Hawktalk

ICO decides that European Commission’s criticism of the Data Protection Act should be published

Just a brief note on my pet obsession; should data controllers and data subjects in the UK know why the European Commission claims that the Data Protection Act 1998 is a defective implementation of Directive 95/46/EC? The good news is that I have obtained a Decision Notice that requires some of the full details to be provided to me; the bad news is that the Government has 35 days to appeal.

I should explain why I think the Government are treating this subject as if I had asked for some state secret which makes one vulnerable to extraordinary rendition. The main exemption used is section 27 (prejudice to international relations) which on the face of it appears laughable; I don’t think anything about data protection will cause any international rumpus or the withdrawal of ambassadors. But this is what is being argued – so why?

Underpinning the requested information is a threat of infraction proceedings against the UK; these have been pending since Durant (another obsession!) in 2003. I have had to argue that the threat of infraction proceedings is very limited (after 9 years of inaction by the Commission, they are hardly going to embark on legal proceedings given the Regulation); but it is this threat of infraction that explains why the UK/Commission FOI shutters are firmly closed.

Infraction proceedings are considered when any Member State has not implemented a Directive (i.e. any Directive of which there is a great number). Thanks to the case of Petrie (Case T-191/99 Petrie and Others v Commission [2001] ECR II-3677), a case determined by the European Court of Justice over a decade ago, details of infraction proceedings are not published because of confidentiality concerns and the risk to legal proceedings.

This has resulted in very little information being released. For instance, Guardian Journalist, Rob Edwards, tried to get some very limited details about infractions but anything substantial was rebutted on Petrie grounds (see Decision 196/2007 Mr Rob Edwards and the Scottish Ministers).

The Petrie decision is used by the European Commission to justify not providing details about any infraction proceeding; in many instances Member States are also not keen for these details to be published. The result is a hermetically sealed system where nothing about infraction proceedings is published and what is given out is done so grudgingly – even to national Parliaments. The only relaxation is when the Commission or Member State decides it is in their interest to provide details. And this is about ANY DIRECTIVE.

So do you think the public or national Parliaments should know why infraction proceedings are occurring? The European Ombudsman thinks so; that is why he supported my case to extract a very minimal information from the European Commission. This took four years, believe it or not (see references)! If it wasn’t for the Ombudsman, there would be nothing.

However, like a hole in a dam, the breach is widening. My FOI request is now a significant chink the Petrie position. For the first time, there is a prospect of significant details of the information underpinning infraction proceedings being published in the absence of any approval or agreement from the Commission and European Government.

This argument can be applied to any Directive. That is why the “obsessive” battle is important; it also explains why I am expecting an Appeal.

References

The Decision Notice:Download FS50411133_for blog May 2012

If you want summary details of why the European Commission thinks the UK Act is defective see:

http://amberhawk.typepad.com/amberhawk/2011/02/european-commission-explains-why-uks-data-protection-act-is-deficient.html  (Commission’s view; this took 4 years)

http://amberhawk.typepad.com/amberhawk/2011/05/privacy-new-government-revelations-amplify-concerns-surrounding-deficiencies-in-uks-data-protection-.html (UK summary of the Commission’s view – more substantial; released because the Commission released details)

The following reference relates to the reply that the Government has made to the Commission (this information is still “top secret”): http://amberhawk.typepad.com/amberhawk/2011/10/what-is-wrong-with-the-data-protection-act-foi-infraction-saga-hits-the-buffers.html

 

Desire for a FOI charging regime equates to reduced accountability of public bodies

I have to confess that I am just a normal type of guy who reads Hansard and watches the BBC’s Parliamentary Channel. The last (wet) bank-holiday weekend, for instance, there was a riveting repeat of Jack Straw’s evidence to the Justice Committee on the operation of the Freedom of Information (FOI) Act.

As Home Secretary, Jack Straw was responsible for piloting the Data Protection and Freedom of Information Bills through Parliament; he knows where the legislative skeletons can be found. And at the time of his stewardship of the FOI Bill in Parliament, he knew that Tony Blair had decided that FOI was his worst idea ever. He confirmed that but for the Ministerial veto, the Government would have dropped the FOI Bill.

So I think his take on the current review of FOI is important. I also think Straw’s position is close to what I think the Government would like to propose.

As an aside, remember that the Data Protection and FOI Acts started off as Home Office Bills (prop J. Straw); that is why these Acts have significant exemptions in areas that cover Home Office functions such as law enforcement, policing, immigration and national security. Jack Straw protected his fiefdom very well.

Anyway back Jack Straw’s evidence to the Justice Committee; it amounted to four propositions:

•    charge the applicant about £10-£15 for each FOI access request;
•    make the FOIA exemptions in Section 35 (formulation of Ministerial policy etc) and Section 36 (prejudice to the effective conduct of public affairs) in so far as they apply to Ministerial decisions an absolute, class exemption (i.e. no public interest test);
•    reword the “formulation or development of government policy” part of the Section 35 exemption so that it applies indefinitely, and
•    keep the Ministerial veto as a safeguard to be used sparingly in other cases.

The argument over FOI as debated at the moment has two strands:

•    One strand goes something like this: “FOI requests costs us £184 each so it is only proper the applicant pays a modest amount, especially in these days when money is tight”.
•    The second strand is that Ministers (unlike NHS boards, police boards and Mayors in large conurbations) are in a special place because when they determine policy, they should be able to keep key information secret for at least 20 years (the minimum time when documents become public records).

As can be seen the second argument is far more difficult to make; that is why there is a fuss over the latest veto re the NHS Risk Assessment. Hence, the focus of debate is more on the first strand.

Backing the cost arguments is a report is a Mori study which has provided some cost estimates (which are not representative, if you read the report carefully). For example, Mori reports that:

“Statistics produced by the Ministry of Justice over the period 1 October 2010 – 30 September 2011 indicate that Departments of State and other monitored bodies covered by these statistics received a total of 45,958 FOI requests. In order to produce an estimate of the total annual cost in staff time of processing and responding to central government requests, it is possible to multiply £184 (the average cost of the 225 FOI requests submitted to central government) by the total number of requests received. This gives an estimated staff cost of £8,456,272 per year”.

Before you say that £8.5 million could allow us to build a new school or a hundredth of a new fighter aircraft, just ask what this money is doing?

I would argue that for £8.5 million, we get 46,000 FOI requestors using their own resources to make a Government accountable for its spending of £722 billions (the annual figure for expenditure on Central Government Departments). In other words, a relative spend of a small amount on FOI (0.01% of Government expenditure on Central Government) has the potential to hold Government accountable across the whole extent of its policy range (subject to an exemption, of course).

Similarly, for the Universities. For instance, JISC, the UK's body on information and digital technology in higher education, tracked 36 requests in seven institutions and found that the average cost, including staff time, of answering an FoI request was £121. Extrapolating this research to all FOI costs for the University sector, the cost of FOI can be estimated to be between £2.3 and £9.2 million (or around 16,000 – 40,000 requests across the University sector – if that £121 number is accurate).

