This summer edition of the Information Law Update considers decisions of interest from June and July 2013. With fewer decisions of note being handed down during the summer season, we have taken the opportunity to include a more detailed consideration of the hot topic of surveillance from Eleanor Grey QC. We also consider two cases which raise issues in relation to disclosure of data by the police as well as returning to the topic of vexatious requests, this time focusing on the approach to the ‘manifestly unreasonable’ test under the Environmental Information Regulations 2004.
The Attorney-‐General’s power of veto
The most notable case of the last few months has been R(Evans) v Attorney General  EWHC 1960 (Admin), in which the Divisional Court upheld the use of the Attorney General’s veto under the Freedom of Information Act and as it applies to the Environmental Information Regulations 2004. The AG vetoed the disclosure of correspondence between HRH Prince of Wales and ministers in seven government departments; the legal challenge to his decision failed. Although the “executive override” represented by the veto has been described as a ‘constitutional aberration’, it could be argued that giving the government the final say in the release of documents under FOIA represented an essential element of the ‘package’ of reforms contained in the Act, and was one of the elements which enabled the Act to come into being. Further, it might also be argued that the power has been used with reasonable restraint, given that it has been used on only six occasions since the Act took effect.
Surveillance: Cameras and Consent
- Surveillance has been a hot topic recently, whether as a result of the ‘Prism’ or ‘Tempora’ revelations about the US’s National Security Agency or the UK’s GCHQ’s activities, or because of recent developments regarding the use of CCTV cameras. As to CCTV, according to a newspaper report 1 of a recent survey by the British Security Industry Association, 5.9 million CCTV cameras are watching us, roughly one for every 10 citizens. This is not an ‘inevitable’ consequence of modern life but a peculiarly British development. Apparently, we have 20% of all CCTV in the world, more official eyes than China. Global retailers fit CCTV into their stores in the UK, while feeling no need to do so elsewhere. Whatever the purpose of a new building is, architects design integral CCTV and a surveillance budget is set aside. The ultra-‐cautious “you never know when...” approach takes over; councils make having CCTV a pre-‐condition of getting a liquor licence, whether dealing with a big city-‐centre nightclub or a quiet village pub. 2 All this sits side by side with a degree of incompetence. The BSIA notes that most private CCTV is a sham; cameras are rarely monitored and badly positioned, more likely to catch the heads of shoppers than their faces.
- So, is it necessary or lawful to record children in youth clubs by (as was apparently the case in a parish in Gloucestershire), streaming the footage to the living room TV of two parish councillors? Practitioners have to date been able to look at the ICO’s CCTV Code of Practice 3 for guidance. But on 4 June 2013, the Home Secretary laid a “Surveillance Camera Code of Practice” 4 before Parliament. The Code came into force on 12 August 2013. It applies to ‘relevant authorities’ as defined by s33 of the Protection of Freedoms Act 2012; that is, mostly local authorities and policing authorities. 5 The Code applies to ‘overt’ surveillance; ‘covert’ surveillance is regulated by RIPA (the Regulation of Investigatory Powers Act 2000). The duty upon relevant authorities is to ‘have regard to’ the Code. Although this is not an absolute duty to follow the Code, a failure to apply its provisions would call for reasoned explanation, and would be taken into account in civil or criminal proceedings.
- Many operators of cameras, including those in the private sector, will fall outside the definition of a ‘relevant authority.’ The Code states that “... the government fully recognises that many surveillance camera systems within public places are operated by the private sector, by the third sector or by other public authorities (for example, shops and shopping centres, sports grounds and other sports venues, schools, transport systems and hospitals). ... the government will keep the code under review and may in due course consider adding others to the list of relevant authorities.”
