Hawktalk

Government to permit council officials to gain routine access to tax records; powers extend well beyond the justification for data sharing

The Local Government Finance Bill, now before Parliament, is drafted in such a way that it could permit the routine disclosure of tax records and other personal data held by HMRC to council officers for several council tax related purposes. The powers also allow HMRC to disclose such details directly to contractors of the Council (e.g. perhaps those IT service providers based overseas or in the Cloud); this could permit tax details to go to many interesting destinations outside the EEA.

Having said that there is one very important surprise in the legislation, which I explain at the end of this blog.

So how can we be confident that routine data sharing between Councils and HMRC is a possible outcome? As readers know, there is an exemption from the non-disclosure provisions in Section 29 of the Data Protection Act that covers the “assessment or collection of any tax or duty...”; clearly "Council Tax" is a “tax” as required by Section 29.

This exemption from the non-disclosure provisions permits the disclosure of personal data by HMRC to a Council assessing/collecting Council Tax, on a case by case basis, without the need to consider the Principles and the data subject rights  that could interfere with such a disclosure (e.g. right to object to disclosure). However, the HMRC has to be satisfied that failure to disclose to a Council “would prejudice” the collection of Council Tax.

So, if the current law allows for disclosure in these important tax avoidance circumstances (e.g. a case by case disclosure where prejudice to the collection of Council Tax exists), it follows that the new statutory gateway can permit disclosure in circumstances where these tax avoidance factors are not relevant to any decision by the HMRC on whether or not to disclose to a Council. For instance, those disclosures which are not “case by case” (e.g. routine) and where there is no “prejudice” to the collection or assessment of Council Tax.

Also note that the word “relate” is unqualified; so “purposes relating to council tax” could easily extend to any Council purpose that depends on the collection of Council Tax; in this way many Council functions become arguably related to Council Tax. This risk would not be present if the legislation stated that the disclosure was restricted to the “council tax purpose”.

For completeness I provide an annotated example of the data sharing provisions (from Clause 15 of the Bill):

(1) A Revenue and Customs official may supply information which is held by the Revenue and Customs in connection with a function of the Revenue and Customs to a qualifying person for prescribed purposes relating to council tax. (Comment: my emphasis on the word “relating”)

(2) The following are qualifying persons for the purpose of this paragraph—

 (a) a billing authority in England; (Comment: this is the Council Tax function; below are the powers to disclose directly to contractors);
 (b) a person authorised to exercise any function of such an authority relating to council tax;
 (c) a person providing services to such an authority relating to council tax.

(3) Information supplied under this paragraph may be used for another prescribed purpose relating to council tax. Comment: note the word “relating” means that the purpose has to have some relationship with Council Tax purpose (e.g. purposes based on the need to collect Council Tax).

(4) Information supplied under this paragraph may be supplied to another qualifying person for a prescribed purpose relating to council tax (whether or not that is a purpose for which it was supplied). Comment: this is a general provision to negate the protection offered by the Second Data Protection Principle (incompatibility of the purpose of disclosure to the purpose of collection of personal data);  it also negates the Third Data Protection Principle if the data items to be disclose were to be specified in regulations.

So how does the Government explain the need for these data sharing provisions. The “Explanatory Notes” accompanying the Bill state:

 “Local authorities will need to use information held by HMRC to determine whether a person is entitled to a reduction in council tax. These provisions will reduce the need for authorities to collect information from persons claiming a reduction when it has already been supplied to HMRC and will help to ensure the information used to calculate a reduction is accurate.These information sharing powers are therefore needed to ensure local authorities are able to administer council tax efficiently and to help prevent fraudulent claims for a council tax reduction" (at paragraph 127).

In other words, the justification proffered falls within the existing S.29 exemption. It amounts to a check on whether the HMRC and Local Authority agree that a person claiming a single person's Council Tax reduction also relates to a single person in relation to Child Benefit (what remains of it, I mean) or tax credit claims. You simply do not need general data sharing powers relating to data subjects who are NOT claiming this reduction; you do not need powers that links to purposes that can extend well beyond the official justification.

