment is available here.
Legal professional privilege
Paragraph 10 of Schedule 7 to the DPA provides a specific exception for “information in respect of which a claim to legal professional privilege or, in Scotland, to confidentiality as between client and professional legal adviser, could be maintained in legal proceedings”. The family argued that this exception was restricted to English law professional privilege and did not extend to documents that were covered by Bahamian rules on disclosure or which were subject to equitable rules in English trust law about non-disclosure of information to Trust beneficiaries. HHJ Behrens did not accept these submissions. He considered, following Durant v FSA  EWCA 1746 that a purposive approach is to be taken to interpretation of the DPA and that the exception in para 10 of Sch 7 was not to be strictly construed. Adopting a purposive approach, he held that the exception was to be construed as if it applied to any documents in respect of which there is a right to resist compulsory disclosure in legal proceedings. Accordingly, it covered all the documents in respect of which the parties would be entitled to resist compulsory disclosure in the Bahamian proceedings, even though these were not covered by the English doctrine of legal professional privilege. This is a novel interpretation that may receive further attention from the courts in due course.
Relevant filing system
HHJ Behrens referred to the observations of Auld LJ in Durant in relation to the meaning of ‘relevant filing system’ for the purposes of the DPA. Auld LJ held (at  of Durant) that “Parliament intended to apply the Act to manual records only if they are of sufficient sophistication to provide the same or similar ready accessibility as a computerised filing system. That requires a filing system so referenced or indexed that it enables the data controller’s employee responsible to identify at the outset of his search with reasonable certainty and speed the file or files in which the specific data relating to the person requesting the information is located and to locate the relevant information about him within the file or files, without having to make a manual search of them. To leave it to the searcher to leaf through files, possibly at great length and costs, and fruitlessly, to see whether it or they contain information relating to the person requesting information and whether that information is data within the Act bears … no resemblance to a computerised search”. Although HHJ Behrens did not ultimately determine whether TW’s filing system satisfied the definition of ‘relevant filing system’ he indicated that as it appeared that documents within the manual files were not chronologically arranged or filed in any way by reference to individuals, they may well fall outside the scope of the Act.
Section 8(2) of the DPA provides that a data controller need not supply copies of information “in permanent form” if that would require “disproportionate effort”. The Information Commissioner in his Code of Practice is keen to minimise reliance on this exception stating, “You cannot refuse to comply with a SAR on the basis that it would involve disproportionate effort, simply because it would be costly and time consuming to find the requested personal data held in archived emails.” And: “We stress that you should rely on the disproportionate effort exception only in the most exceptional of cases. The right of subject access is central to data protection law and we rarely hear of instances where an organisation could legitimately use disproportionate effort as a reason for denying an individual access to any of their personal data. Even if you can show that supplying a copy of information in permanent form would involve disproportionate effort, you must still comply with the request in some other way.” However, in this case HHJ Behrens referred to his own earlier judgment in Elliott v Lloyds TSB Bank and Hickinbottom J’s decision in Ezsias v Welsh Ministers before summarising the position in relation to s 8(2) as follows: “A data controller is only required under s 8(2) to supply the individual with such personal data as is found after a reasonable and proportionate search”. This is arguably a significantly more relaxed approach than that taken by the Information Commissioner. It remains to be seen whether the Information Commissioner will amend his guidance in the light of this string of decisions.
In this case, HHJ Behrens went on to hold that it would not have been reasonable and proportionate for TW to carry out the search in this case. In reaching this conclusion, HHJ Behrens interestingly appears to have been influenced by the disproportionality of requiring ‘skilled lawyers’ to review documents for LPP when the applicant need only pay £10 for a subject access request.
