Author Archives: Alistair Sloan

When is a filing system a relevant one?

Yesterday, the Court of Appeal (England and Wales) delivered a fresh judgment in the field of data protection. In its judgment in Dawson-Damer v Taylor Wessing LLP [2020] EWCA Civ 352, the Court (Lord Justice Floyd, Lord Justice Newey and Lord Justice Arnold) considered two issues: (1) the exemption in paragraph 10 of Schedule 7 to the Data Protection Act 1998 relating to legal professional privilege; and (2) the meaning of a “relevant filing system” within section 1(1) of the Data Protection Act 1998. Although this case was concerned with the 1998 Act rather than the GDPR and Data Protection Act 2018, the guidance provided by the Court of Appeal will be of assistance when dealing with the current data protection landscape.

In this blog post I intend to focus only on the issue of a relevant filing system and not on the legal professional privilege. I may, should time permit, come back to the issue of Legal Professional Privilege in the near future.

In the court below, the judge decided that 35 paper files held by Taylor Wessing LLP constituted a relevant filing system and therefore the personal data contained therein were within scope of a subject access request. Every data protection practitioner’s favourite case (Durant v Financial Services Authority) was, of course, a feature of this latest judgment from the Court of Appeal. The Court decided, however, that the decision of the Court of Justice of the European Union in Tietosuojavaltuutettu had changed the landscape somewhat and that the decision of the Grand Chamber was inconsistent with the interpretation of “relevant filing system” in Durant. The Court of Appeal considered that the approach in Durant was “in some respects, more restrictive and cannot be fully reconciled with the CJEU’s interpretation.” [para 88]

At Paragraph 90 of its judgment, the Court of Appeal, sets out four questions that it considers should be asked in light of the CJEU’s decision in Tietosuojavaltuutettu. Those questions are:

1. Are the files a “structured set of personal data”?
2. Are the data accessible according to specific criteria?
3. Are those criteria “related to individuals”?
4. Do the specific criteria enable the data to be easily retrieved?

The Court of Appeal endorsed the “temp test” set out by the Information Commissioner in her guidance. That test explains the concepts by reference to the employment by a controller of a temporary administrative assistant. Would such a person be able to extract specific information about an individual from the controller’s manual records without any particular knowledge of the controller’s type of work of the documents held by a controller. The test does assume that the temp in question is reasonably competent, required on a short induction, explanation and/or operating manual on the controller’s particular filing system in order for them to be able to use it. In essence, if a temp could easily extract information from a controller’s filing system without any real skill or knowledge (beyond competence and basic introductory training), then the filing system is likely to be a “relevant filing system”

In Dawson-Damer, a trainee solicitor and a senior associate had been utilised in order to go through the paper files in order to extract the information. The Judge had relied upon this as a reason why it was a relevant filing system; this was an error, the Court of Appeal held. The Court of Appeal stated that “[i]f access to the relevant data requires the use of trainees and skilled lawyers, turning the pages of the files and reviewing the material identified, that is a clear indication that the structure itself does not enable ready access to the data.” [para 99]

It will not be enough to simply use highly skilled individuals in order to leaf through files and extract information to prove that a manual filing system is not a “relevant filing system”; if a temp could have been capable of performing the same work then it will still be a relevant filing system regardless of who actually performed the task. Data Controllers often put tasks like this out to their lawyers and it will often be trainee solicitors, under supervision (as is the case with all tasks performed by trainee solicitors) of experienced solicitors, who carry out these tasks on behalf of clients who elect to send it to their lawyers; simply deciding to do so will not be sufficient to be able to successfully argue that the filing system in question is not a “relevant filing system”. The court is likely to look at the matter objectively and decide whether a temp administrative assistant could have extracted the information had the controller kept the matter in-house. There are good reasons why a controller might wish to out-source the task to lawyers (there is value that a lawyer can add); however, if it’s simply to try and avoid disclosing personal data by arguing that the manual filing system is not a “relevant filing system” then the controller is likely to be out of luck.

It is also important to note that the temp test is more of a rule of thumb than an exacting legal test. It simply acts as a good indicator that the manual filing system is a relevant filing system for data protection purposes. However, in the case before the Court of Appeal, it was of assistance to Taylor Wessing. The Court determined that the Claimant had failed to prove that the filing system was a relevant filing system and that the conclusion reached by the judge at first instance was not supported by the evidence.

Alistair Sloan

We are able to provide advice and assistance to controllers, processors and data subjects in respect of data protection matters. If you would like advice or assistance in connection with a data protection matter, or any other information law concern, then please contact us on 0141 229 0880 or by E-mail to info@inksters.com.

Information Law Review of 2019

Well, it is that time again; the beginning of a New Year and therefore time for my third annual look at what happened in the world of information law in the previous twelve months and what those with an interest in the field should be looking out for in 2020. I would like to begin by wishing all readers of the Information Law Blog, both new and old, a very happy New Year.

My reviews of 2017 and 2018 began by looking at the case of Various Claimants v WM Morrisons Supermarkets Limited. I shall keep the tradition going by looking once again at this case. In 2018, the Court of Appeal dismissed the appeal by Morrisons against the decision of Mr Justice Langstaff holding them vicariously liable for the actions of an ex-employee. This case rumbled on again in 2019, with the Supreme Court hearing an appeal by Morrisons on 6th and 7th November. By the end of 2019, the Supreme Court had not yet issued its judgment and so that will be something to look out for in 2020; the Supreme Court’s judgment (although concerned with the Data Protection Act 1998, rather than the GDPR and Data Protection Act 2018) will have ramifications for data subjects and controllers, regardless of which way it goes.