The Code draws upon the framework of Article 8, ECHR, to suggest that overt surveillance cameras may be used in a public place whenever that use is “in pursuit of a legitimate aim; necessary to meet a pressing need; proportionate; effective; and compliant with any relevant legal obligations”. Such surveillance should be “surveillance by consent”; but that consent must be informed and not assumed by the system operator. There are 12 guiding principles set out by the Code:-‐
“2.6 System operators should adopt the following 12 guiding principles:
- Use of a surveillance camera system must always be for a specified purpose which is in pursuit of a legitimate aim and necessary to meet an identified pressing need.
- The use of a surveillance camera system must take into account its effect on individuals and their privacy, with regular reviews to ensure its use remains justified.
- There must be as much transparency in the use of a surveillance camera system as possible, including a published contact point for access to information and complaints.
- There must be clear responsibility and accountability for all surveillance camera system activities including images and information collected, held and used.
- Clear rules, policies and procedures must be in place before a surveillance camera system is used, and these must be communicated to all who need to comply with them.
- No more images and information should be stored than that which is strictly required for the stated purpose of a surveillance camera system, and such images and information should be deleted once its purpose has been discharged.
- Access to retained images and information should be restricted and there must be clearly defined rules on who can gain access and for what purpose such access is granted; the disclosure of images and information should only take place when it is necessary for such a purpose or for law enforcement purposes.
- Surveillance camera system operators should consider any approved operational, technical and competency standards relevant to a system and its purpose and work to meet and maintain those standards.
- Surveillance camera system images and information should be subject to appropriate security measures to safeguard against unauthorised access and use.
- There should be effective review and audit mechanisms to ensure legal requirements, policies and standards are complied with in practice, and regular reports should be published.
- When the use of a surveillance camera system is in pursuit of a legitimate aim and a pressing need, it should then be used in the most effective way to support public safety and law enforcement with the aim of processing images and information of evidential value.
- Any information used to support a surveillance camera system which matches against a reference database for matching purposes should be accurate and kept up to date.
- A recent example of the need to justify the use of CCTV can be found in the enforcement notice served on 15 July by the ICO, on the Chief Constable of Hertfordshire Constabulary. The ICO declared the CCTV “ring of steel” around Royston, Hertfordshire, unlawful. Seven static Automatic Number Plate Recognition cameras covered the entrances and exits to Royston, recording the number-‐plates of each car that drove in or out. The ICO found that “no satisfactory explanation” of the policy had been given to him. He held that there was a breach of the first data protection principle (fair and lawful processing) and also the third principle (excessive processing). He made explicit reference to Article 8 of the ECHR in reaching this conclusion, holding that there was an unlawful interference with the right to respect for a private and family life. The remedy referred back to the absence of a “satisfactory explanation” for the policy; the CC was to “refrain from processing” the data “except to the extent that that such processing can be justified to the satisfaction of the Commissioner … following the conduct of a Privacy Impact Assessment”. The assessment was to define the “pressing social need”, to assess the effectiveness of the measures in addressing it, the impact on the private lives of individuals and to determine whether the measures were “a proportionate interference”.
Practitioners will recognise the influence of the requirements of Article 8, ECHR, upon these required steps.
Data Protection in the Supreme Court
- In a rare development, the subject of data protection has been considered by the UK’s Supreme Court: see South Lanarkshire Council (Appellant) v The Scottish Information Commissioner (Respondent)  UKSC 55, which considered the Scottish Freedom of Information Act 2002’s equivalent of s40(2), FOIA. The Supreme Court was considering a request for information about the number (but not the identity) of its employees in a particular post at points on the Council’s pay scales. The requestor’s purpose was to investigate whether the appellant’s pay gradings favoured work traditionally done by men. The request was refused on the basis that to release the information would contravene the DPA, but the Scottish Information Commissioner decided that the information should be released. The Council appealed.
The Supreme Court upheld the ICO’s decision. Baroness Hale considered the relationship between Article 8 of the ECHR and Condition 6 of Schedule 2 of the DPA (i.e. the requirement that “the processing [be] necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject”). She stated that:
“It is obvious that condition 6 requires three questions to be answered:
- Is the data controller or the third party or parties to whom the data are disclosed pursuing a legitimate interest or interests?