Section 7(9) of the DPA undoubtedly gives the court a discretion as to whether to order a data controller to comply with a subject access request. In a number of cases now the courts have ruled that this discretion enables the court to refuse to make such an order even if none of the exceptions under the DPA apply and therefore the data controller is breaching the Act by refusing to respond: see the previous Panopticon posts mentioned in the first paragraph of this blog. This case is another such. Although not necessary to his decision, as TW had already ‘won’ on the LPP and disproportionate effort points above, HHJ Behrens gave three reasons why he would not in any event have exercised his discretion under s 7(9) in this case:
- The real purpose of the subject access requests was to obtain information for used in connection with the Bahamian proceedings. HHJ Behrens was satisfied that the claimants would not have brought the applications at all were it not for the Bahamian proceedings. This was, following Durant, not a proper purpose for a request under the DPA;
- It would be unreasonable and disproportionate to order TW to comply with the request: the same points as were relevant to the s 8(2) exception were relevant to the s 7(9) discretion; and
- It was not a proper use of the DPA to enable the claimants to obtain documents that they could not have obtained in the Bahamian proceedings.
HHJ Behrens recognised that a number of points in his judgment were novel and indicated that he was therefore minded to grant permission to appeal, if permission were sought. Permission was sought and duly granted so expect to hear further from the Court of Appeal on these issues in due course.
Jonathan Swift QC appeared for the claimants.
Facebook, drag artists and data protection dilemmas: ‘if you stand on our pitch, you must play by our rules’July 31st, 2015 by Robin Hopkins
Facebook is one of the main battlegrounds between privacy and other social goods such as safety and security.
On the one hand, it faces a safeguarding challenge. Interactions through Facebook have the potential to cause harm: defamation, data protection breaches, stalking, harassment, abuse and the like. One safeguard against such harms is to ensure that users are identifiable, i.e. that they really are who they say they are. This facilitates accountability and helps to ensure that only users of an appropriate age are communicating on Facebook. The ongoing litigation before the Northern Irish courts in the HL case raises exactly these sorts of concerns about child protection.
Part of the solution is Facebook’s ‘real names’ policy: you cannot register using a pseudonym, but only with your official identity.
On the other hand, Facebook encounters an argument which runs like this: individuals should be free to decide how they project themselves in their communications with the world. This means that, provided they are doing no harm, they should in principle be allowed to use whatever identity they like, including pseudonyms, working names (for people who wish to keep their private Facebooking and their professional lives separate) or stage names (particularly relevant for drag artists, for example). The real names policy arguably undermines this element of human autonomy, dignity and privacy. There have been colourful recent protests against the policy on these sorts of grounds.
Which is the stronger argument? Well, the answer to the question seems to depend on who you ask, and where you ask.
The Data Protection Commissioner in Ireland, where Facebook has its EU headquarters, has upheld the real names policy. When one of Germany’s regional Data Protection Commissioners (Schleswig-Holstein) took the opposite view, Facebook challenged his ruling and secured a court victory in 2013. The German court suspended the order against the real names policy and, equally importantly, decided that the challenge should proceed in Ireland, not Germany.
This week, however, another German decision turned the tables on the real names policy yet again. The Hamburg data protection authority upheld a complaint from someone who used a pseudonym on Facebook so as to separate her private and professional communications. The Hamburg DPA found against Facebook and held that it was not allowed unilaterally to change users’ chosen usernames to their real names. Nor was it entitled to demand official identification documents – an issue of particular relevance to child protection issues such as those arising in HL.
The Hamburg ruling is notable on a number of fronts. It exemplifies the tension between privacy – in all its nuanced forms – and other values. It illustrates the dilemmas bedevilling the business models of social media companies such as Facebook.
The case also highlights real challenges for the future of European data protection. The General Data Protection Regulation – currently clawing its way from draft to final form – aspires to harmonised pan-European standards. It includes a mechanism for data protection authorities to co-operate and resolve differences. But if authorities within the same country are prone to divergence on issues such as the real names policy, how optimistic can one be that regulators across the EU will sing from the same hymn sheet?
Important questions arise about data protection and multinational internet companies: in which country (or region, for that matter) should a user raise a complaint to a regulator? If they want to complain to a court, where do they do that? If a German user complains to an Irish regulator or court, to what extent do those authorities have to consider German law?
For the moment, Facebook clearly seeks home ground advantage. But its preference for the Irish forum was rejected by the Hamburg authority in this week’s ruling. He is reported as saying that “… Facebook cannot again argue that only Irish Data Protection law would be applicable … anyone who stands on our pitch also has to play our game”.