Now we come to the really interesting bit I promised. There is a provision that states: “Regulations under this paragraph must not be made except with the consent of the Commissioners for Her Majesty’s Revenue and Customs”. This is the first time I have seen that the exercise of Ministerial Powers is to become subject to a veto by someone who is not the Minister.

I think this has broken the ice in a very important way. Wouldn’t it be nice to see the following in ALL data sharing powers similarly subject to an independent review: for instance, “Regulations under this paragraph must not be made except with the consent of the Information Commissioner?”.

Now we can dream on, but such a provision would be real data protection from the excess of Ministerial powers; and I can think of a number of places where I would put it!

References:

The Bill and Explanatory Notes (at the time of presentation to the House of Lords) can be found on: http://services.parliament.uk/bills/2012-13/localgovernmentfinance.html

ICO decides that European Commission’s criticism of the Data Protection Act should be published

Just a brief note on my pet obsession; should data controllers and data subjects in the UK know why the European Commission claims that the Data Protection Act 1998 is a defective implementation of Directive 95/46/EC? The good news is that I have obtained a Decision Notice that requires some of the full details to be provided to me; the bad news is that the Government has 35 days to appeal.

I should explain why I think the Government are treating this subject as if I had asked for some state secret which makes one vulnerable to extraordinary rendition. The main exemption used is section 27 (prejudice to international relations) which on the face of it appears laughable; I don’t think anything about data protection will cause any international rumpus or the withdrawal of ambassadors. But this is what is being argued – so why?

Underpinning the requested information is a threat of infraction proceedings against the UK; these have been pending since Durant (another obsession!) in 2003. I have had to argue that the threat of infraction proceedings is very limited (after 9 years of inaction by the Commission, they are hardly going to embark on legal proceedings given the Regulation); but it is this threat of infraction that explains why the UK/Commission FOI shutters are firmly closed.

Infraction proceedings are considered when any Member State has not implemented a Directive (i.e. any Directive of which there is a great number). Thanks to the case of Petrie (Case T-191/99 Petrie and Others v Commission [2001] ECR II-3677), a case determined by the European Court of Justice over a decade ago, details of infraction proceedings are not published because of confidentiality concerns and the risk to legal proceedings.

This has resulted in very little information being released. For instance, Guardian Journalist, Rob Edwards, tried to get some very limited details about infractions but anything substantial was rebutted on Petrie grounds (see Decision 196/2007 Mr Rob Edwards and the Scottish Ministers).

The Petrie decision is used by the European Commission to justify not providing details about any infraction proceeding; in many instances Member States are also not keen for these details to be published. The result is a hermetically sealed system where nothing about infraction proceedings is published and what is given out is done so grudgingly – even to national Parliaments. The only relaxation is when the Commission or Member State decides it is in their interest to provide details. And this is about ANY DIRECTIVE.

So do you think the public or national Parliaments should know why infraction proceedings are occurring? The European Ombudsman thinks so; that is why he supported my case to extract a very minimal information from the European Commission. This took four years, believe it or not (see references)! If it wasn’t for the Ombudsman, there would be nothing.

However, like a hole in a dam, the breach is widening. My FOI request is now a significant chink the Petrie position. For the first time, there is a prospect of significant details of the information underpinning infraction proceedings being published in the absence of any approval or agreement from the Commission and European Government.

This argument can be applied to any Directive. That is why the “obsessive” battle is important; it also explains why I am expecting an Appeal.

References

The Decision Notice:Download FS50411133_for blog May 2012

If you want summary details of why the European Commission thinks the UK Act is defective see:

http://amberhawk.typepad.com/amberhawk/2011/02/european-commission-explains-why-uks-data-protection-act-is-deficient.html  (Commission’s view; this took 4 years)

http://amberhawk.typepad.com/amberhawk/2011/05/privacy-new-government-revelations-amplify-concerns-surrounding-deficiencies-in-uks-data-protection-.html (UK summary of the Commission’s view – more substantial; released because the Commission released details)

The following reference relates to the reply that the Government has made to the Commission (this information is still “top secret”): http://amberhawk.typepad.com/amberhawk/2011/10/what-is-wrong-with-the-data-protection-act-foi-infraction-saga-hits-the-buffers.html

 

Fines for non-registration with the police? Reforms permit enhanced secondary use of electoral rolls.