Brexit continued to be a feature of 2019 in the Information law world. We have seen the changes that will take effect in data protection law as a result of the UK’s withdrawal from the European Union, which is now scheduled to take place at the end of this month. Brexit, however, will not stop being a feature of information law at 23:00 on 31st January (assuming there are no further delays). We will be in a transition period until the end of the year, but we don’t yet know exactly what we’re transitioning to which might start to become clearer by the Summer.

Brexit also featured in the information law world in other respects as well. There are still some data protection and privacy concerns floating around from the 2016 referendum on the UK’s membership of the EU. Indirectly related to that have been proceedings in the Upper Tribunal involving UKIP and in also in the First-Tier Tribunal. If reports are anything to go by, proceedings in the First-Tier Tribunal at the end of 2019 could result in an extremely critical decision against the Commissioner, so that is something to look out for in 2020.

We also saw the first GDPR administrative fine issued in the UK by the Information Commissioner (some 19 or so months after the GDPR became applicable and quite a bit behind other regulators in other EU Member States). The Commissioner has issued two Notices of Intent against two other Controllers (that we’re aware of) both of which were due to expire this month, but it has been confirmed by the Information Commissioner that the statutory six month period has been extended by agreement (in accordance with the statutory provisions). The reasons for this have not been made public at this time.

Just before Christmas the Advocate General of the European Court of Justice gave his opinion in Data Protection Commissioner v Facebook Ireland & Schrems concerning standard contractual clauses. We can expect a decision from the European Court of Justice to follow soon, whether that is before or after “exit day” at the end of January remains to be seen.

In the wider field of privacy law, the Court of Appeal took a look at the judgment of Mr Justice Arnold in the case involving Channel 5’s fly-on-the-wall documentary ‘Can’t Pay? We’ll Take it Away’. The Court of Appeal dismissed the appeals by the Respondents in respect of liability and the cross-appeal by the Claimants on the issue of quantum of damages. Meanwhile, in Scotland, Lord Bannatyne (for the first time) declared that there exists in the law of Scotland a common law right to privacy.

In May, Information Notices were again a feature of the decisions flowing from the First-Tier Tribunal; this time, however, it was concerning the Commissioner’s powers under the Freedom of Information Act 2000. The Tribunal confirmed that the Commissioner can issue an information notice in order to obtain information as part of her process for determining whether a person is a public authority for the purposes of the Environmental Information Regulations 2004.

In 2019, the Scottish Parliament’s Public Audit and Post-Legislative Scrutiny Committee began undertaking Post-Legislative Scrutiny of the Freedom of Information (Scotland) Act 2002. In 2019, I gave both written and oral [pdf] evidence to the Committee. The Committee is expected to release its report and recommendations next month.

In 2019, we saw the expansion of FOI in Scotland with Registered Social Landlords formally being designated as Scottish public authorities for the purposes of the Freedom of Information (Scotland) Act 2002.

We also had one of those rare things: a decision from the Court of Session in an appeal against a decision of the Scottish Information Commissioner. In the sole decision in such an appeal issued by the Court of Session in 2019, my client successfully challenged (on a point of law) a finding by the Commissioner that information he had requested was not held by a local council for the purpose of the Freedom of Information (Scotland) Act 2002. This case provides some useful guidance on determining whether information is held, or not, for the purposes of the Freedom of Information (Scotland) Act 2002.

Alistair Sloan

If you would like advice or assistance with Privacy and Data Protection matters or with UK and Scottish Freedom of Information requests contact our team on 0141 229 0880.

Commissioner Dispenses GDPR Administrative Fine

On 20th December 2019, the Information Commissioner published a Penalty Notice [pdf] it had issued under the Data Protection Act 2018 to Doorstep Dispensaree Limited in the sum of £275,000. While we have had the Marriot and British Airways Notices of Intent, this is the first penalty notice published by the Information Commissioner exercising her powers under the Data Protection Act 2018 and the General Data Protection Regulation to issue administrative fines (formally known in the UK as “Penalty Notices”).

In this case, the Information Commissioner was acting upon information received from another UK Regulator (the Medicines and Healthcare Products Regulatory Agency, or “MHRA”). The MHRA had executed a search warrant under its own regulatory scheme and discovered in a courtyard approximately 500,000 documents containing personal data, all of which were contained in an insecure manner. The MHRA inspected the documents and discovered that they contained personal data and special category personal data. The documents were dated from January 2016 to June 2018 and the condition of them indicated that they had been stored in the courtyard for some time. The Information Commissioner began an investigation; she wrote to the data controller asking a number of questions. The controller responded, via its solicitor; however, its response didn’t answer any of the Commissioner’s questions, but instead it seemed to the Commissioner (as recorded in the penalty notice) that the controller was denying any knowledge of the documents.

The Commissioner followed-up with more information and repeated the questions initially asked. The controller refused to answer those questions and the Commissioner records that it appears as though the Controller was conflating the separate investigation by the Commissioner with the one being undertaken by the MHRA. The Commissioner thereafter issued it with an information notice, which the controller (unsuccessfully) appealed to the First-Tier Tribunal. The Commissioner’s Penalty Notice then records that after the appeal was disposed of by the Tribunal, the controller did not comply timeously with the notice and the Commissioner had to threaten the controller with obtaining an information order and/or issuing a penalty notice.

The controller finally responded to the Information Notice, refusing to provide some information (under section 143(6) of the Data Protection Act 2018) on the basis that providing that information would open the controller up to prosecution by the MHRA in its separate criminal investigation. The controller provided various documents to the Commissioner, most of which were dated from 2015.

The Commissioner ultimately found that the controller’s infringements of data protection law were systemic in nature; the Commissioner pointed to the inadequate and outdated policies and procedures that it had in place. Furthermore, its privacy notice fell far short of what was enquired by Articles 13 and 14 of the GDPR. Interestingly, there appears to be no reference in the Penalty Notice to the early payment discount that was a feature of monetary penalty notices issued by the ICO under the Data Protection Act 1998.