- Is the processing involved necessary for the purposes of those interests?
- Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?”
Baroness Hale held that:
- The word “necessary” has to be considered in relation to the processing to which it relates. If the processing in question would involve an interference with the data subject’s right to respect for his private life, then the requirements of article 8(2) of the European Convention on Human Rights must be fulfilled. In a case involving Condition 6, the balancing exercise required by Article 8(2) is built into the condition itself; what matters is that the overall result is compliant with the Convention.
- In this case, the identity of the data subjects would not be identified from the disclosures sought; as a result it was “quite difficult to see why there is any interference with their right to respect for their private lives.”
- The meaning of the word “necessary” was clearly established in community law. It means “reasonably” rather than absolutely or strictly necessary, and forms a part of the proportionality test. A measure which interferes with a right protected by community law must be the least restrictive for the achievement of a legitimate aim. “Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less.”
Finally, the Supreme Court noted that the Information Commissioner was bound by the requirements of natural justice when conducting an investigation; this would require disclosure of any new material that was adverse to the interests of the participants, which he had received. It is noteworthy that in Scotland, the Scottish Information Commissioner is the sole finder of facts. There is a right of appeal to the Inner House of the Court of Session, but on a point of law only. That stands in contrast to the wider role of the FTT in England and Wales, which can re-‐hear cases. So the need for the Commissioner to act fairly was of even greater importance in Scotland.
Challenges to the disclosure of data by the police.
- Also from Scotland is the case of Lyons v CC of Strathclyde Police  CSIH 46. The Lyons case demonstrates the many difficulties of using the DPA to challenge the disclosure of information by (here) the police. In this case, the Chief Constable of Strathclyde had twice written to regulatory bodies, to say that intelligence held by the police indicated that Mr Lyons was involved in serious and organised crime, including drug trafficking. Mr Lyons challenged the truth of these disclosures of ‘sensitive’ personal data, saying that he had led “a straight life”. His attempt to use the DPA to stop such disclosures being made was unsuccessful. He suggested that there was a breach of the fourth data protection principle (“Personal data shall be accurate”). But it was held that the police letter was no more than a statement that “the police held intelligence that indicates that the claimant was involved in serious and organised crime.” That was an accurate statement. Furthermore, “a data controller is not required to guarantee that information obtained from a third party [i.e, a police source] and then held by the data controller is factually correct”; the data controller is merely required to take “reasonable steps” to ensure the accuracy of the data, and also to record any objections expressed by the data subject (see paragraph 7 of Part II of Schedule 1, which gives further commentary on the application of the data protection principles).
- An argument might have been developed that this processing was “unfair”, having regard to the requirements of the first data protection principle. After all, the problem for Mr Lyons was that the police were – at least implicitly – giving weight to the allegations they were passing on, but he had no means of knowing their sources: the information was “shorn of any indication where the information came from”. As a result, it would be difficult to question the accuracy or credibility of the information. However, this was not properly pleaded (see paragraph 24 of the judgment), and the Court was not prepared to entertain the point.
- The most recent English case on police powers of retention (rather than disclosure) of information is TD v Metropolitan Police Commissioner  EWHC 2231 (Admin) (25.7.13), in which the Divisional Court upheld the Defendant’s decision to retain information about an allegation of sexual assault on the Police National Computer. The allegation, in respect of which no action was taken against TD by the police, had been retained on the files for nearly 9 years by the time that the case came to court. The police had demonstrated that they would not disclose it to a future employer for the purpose of an Enhanced Criminal Records Certificate, but wished to be able to examine it should another allegation be made against TD or by the same complainant. The Defendant’s guidance for “serious specified offences” (which this potentially was) was that the information would be retained indefinitely.