Should you be fined if you failed to register with the local police, the national security agencies, any Government Department or a Credit Reference Agency? Should the national security agencies, for instance, be entitled to create a population register, the core of which could be similar to that of associated with the ill-fated ID Card (much beloved by the previous Government)?

Surprised by these questions? Both these outcomes are possible, courtesy of the Electoral Registration and Administration Bill just published following last week’s Queen’s Speech.

This Bill allows for individual electoral registration; this means that each elector must apply individually to be registered to vote. To ensure that all voters are registered, the Bill permits extensive data matching powers to verify applications, to check existing entries in electoral registers against other sources of data, and to hunt for individuals who do not currently appear on the electoral roll.

Also like registration for an ID Card, there will be a civil penalty for those who fail to make an application when required to do so by an Electoral Registration Officer (“ERO”). This continues the compulsion under the current law which makes it an offence if an individual fails to provide information to an ERO when asked.

The details provided on such registers are usually the voter’s name, address, nationality and age; however the associated Privacy Impact Assessment adds that the register will need to have access to Nationality (plus immigration status where appropriate), NINO and previous and/or alternative address. All these details formed core elements of the ID Card’s database (the National Identity Register or NIR).

Each full register is updated every month and published once a year. Like the ill-fated NIR, the full register can be used for several purposes: there is the obvious electoral purpose, a prevention and detection of crime purpose, a safeguarding national security purpose and a purpose related to checking the identities of individuals who have applied for financial services.

Each full register can also be sold to any government department for its purpose, it can be used for vetting job applicants and employees if this is required by law, and by credit reference agencies. The selling price for a full register is about £15 per 1,000 names so a 100,000 constituency will cost about £1,500 (for details see references). The Bill does not propose a central database of voters, but clearly this has not stopped the collection of a comprehensive set of electoral rolls (e.g. by the credit reference industry).

Despite an obligation to inform the ERO (and thence several state institutions) of your name, address and age (when asked), the Explanatory Notes accompanying the Bill plays down concerns over Article 8 and the obligation to respect private and family life. The Notes explain:

“The operation of the provisions in the Bill involves the processing of individuals’ personal information and therefore arguably engages Article 8 ECHR” (my emphasis on arguably).  The Notes then add “The question of compatibility with Article 8 will, therefore, depend to an extent on the way in which the new system is implemented”. (As we shall see, the implementation is by wide ranging, unfettered, exercise of power by the Secretary of State).

The claim that Article 8 is not engaged arises because:

a. it is necessary for EROs to ensure that only those individuals who are entitled to be registered to vote are included on the register and to reduce voter fraud;

b. all secondary uses (e.g. prevention of crime) are exclusions in Article 8(2) of the Human Rights Act; and

c. a challenge to the current scheme for the disclosure and use of the electoral register was found to be a “very modest” interference with the right to vote (and if challenged, is likely to fall within the margin of appreciation associated with Article 8; see R (Robertson) v Secretary of State [2003] EWHC 1760 (Admin)).

Now I turn to the powers of the Secretary of State in the Bill (and can you remember that what the ERO puts on an electoral register potentially goes to everybody allowed a copy of the full register e.g. police, credit reference agencies etc). The powers can be used to permit any ERO:

(a) to verify information relating to a person who is registered or who is named in an application for registration, or alteration of, an entry in a register (note that such verification includes checking with other sources of information held by other persons);

(b) to ascertain the names and addresses of people who are not registered but who are entitled to be registered (note that this is a “hunt the errant voter” provision possibly by data matching from such sources identified above), or

(c) to identify those people who are registered but who are not entitled to be registered (perhaps doing checks with the immigration service – who knows!).

The Secretary of State’s powers may also authorise “comparisons” (i.e. more data matching) with other information and allow the “conferring of other functions on a person” (this should make the processing undertaken by the other person, legitimate in terms of Schedule 2 of the DPA) and authorise the Secretary of State to make grants to a person on whom functions are conferred (this means the tax payer pays for the pleasure).

The idea behind the above is, for example, to set up a system whereby information provided with applications for registration and information held by specified public authorities are passed to say another person for comparison, with the results passed back to EROs for registration. The Audit Commission (or its replacement when abolished) springs to mind with its considerable data matching experience countering Local Government benefit fraud.