But again ask: “What do you get for that money?”. In the UK, there are about 120,000 students paying about £7,000-£9,000 each per year under the new student loan system – that is about £1 billion; the public money spent on Universities by the Treasury is  around £9billion. So it follows that members of the public are contributing £10 billion to University sector; so spending something like £5 million on general public accountability to 25,000 requestors via FOI. This represents about 0.05% of spending in the University sector; pretty good value I would argue.

Of course these numbers (i.e. the 0.01% and 0.05%) I have quoted above are only an approximate guide, but they should be of the correct order of magnitude. They confirm that FOI expenditure is small beer indeed compared with what every taxpayer gains in accountability.

Of course, also, it’s a pain for a University to provide details of why it is doing animal research that has been banned in Germany or why a Minister does not want to publish a health risk assessment (suspected to confirm that the new Health Reforms could destabilise the NHS; yesterday’s veto does not help allay those fears, I should add).

However this is what accountability is all about; it is very uncomfortable at times for those being held to account. So when Ministers use private emails to conduct a public policy debate (to avoid FOI), they really don't like it when an independent regulator says that these emails are still subject to FOI requests.

Once upon a time, making public bodies accountable was central to Government policy. Remember in June 2011, Communities and Local Government Secretary Eric Pickles, stated that he wanted “a new wave of local scrutiny by citizen journalists, microbloggers and armchair auditors” as their role was needed in  “in eliminating waste and inefficiency to deliver value for money to the taxpayer and help protect services”. Isn’t this is what the product of an FOI does in many instances – raise issues of concern?

The Secretary of State even cited cases uncovered by local armchair auditors; for instance in Barnet where “serious deficiencies in procurement arrangements saw the council spend over £1m of taxpayers' money to hire a private security firm with no tendering exercise, contract or proper invoicing. It was and activist bloggers” or in Islington where “many invoices had been paid more than once”.

I would argue that an adjunct of the Pickles’ policy of encouraging “armchair auditors” is to empower them to make follow-up FOI requests, free of charge, about public contracts. If the Government introduces charges for FOIA requests, the Mr Pickles “armchair auditor” idea is finished. Which armchair auditor is going to shell out £10-£15 to follow an accounting trail?

In other words, I think the issue about FOI is simple: if you don’t want public accountability, implement a FOI charging regime. Tony Blair understood that charging undermines FOI – and his memoirs eloquently explained the motive. It appears that this Government is following in Blair’s wake for the same reasons one should add.

Honestly, the final equation is very simple: FOI charging = unaccountability (especially for Central Government).

References

Jack Straw’s evidence session (uncorrected): http://www.publications.parliament.uk/pa/cm201012/cmselect/cmjust/uc1849-v/uc184901.htm

Local Government FOI costs: http://www.lgcplus.com/briefings/corporate-core/legal/cost-of-foi-requests-rises-to-34m/5019109.article

Higher education FOI costs: http://www.timeshighereducation.co.uk/story.asp?storyCode=419674&sectioncode=26

Mori cost evidence: Download Blog May 2011 investigative-study-informing-foia

Durant strikes again! The names of those investigating complaints are not personal data

The Information Tribunal has just adjudged that the names of three junior members of staff who had a part in an applicant’s complaint to the Financial Services Authority (FSA) can be disclosed as part of a Freedom of Information (FOI) request. The Information Rights Tribunal, following Durant, concluded that the names of these staff were not personal data.

As every data protection aficionado knows, mentioning Durant is rather like swearing in public, as its application can result in bizarre conclusions; this Tribunal determination, I think, is one of these. So this blog explains where I think the Tribunal went wrong and suggests what should happen with such FOI requests.

The Tribunal Decision

The appeal concerned a request made by an applicant to the FSA for a copy of information it held about his complaint. Paragraph 21 of the Information Commissioner’s Decision Notice confirms that the requested information included the names of “the staff in question (who) worked on the complainant’s complaint” (see references).

In its decision (see references) the Information Rights Tribunal said that these employee names were not personal data because the name did not "affect the individuals' privacy, whether in their personal or family life, business or professional capacity". This overturned the ICO’s Decision Notice which concluded that the FSA was right to withhold these details because:

“21 The Commissioner notes that while the staff in question worked on the complainant’s complaint, they did not correspond with him about it. He also notes that the public authority has confirmed that they were not in public facing roles and that these individuals were of a grade below that of manager. It is the Commissioner’s view that these members of staff would have had no expectation that their names would be released into the public domain.

22. The Commissioner is also satisfied that disclosure of their names would not add anything further to the way in which the complainant’s complaint had been dealt with. Therefore any legitimate interest in the disclosure of the names of these individuals is outweighed by the prejudice disclosure would cause to the rights and freedoms of the individuals concerned”.

By contrast, the Information Rights Tribunal said that the three names "may well be sufficient" to identify the individuals when taken together with information that they were employed by the FSA in certain positions on a given date, however it did not follow that the names themselves were personal data even if the individuals could be identified as the information must also be "such as to affect the person's privacy".

Slavishly following Durant, the Tribunal concluded that "In our view the Disputed Information (these are the names of employees) is not biographical in any significant sense" and that in this case "The information does not go beyond the recording of the data subjects' involvement in a matter that has no personal connotations. It simply concerns a transaction or matter in which the individuals in question were involved".

The Tribunal was careful to say that this would not always be the case. For instance, "there are a number of organisations, the nature of whose activities are such that information that a particular individual was employed by them, might well amount to personal data" and that disclosing the name of an individual who was employed by an organisation licensed to conduct experiments on animals "may disclose something about his likely opinion on the often contentious subject of animal rights, and could lead to harassment by so-called animal rights activists".

In such cases, the Tribunal said this information would be personal data that were exempt under FOI as the requested details were "biographical" and did indeed impact on an individual's privacy.

Where the Tribunal went wrong

We can now see what has happened? The Tribunal has asked:

a. Is the requested information “data”? Answer “yes”
b. Does it relate to a living individual? Answer “yes”
c. Does it relate to a living individual in a biographically significant way? Answer “No”
d. Is there a context that makes it biographically significant? Answer “No – we can’t see one” (despite the fact that “the staff in question worked on the complainant’s complaint”!)

The problem is at questions (c) and (d) – so the question has to be asked “How does a public authority know what is biographically significant for a data subject and what is not”?

For the Tribunal, consideration of the “two notions” put forward by Auld LJ. in Durant is suffice (e.g. “biographical significance” and “continuum”). In other words, it is the public authority who determines these matters in every instance. However, I think this is a too simplistic approach to the three possible scenarios concerning “biographical significance”.

These scenarios are:

• The public authority knows for certain the personal details are biographically significant;
• The public authority knows for certain the personal details are not biographically significant; or 
• The public authority does not know whether the details are biographically significant or not.

I think we can agree that the essential problem is with the last issue (i.e. the public authority does not know).