The draft Regulation has something to say on these matters, but is far from clear as to how to decide on the right pitch and the right rules for vital privacy battles like these.
Robin Hopkins @hopkinsrobin
In a judgment of the Divisional Court handed down this morning, Bean LJ and Collins J have declared section 1 of the Data Retention and Investigatory Powers Act 2014 (DRIPA) to be unlawful.
That attempt has today suffered a serious setback via the successful challenges brought by the MPs David Davis and Tom Watson, as well as Messrs Brice and Lewis. The Divisional Court did, however, suspend the effect of its order until after 31 March 2016, so as to give Parliament time to consider how to put things right.
Analysis to follow in due course, but for now, here is the judgment: Davis Watson Judgment.
Robin Hopkins @hopkinsrobin
The Guardian has reported today on data emerging from Google about how it has implemented the Google Spain ‘right to be forgotten’ principle over the past year or so: see this very interesting article by Julia Powles.
While the data is rough-and-ready, it appears to indicate that the vast majority of RTBF requests actioned by Google have concerned ‘ordinary people’. By that I mean people who are neither famous nor infamous, and who seek not to have high-public-interest stories erased from history, but to have low-public-interest personal information removed from the fingertips of anyone who cares to Google their name. Okay, that explanation here is itself rough-and-ready, but you get the point: most RTBF requests come not from Max Mosley types, but from Mario Costeja González types (he being the man who brought the Google Spain complaint in the first place).
As Julia Powles points out, today’s rough-and-ready is thus far the best we have to go on in terms of understanding how the RTBF is actually working in practice. There is very little transparency on this. Blame for that opaqueness cannot fairly be levelled only at Google and its ilk – though, as the Powles articles argues, they may have a vested interest in maintaining that opaqueness. Opaqueness was inevitable following a judgment like Google Spain, and European regulators have, perhaps forgivably, not yet produced detailed guidance at a European level on how the public can expect such requests to be dealt with. In the UK, the ICO has given guidance (see here) and initiated complaints process (see here).
Today’s data suggests to me that a further reason for this opaqueness is the ‘ordinary person’ factor: the Max Mosleys of the world tend to litigate (and then settle) when they are dissatisfied, but the ordinary person tends not to (Mr González being an exception). We remain largely in the dark about how this web-shaping issue works.
So: the ordinary person is most in need of transparent RTBF rules, but least equipped to fight for them.
How might that be resolved? Options seem to me to include some combination of (a) clear regulatory guidance, tested in the courts, (b) litigation by a Max Mosley-type figure which runs its course, (c) litigation by more Mr González figures (i.e. ordinary individuals), (d) litigation by groups of ordinary people (as in Vidal Hall, for example) – or perhaps (e) litigation by members of the media who object to their stories disappearing from Google searches.
The RTBF is still in its infancy. Google may be its own judge for now, but one imagines not for long.
Robin Hopkins @hopkinsrobin
As illustrated by Anya Proops’ recent post on a Hungarian case currently before the CJEU, the territorial jurisdiction of European data protection law can raise difficult questions.
Such questions have bitten hard in the Europe vs Facebook litigation. Max Schrems, an Austrian law graduate, is spearheading a massive class action in which some 25,000 Facebook users allege numerous data protection violations by the social media giant. Those include: unlawful obtaining of personal data (including via plug-ins and “like” buttons); invalid consent to Facebook’s processing of users’ personal data; use of personal data for impermissible purposes, including the unlawful analysing of data/profiling of users (“the Defendant analyses the data available on every user and tries to explore users’ interests, preferences and circumstances…”); unlawful sharing of personal data with third parties and third-party applications. The details of the claim are here.
Importantly, however, the claim is against Facebook Ireland Ltd, a subsidiary of the Californian-based Facebook Inc. The class action has been brought in Austria.
Facebook challenged the Austrian court’s jurisdiction. Last week, it received a judgment in its favour from the Viennese Regional Civil Court. The Court said it lacks jurisdiction in part because Mr Schrems is not deemed to be a ‘consumer’ of Facebook’s services. In part also, it lacks jurisdiction because Austria is not the right place to be bringing the claim. Facebook argued that the claim should be brought either in Ireland or in California, and the Court agreed.