The powers can also minimise the impact or protection afforded by the Data Protection Principles; they can:

a. authorise “a person to disclose or otherwise process information only in accordance with an agreement” (i.e. this makes the data sharing lawful,  provides a Schedule 2 ground but the processing may have to be in accordance with a data sharing protocol);

b. authorise or require “a person to disclose or otherwise process information only in accordance with requirements imposed by the Secretary of State” (i.e. allows the Secretary of State to mandate such disclosures in the absence of an agreement; any disclosure becomes lawful in terms of the First, Second and Seventh Principles);

c. require “the retention or disposal, or otherwise regulating the processing, of information disclosed” (i.e. this can legitimise retention criteria that are more extensive that the minimum retention criteria that would be established by Fifth Data Protection Principle).

Now take a big breath as we are not finished discussing powers. Are you ready? There is also a power so that “Provision made under this paragraph (e.g. to require disclosure or data sharing) has effect despite any statutory or other restriction on the disclosure of information”! No comment except to say “overkill to the power of a million”.

The only safeguard re exercise of these powers is that the “Secretary of State must consult any relevant person” (e.g.  the Electoral Commission, the Information Commissioner). Note that what this really means that the Secretary of State is free to ignore what either Commissioner says; the obligation only is to “consult”.

The degree of compulsion that will be placed on voters to register under the new arrangements is yet an unknown quantity; however, the current position was set out in an answer to a PQ six months ago. Mr Clegg, Deputy PM, wrote that:

“It is currently not compulsory to be registered to vote and this will not change under the Government’s individual electoral registration (IER) proposals. It is an offence at present for anyone not to provide information when required to do so by an electoral registration officer (ERO), for example, in response to the household canvass form. The Government propose to retain this offence under the new system, however, it is not proposed to create a new offence for an individual failing to respond to an invitation to register. We believe that the act of registering is one of personal responsibility, and as such there should be no compulsion for an individual to make an application to register to vote”. (Hansard, 17 Oct 2011 : Column 714W).

To be fair to EROs, they have not pursued many prosecutions and I have only seen the odd one or two over the last decade. However, the fining regime that involves civil penalties could be completely different as there appears to be a shift in enforcement power: fining policy is in the hands of the Secretary of State and not in the hands of an ERO (as in the case or prosecution). All the Bill vaguely says is that “The procedure for imposing a civil penalty on a person is to be set out in regulations”; it outlines an appeals process but does not define the amount of the penalty.

If these civil penalty regulations are used to implement an combative approach to enforce voter registration, then you almost turn the clock back to the ID Card situation where failure to register on the NIR attracted a penalty, and entitlement for services depended on the existence of an entry in the NIR. Under an aggressive penalty regime, for instance, those in receipt of a benefit or driving licence or paying tax could be “reminded” by the relevant government department that they are not on the local electoral register, and be told that the local ERO “has been informed”. I think you can follow the rest of the logic by yourself!

The Government intend that the number of such organisations that can have copies of the individual voter registers are not really part of the discussion; this is because the wide powers of the Secretary of State, found in Schedule 2 (para 10B) of Representation of the People Act 1983, are being enhanced and strengthened (and not questioned! - even by the published PIA).

Under the 1983 Act provisions, the Secretary of State can continue to authorise or require an ERO “to supply to such persons as may be prescribed copies of the full register and other documents, or prescribed parts of them, whether free of charge or on payment of a prescribed fee”; the Secretary of State can also continue to define the secondary purposes for which the information contained in the registers may be used.

In other words, the Secretary of State has complete control over use, content and disclosure from all electoral registers and the Secretary of State has untrammelled powers to deliver any outcome the Government wants. All these powers exercised by Statutory Instruments which usually get little or no scrutiny; this is very redolent of New Labour’s surveillance state legislation.

The real issue is of course, is whether Electoral Rolls should be used for these wider purposes; and of course there are arguments either way on this score. In my view, the primary purpose of the Electoral Roll is to encourage voters to engage with the democratic process; having an infrastructure of wide ranging data sharing powers so that recalcitrant voters can be issued civil penalties will discourage such political engagement. Far better, I suggest, is to make the institution of Parliament more in tune or responsive with the needs of the voters; what we have with majority Governments is a Parliament that usually offers a degree of scrutiny at the level of a rubber stamp.