It was plain that the retention of the information constituted an “interference” with the Claimant’s Article 8 rights; the question was whether it could be justified under Article 8(2). The Court accepted that it was justified, at least at the present time:
“When considering the policy for review and retention the interests at stake may be wider than the rights of the individual concerned and the detection of crime. The striking feature on the claimant’s account of the allegation in this case is that it was fabricated altogether. It is not uncommon in cases alleging sexual impropriety for evidence of a complainant’s history of previous unfounded allegations, disclosed by the prosecuting authorities, to be essential to ensure a fair trial.” .
- But Moses LJ and Burnett J criticised the absence of provision for a review of the necessity of retention; the Defendant’s policy needed to incorporate this.
The general pattern of cases such as TD and the ‘Ring of Steel’ enforcement decision is to link issues under the DPA to an analysis of rights under Article 8, ECHR. Whether this is necessary, given the very specific language and requirements of the DPA, may be questioned. After all, as Baroness Hale observed, in a case involving Condition 6 the balancing exercise required by Article 8(2) is built into the condition itself. So it should not be necessary to conduct a ‘parallel’ exercise by reference to Article 8, ECHR.
The Upper Tribunal
- In the April -‐ May update, we reported on Home Office v ICO and others; John O v ICO (EA/2011/0265/022/0280) and Browning v ICO  UKUT 0236 (AAC), both of which concerned the ‘closed’ procedure of the Information Rights Tribunal. The Upper Tribunal (UT) returned to the subject in the case of FCO v Information Commissioner and Plowden  UKUT 0275 (AAC), in which Judge Jacobs emphasized that the FTT should always ensure that as much evidence as possible is given in open hearing. After evidence has been given in closed hearing, the other party should be told of any evidence that can properly be disclosed. The FTT is entitled to the cooperation of the public authority calling evidence in the closed hearing in achieving these ends. Judge Jacobs reminded the parties that an FTT decision may be set aside if these principles are not observed.
Judge Jacobs further held that the UT will be less reluctant to hold that the FTT has made an error of law in assessing the public interest balance, if the FTT has assessed a policy area in which it has no particular expertise (such as foreign affairs and diplomacy, the subject of the case). Further, an assessment of the public interest balance requires assessment of both the detrimental effects of disclosure and the benefits of disclosure. In this case, the benefits of disclosing information which was ‘not particularly informative’ had to be justified, when set against the high public interest in maintaining the exemption in a case relating to diplomatic exchanges.
Manifestly unreasonable requests.
- In the April-‐May edition of this newsletter, we reported on the IC’s guidance on vexatious requests under s14(1) FOIA. With two new FTT decisions which consider the application of the test for “manifestly unreasonable” requests under the EIR, it is now that test which is under the microscope. The EIR provides no binding definition of the term ‘manifestly unreasonable’ but case law has held it to be coterminous with the term ‘vexatious’ under section 14 FOIA (see Craven v IC & DECC [2012 UKUT 442 (AC) at 30). It is of note, however, that in both of the decisions discussed below, the Tribunal did not agree with the IC’s importation of the FOIA time limits, raising questions about the extent to which the approach taken to vexatious requests under the FOIA should be transposed to requests made under the EIR.
In Yeoman v Information Commissioner (EA/2013/0008) the IC’s approach to this test was overruled by the FTT. The case concerned requests for disclosure, from Cornwall Council, of all ‘section 106 agreements’ (i.e. -‐ agreements between developers and local planning authorities that are negotiated under the Town and Country Planning Act 1990 as part of a condition of planning consent). When reaching the conclusion that the request was manifestly unreasonable, the IC had taken into account:
- the time that it would take the public authority to respond to the requests (the Council estimated that it would take around 28 hours 47 minutes of staff time);
- the effective staff time limit of 18 hours in relation to FOIA applications. There was no similar effective time limit under the EIR, but, the IC felt that the time estimate was so far in excess of the FOIA limit as to render the request ‘clearly unreasonable’; and
- whether the public interest test favoured non-‐disclosure. The IC concluded that given the time involved in meeting the request, this would disrupt the Council’s ‘core duties’.