The controller was also issued with an Enforcement Notice [pdf] by the Commissioner; which requires the controller to, among other things, update its internal policies and procedures, appoint a member of staff as an Information Governance Lead or Data Protection Officer, introduce mandatory training and update its privacy notice in line with Articles 13 and 14.

This Penalty Notice contains much that can be of assistance to controllers when it comes to enforcement action under the GDPR. The first point that is worth mentioning is that it is not recommended that controllers do not co-operate with the ICO during investigations. Indeed, controllers (and processors) and their representatives are under a positive duty to co-operate with the Commissioner (Article 31 of the GDPR). In any event, the Commissioner has a range of powers to ensure that she can properly investigate alleged breaches of data protection law; including, the power to issue an information notice, obtain an information order and obtain (and execute) a search warrant. It’s important that where you’re facing multiple regularly investigations simultaneously that you take each one seriously and understand precisely what each regulator is investigating and what their respective powers are.

It also appears that the Commissioner has dropped the early payment discount that used to be offered to controllers to encourage them to pay the penalty notice (an appeal automatically meant that the controller lost the early payment discount, as it would delay payment of the monetary penalty).

Alistair Sloan

We are able to assist data subjects, controllers and processors with data protection law matters, as well as a range of other information law concerns. If you would like to speak to us about an information law matter, then please contact our team on 0141 229 0880 or by E-mail.

We don’t hold it…oh yes you do!

Dr Ian Graham v The Scottish Information Commissioner [2019] CSIH 57 is a rare decision of the Court of Session in an appeal against a decision of the Scottish Information Commissioner, the last one coming almost 12 months ago. The case was considered by the Second Division (with the bench comprising of the Lord Justice Clerk, Lord Malcolm and Lord Glennie) with Lord Glennie delivering the Opinion of the Court.

Before a Scottish public authority is required to release information, it actually has to hold it and information will not be held, according to the law, if it is held by the Scottish public authority on behalf of a third party. The question that was considered in the appeal by Dr Graham was on this fundamental point: whether the Scottish public authority held the information or not; and in particular whether information was held by a Council on behalf of a third party (in this case, the Returning Officer).

In January 2018, Dr Graham requested the following information from Aberdeenshire Council: (1) a list of the contracts called off by the council from the framework agreement, (2) invoice and order copies for each contract, (3) payment confirmation from the council of the invoices and (4) whether the council reclaimed the input VAT on the invoice. The framework agreement in question was for the provision of electoral services to the returning officer. In terms of the contract (and of importance for this appeal), the Council assumed obligations and liabilities under the contract and also had responsibilities and liabilities in respect of the procurement process.

Whilst the Council ultimately released information in relation to parts (3) and (4) of his request, initially the Council also claimed that it did not hold this information for the purposes of the Freedom of Information (Scotland) Act 2002 (“FIOSA”). The Council’s argument was that because a returning officer, although an official from within the council, was legally a separate entity from the rest of the council when acting in their capacity as returning officer, they only held the information on behalf of the returning officer and not in their own right. Dr Graham was dissatisfied with this and applied to the Scottish Information Commissioner for a decision on whether the Council had complied with its disclosure obligations under FOISA. The Commissioner upheld the Council’s decision, determining that the Council did not hold the information for the purposes of FOISA, but rather held it on behalf of the returning officer.

Counsel for the Appellant argued that the word ‘held’ was being submitted to too much scrutiny, as well as drawing attention to the spirit in which the FOISA had been made; that being to make information available to the public. Counsel contended that a liberal approach should be taken to the interpretation of this provision. Reference was made by the Appellant’s Counsel to University and Colleges Admission Service v Information Commissioner [2014] UKUT 0557 (AAC) and Common Services Agency v Scottish Information Commissioner 2008 SC (HL) 184. Counsel for the Appellant further drew upon University of Newcastle v Information Commissioner [2011] UKUT 185 (AAC) to demonstrate how a more common-sense approach was preferable. The broader interpretation of ‘held’ was further supported  by the decision of the Upper Tribunal in Department of Health v Information Commissioner where it was held that a ministerial diary was ‘held’ by a department purely as a historical record for reference purposes. With reference to the current case, he ultimately claimed that the differentiation between the council holding the information for itself or on behalf of the returning officer was immaterial and indeed that both conditions could be fulfilled simultaneously in the present circumstances; with the fine-tooth investigation of the council election laws amounting to little more than prevaricating.

The Court allowed Dr Graham’s appeal, emphasising that “that the relevant provisions of FOISA should, so far as possible, be interpreted in a manner consistent with the policy of the Act, namely the desirability of making information available to the public, all in the interests of promoting open, transparent and accountable government.” [15] The court also held “that the words and expressions used in the Act should, so far as possible, be given their ordinary and natural meaning” and that “[t]here should be no scope for the introduction of technicalities, unnecessary legal concepts calculated to over-complicate matters and, by so doing, to restrict the disclosure of relevant information.” [15].

The Court approved of and agreed with the reasoning given by the Upper Tribunal at paragraphs 21-22 of its decision in University of Newcastle. In essence, a Scottish public authority will hold information if it has more than a de minimis interest in the information. That is to say, it will only fall outside of the scope of FOISA if it has “no (or no material) interest of its own” in the information. [18] As a result of the Court’s decision, it reduced the Commissioner’s decision and remitted the matter back to him so that he could reconsider Dr. Graham’s application in light of its opinion.