Such penalties do make more sense if the objective is to populate the databases of the police, credit reference agencies, other Government Departments and the national security agencies etc etc; this is especially the case when the improved accuracy of individual voter registers become available.  So, in summary, I can see in about five years time (when this Bill is settled in), there will be increased pressure for even further wider use of electoral rolls by different bodies.

Those of you with memories of the National Identity Register will remember that the NIR was to be used for a Population Register, accessible to all public authorities. Remember that NIR was supported by wide ranging disclosure powers for the Secretary of State, a strict eligibility criteria of registration, and strident civil penalties for refusenicks.

Now consider the new system of voter registration and that pinnacle of inductive reasoning: “if it looks like a duck, swims like a duck, and quacks like a duck, then it probably is a duck”.

And now you know where I am coming from!

References

Explanatory Notes on the Electoral Registration and Administration Bill: from http://www.publications.parliament.uk/pa/bills/cbill/2012-2013/0006/en/13006en.htm

The Electoral Registration and Administration Bill itself: http://services.parliament.uk/bills/2012-13/electoralregistrationandadministration.html

Privacy Impact Assessment (which amazingly does not consider any of the legislative issues raised here) https://update.cabinetoffice.gov.uk/sites/default/files/resources/Privacy-Impact-Assessment-090512.pdf.

Download background details of the supply and sale of the Electoral Roll (Parliamentary Paper):Download Electoral roll document_for blog May2012

 

Desire for a FOI charging regime equates to reduced accountability of public bodies

I have to confess that I am just a normal type of guy who reads Hansard and watches the BBC’s Parliamentary Channel. The last (wet) bank-holiday weekend, for instance, there was a riveting repeat of Jack Straw’s evidence to the Justice Committee on the operation of the Freedom of Information (FOI) Act.

As Home Secretary, Jack Straw was responsible for piloting the Data Protection and Freedom of Information Bills through Parliament; he knows where the legislative skeletons can be found. And at the time of his stewardship of the FOI Bill in Parliament, he knew that Tony Blair had decided that FOI was his worst idea ever. He confirmed that but for the Ministerial veto, the Government would have dropped the FOI Bill.

So I think his take on the current review of FOI is important. I also think Straw’s position is close to what I think the Government would like to propose.

As an aside, remember that the Data Protection and FOI Acts started off as Home Office Bills (prop J. Straw); that is why these Acts have significant exemptions in areas that cover Home Office functions such as law enforcement, policing, immigration and national security. Jack Straw protected his fiefdom very well.

Anyway back Jack Straw’s evidence to the Justice Committee; it amounted to four propositions:

•    charge the applicant about £10-£15 for each FOI access request;
•    make the FOIA exemptions in Section 35 (formulation of Ministerial policy etc) and Section 36 (prejudice to the effective conduct of public affairs) in so far as they apply to Ministerial decisions an absolute, class exemption (i.e. no public interest test);
•    reword the “formulation or development of government policy” part of the Section 35 exemption so that it applies indefinitely, and
•    keep the Ministerial veto as a safeguard to be used sparingly in other cases.

The argument over FOI as debated at the moment has two strands:

•    One strand goes something like this: “FOI requests costs us £184 each so it is only proper the applicant pays a modest amount, especially in these days when money is tight”.
•    The second strand is that Ministers (unlike NHS boards, police boards and Mayors in large conurbations) are in a special place because when they determine policy, they should be able to keep key information secret for at least 20 years (the minimum time when documents become public records).

As can be seen the second argument is far more difficult to make; that is why there is a fuss over the latest veto re the NHS Risk Assessment. Hence, the focus of debate is more on the first strand.

Backing the cost arguments is a report is a Mori study which has provided some cost estimates (which are not representative, if you read the report carefully). For example, Mori reports that:

“Statistics produced by the Ministry of Justice over the period 1 October 2010 – 30 September 2011 indicate that Departments of State and other monitored bodies covered by these statistics received a total of 45,958 FOI requests. In order to produce an estimate of the total annual cost in staff time of processing and responding to central government requests, it is possible to multiply £184 (the average cost of the 225 FOI requests submitted to central government) by the total number of requests received. This gives an estimated staff cost of £8,456,272 per year”.