This issue of “not knowing” was actually resolved in the Durant judgement. In section 7(4) of the Data Protection Act, the data controller is faced with the dilemma of whether it is reasonable in all the circumstances to release (or not to release) the identity of other individuals identified in personal data that have been requested by a data subject.

In paragraph 61 of Durant, Auld LJ. states that where the data controller cannot resolve this dilemma, “The data controller ....  should also be entitled to ask what, if any, legitimate interest the data subject has in disclosure of the identity of another individual named in or identifiable from personal data to which he is otherwise entitled...”.  In other words, if in doubt, ask the requestor why he wants the name. This was not suggested by the Tribunal.

This “ask the requestor” idea is reinforced by interpreting the balance of interest tests in Schedule 2, paragraph 6 of the DPA which is used to justify release of personal data by FOI requests. This sets out the balance of interest as follows:

“The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject”. (my emphasis)

So how does one know what weight to place on the “legitimate interests of the data subject” when you don’t know? Use a crystal ball? Employ Tarot Cards? Throw dice?

If you just ask “Who is in the best position to know what weight to place on the data subject’s legitimate interests?”, then I think the answer is obvious. So my conclusion: ask the requestor for why he wants the personal data and then, if needed, ask the data subject for a view? There is nothing in the FOI Act that I can see that stops this kind of approach.

Of course, the public authority after consideration of the data subject’s legitimate interests can still decide to release the personal data. In addition, there might be standard conditions when there is no need to ask the data subject for his view (these have been established by cases before the Tribunal such as those dealing with expenses of senior managers).

I should add that the Scottish Information Commissioner already asks this question of the FOISA applicant when he can’t fathom "the legitimate interests of the Third Party to whom personal data are disclosed" (see above). I raise this just to show that asking the requestor is not an alien FOI concept just made up by me for this blog (see references below).

Reverting to Durant, it is interesting to note that Mr Durant did not get the details of the individual handling his complaint at the FSA because, according to the judgment Auld LJ says “.....the name of an FSA employee which, in itself, can have been of little or no legitimate value to Mr. Durant and who had understandably withheld his or her consent because Mr. Durant had abused him or her over the telephone” (para 67 of Durant).

Note that it is this "little or no legitimate value" sentiment finds expression in the Commissioner’s Decision Notice, where he says “...The Commissioner is also satisfied that disclosure of their names would not add anything further to the way in which the complainant’s complaint had been dealt with. Therefore any legitimate interest in the disclosure of the names of these individuals is outweighed by the prejudice disclosure would cause to the rights and freedoms of the individuals concerned” (para 22 of the Decision).

So that is why I think that when a public authority receives a request on the lines outlined above and has difficulty in deciding what to do, it is perfectly proper for it to ask modest questions of the requestor AND/OR the data subject about his or her legitimate interest so that the correct balance can be struck. Indeed, I am brave enough to say that when a public authority does not know where the balance of interests lies, this is the only way for that authority to determine the correct balance of interests.

This is where the Tribunal went wrong. It has decided that the public autrhority in all instances should have a punt at arriving at the correct balance whereas it should have promoted the obvious mechanism which actually arrives at the correct balance.

Note that there is a sting in the tail for the FOI requestor who misleads the public authority as to his legitimate interest; such a requestor could be committing an offence under Section 55 of the Act if the public authority were to disclose personal data on the wrong basis.

This assures the public authority that the FOI requestor is unlikely to tell porkies.

References

Download the ICO’s Decision Notice: Download Fs_50312938_durant_names not personal data

Download the Tribunal Notice in this case:Download Fs_50312938_APPEAL_names not personal data

“Some FOI requests for personal data are not purpose blind” (this includes the SIC Decision Notice referred to above): http://amberhawk.typepad.com/amberhawk/2010/07/some-foi-requests-for-personal-data-are-not-purpose-blind.html

Internal investigation into a Monetary Penalty Notice has to be released under FOIA

Public authorities should be prepared that, if they are subject to enforcement action by the Information Commissioner  (e.g. Monetary Penalty Notice, Undertaking, Audit, Enforcement Notice etc), that internal reports into why the action was taken might become the target for FOI requests. This is the outcome of a recent Decision Notice involving the London Borough of Ealing. Implicitly, the ICO is signalling that he thinks such reports and investigations should be published where practicable.

In February 2011, Ealing Council reported a theft of two laptops containing the details of around 1,700 individuals were stolen from an employee’s home (including sensitive personal data). Almost 1,000 of the individuals were clients of Ealing Council and both laptops were password protected but unencrypted – despite this being of Council policy. The ICO served Ealing Council with a Monetary Penalty Notice of £80,000.

On 30 May 2011, the Council received a FOI request for “….a copy of the report into the loss of the unencrypted laptop which resulted in an £80,000 fine from the ICO”  The Council directed the applicant to the Monetary Penalty Notice published on the ICO’s website.

The requestor wrote back explaining that it was the Council’s own internal report into the matter that was being sought. The Council refused to provide the requested information stating that the information was being withheld under the ‘prejudice to effective conduct of public affairs’ exemption (namely section 36(2)(b) of the FOIA) and that the public interest was in favour of non-disclosure. This position was upheld on internal review.

The ICO decided that the Council had correctly applied the ‘prejudice to effective conduct of public affairs’ exemption but that it wrongly concluded that the public interest in maintaining the exemption outweighed the public interest in disclosure.  The two main reasons for this decision were as follows:

• disclosure “would also contribute to public understanding of the issues documented in the publically-available Monetary Penalty Notice”.

• “disclosure would demonstrate to the public that the council has taken robust steps to address the security implications of the incident and that measures have been put in place to ensure that there is not a recurrence. This would improve public confidence in the workings of the council”.

Now I am suggesting to you that these two arguments employed by the ICO could apply to almost any enforcement action by his office. So if your employer is a public authority and subject to enforcement action under the Data Protection Act, then expect FOI requests which will probably lead to the publication of your internal investigations into the problem.

Download the Decision Notice here: Download Fs_50399720_EALINGBLOG

 

What is wrong with the Data Protection Act? FOI Infraction saga hits the buffers

Bad news guys! I have just received my Tribunal Decision which throws out my attempt to find out what is wrong with the UK’s Data Protection Act. The Decision means that sixty million data subjects and one third of a million data controllers will not fully understand why the European Commission thinks that the UK’s implementation of Data Protection Act has been deficient since 2004. I think this is a shocking state of affairs.

The result of this Decision is important for another reason. The jungle drums are increasingly beating out the message that the European Commission is thinking of enacting a new data protection regime by regulations. Will such regulations address the identified problems with the UK Act? Well, if the public doesn’t know what these problems are, then it won’t be able to judge.

I asked the Ministry of Justice (MoJ) for a summary of the information held about the infraction proceedings, because an earlier FOI request for the full detail had failed. I was hoping that (a) the summary might exist or (b) the summary information might be scattered around in emails and documents already held, and that finally, this summary would not be exempt. And thirdly, because of the House of Lords decision in CSA v SIC, I also argued a new point: even if the summary information did not exist, CSA v SIC implied that this step did not need the creation of new information (see references).