The effect of this decision should be to widen the scope of information that is available to the public under FOISA. Scottish public authorities and the Commissioner will be required to take a more holistic approach in future to deciding whether information is only held by the Scottish public authority on behalf of a third party. A more practical approach requires to be taken than simply looking at whether the Scottish public authority and the third party are separate entities from one another; consideration must be given to the underlying factual matrix. The opinion of the Court also re-iterates previous comments by the courts that the Act should be interpreted in a way that isn’t too complex or technical.

Our Alistair Sloan acted for the successful appellant in this case, instructing John MacGregor, Advocate.

Danny Cummins (Trainee Solicitor)

If you would like advice or assistance in respect of a Freedom of Information matter or a data protection/privacy issue then contact us on 0141 229 0880 or you can send us an E-mail.

Penalty Notices and Notices of Intent

Yesterday there was a great deal of excitement as some news outlets reported that British Airways had been fined £183m by the Information Commissioner’s Office. It became apparent fairly quickly that this wasn’t what had happened and that we are still waiting for the Commissioner to issue the first “penalty notice” for a breach of the General Data protection Regulation.

What did come to light yesterday was that the Commissioner had issued a notice of intent to British Airways giving them notice that she intends on issuing a penalty notice in the sum f £183m. This is not the first time where news of a notice of intent has resulted in reporting that the Commissioner had actually issued a financial penalty. The last time was when she issued Facebook with a notice of intent in respect of a pre-GDPR breach (a penalty was subsequently served on Facebook in the sum of £500,000 and that penalty is currently the subject of an appeal to the First-Tier Tribunal).

There is quite a bit of difference between a notice of intent and a penalty notice (formally known as a monetary penalty notice in the Data Protection Act 1998) and they shouldn’t be confused with one another. So, given the confusion, I thought I might write a brief guide to the process adopted in the UK in respect of administrative fines under the GDPR and the Law Enforcement Directive.

The process essentially begins with the Commissioner opening an investigation. This could be as a result of a mandatory breach notification by the controller, a complaint made by a data subject or  it having come to the attention of the Commissioner in some other way (for example, via the media). The Commissioner then enters into an information gathering phase, and she has the power to compel (subject to appeal and some other limited exceptions) data controllers to provide her with information by issuing an information notice should data controllers refuse to engage with her office.

At some stage the Commissioner will decide whether enforcement action is appropriate in the particular case. There will have been a dialogue of sorts going on between the Commissioner’s office and the controller during the information gathering phase. A financial penalty is not the only option available to the Commissioner. If the Commissioner decides that an administrative fine (in GDPR language, or “penalty notice” in the language of the Data Protection Act 2018 (“DPA2018”)) might be the appropriate means to deal with the breach, then she is required by Paragraph 2(1) of Schedule 16 to the DPA2018 to the to give written notice to the controller of her intent to do so; this is known as a “notice of intent”. This notice must contain certain information, which is set out in paragraph 3 of Schedule 16 to the DPA2018.

The notice of intent is an important step because, by virtue of paragraph 3(4) of Schedule 16, the notice of intent must contain details of a period in which the controller can make written representations to the Commissioner; this period must not be less than 21 days. The Commissioner is prohibited from serving a penalty notice until this period has expired (paragraph 4(1) of Schedule 16). Furthermore, before deciding to issue a penalty and before finally deciding upon the amount of any penalty, the Commissioner must consider any written or oral representations made by or on behalf of the controller (paragraph 4(2) of Schedule 16).

Essentially, the notice of intent forms part of the due process of law. The Commissioner sets out in the notice the basis upon which she believes a penalty notice is appropriate and the proposed amount of the penalty notice. The controller then has an opportunity to make its case to the Commissioner and put forward a legal or factual case which:- (a) argues that no penalty notice should or can be given; (b) challenges proposed findings in fact contained within the notice of intent; and/or (c) challenge the proposed amount.

When the commissioner issues a notice of intent, she (and her office) must continue to have an open mind. It is not simply a tick-box exercise; it is an important part of a formal legal process. The Commissioner must be open to being persuaded by the controller that she is wrong in any of the matters set out in the notice of intent; including, being persuaded that the legal tests for issuing a penalty notice has not been met.

A notice of intent is certainly not (or shouldn’t be) a guarantee that a penalty notice will follow, or that it will be in the amount specified in the notice of intent. It is no more than a formal document giving notice to a controller of the Commissioner’s intentions and forms part of the legal process for issuing an administrative fine.

Once a notice of intent has been served by the Commissioner, she is normally required to issue the penalty notice within 6 months (paragraph 2(2) of Schedule 16); this includes the time permitted for written, and where applicable, oral representations. However, this period can be extended where the Commissioner and the controller agree (paragraph 2(3) of Schedule 16)

Appeals
Unlike a notice of intent, a penalty notice is subject of a right of appeal to the First-Tier Tribunal. In such an appeal all of the relevant factual and legal matters are reconsidered by the Tribunal. The Tribunal is empowered to uphold the penalty notice, modify the penalty notice or quash the penalty notice. Thereafter, there are appeals (but not as of right, only with permission) to the Upper Tribunal and the courts on points of law. Failures within the notice of intent procedure would give rise to grounds of appeal in respect the penalty notice. Depending upon the nature of the defects they could ultimately lead to the Tribunal quashing the Penalty Notice.

“One Stop Shop”
One final thing of note is that the Information Commissioner is acting as the “lead supervisory authority” in the British Airways matter; this is a mechanism which exists in the General Data Protection Regulation and applies so long as the United Kingdom remains a member of the European Union. Other supervisory authorities from elsewhere in the EU will also have the opportunity to comment on the Commissioner’s enforcement action in this case. This is an important aspect to note in relation to all enforcement action, not just penalty notices. Before taking a final decision in the British Airways case the Information Commissioner will have to circulate a draft of her decision to those other supervisory authorities, who are then permitted to make comments; the Commissioner must take these comments into account. This mechanism applies where there is cross-border processing taking place (see Article 4(23) of the General Data Protection Regulation for a definition of “cross-border processing”), which was the case in repsect of the British Airways data breach.