Before you say that £8.5 million could allow us to build a new school or a hundredth of a new fighter aircraft, just ask what this money is doing?

I would argue that for £8.5 million, we get 46,000 FOI requestors using their own resources to make a Government accountable for its spending of £722 billions (the annual figure for expenditure on Central Government Departments). In other words, a relative spend of a small amount on FOI (0.01% of Government expenditure on Central Government) has the potential to hold Government accountable across the whole extent of its policy range (subject to an exemption, of course).

Similarly, for the Universities. For instance, JISC, the UK's body on information and digital technology in higher education, tracked 36 requests in seven institutions and found that the average cost, including staff time, of answering an FoI request was £121. Extrapolating this research to all FOI costs for the University sector, the cost of FOI can be estimated to be between £2.3 and £9.2 million (or around 16,000 – 40,000 requests across the University sector – if that £121 number is accurate).

But again ask: “What do you get for that money?”. In the UK, there are about 120,000 students paying about £7,000-£9,000 each per year under the new student loan system – that is about £1 billion; the public money spent on Universities by the Treasury is  around £9billion. So it follows that members of the public are contributing £10 billion to University sector; so spending something like £5 million on general public accountability to 25,000 requestors via FOI. This represents about 0.05% of spending in the University sector; pretty good value I would argue.

Of course these numbers (i.e. the 0.01% and 0.05%) I have quoted above are only an approximate guide, but they should be of the correct order of magnitude. They confirm that FOI expenditure is small beer indeed compared with what every taxpayer gains in accountability.

Of course, also, it’s a pain for a University to provide details of why it is doing animal research that has been banned in Germany or why a Minister does not want to publish a health risk assessment (suspected to confirm that the new Health Reforms could destabilise the NHS; yesterday’s veto does not help allay those fears, I should add).

However this is what accountability is all about; it is very uncomfortable at times for those being held to account. So when Ministers use private emails to conduct a public policy debate (to avoid FOI), they really don't like it when an independent regulator says that these emails are still subject to FOI requests.

Once upon a time, making public bodies accountable was central to Government policy. Remember in June 2011, Communities and Local Government Secretary Eric Pickles, stated that he wanted “a new wave of local scrutiny by citizen journalists, microbloggers and armchair auditors” as their role was needed in  “in eliminating waste and inefficiency to deliver value for money to the taxpayer and help protect services”. Isn’t this is what the product of an FOI does in many instances – raise issues of concern?

The Secretary of State even cited cases uncovered by local armchair auditors; for instance in Barnet where “serious deficiencies in procurement arrangements saw the council spend over £1m of taxpayers' money to hire a private security firm with no tendering exercise, contract or proper invoicing. It was and activist bloggers” or in Islington where “many invoices had been paid more than once”.

I would argue that an adjunct of the Pickles’ policy of encouraging “armchair auditors” is to empower them to make follow-up FOI requests, free of charge, about public contracts. If the Government introduces charges for FOIA requests, the Mr Pickles “armchair auditor” idea is finished. Which armchair auditor is going to shell out £10-£15 to follow an accounting trail?

In other words, I think the issue about FOI is simple: if you don’t want public accountability, implement a FOI charging regime. Tony Blair understood that charging undermines FOI – and his memoirs eloquently explained the motive. It appears that this Government is following in Blair’s wake for the same reasons one should add.

Honestly, the final equation is very simple: FOI charging = unaccountability (especially for Central Government).

References

Jack Straw’s evidence session (uncorrected): http://www.publications.parliament.uk/pa/cm201012/cmselect/cmjust/uc1849-v/uc184901.htm

Local Government FOI costs: http://www.lgcplus.com/briefings/corporate-core/legal/cost-of-foi-requests-rises-to-34m/5019109.article

Higher education FOI costs: http://www.timeshighereducation.co.uk/story.asp?storyCode=419674&sectioncode=26

Mori cost evidence: Download Blog May 2011 investigative-study-informing-foia