By contrast, the Commissioner, in his Decision Notice which has been upheld by the Tribunal, said that the summary information is only relevant to the form in which existing information is presented to the requestor. It followed that this meant that any exemption had to be applied to the full existing information as the summary was only relevant when information is to be given to the applicant. And because in my case (i.e. my previous failed FOI request), the full information was still exempt, the question of providing a summary was irrelevant.

It is this view which has prevailed. However, I am disappointed that the Tribunal Decision did not document any rebuttal of any of the arguments I had presented. To redress this omission why I have attached the relevant arguments so that blog readers can take a look if interested (download at end).  I am still of the opinion that asking for "summary information" is a valid FOI request!

FOI practitioners should read the following

What is interesting for FOI specialists is the Tribunal Decision in relation to the “time of the request”. My request was made on 1st October 2009. The MoJ did not respond till 3rd Feb 2010 – hardly 20 working days! I immediately asked for a review which was completed on 25th August 2010 - hardly 20 working days as recommended by the ICO for the internal review period. (These are delays which the Tribunal Decision categorises as “some delay” and “less serious delay” - hardly a problem then!).

At the end of June 2010, the MoJ received a substantive response from the European Commission about the deficiencies in the Data Protection Act 1988 (and responded to them).

My question to readers with a FOI interest is as follows: if my request was made in October 2009, can the information received by the MoJ in June 2010 form part of the request, because clearly this information was not held at the time of the request?

The answer is “yes” because the internal review process had not been completed.

The Tribunal Decision relies on the Commissioner’s argument for this, but this in turn relies on just one Tribunal Decision. However, I have placed in the public domain (see downloads), a fully referenced justification of why the Tribunal came to this position which mentions several such Decisions. The Tribunal decided not to refer to this document.

The message for FOI practitioners is this: if the FOI Internal Review process gets stretched out, subsequent information relating to the request received after the time of the request might need to be included in the review and possibly disclosed to the applicant.

Concluding comment

It is interesting to note that the Tribunal, at the end of its Decision, records the fact that I am entitled to a heavily redacted summary of information held by the MoJ in June 2009.

This is, of course, was one of the arguments that I was running: namely, non-exempt, summary information exists, and can be extracted from the full, existing exempt information.

It’s a funny old inconsistent world!

References

The arguments in relation to my request is here. Download BLOG_Tribunal arguments
The Tribunal Decisions relating to the “time of the request” is here. Download BLOG_Time of request
The Tribunal Decision Notice can be downloaded here. Download BLOG_Tribunal Decision EA20110116
CSA v SIC reference is: Common Services Agency v Scottish Information Commissioner ([2008] UKHL 47 [2008] 1 WLR 1550.

Note: Some details of the deficiencies in the UK Act have been published under FOI. See “Privacy: new Government revelations amplify concerns surrounding deficiencies in UK’s Data Protection” Act. http://amberhawk.typepad.com/amberhawk/2011/05/privacy-new-government-revelations-amplify-concerns-surrounding-deficiencies-in-uks-data-protection-.html  and attachments at the end

 Data Protection/FOI courses

We have an audit and PIA course coming up in London. There is a full set of data protection courses in Leeds, London and Edinburgh Our FOI courses are in London (currently underway) and Leeds (in 2012). Details on the Amberhawk site

 

If IP addresses ARE “personal data” for a copyright purpose, aren’t they personal data for ALL purposes?

Let’s revisit that old chestnut: “is an IP address you use in an internet session personal data about you?”. The reason: I have just come across two legal references which relate to copyright infringement, where the argument that an IP address is personal data was accepted. (An IP address is the number linked to your connection to the internet so that communications can occur; for instance 68.74.255.92).

The first reference I found was the Monetary Penalty Notice that ACS Law obtained (and the £200K fine that wasn’t;  see references). The company, used to send ISPs on a regular basis, a list of IP addresses suspected of being involved in breaches of copyright. (The company went out of business because of its poor security; that is why the eventual penalty was reduced to £1K).

In the ACS Law Monetary Penalty Notice the ICO clearly states:

“The Commissioner understands that the data requests sent to each ISP by the data controller (in this case) were for information populating a spreadsheet containing hundreds and sometimes thousands of IP addresses. …. ISPs responded to the data controller by returning the spreadsheet with all the existing data, together with the name and address of the registered account holder that they had input alongside each entry”.

So the ISPs mentioned above, presumably because they have blocks of IP addresses specifically allocated to them, were able to provide a link between a requested IP address and a specific individual account holder. In this way, the IP address formed part of the personal data each ISP had in its possession.

This point was reinforced with a judicial review concerning the Digital Economy Act 2010 (see references) where it was claimed by many organizations that some regulations enacted by Government were incompatible with a number of provisions of EU law. One part of this argument related to the Data Protection Directive (DPD) 95/46/EC.

The judgment states that, as common ground between the parties, an IP address is personal data. In detail, it states that:

“It is common ground that... (various provisions in the Digital Economy Act)..., are likely to require ISPs to process “personal data” within the meaning of Articles 2(a) and (b) of the DPD.  The ISP must link the IP address provided by the copyright owner with an individual subscriber’s name and address, and write to them and compile lists”... (that can be supplied to Third Parties; paragraph 152).

So suppose an ISP allows other organisations to capture or monitor a user’s IP address say for behavioral marketing. As the ISP is processing personal data (see above), isn’t it allowing part of the personal data under its control (e.g. the IP address it has been allocated, and possibly owns, which also relates to the browsing habits of a known individual) to be used for Third Party marketing?

As all Tribunal determinations on Third Party marketing have stated that this needs the prior consent of each data subject (i.e. each and every account holder),  shouldn’t the ISP be doing something to alert or protect its customers from the use of their IP addresses for third party marketing? Like getting their consent, perhaps?

Now look at the issue from the standpoint of those behavioral marketers that arrange for a pop-up box to appear after monitoring IP addresses; for convenience, I show examples of these boxes posted on Wiki. What is the purpose of the pop-up box?View this photo  Answer of course: “marketing”.

Note that many pop-up boxes shown provide links to enable direct contact with the customer. So where organisations are using/monitoring the IP address to identify potential leads, they know that identifying information about an individual is likely to come into their possession.

If this is the case, then this too falls within the UK Act’s definition of personal data. It follows that personal data are being processed for a marketing purpose, without the data subject having been given the advance choice to opt-out of the marketing purpose (e.g. in a fair processing notice).

Is the release of IP addresses like the release of anonymous statistics?

There are those who would argue that an IP address, by itself, does not identify the individual. In support, they might quote recent judgments about “anonymous statistics”, which appear to suggest that the disclosure of anonymised information, extracted from personal data, is not a release of personal data.

I argue that the position the release of these "anonymous statistics" and IP addresses is not the same and can be distinguished very easily as follows.