Alistair Sloan

We are able to assist data subjects, controllers and processors with data protection law matters, as well as a range of other information law concerns. If you would like to speak to us about an information law matter, then please contact our team on 0141 229 0880 or by E-mail.

Dealing with vexatious FOI Requests

The call for views by the Public Audit and Post-Legislative Scrutiny Committee of the Scottish Parliament (“the Committee”) in respect of its post-legislative scrutiny of the Freedom of Information (Scotland) Act 2002 (“FOISA”) ended on 21 June 2019 (having been extended a couple of times). One of the issues that came up on a number of occasions in the Committee’s discussions and evidence sessions prior to formally deciding to undertake post-legislative scrutiny of FOISA was the issue of vexatious requests. This issue has come up again in a number of responses to the call for views provided by Scottish public authorities (but certainly not all those Scottish public authorities that submitted responses).

It does seem as though Scottish public authorities, generally, are fairly poor at utilising section 14 of FOISA, which provides that a Scottish public authority does not need to comply with a request for information where it is vexatious. The Scottish Information Commissioner has also expressed the view that authorities are not utilising the available provisions within FOISA to deal with vexatious requests, such as at an evidence session before the Committee on 10 January 2019 [pdf].

The response of by Glasgow City Council [pdf] provides an example of a single requester who has made around 100 FOI requests on a related topic. It strikes me that requests from this particular requester on this particular topic could very well fall within the ambit of section 14 (although, I make that comment with only that information which is available from Glasgow City Council in its response). While the law requires the request to be vexatious, rather than the requester themselves, it is permissible to look at the requester’s conduct towards, previous correspondence with and previous requests to the authority in determining whether a particular request that has come in is, in fact, vexatious. This is something that Scottish public authorities seem to struggle with and often seem look at a particular request in isolation and not necessarily consider the wider background and context.

The leading case on section 14 of FOISA, Beggs v Scottish Information Commissioner, was only decided at the end of 2018 and therefore prior to that there was no authoritative guidance on the application of section 14 of FOISA. However, the Scottish Information Commissioner and Scottish public authorities have looked to Dransfield v Information Commissioner to help with the application of section 14 of FOISA. In Beggs the Inner House of the Court of Session essentially approved of the decision of the Court of Appeal in Dransfield. The decision in Beggs is, subject to any appeal to the UK Supreme Court, binding authority on the operation of section 14 of FOISA. Scottish public authorities can therefore look to both the Judgment of the Court of Appeal in Dransfield and the opinion of Lord Brodie in Beggs for guidance on section 14 of FOISA and how to apply it in appropriate cases.

The Court of Appeal and the Inner House of the Court of Session have both stressed that the right of access to information is a constitutional one and so the bar for engaging section 14 is a high one. However, it is clear that the bar is not so high so as to be impossible to meet in practice.

Section 14 of FOISA allows Scottish public authorities to consider matters that would not normally be relevant to FOI requests, such as the identity of the requester and their motives. Scottish public authorities (and indeed, public authorities working under the Freedom of Information Act 2000) should remember that they can look at a requester’s motives; for example, a malicious motive can be an indicator that a request is vexatious (but is not necessarily evidence that the request is, in fact, vexatious): Beggs at paragraph 33. Equally, the absence of a malicious motivation is not necessarily evidence that the request is not vexatious.

A person’s previous dealings with an authority can be relevant as can their other FOI requests: if a person is showing signs of obsessive behaviour, then that could be an indicator that the request is vexatious. The authority needs to look at the request objectively, in the surrounding circumstances, and come to a judgement as to whether the request is vexatious. However, it will need to remember to have evidence to support its conclusion in case the requester makes an application to the Commissioner challenging the application of section 14 by the authority.

Perhaps there is concern within authorities about getting it wrong and having a section 14 refusal overturned by the Commissioner; however, we can only learn from doing and from our mistakes. There are 96 decision notices on the Scottish Information Commissioner’s website relating to section 14(1) of FOISA (the specific part of section 14 that deals with vexatious requests). This number does seem to be rather small given that wide opinion coming from Scottish public authorities over many years that vexatious requests are a particular problem. Over 50 of those decision notices find entirely in favour of the authority and a good number are classified as partially upheld (many of which appear to have included technical defaults by the authority). It is clear that where a Scottish public authority appropriately deploys section 14 in respect of vexatious requests, the Commissioner will uphold that decision.

It certainly does seem to be the case that Scottish public authorities are reticent to utilise section 14 of FOISA. Perhaps, it is because they do not fully understand the scope of section 14 or are unsure about its precise application – it can potentially be used in a wide variety of circumstances. Scottish public authorities could certainly be using section 14 much more frequently than what they are at present and they should seek to become much more confident in using section 14. Indeed, a majority of the examples that I have seen emanate from Scottish public authorities, which they put forward as examples of problems that they are facing which cannot be dealt with by the application of section 14; most probably could, in fact, have been dealt with by the application of section 14. The same level of reluctance is not obviously present in respect of those authorities subject to the Freedom of Information Act 2000.

Alistair Sloan

If you are a requester or a public authority who would like advice or assistance in regards to freedom of information law then contact our team on 0141 229 0880 or by E-mail. We are also able to assist with a range of other information law matters.

Privacy, the common law and Scotland

In a recent opinion from Lord Bannatyne (B C and Others v Chief Constable Police Service of Scotland and others [2019] CSOH 48), sitting in the Outer House of the Court of Session, we have the first express statement that there is a right of privacy at common law in Scotland. Traditionally in Scotland, privacy law has been dealt with through the European Convention on Human Rights, the Human Rights Act and data protection law.