Mr Schrems has announced his intention to appeal. In the meantime, the Austrian decision will continue to raise both eyebrows and questions, particularly given that a number of other judgments in recent years have seen European courts accepting jurisdiction to hear claims against social media companies (such as Google: see Vidal-Hall, for example) based elsewhere.
The Austrian decision also highlights the difficulties of the ‘one-stop shop’ principle which remains part of the draft Data Protection Regulation (albeit in more nuanced and complicated formulation than had earlier been proposed). In short, why should an Austrian user have to sue in Ireland?
Panopticon will report on any developments in this case in due course. It will also report on the other strand of Mr Schrems’ privacy campaign, namely his challenge to the lawfulness of the Safe Harbour regime for the transferring of personal data to the USA. That challenge has been heard by the CJEU, and the Advocate General’s opinion is imminent. The case will have major implications for those whose business involves transatlantic data transfers.
Robin Hopkins @hopkinsrobin
The Scottish Government has initiated a Consultation on further extension of coverage of the Freedom of Information (Scotland) Act 2002 (“FoIS”) to more organisations, specifically contractors who run privately managed prisons, providers of secure accommodation for children, grant-aided schools and independent special schools.
FoIS provides a statutory right of access to information held by Scottish public authorities. These range from the Scottish Parliament and Government, to local authorities, NHS boards, higher and further education bodies, doctors and dental practitioners. However, the provisions of FoIS can be extended to bodies that carry out functions of a public nature or which provide, under a contract with a Scottish public authority, a service which is a function of that authority. This can be done by making an Order under s5 of FoIS, which designates those bodies as a Scottish public authority for the purposes of FoIS. They are then subject to the full requirements of FoIS. They would also automatically become subject to the requirements of the Environmental Information (Scotland) Regulations 2004. In accordance with s7(3) of FoIS, bodies proposed for coverage would be covered only in respect of the information they hold about specified public functions or services. Their duties under FoIS would therefore be limited to those functions or services as set out in the Order.
The Scottish Government brought forward Scotland’s first Order under s5(1) of FoIS in September 2013. Following consideration by the Parliament the Order came into effect on 1 April 2014. The Order extended coverage of FoIS to certain trusts which have been created by local authorities to deliver sporting, cultural and leisure facilities and/or activities on behalf of the local authority(ies).
The Scottish Government are now consulting on options for further extension of coverage. They are proposing to lay an Order in the Scottish Parliament in Autumn 2015. Subject to the Scottish Parliament supporting the Order, they would expect the bodies covered to become subject to FoIS and the EIR from Spring 2016. In addition to the organisations discussed in the Consultation Paper, suggestions are sought as to what other bodies – whether individually or collectively – should be considered in any future consultation.
In the previous consultation in 2010 the Scottish Government adopted a factor-based approach in determining the extent to which a function of an organisation could be described as being ‘of a public nature’. They continue to believe that a factor-based approach is appropriate, and that a range of factors should be considered in assessing the ‘public nature’ of particular functions undertaken by certain organisations.
The Consultation Paper notes that the Scottish Information Commissioner has called for the extension of FoIS coverage to social housing owned by RSLs. For a number of reasons, the Scottish Government are not currently persuaded of the merits of extending coverage to housing associations.
The Scottish Government do, however, consider that a number of factors apply in relation to the functions undertaken, or services provided, by those various organisations highlighted in the Consultation Paper. In particular, there is a focus on organisations who, for the purposes of s5 of FoIS, undertake functions of a public nature or provide a service that is a function of a public authority(ies) relating to security, care and education.
The organisations considered for inclusion at this stage are:
- contractors who run privately-managed prisons
- providers of secure accommodation for children
- grant-aided schools
- independent special schools
With all these groups it is envisaged that any Order would provide a ‘class description’ in respect of the particular function undertaken or service provided. Given the potential for contractors or service providers to change over a period of time, a ‘class description’ gives more flexibility than listing specific bodies or contractors in the Order.