Showing posts with label Freedom of Information. Show all posts
Showing posts with label Freedom of Information. Show all posts

Tuesday, 11 January 2022

Information Rights - Driver v Information Commissioner

Ramsgate Sands in 1854
Artist William Frith 

 













First Tier Tribunal (General Regulatory Chamber) (Upper Tribunal Judge Rintoul, J Randall and Raz Edwards) Driver v Information Commissioner and another [2021] UKFTT 2017-0218 (GRC)

In his preface to the white paper Your Right to Know (Cm 3818), the then Prime Minister, Tony Blair, introduced his government's proposals for a Freedom of Information Bill as one of several important constitutional reforms.  Others included the Human Rights Bill,  devolution statutes for Scotland and Wales and the Data Protection Act 1998.  The government's intention was to redefine its relationship with the governed.

S.1 (1) of the Freedom of Information Act 2000 states that:
"Any person making a request for information to a public authority is entitled—
(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and
(b) if that is the case, to have that information communicated to him."

However, those rights are subject to several exceptions pursuant to s.1 (2) and s.2 (1), (2) and (3) (g) of the Act. One of those exceptions is s.41:

"(1) Information is exempt information if—
(a) it was obtained by the public authority from any other person (including another public authority), and
(b) the disclosure of the information to the public (otherwise than under this Act) by the public authority holding it would constitute a breach of confidence actionable by that or any other person.
(2)  The duty to confirm or deny does not arise if, or to the extent that, the confirmation or denial that would have to be given to comply with section 1 (1) (a) would (apart from this Act) constitute an actionable breach of confidence."
In Higher Education Funding Council for England v Information Commissioner and another (unreported, 13 Jan 2010). the Information Tribunal held that a public authority seeking to rely on that exception would have to show that the disclosure would be likely to give rise to a successful action for breach of confidence:
“Our conclusion on this part of the case, therefore, is that the HEFCE must establish that disclosure would expose it to the risk of a breach of confidence claim which, on a balance of probabilities, would succeed. This includes considering whether the public authority would have a defence to the claim.  Establishing that such a claim would be arguable is not sufficient to bring the exemption into play.”

An example of such a claim was  Driver v Information Commissioner and another   [2021] UKFTT 2017_0218 (GRC).

The information in question was the identity of certain claimants and the amounts paid to each of them in an out of court settlement with a local authority that had banned the transport of live animals through its port in contravention of EU law.  Those claimants had successfully challenged the ban in the Chancery Division on the grounds that it breached art 35 of the Treaty on the Functioning of the European Union.  They subsequently claimed damages for losses occasioned by the ban.  

 A local resident who had opposed live animal exports asked the authority for the above information under s.1 (1) of the Freedom of Information Act 2000. The authority declined on the ground that disclosure of that information would be an actionable breach of confidence. The resident asked the Information Commissioner to intervene.  The Commissioner sided with the local authority.  The resident appealed successfully against the Commissioner's decision to the General Regulatory Tribunal.  The Tribunal held that s.41 did not apply because the withheld information had not been obtained by the local authority (see Driver v Information Commissioner and another [2017] UKFTT 2017_0040 (GRC)).  The Information Commissioner appealed to the Upper Tribunal which allowed the appeal and remitted the case to a differently constituted first instance tribunal (see Information Commissioner v Driver and another [2020] UKUT 333 (AAC)). The Upper Tribunal directed the new tribunal to proceed on the basis that the threshold condition in s.41 (1) (a) of the Act had been satisfied.  That is to say, the claimants’ names constituted information obtained by the public authority from another person.

In the remitted proceedings the tribunal took as its starting point the following passage from the judgment of Mr Justice Megarry (as he then was) in Coco v A N Clark (Engineers) Ltd [1968] FSR 415:

"In my judgment, three elements are normally required if, apart from contract, a case of breach of confidence is to succeed. First, the information itself, in the words of Lord Greene, M.R. in the Saltman case on page 215, must “have the necessary quality of confidence about it”. Secondly, that information must have been imparted in circumstances importing an obligation of confidence. Thirdly, there must be an unauthorised use of that information to the detriment of the party communicating it. I must briefly examine each of these requirements in turn."

The tribunal was satisfied that the information in question was passed to the local authority in the course of negotiations for compensation. The object of those negotiations was to achieve an out of court settlement.  At para [33] of its decision it said:

"There are good reasons of public policy why such negotiations are conducted with an expectation of confidentiality, not least of which is to encourage parties to settle disputes without the need to go to court. These negotiations were, we accept, carried out on a without prejudice basis. That, in turn, prevents the parties from revealing later what was discussed. The corollary of that is to impose a duty of confidentiality as, otherwise, the basis of without prejudice communications would be undermined. We find that is so irrespective of the fact that there was no express agreement to keep matters confidential; that was not necessary given the nature of the negotiations."

The resident had submitted that the information was not confidential because the identities of the claimants were well known.  They may have been witnesses in previous litigation.  Their names, photographs and videos had been circulated over the internet. That was true but what that evidence did not do was "identify with any certainty any entity, real or corporate, as having been in receipt of compensation or, importantly, the amount paid to each."  Accordingly, the confidential nature of the information had been retained and the obligation of confidence had not been waived.  The tribunal was satisfied that the information had "the necessary quality of confidence about it" and had been "transmitted in circumstances importing an obligation of confidence."