This case involved a number of police officers who are facing disciplinary proceedings by the Police Service of Scotland for alleged misconduct which is founded upon a number of messages sent via WhatsApp. The messages came into the possession of the professional standards department having been discovered on the phone of an officer who was being investigated in connection with alleged sexual offences.

The messages in question were characterised by Senior Counsel for the Police Service of Scotland in her written submissions as being “on any view, blatantly sexist and degrading, racist, anti-semitic, homophobic, mocking of disability” and included “a flagrant disregard for police procedures by posting crime scene photos of current investigations.” [para 166] Lord Bannatyne believed that it was “a characterisation which a reasonable person having regard to the content of the messages would be entitled to reach. I conclude that the content of the messages can be regarded as potentially informing the issue of breach of Standards in circumstances calling into question the impartial discharge of the petitioners’ duties.” [para 166]

In terms of the common law right to privacy, the starting point for Lord Bannatyne was the relationship between the Human Rights Act 1998 and the Common Law. He quoted Lord Reid, with approval, in R (Osborn) v The Parole Board at paragraph 57 of that judgment. From that passage Lord Bannatyne concluded that if the right to privacy exists at common law, Article 8 of the convention does not supersede it. Lord Bannatyne noted that the European jurisprudence could be used to help inform and develop a common law right to privacy.

He then went on to ask whether there was a justification for a right to privacy in the common law. He cited, with approval, the words of Lord Nicholls at paragraph 12 of the judgment in Campbell v MGN Ltd. Lord Bannatyne thought that the right to privacy could “be described as a core value and one which is inherent in a democratic and civilised state.” [para 106]. He continued:

“[it] seems to flow from the centrality of the role of privacy in a democratic society and particularly in a society where electronic storage of information and electronic means of intrusion into the private lives of a citizen by government, private organisations and individuals are growing exponentially the common law should recognise the right to privacy.” [para 107]

Lord Bannatyne considered that the English authority on the point was of assistance. In England and Wales the common law on privacy has been developed in the context of the development of the law on breach of confidence. Scotland also has a concept of breach of confidence, which is a well understood remedy and it has been explicitly accepted previously that the law in Scotland in respect of breach of confidence is the same as the law in respect of breach of confidence in England and Wales (see, for example, Lord Advocate v Scotsman Publications).

At paragraph 116 of his opinion, Lord Bannatyne observed “that given privacy is a fundamental right I think it highly likely that it exists in the common law of Scotland.” He also noted that it was “inherently unlikely” that Scottish and English law in relation to this fundamental matter are entirely different.

Finally, he considered the existing case law in Scotland (to the extent that there is any) tended to support the view that such a right exists in the law of Scotland. He also found it “noteworthy” that none of the cases to which he was referred expressly or implicitly stated that there was no common law right to privacy in Scotland.

Lord Bannatyne went on to consider that the Petitioners could have “no reasonable expectation of privacy” flowing “from the attributes which arise as a result of their position as constables.” [para 166] It is not the case that police officers, as a result of their position, have no right to privacy at all, but, rather, that this right is limited. Lord Bannatyne opines that the limitation can be defined in the following way: “f their behaviour in private can be said to be potentially in breach of the Standards in such a way as to raise doubts regarding the impartial performance of their duties then they have no reasonable expectation of privacy.” [para 168] A police officer, because of the attributes of a person holding the office of constable, is in a different position to an ordinary member of the public. [para 168]

The remaining issues that had to be dealt with by Lord Bannatyne were dealt with in, comparably, fairly short compass. Lord Bannatyne held that “there is a clear and accessible basis for the disclosure [by the police, as a public authority, to the professional standards branch of Police Scotland] in the circumstances of this case.” [para 192] He also held that the disclosure decision was not an arbitrary one. [para 192]

Lord Bannatyne also held the interference was necessary, in accordance with Article 8(2) of the Convention. He did not agree that all of the matters listed in Article 8(2) were engaged, but did hold that ‘public safety’ and ‘the prevention and detection of crime’ were engaged. [para 198] In terms of the balancing exercise to be carried out, Lord Bannatyne considered that the balance was“heavily weighted on the side of disclosure” and he was “unable to identify a less intrusive measure which could have been used without unacceptably comprising the objectives [he had] identified.” [para 201]

Finally, in respect of interdict, Lord Bannatyne held that even if he had been with the Petitioners he would nevertheless have held that the Petitioners were not entitled to the interdict which they sought. [para 202]

This is an important case as it is the first time that a Scottish court has expressly declared that there is a common law right to privacy in Scotland. That, however, has to be tempered with the fact that it is a decision of the Outer House and therefore only of persuasive authority in the Court of Session and lower courts. A different Lord Ordinary (or a Sheriff) may ultimately reach a different conclusion (although, I think that unlikely). Although, the Petitioners were right on this point, they ultimately lost the case and the petition was refused. Therefore there may well be a reclaiming motion (appeal) to the Inner House and this point may well be considered and decided upon by the Inner House. This would give us binding authority which all the lower courts in Scotland would be required to follow stating that there is a common law right to privacy in Scotland.

The decision will certainly add an additional tool to the armory of individuals who are concerned about their privacy and breaches thereof; it will also be another angle which those advising on issues of privacy will have to consider. We may begin to see more cases proceed on the basis of a breach of the common law right to privacy as opposed to cases proceeding on breaches of convention rights and data protection law.

Alistair Sloan

If you would like advice in connection with any privacy matter, or any other information law matter; contact our team on 0141 229 0880 or by E-mail. You can also follow our dedicated Information law twitter account.