Consider the ProLife Alliance FOI request to the DoH for the release of abortion statistics concerning the number of late-term abortions. The DoH refused the request and claimed that the requested information was personal data, the Information Commissioner said the statistics were not personal data, the Tribunal said they were personal data, and Cranston J, in his judgment published in June agreed with the Commissioner (but on different grounds; see references).

Cranston J argued that to consider the requested data as personal data would establish a principle which would prevent any publication of medical statistics, however broad. To justify his position, he then went on to examine whether identifiability was likely (a) in the hands of the data controller and (b) in the hands of recipients who get the statistics. He was satisfied that if identification in the hands of the recipient was “extremely remote”, then the information was not personal data.

Now we come to the difference that distinguishes the disclosure of statistics and the disclosure of IP addresses. With the former, the data controller might be able to identify an individual from the statistics in conjunction with other information in its possession. By contrast, the recipient of the statistical data, following the logic of Cranston J, is remote from making such an identification.

This starkly contrasts with the disclosure or capture of IP addresses. Although an individual cannot be identified from just the IP address, the user or recipient of that IP address has every intent to identify a potential customer as part of his marketing purpose.

Additionally, the holder of the IP address knows that in the hands of the ISP, the IP address defintely forms part of a collection of personal data. With statistics, this point might not be so clear cut; for instance the public authority might create a set of statistics for release under FOI where it cannot perform the back identification.

That is why I am increasingly drawn to the conclusion that IP addresses have to be treated as personal data by behavioral marketers as there is a prior intent to identify the individual behind the IP address.

I am also coming to the conclusion that ISPs can do more to protect its customers from unwanted marketing, especially if they own a block of IP addresses.

References

DP extracts from R (BT & Anor) v The Secretary of State for Business, Innovation and Skills [2011] EWHC 1021 (Admin) can be downloaded. I was put onto this case by the excellent Panopticon Blog http://www.panopticonblog.com/2011/06/14/personal-data-crucial-points-from-the-abortion-statistics-case/)

The Abortion stats case: R (DEPARTMENT OF HEALTH)-v-IC [2011] EWHC April 2011 was discussed in the reference above

ACS Law Ltd Monetary Penalty Notice (10th May 2011) is on the ICO website (http://www.ico.gov.uk/what_we_cover/taking_action/dp_pecr.aspx#monetarypenalties)

Data Protection/FOI courses

We have an audit and PIA course coming up and a full set of data protection courses in Leeds, London and Edinburgh  Our FOI courses are in London (currently underway) and Leeds (in 2012). Details on the Amberhawk site

Could Mr Gove’s emails breach the Data Protection Act as well as Freedom of Information?

Does the use of Gmail or Hotmail by a Minister's Private Office (in order to evade Freedom of Information (FOI) obligations) also lead to breaches in the Data Protection Act? Well, I can see how this could be the case.

The press has raised this issue only in the context of FOI. Yesterday's Sunday Times, for example, noted that the allegations facing Michael Gove and his special adviser, Dominic Cummings, were that by using personal email accounts, they were assuming that any requested information could not be held by a public authority and therefore not subject to a FOI regime.

A spokesman for the Department for Education (DfE) has told the press that "The Cabinet Office is clear that private email accounts do not fall within the FOI Act and are not searchable by civil servants. Neither the Secretary of State nor special advisers have been asked to disclose emails sent from private accounts".

The DfE spokesman then added: "the Permanent Secretary is satisfied that ministers and special advisers act within the law". Despite this, the Information Commissioner has entered the fray and has said that private account emails discussing Government business could be subject to FOI requests.

Whether these emails are, or are not, subject to FOIA will no doubt be resolved in the near future. However, what I am certain about is that all these emails contain some personal data (even if the personal data is limited to email addresses) and these emails are regulated by the Data Protection Act.

Mr Gove, the Sunday Times reports, uses the username of “Mrs Blurt” in his emails. However, suppose the advisor (Dominic Cummings perhaps using the name of “Mr Blurt”) sends an email to “Mrs Blurt” or vice-versa. Now further suppose that email says the following: “Can we talk to the Whips to make sure that Joe Bloggs MP does not get on the Standing Committee that is scrutinising the Education Bill?”. (This kind of exclusion happens as MPs are usually selected for Committees by the Whips on the basis the less troublesome they are, the easier it is for Government business to get through).

Perhaps another email might go: “I have just had a meeting from Head Teacher X who publicly asked some very awkward questions about our education reforms. Just in case there are ‘future complications’ , I recommend that this head teacher’s school should not be in the first wave of schools that get compulsory Academy status?”.

Could these be the sort of emails that a special advisor could send to a Minister – especially if they think the FOI regime does not apply? Well I think this is distinctly possible.

First data protection question: are these emails personal data? I think we can say:  “obviously yes”. There are four data subjects: Mr Gove, Dominic Cummings (i.e. “Mr and Mrs Blurt”) and the MP or Head Teacher X. Who is the data controller? Well if it is not the Department for Education (remember, the claim is that the emails are exempt from FOIA) then it has to be Mr Gove and possibly Mr Cummings as well.

Does the personal data fall into the domestic purpose exemption in Section 36 of the DPA? Well, if there are emails that have the content described above, I suggest that this exemption is inapplicable. Do the emails impact on the MP and Head Teacher mentioned in them, so much so that they should be informed about the processing purpose via the fair processing rules? Well, I can’t see an exemption from this obligation.

Michael Gove, as an MP, has a register entry that describes his constituency casework for the purpose of “the carrying out of casework on behalf of individual constituents”. Any “personal emails” about an MP or head teacher as postulated above have nothing to do with this purpose as the data subjects are not constituents. Dominic Cummings, as of today, is not registered at all.

So we have one, possibly two data controllers, likely to be processing personal data in breach of the data protection principles:- one for an unregistered purpose and the other just, plain simple unregistered. Not only could we have FOI evasion but we are also likely to have DP evasion in addition. This means that Mr Gove has gone one better than Tony Blair: Mr Blair only disapproves of FOI.

So if the Information Commissioner finds resistance to his FOI enforcement powers, perhaps he should put his data protection hat on. After all, I think the data protection arguments are sound and failure to comply with the Commissioner's data protection powers can be a criminal offence (unlike with FOIA).!

Update and courses

This October/November, we have data protection courses in Leeds, London and Edinburgh and an FOI course in London: full details on the Amberhawk website.

Next Update is October 17th 2011 in London. The guest speaker is Kuan Ho: "Every Cloud has a Data Protection Lining"; Rosemary Jay, from Hunton and Williams will be analysing the data protection fallout of the hacking affair. Sue Cullen and myself will be delivering updates on the usual "what's new" matters (e.g. enforcement, undertakings, FOI/DP interface and news roundup). £195+VAT per place: full details on the Amberhawk website (www.amberhawk.com).

Information Commissioner criticises the Data Protection and Freedom of Information regimes

I have just read the uncorrected transcript of the Information Commissioner’s (IC) evidence to MPs last week. There are several other important points which have been largely unreported; hence this blog.