- The tribunal agreed with the IC’s analysis that the amount of staff time that it would take to respond to the request rendered it manifestly unreasonable. However, the Tribunal did not agree with the IC’s importation of the FOIA time limits. It held that the absence of time limits from the EIR framework was a “fairly compelling indication” that the FOIA time limits were not a pertinent consideration in relation to EIR applications.
- The Tribunal was also critical of the IC's approach to the issue of the public interest. The Tribunal concluded that the IC had considered the public interest too narrowly, focusing only on the interests of the business community. The Tribunal stressed that there was a broader and “manifest public interest” in having the information sought released to the wider public (and not just the business community) so that they would know about the amount of money (or other obligations) associated with section 106 agreements. The public would also be able to check when commitments under section 106 agreements were due to arise and whether developers were honouring their commitments. This was a “core function” of the public authority rather than a distraction.
- The Tribunal found that the IC had wrongly conflated the public interest test with the ‘manifestly unreasonable’ test, finding that length of time involved in answering the request meant that disclosure was against the public interest. The Tribunal stressed that the public interest test is distinct from and not synonymous with the manifestly unreasonable test. Thus, although the Tribunal concluded that, on balance, the request could properly be characterised as manifestly unreasonable, it also concluded that the public interest strongly favoured disclosure. The appeal was allowed and the Council was ordered to respond to the request.
The IC found his application of the ‘manifestly unreasonable’ test overruled again in Silverman v IC (EA/2013/0027), a case decided on the same day and before the same judge. Requests had been made to the Department of Transport for information relating to Mr Silverman’s campaign entitled ‘Clean Highways’. The campaign sought to tackle litter problems on the UK’s road network. The Department of Transport estimated that it would take it around 72 hours of staff time to respond to Mr Silverman’s requests. The Commissioner felt this estimate to be slightly excessive but he did not carry out his own analysis or offer a substitute figure. The Commissioner also considered the following factors:
- the number of previous requests that had been made by Mr Silverman since May 2010;
- the public authority’s positive response to previous representations from Mr Silverman; and
- the unsuccessful nature of the appellant’s application for a litter abatement order in proceedings brought against the public authority.
- The Commissioner concluded that these three points, taken together, meant that Mr Silverman's applications were ‘manifestly unreasonable’. Mr Silverman disputed the Commissioner's conclusions www.39essex.com 7regarding the time it would take to respond to his requests, the conclusion that the requests would be burdensome and the conclusion that the requests were obsessive.
- Applying IC v Devon County Council & Dransfield  UKUT 440 (AC), the Tribunal noted that it was confronted with conflicting evidence on the extent of the burden to the public authority created by the request. It felt unable to provide its own time estimate but, on balance, it concluded that the time incurred in responding to the requests could not be properly characterised as an unreasonable burden. It also repeated its comments on the inappropriateness of importing FOIA time limits to the EIR framework.
- The Tribunal further found that the number of applications (13 over a period of two and a half years) was not excessive “in light of the worthwhile nature of Mr Silverman's campaign”. The Tribunal found the Commissioner’s submissions in relation to the apparently obsessive nature of Mr Silverman's requests to be muddled and unpersuasive. It also rejected the conclusion that the failed application for a litter abatement order had any notable relevance. Finally, it noted the fact that Mr Silverman had made a number of FOIA and EIR applications following this appeal which had been answered without complaint. This undermined the suggestion that his requests had reached a level where they could be objectively characterised as obsessive. Consequently, the Tribunal unanimously concluded that Mr Silverman's requests could not be properly characterised as manifestly unreasonable. The appeal was allowed and the DoT ordered to respond to the appellant’s enquiries.
- Interestingly, in reaching its decision, the Tribunal placed significant weight on what it considered to be the “decent worthwhile” nature of Mr Silverman’s campaign which it considered to have a “serious aim and purpose which was of general benefit to the whole community”, perhaps suggesting that a campaign which was not considered as worthy or ‘decent’ (or uncontroversial?) may be subject to a different approach from the Tribunal.