Domestic CCTV and Data Protection

There was a time where CCTV systems were of a very poor quality and were rather expensive and were therefore limited to commercial premises. However it is now possible to get reasonably good quality CCTV cameras for less than £20 and as such there has been a steady rise in the number of homeowners installing CCTV cameras to help with home security.

Article 2 of the General Data Protection Regulation (GDPR) sets out the Regulation’s material scope; it includes a carve-out for processing of personal data “by a natural person in the course of a purely personal or household activity.” This replicates the language of the Directive which the GDPR replaces and which was reflected in section 36 of the Data Protection Act 1998 (the “domestic purposes” exemption).

On the face of it a home operated CCTV system seems to fall squarely within the scope of the carve-out for personal and household activities in Article 2 of the GDPR; however, the case law which interpreted the old Directive adds some complexity to matters. The placing of a home CCTV system is of particular importance; in particular, what is caught by the camera. If the camera is placed incorrectly then it can result in individuals falling outside of the carve-out in Article 2 of the GDPR and becoming a controller; with all of the liability and responsibility that this entails.

Domestic CCTV can be particularly useful in situations where there are neighbour disputes or where there is allegations of harassment; however, equally these are situations where a particular risk in terms of data protection law enters into the equation.

The issue of the use of domestic CCTV is something that I am increasingly being asked to advise on by clients; both the owners of the CCTV system and their neighbours. Invariably, there are issues that require to be resolved about the use of the domestic CCTV systems in these circumstances.

The matter has never been tested under the GDPR; however, given that the relevant provisions are substantially the same it seems likely that the cases decided under the older Directive and the now repealed Data Protection Act 1998 remain of relevance and will very likely be followed by the courts. Care should therefore be taken when installing domestic CCTV systems to ensure that you can continue to rely upon the domestic purposes exemption and not accidentally incur liability to third parties. People are becoming increasingly more privacy aware and concerned and as such it is becoming more important for domestic CCTV users to become aware of the limits of the domestic purposes exemption and how to avoid incurring liability under data protection laws.

Alistair Sloan

If you require advice and assistance in respect of the use of CCTV by individuals or business; or any other data protection or privacy law concern; then you can contact our team on 0141 229 0880 or by E-mail to info@inksters.com. You can also follow our dedicated information law twitter account for news and updates on a range of information law matters.

Cart before Horse

E.ON UK Plc v The Information Commissioner and Fish Legal [2019] UKUT 132 (AAC) is an appeal to the Upper Tribunal (Administrative Appeals Chamber) concerning an issue that doesn’t come up very often in information rights litigation: the Information Commissioner’s power to issue an Information Notice under section 51 of the Freedom of Information Act 2000 (“FOIA”).

The background to this appeal is a little convoluted, but of importance to understanding the issues and the decision of the Upper Tribunal. The solicitor of Fish Legal made a request for information to E.ON UK Plc seeking information from it. The information sought was environmental information and so the request fell to be dealt with under the Environmental Information Regulations 2004 (“EIRs”). E.ON UK Plc disputed that it was not a public authority and so did not issue a substantive response to the request. It became clear during the Commissioner’s involvement that the position of E.ON would be that, if it were a public authority, it did not hold the information.

As there was a dispute as to whether E.ON is a public authority, the Commissioner determined that she needed to resolve that issue first. If E.ON is not a public authority, then she had no jurisdiction to determine whether it held the information in question. After some exchange of correspondence between the Commissioner’s case officer and E.ON, an information notice was served on E.ON. The purpose of this Notice, we learn from the decision of the Upper Tribunal, was to assist the Commissioner in determining whether E.ON UK PLC is a public authority for the purposes of the EIRs.

E.ON appealed to the First-Tier Tribunal (Information Rights) against the information notice. It did so on two grounds: firstly, the decision to issue the information notice was unlawful because, as E.ON did not hold the requested information, it was pointless, disproportionate and academic. Secondly, the information requested in the notice was wholly or mainly in the public domain and so it was unlawful to issue an information notice to require E.ON to provide the information.

The First-Tier Tribunal heard argument and issued what it described as a decision on a preliminary issue, inviting written submissions from the parties as to how the remainder of the appeal should progress. E.ON appealed to the Upper Tribunal and its grounds of appeal are set out by the Upper Tribunal in paragraph 4 of its decision.

What is of most interest in this appeal was the position adopted by E.ON as to the Commissioner’s powers to determine whether the information was held or not. E.ON argued that the Commissioner could consider  whether a purported public authority held the information requested, before deciding whether it was reasonable and proportionate to issue an information notice seeking information to assist the Commissioner in deciding whether the purported authority is, in fact, a public authority. E.ON argued, essentially, that where a purported authority did not hold the information it was unlawful, disproportionate and unreasonable for the Commissioner to issue an Information Notice requiring a body to provide her with information to assist her in determining whether the purported authority was, in fact a public authority.

This argument was, ultimately, given short shrift by Upper Tribunal Judge Markus QC. The Upper Tribunal Judge considered that this “position would lead the Commissioner to a dead end” [47] as “[t]here is no statutory provision which could accommodate the outcome for which [Counsel for E.ON] contended, that being a decision by the Commissioner not to address the public authority question because there was no point in doing so.” [47] The outcome of the position advanced by E.ON before the Upper Tribunal would have simultaneously meant that the Commissioner could not have issued a decision notice under section 50 of FOIA that no information was held, because there was no decision that she had jurisdiction; she could not issue a decision on whether she had jurisdiction because it was pointless, and in any event she lacked the information she required to do so and she could not have refused a to make a decision under section 50 because none of the circumstances in section 50(2) of FOIA applied.