As well as the custodial section 55 offence (see last week’s blog), the IC wants a strengthened offence in the Freedom of Information Act (FOIA). He also has serious doubts as to whether the changes in the Freedoms Bill (e.g. to CCTV, DNA, criminal record disclosure) will actually deliver enhanced privacy benefits. Finally, the ICO wants more independence and a more flexible approach to the funding his office.

The IC would like to see attention given to section 77 offence in FOIA. This section creates an offence if anyone tampers with information that is subject to a request under the Act (or obstructs that request). The section also extends the offence to include tampering with personal data that has been requested via subject access procedures. (Note: this offence only applies to data controllers that are also public authorities).

The problem is that the s.77 offence is triable only in the Magistrate's Court. However, under section 127(1) of the Magistrates Court Act 1980, proceedings for all such offences must be brought within 6 months of the offence occurring. Given that before the Commissioner considers the offence, there has to be a request to a public authority, a refusal and an internal review, then by the time the ICO looks at the matter in detail, the six-month deadline is often well passed.

In practice therefore, this offence is not an offence. That is why the IC told MPs: “instead of being an offence that is prosecuted in the Magistrate’s Court, it ought to be an offence that is prosecutable either way in the Magistrate’s Court or the Crown Court”.

Criminalising those who deliberately set out to evade FOI responsibilities and ignore FOI requests will get nowhere; especially if the idea is mooted with emailing Ministers such as Mr. Gove, Secretary of State for Education.

In relation to the Protection of Freedoms Bill, the IC points out that the initial enthusiasm of Government to curb the intrusion into privacy has faltered somewhat. He says:

• “We have concerns over the DNA regime where it relates to innocent people or people who are no longer of interest to the police, where it is proving very difficult to get a solution that ensures that the record on the police national computer also gets deleted.”

• “I have concerns around CCTV and automatic number plate recognition, where the consistency and comprehensiveness of the approach are concerns. I don’t see how it runs alongside the Information Commissioner’s code for CCTV. It is a regime that will apply not to every sector in England and Wales and so on”.

• “I am concerned that the proposals on criminal records disclosure don’t really seem to be taking into account the recommendations of the expert adviser who produced the report “A Balanced Approach”. The approach seems to be anything but balanced.”

The IC added that he was “still hoping that we will get a better solution for filtering out old and minor convictions from employer vetting checks” and that “it was absolutely vital that we get progress on what we call enforced subject access”. This latter offence in the Police Act 1997 has been available to be commenced by Home Secretaries for over a decade.

The IC is also concerned about “spamming texts” when they say something like “Our records show that you are in line for a compensation payment of £4,750 for that accident you had. Text CLAIM or STOP".  The problem is, the IC said, was that “if you text either, you are confirming that you are there and providing a marketing lead, because these are randomly generated texts”. 

The IC added that “We are working very hard with OFCOM and the telecom companies to try to get to the source of these spam texts, but it is a bit like looking for the launch sites of V2 bombers in the Second World War”. I don’t buy this explanation at all: telecom companies that do not know who is using their network. Come off it – they charge for texts don't they?

The IC stated that the illegal trade in personal data was a practice “that could apply to insurance companies, garages, car hire companies and towing companies” because “all appear to be sources of information, usually paid for by the claims management companies who collect the information”.

Then the IC ironically added that “We are trying to find out from the Association of British Insurers what they have to say about that, and frankly they are not being very helpful at the moment”. In addition “We have invited a number of insurance companies to undergo voluntary auditing and, surprise, surprise, they are not interested”.  My take on this is as follows: if the IC cannot “invite” data controllers in the insurance sector to discuss this issue, the only option open will be to enforce the Act as soon as there are any reasonable grounds of suspicion. So don't be surprised if that happens.

The IC wants more independence from Government.  He said that “my problem, if it is a problem, is, if I am not seen as an officer of Parliament, reporting directly to Parliament, I have to negotiate my way through with many other Departments of State. ... I have to get a tick on anything I propose to do”. The Government is expected to publish a document about the independence of the IC in the very near future.

The IC also highlighted “the unsatisfactory nature of the hybrid funding that funds the IC with three quarters of the money coming from notification fees for data protection and a quarter coming from grant in aid for freedom of information”.  He complained that his office “spending far too much of my time trying to work out apportionment of costs between FOI and DPA in order to keep the National Audit Office happy” and he “cannot treat information rights as the seamless project that it is”.

Another way of seeing this is that he wants private sector data controllers fund his role as a public sector FOI regulator. I can’t see this happening. However, having a separate and larger registration fee for public authorities (i.e. above the current £500 maximum) could work.

Finally, the IC was asked:”what was at the top of his wish list”. The IC responded that it was “implementation of sections 77 and 78 of the 2008 Criminal Justice and Immigration Act” and the custodial section 55 offences. That was discussed in spades in the last week’s blog.

References

Read the ICO’s evidence (uncorrected): http://www.publications.parliament.uk/pa/cm201012/cmselect/cmjust/uc1473-i/uc147301.htm

Update and courses

This autumn, we have data protection courses in Leeds, London and Edinburgh. full details on the Amberhawk website

Next Update is October 17th 2011 in London. The guest speaker is Kuan Ho: "Every Cloud has a Data Protection Lining"; Rosemary Jay, from Hunton and Williams will be analysing the data protection fallout of the hacking affair. Sue Cullen and myself will be delivering updates on the usual "what's new" matters (e.g. enforcement, undertakings, FOI/DP interface and news roundup). £195+VAT per place: full details on the Amberhawk website (www.amberhawk.com).

Privacy issues: Smart Metering, Violent Warning Markers and Undertakings

Happy New Year. Isn’t it horrid to be back at work?

Normally the end of year holiday is very quiet – not so this year, so I have taken the opportunity to report on three issues that could have been easily missed since my last blog. The commentary deals with Smart Meters, Violent Warning Markers and Undertakings. Full references at end as usual.

Smart Metering

With the UK’s Government blessing, most public utilities are moving to “smart metering”.  For instance, all old fashioned electricity meters are being replaced by 2020 with devices where consumers can find out, in real time, what resources are used by which device, and how much it costs to use. Such information, the Government hope, will reduce electricity consumption and carbon dioxide emissions; it will also make the visit from a meter reader as outdated as a visit from a Petty Chapman.

However, smart meters could allow public utilities to hold personal data about lifestyles   – for example, how many times you cook food in an oven, when you have a bath, when you are at home or on holiday. Inferences could be made – for example, what do you think has happened if the meter readings are consistent with a shower in a two person flat being switched on four times – twice at 11.30pm and twice around midnight?

Also, if the authorities want to know whether someone is at home, they can monitor the real-time meter – perhaps relying on the exemption from the non disclosure provisions in section 29 (crime and taxation) to facilitate disclosure. Covert surveillance (e.g. such as that employed by Poole Borough Council in relation to its school admissions policy - see references) becomes unnecessary as an analysis of meter readings can be used to assess how much (and when) a property is being used as the prime domestic residence. Finally, burglars are likely to take an interest in very low-usage meter readings, so personal data security is a very important issue.