Turning to the question of detriment, the tribunal said at [42]:

"We consider that there is a detriment in the disclosure of withheld material in that the material was supplied on the basis that it was to be kept confidential. The parties clearly proceeded on that basis. The fact that they had done so, and had suffered loss, is something that they wished not to be known."

The tribunal reminded itself that its role was to consider only if it was more likely than not that a court would find a breach of confidence. Given the particular circumstances in which the information had been imparted and the relationship of trust that that would have been created, the disclosure of the information to the resident would have met the detriment requirement.

The tribunal acknowledged that there are circumstances in which the public interest outeights the obligation of confidence.  In this case, there was a significant weight to be attached to the public interest in keeping confidential negotiations undertaken on a without prejudice basis. All the parties who had entered into those negotiations did so on the assumption that they would be kept confidential. It was an assumption they were rightly entitled to hold.  The tribunal accepted that the public was entitled to know how its money was spent and to whom, but the amount of the settlement and the reason for entering it was already in the public domain.  There was no need to disclose more.  The tribunal concluded at [51] that the withheld material was exempted information by operation of s.41.

Anyone wishing to discuss this article may call me on 020 7404 5252 or send me a message through my contact form.

Monday, 25 June 2018

What is meant by the "Applied GDPR"

Jane Lambert











The term the "applied GDPR" is defined by s.3 (11) of the Data Protection Act 2018 as  the GDPR as applied by Chapter 3 of Part 2 of the Act.  According to s.4 (3) Chapter 3 applies to certain types of processing of personal data to which the GDPR does not apply and makes provision for a regime broadly equivalent to the GDPR to apply to such processing.   S.22 (1) of the Act provides that the  GDPR applies to the processing of personal data to which Chapter 3 applies as if its articles were part of an Act of Parliament.

Processing to which Chapter 3 applies
S.21 provides that Chapter 3 applies to:

  • automated or structured processing of personal data in the course of an activity that:
    • falls outside the scope of EU law; or
    • is carried out by a member state in relation to the EU's common foreign and security policy but does not fall within law enforcement as that is covered by Part 3 or processing by intelligence services which is covered by Part 4 (s.21 (1)); and
  • manual unstructured processing of personal data held by certain public authorities (s.21 (2)).
S.22 (1) extends the GDPR to the processing of personal data to which Chapter 3 applies as if the GDPR's articles were part of an Act of Parliament for the whole UK.   The explanatory note explains that Chapter 3 applies to manual unstructured processing of personal data held by certain public authorities because such processing was regulated by the Data Protection Act 1998 but not by the GDPR. The public authorities concerned are defined by s.21 (5) as public authorities as defined by the Freedom of Information Act 2000 or Scottish public authorities as defined by the Freedom of Information (Scotland) Act 2002.

Modifications to the GDPR
The GDPR that apply to the processing to which Chapter 3 applies are modified by Part I of Sched. 6 to the Act. That part consists of 72 paragraphs most of which modify articles of the GDPR. For instance, art 2 of the GDPR provides:

"Material scope
1. This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.
2. This Regulation does not apply to the processing of personal data:
(a) in the course of an activity which falls outside the scope of Union law;
(b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU;
(c) by a natural person in the course of a purely personal or household activity;
(d) by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.
3. For the processing of personal data by the Union institutions, bodies, offices and agencies, Regulation (EC) No 45/2001 applies. Regulation (EC) No 45/2001 and other Union legal acts applicable to such processing of personal data shall be adapted to the principles and rules of this Regulation in accordance with Article 98.
4. This Regulation shall be without prejudice to the application of Directive 2000/31/EC, in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive."
Para 7 substitutes the following provision for art 2 of the GDPR in relation to the processing to which Chapter 3 applies:
“2  This Regulation applies to the processing of personal data to which Chapter 3 of Part 2 of the 2018 Act applies (see section 21 of that Act).”
Supplementary Provisions
As I noted in The Relationship between the Data Protection Act 2018 and the GDPR 20 June 2018, S.4 (2) of the Act provides for Chapter 2 of Part 2 to applies to the types of processing of personal data to which the GDPR applies by virtue of art 2 of the GDPR.  I discussed the provisions of Chapter 2 in my article.  Chapter 2 also applies to the applied GDPR as it applies to the GDPR by virtue of s.22 (2) but Part 2 of Sched. 6 modifies Chapter 2 of Part 2 in respect of those applied GDPR pursuant to s.22 (4) (b).

Interpretation of the Applied GDPR
S.22 (5) of the Act provides:
"A question as to the meaning or effect of a provision of the applied GDPR, or the applied Chapter 2 , is to be determined consistently with the interpretation of the equivalent provision of the GDPR, or Chapter 2 of this Part, as it applies otherwise than by virtue of this Chapter, except so far as Schedule 6 requires a different interpretation."
Rule Making Powers
S.23 (1) enables the Secretary of State to make regulations in relation to the processing of personal data to which Chapter 3 applies.

Manual Unstructured Data
S.24 makes certain modifications to the applied GDPR in relation to unstructured data held by public authorities as defined by the Freedom of Information Act 2000 or Scottish public authorities as defined by the Freedom of Information (Scotland) Act 2002.

Exemptions
Exemptions are made for manual unstructured data used in longstanding historical research by virtue of s.25, and national security and defence pursuant to  s.26, s.27 and s.28.

Further Information
Anyone wishing to discuss this article or data protection generally should call me during office hours on +44 (0)20 7404 5252 or send me a message through my contact form.