Upper Tribunal Markus QC remarks, paragraph 49 of her decision, that what the First-Tier Tribunal decided at paragraph 24 of its own decision was not that it was unable to decide any matter not determined by the Commissioner, but rather that the question whether the information requested by the applicant was held by the authority was irrelevant in an appeal against an information notice which was directed at establishing whether the Commissioner had jurisdiction. The question as to whether the information was held would be decided, if at all, if the Commissioner had jurisdiction to do so.

E.ON also tried to argue that the section 50 application by the applicant should be treated as being frivolous or vexatious by the Commissioner (thus giving her a reason under section 50(2) of FOIA to refuse to issue a decision notice). This, again, was also based upon E.ON’s position that it did not hold the information. E.ON seemed to be suggesting that it was frivolous or vexatious to press for the Commissioner to determine whether she had jurisdiction when the purported authority had demonstrated that it did not hold the information. The Upper Tribunal disagreed stating that “[t]here is nothing in this case which gets close to meeting the high standard set by vexatiousness” [61] (with reference to the principles set out in the Upper Tribunal and Court of Appeal in Dransfield v Information Commissioner and Devon CC).

What appears to have become lost in these appeal proceedings is that this is an appeal against an information notice and not an appeal against a decision notice. The Tribunal was not concerned with the substantive issue (whether or not E.ON had complied with its obligations under the EIRs, if it has any such obligation at all). E.ON, in this appeal, were getting ahead of themselves; or as the Commissioner reportedly put it “they were putting the cart before the horse”. The Commissioner had not made any decision on the issue (that would not stop the Tribunal considering it though if it were an appeal against a decision notice issued under section 50) as she had been unable to determine the preliminary issue of jurisdiction. The purpose of the Information Notice was to enable her to gather sufficient information to determine that issue.

The Commissioner simply does not, and this has been clear for some considerable time, have the power to determine a substantive issue (such as whether information is held) if she does not have jurisdiction. Where there is doubt about her jurisdiction, that matter has to be resolved by the Commissioner first. If the Commissioner is satisfied of her jurisdiction she will go on to consider the substantive issue (and the two matters will be dealt with in one decision notice dealing first with jurisdiction and then the substantive issue); if she determines that she has no jurisdiction she will issue a decision to that effect which can then be appealed in the normal way.

It remains to be seen whether the Commissioner’s Information Notice will survive; the First-Tier Tribunal has yet to consider all of the matters set out in the initial appeal by E.ON. Now that the Upper Tribunal has disposed of this appeal, the First-Tier Tribunal will now need to hear and determine the rest of the appeal.

Alistair Sloan

If you require advice and assistance with a Freedom of Information matter, or any other information law issue, contact our team on 0141 229 0880 or E-mail info@inksters.com.

Post-legislative scrutiny of the Freedom of Information (Scotland) Act 2002

The Public Audit and Post-Legislative Scrutiny Committee of the Scottish Parliament is currently calling for views on the operation of the Freedom of Information (Scotland) Act 2002 (“FOISA”) as part of its post-legislative scrutiny of FOISA. I have submitted a response to the Committee, which addresses five issues in respect of FOISA (and also touches, where applicable, on the Environmental Information (Scotland) Regulations 2004 (“the Scottish EIRs”)). You can read my full submission here [pdf], but below is a summary of what I have discussed in my submission to the Committee.

The first thing that I have suggested is a possible change to the code of practice issued by the Scottish Ministers under section 60 of FOISA to deal with concerns raised about the processing of personal data in connection with FOI requests. I have covered this issue in more detail on this blog before. In my response I have suggested that this issue is probably best addressed through the code of practice rather than through a change to the wording of the Act.

I have also suggested that any concerns around a failure to make or keep records would not be an appropriate issue to address in the context of FOISA; however, it might be worthy of its own legislative project in the event that Parliament considered that this was an issue. This arises out of concerns expressed that FOISA has resulted in records not being made or kept so as to avoid the need to disclose them. I argue that it is inappropriate to bring this into FOISA; as FOISA has a different focus. FOISA is about giving a right of access to information that exists at the time it is requested and not about what information should be kept by Scottish public authorities. Furthermore, to introduce potentially detailed and technical rules around the making and keeping of records into FOISA could over-complicate FOISA.

I have also suggested that section 48 of FOISA be repealed; or, at least, amended. There is no equivalent provision within the UK Act and there doesn’t seem to be any issues under that legislative scheme that would suggest an outright ban on the Scottish Information Commissioner being able to look these requests is appropriate. Furthermore, it has a significant effect on requesters appeal rights and the alternatives available are not a proper substitute for an investigation by the Commissioner. In this context I also raised concerns about whether section 48 is compatible with our EU obligations as it also extends to requests made under the Scottish EIRs.

I have also suggested amending section 56 of FOISA so that appeals against decisions no longer go directly to the Court of Session. For quite a long time I have considered that this appeal route is prohibitive to most requesters and also to Scottish public authorities (especially smaller authorities with less in the way of financial resources). I’ve also suggested that this has affected the development of the law and Scotland lacks the same level of judicial authority in terms of what different parts of FOISA mean that exists under the UK Act. I’ve suggested, at the very least, appeals should be made to the new Upper Tribunal for Scotland in the first instance. I contrasted the Scottish appellate structure with that which applies under the UK Act. I have also suggested that the present appellate structure may mean that the law doe snot comply with EU law in respect of the Scottish EIRs.

Finally, I’ve also suggested that FOISA be updated to take account of advances in technology and in particular to allow the Scottish Information Commissioner to serve formal notices by E-mail rather than requiring them to be served by recorded delivery post (as is currently the case).

Alistair Sloan

If you would like advice or assistance in respect of freedom of information matters or any other information law matter then contact Alistair Sloan on 0141 229 0880 or by E-mail. You can also follow our dedicated information law twitter account.