Before the holidays, the Ponemon Institute (an American Research organisation specialising in security and privacy) published research on USA consumer attitudes to smart metering. It shows that many consumers do not understand the range of details recorded or transmitted by a smart meter, and are not provided (or did not recall receiving) information about the installation of a smart meter. Consumers who claim to have the best understanding of a smart meter are most concerned about the impact on individual privacy. The major concern, not unsurprisingly, appears to be how the collection of personal information could reveal details about their lifestyle.

In other words, there are significant data protection issues about smart metering that have yet to be resolved (or even aired in public in the UK).

Violent warning markers

Slough Borough Council’s appeal against the awarding of libel damages was published just before Xmas. The Appeal relates to the placing of personal data (about Ms. Jane Clift) on Slough’s Register of Violent People which was then subsequently shared with other public bodies and within the Council.  At the Lower Court, Ms Clift was successful in her argument that the sharing of her personal data was an unnecessary interference with her personal life and their distribution amounted to defamation. She was awarded £12K compensation and costs.

Slough’s appeal surrounded the legal point as to whether or not a Local Authority had a public-law, moral or social duty to disclose the details on the Violent Persons Register. If such a duty existed, the content of the disclosed personal data was irrelevant to the question of whether personal data, once placed on the Register, had to be disclosed. In other words, if Slough had such a lawful duty, then it followed that there could be no defamation as there was an obligation to disclose details from the Register.

Paragraph 35 of the Appeal judgment is the killer for the Council: “....Ill-considered and indiscriminate disclosure is bound to be disproportionate and no plea of administrative difficulty in verifying the information and limiting publication to those who truly have the need to know or those reasonably thought to be at risk can outweigh the substantial interference with the right to protect reputations. In my judgment the judge's ruling on proportionality is beyond challenge. To publish as widely as the Council did was to breach Ms Clift's Article 8 rights”.

Note that Appeal judgment has no commentary on any data protection issue and therefore does not illuminate the workings of the Act although the ICO’s Guidance on Violent Warning Markers gets a very cursory mention at paragraph 35 as part of a single sentence in 50 paragraph judgment. At best, one can tentatively assume that this Guidance was aired in Court, and the absence of detailed commentary in the judgement can be read as inferring some kind of acceptance of its content in relation to when to place personal data on the Register and when to disclose them - but that is as far as it goes.

I think the real question is: “Why did Slough B.C. bring this appeal?”. The facts of the case were explored in detail by the Lower Court and were found to be wanting; the Court accepted that Ms Clift was not someone who had been violent (or who was potentially violent), but rather someone who became frustrated with officials and complained about their lack of professionalism. Slough’s error was to take verbal statements such as “Right now, I wish she'd drop dead” too literally.

So what legal principle was Slough trying to establish by its Appeal? Was it “if we decide to put people on the Register, then there are no consequences?”. And because of the small nature of the compensation (£12K not £120K), the whole process seems to be a complete waste of resources, paid for by the taxpayer of course. Perhaps somebody in Slough has a big ego to protect, who knows?  But quite evidently the maxim “once in a hole, stop digging” has yet to reach the Borough.

By the way, don’t say something like “I could murder a bag of chips” in Slough – you might get arrested.

Undertakings extended to FOI

The University of East Anglia (UEA) has signed the first Undertaking in relation to Freedom of Information (FOI). Until now, Undertakings have been signed by data controllers in relation to reported losses of personal data; the result is that all previous Undertakings have dealt with the Seventh Principle, but the odd one has contained additional requirements in relation to the First, Third, Fourth and Fifth Principles.

The context of this FOI undertaking concerns the failure to deal with EIR/FOI requests received by the UEA’s Climate Change Research Program. Do you recall those leaked emails (around February last year) which were used by the “No such thing as global warming” lobby to say that the science was being  “fixed” to support a carbon dioxide theory of rising global temperature?

The subject matter got very political and resulted in a Parliamentary Select Committee Inquiry and a host of press headlines. In such circumstances, the Commissioner had no choice but to be seen to “do something” about the obvious FOI/EIR shortfalls which had been exposed and criticised publically.

The interesting fact is that there was no Enforcement Notice issued. This means that the ICO wanted to dispose of the subject with the minimum of fuss, and it is this aspect – the decision not to proceed down an official enforcement route - which helps explain why the Undertaking is likely to become more important to public authorities and data controllers.

DP and FOI Practitioners might want to look at “The Undertaking – 2010” (see references). This explores why the “Undertaking” is increasingly being used by the Information Commissioner as part of his enforcement options. The article considers the implications for data controllers, the lack of an appeals mechanism and the extension of “Undertakings” to breaches of any data protection principle. Now that analysis is relevant to FOI practitioners.

References:
1. The Ponemon Institute research document (Perceptions about Privacy on the Smart Grid) can be obtained from Mike Spinney, Senior Privacy Analyst, mspinney@ponemon.org. Re Poole surveillance: http://amberhawk.typepad.com/amberhawk/2010/08/swimming-in-the-surveillance-poole-the-real-privacy-problems-with-ripa.html

2. Clift v Slough Borough Council [2010] EWCA Civ 1484 (21 December 2010) URL: http://www.bailii.org/ew/cases/EWCA/Civ/2010/1484.html

3. The “Undertaking” analysis can be down loaded from http://www.amberhawk.com/policydoc.asp and the FOI undertaking itself can be found at http://www.ico.gov.uk/what_we_cover/promoting_openness/~/media/documents/library/Freedom_of_Information/Notices/uea_foi_undertaking.ashx.

Advert re DP and FOI courses:

We are running several sets of data protection courses next year. We are starting a set of the 7-day DP course in London (beginning 18th January) and running the 5-day intensive course in Edinburgh (beginning 24th February) and in Leeds (beginning 3rd March). These courses cover the DP ISEB syllabus and prepare delegates for the examination in April 2011, although you do not need to be seeking the qualification to attend.

Our next FOI course starts in Manchester on 26th January. As with Data Protection, these courses cover the FOI ISEB syllabus for the examination in April 2011, although you do not need to be seeking the qualification to attend.

Details on the “brochure” section of the Amberhawk website (www.amberhawk.com)

As GCHQ keeps tabs on FOI requestors, what does “national security” mean?

Following an FOI request instigated by yours truly, it has emerged that GCHQ are keeping tabs on FOI requestors. Even those requestors who have asked public authorities for a copy of GCHQ’s widely distributed, declassified, IT security documentation. The circumstances of my request illustrates why the FOIA exemption (Section 23) pertaining “national security” is ridiculously wide, and raises questions as to what “national security” now means.

The information that was the object of my desires is sexily entitled: “HMG IA Standard No.6: Protecting Personal Data and Managing Information Risk”. Each page is headed with the capital letters “NOT PROTECTIVELY MARKED” (which shows that there are no national security considerations with the content) and a footer which states “This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation”. This is followed by “Refer any FOIA queries to GCHQ...” (contact details provided).

How do I know the document says this? Well I obtained this unclassified document from a public authority web-site and it is relatively easy for readers to obtain their own “samizdat” copy.

The reason for this relative ease is because GCHQ’s “HMG IA Standard No.6..” has been widely distributed, by GCHQ, to Central Government, Local Authorities and NHS bodies and a host of other public sector organisations that have to implement the HMG Security Framework (which is freely available, and recommended download, on the Cabinet Office website). Private sector contractors, approved by GCHQ, are also given copies of the HMG IA Standard No.6.

The publicly available Security Framework documentation refers to the secret “HMG IA Standard No. 6...” as being a key document in helping to implement and understand the HMG Security Policy in the context of the processing of personal data. As this document (and other IA Standards like it) are not officially in the public domain, my FOI request was made with the simple intention of making it so. The objective is a simple one: how can the advice in the Security Framework be followed by other organisations if the supporting declassified documentation is also not made available?

Despite the “NOT PROTECTIVELY MARKED” label, I discovered the document is exempt from the FOI Act because of the wide nature of the national security exemption in section 23. This exemption requires that the requested information “was directly or indirectly supplied to the public authority” by GCHQ, a position that was upheld by an internal review which had input from GCHQ, I hasten to add.

So, suppose GCHQ supplied public bodies with its “Review of the collective works of Enid Blyton with a special emphasis on the roles of Big Ears and Noddy”. Such a document would be exempt from FOIA as the test the S.23 exemption applies is whether GCHQ supplied the text – not whether the exemption is needed in connection with any national security objective. As the S.23 exemption is an absolute exemption, there is no public interest test as to whether or not the document, if released, would prejudice national security.

This is unlike the national security exemption under the Data Protection Act, which provides for an exemption from the “fair processing” requirements of the Act if an exemption is necessary for “safeguarding national security”. As the document I requested is “NOT PROTECTIVELY MARKED”, my asking for it clearly does not raise any national security concern. It is therefore difficult to see why disclosure of personal data to GCHQ is (a) needed for presumably a national security purpose or (b) has to be kept secret from the data subject (i.e. the FOI applicant).

That is why I believe that, in the context of my kind of request, the disclosure of a FOI requestor details to GCHQ in the circumstances described above is a likely breach of the First (unfair) and Third Principles (excessive) and also cannot be legitimised in terms of Schedule 2 of the DPA.

By contrast, if the requestor asked for content that did carry a “confidential” or “secret” or “top secret” classification, then one could see arguments that such a disclosure could be justified. Indeed, one wonders whether this is routine practice already, and details of certain FOI requests and requestors are routinely disclosed to national security agencies. Who knows?

The handling of my FOIA request for an innocuous document provides evidence that the national security agencies will apply whatever exemption it can get it hands on, to be applied whenever it can, irrespective of the circumstances of the case. The mantra appears to be “if it can be kept secret, it will be kept secret”.

This is a worrying conclusion because the meaning of “national security” is expanding almost as fast as the Universe. In the latest “Wiki leaks” episode, the press were full of reports that a “snake venom facility” in Australia was a national security concern for the USA. Are we to assume, therefore, in the UK that “national security powers” could be applied to justify the processing of personal data in connection with the production of snake venom?

It is interesting to note that the Intelligence Services Act of 1994 provides the legal basis for GCHQ’s purpose associated with the provision of “bog standard”, declassified, IT security advice. This states that GCHQ’s role is to “to provide advice and assistance about ...the terminology used for technical matters, and cryptography and other matters relating to the protection of information and other material” to central government any other organisation chosen by the Prime Minister.

That explains why “national security” now embraces “providing advice and assistance on the security of communications and electronic data....”, business continuity and resilience planning (e.g. against Acts of God) and delivering  “information assurance policy services” to public bodies. In fact, all situations envisaged by the Civil Contingencies Act 2004 are arguably now matters of “national security”.

The inclusion of these areas such as IT security is an example of “national security function creep”. These wider dimensions add to that creeping which has already arisen in the area of policing, as both the Intelligence Services Act of 1994 and Security Service Act of 1996, extended the function of the national security agencies to additionally support “the activities of police forces and other law enforcement agencies in the prevention and detection of serious crime”.

So when these national security agencies process personal data to support the police, these agencies do not process personal data for a “crime purpose” (which is the obvious purpose when the processing is to assist the police in connection with serious crime) but rather for the “national security purpose”. This position was upheld by previous Home Secretaries in the previous administration (see reference).

Why the difference? Well both exemptions are designed to protect the processing interests of the respective bodies, and they have successfully achieved this objective. For example, I have not heard the police arguing that the Data Protection Act stops them processing their criminal intelligence. However, the policing exemption in Section 29 of the Data Protection Act is fully subject to the Information Commissioner’s independent oversight, whilst the broader “national security purpose” in Section 28 is not. Hence the inevitable conclusion that the objective of morphing the “national security” purpose to include the “policing purpose” is to minimise and avoid independent supervision by the Commissioner.

I should add that this position cannot be effectively challenged, because Section 28 states that if a Minister signs a certificate that equates the “national security purpose” with the “policing purpose”, then that is the end of the matter.

The dilemma associated with balancing the national security purpose with individual privacy and transparency concerns is not a new issue. Back in 1979, the Lindop Report into Data Protection (Cmnd 7341, paras 23.21-23.24) stated that the national security agencies should be subject to a data protection Code of Practice that was independently supervised.

The Report concluded that it was important to take the national security agencies out of their “hermetically sealed” environment in order to ensure that these agencies would be "open to the healthy - and often constructive - criticism and debate which assures for many other public servants that they will not stray beyond their allotted functions".

So I end this blog by asking a basic question. Do you think that the national security agencies have “strayed”?  Does an expanding definition of “national security”, supported by a lack of transparency and accountability, carry the risk of encouraging such “straying”?

Currently, the national security agencies effectively decide for themselves how far the “national security purpose” stretches: this risks increasing the “national security function creep” and establishing a position that is less and less accountable by the day.

In short, I think the time has come to urgently revisit how the exemptions in Data Protection Act and FOI Act should apply national security agencies.

References:  See “Human Rights Legislation and Government Policy towards national security -  2006” which explores data protection in the context of weak regulation, a lack of Parliamentary and judicial scrutiny, and the national security purpose: http://www.amberhawk.com/policydoc.asp

Advert: We are running several sets of data protection courses next year. We are starting a set of the 7-day DP course in London (beginning 18th January) and running the 5-day intensive course in Edinburgh (beginning 24th February) and in Leeds (beginning 3rd March). These courses cover the DP ISEB syllabus and prepare delegates for the examination in April 2011, although you do not need to be seeking the qualification to attend. 

Our next FOI course starts in Manchester on 26th January. As with Data Protection, these courses cover the FOI ISEB syllabus for the examination in April 2011, although you do not need to be seeking the qualification to attend.

Details on the “brochure” section of the Amberhawk website (www.amberhawk.com)