Year: 2015

The FOI response arriving on platform two is 18 months late…

The request went in at the end of 2013. You can read the post again here and only 18 months after the original request during which time the east cost franchise changed hands. East Coast (government owned) failed to reply for 14 months and when I wrote to Virgin trains (the new owners) earlier this year I didn’t expect much but today the reply arrived.

“I am contacting further to your correspondence regarding information relating to taxis arranged from London King’s Cross station.

I apologise for the delay in responding to you; regrettably an administrative error prevented a previous response from being sent and I am sorry for any inconvenience this may have caused.

You have requested to know the number of times we supplied taxis to passengers arriving at Kings Cross on delayed trains, the total cost of these taxis and the total number of passengers and taxis involved. We do not have records comprehensive enough to fully provide this information however we have reviewed our taxi invoices for 2014 which shows that in that year there was a total of 1800 taxi jobs arranged with a total cost of £254,024.62. Regrettably we are unable to advise of the number of people these taxi jobs were arranged for or the reason why the taxis were arranged as this information is not recorded.”

Well done to Virgin – a Blue Riband to you. Poor show from East Coast – a purple shirt and tie set for your avoidance of FOI for 14 months.

Give your career a boost by gaining an internationally recognised qualification in FOI. No time/budget to attend courses? Keep up to date with all the latest FOI decisions by viewing our live one-hour web seminars.

I Don’t Believe It! Fees for FOI Tribunal Appeals

Just when you thought FOI was safe (“Oh no we didn’t! Not after that Cabinet Office packed the new FOI Commission with people who don’t particularly care about FOI”, I hear you say), The Ministry of Justice has announced a consultation into changes to fees for, amongst others, FOI appeals at tribunal stage.

If the proposal goes ahead, it will cost £100 to apply for an appeal to the First Tier Tribunal (Information Rights) or the Upper Tribunal (if the case is transferred), and £500 for an oral hearing. Christopher Knight of 11 KBW has produced a helpful summary in this post on the Panopticon Blog.

This proposal is not a great surprise. In July 2012, the Justice Select Committee published its Report into Post-Legislative Scrutiny of the Freedom of Information Act 2000. The Government published its official response in December 2012 and paragraph 24 mentioned the possibility of introducing tribunal fees despite the Committee never suggesting it.

Introducing tribunal fees is clearly an attempt to curtail the public’s right to know in the guise of cost saving. The Campaign for Freedom of Information are mounting a vigorous defence of FOI. We should all try and contribute. Readers can also sign the 38 Degrees Petition to protect FOI laws.

Tribunal fees will have a big impact on the number of challenges to public authority decisions. Overworked FOI Officers may initially see cause for celebration. However if fewer appeals are heard the quality of FOI caselaw on important matters of interpretation will suffer. Consequently application of the FOI exemptions, as well as other provision, will become more difficult. This alone is a good reason for a robust response to the consultation from the public sector.

The consultation paper and the impact assessment on tribunal fees are both on the Ministry of Justice website. The deadline for responses is 15th September 2015.

What else is afoot for FOI? I looked into my crystal ball, after the election, to predict how FOI could change now we have a Conservative majority government. It will be interesting to see how many of my predictions come true when the FOI Commission reports back in November.

Don’t forget on 18th July 2015 the new Re-use of Public Sector Information Regulations 2015 (ROPSI) came into force, replacing the 2005 version. They contain some important changes to the UK public sector information re use regime.

Ibrahim Hasan will be reviewing the latest FOI developments and caselaw in detail, in our forthcoming FOI Update webinar.

Aberdeen NOW! Act Now Training comes to Aberdeen!

Aberdeen

Are you based in Aberdeen? Is travelling to Edinburgh time consuming and expensive? Well we have some great news for you… Act Now Training is coming to Aberdeen!

Act Now Training is the UK’s leading provider of seminars and workshops on all aspects of Data Protection, Freedom of Information, Surveillance Law and Records Management. We are pleased to announce new workshops in Aberdeen which:

· are very competitively priced at just £265 plus vat

· run for a full day from 10am to 4pm

· refreshments and lunch provided

· include comprehensive delegate training materials

Log on to our website or click on the links below for all our available courses coming up in September. Book early to avoid disappointment.

Data Protection Act: An A-Z Guide

Freedom of Information (Scotland) Act: An A-Z Guide

Practitioner Certificate in The Freedom of Information (Scotland) Act

Managing Subject Access Requests

All our courses will be held at the Jury’s Inn Hotel. Adjoining the Union Square Shopping Centre, this modern, city-centre hotel is a 3-minute walk from Aberdeen Railway Station making it the perfectly placed, centrally located venue for all your training needs.

We look forward to seeing you!

Re Use Re Loaded – New Public Sector Information Regulations In Force

On 18th July 2015 the new Re-use of Public Sector Information Regulations 2015 (ROPSI) came into force, replacing the 2005 version. They contain some important changes to the UK public sector information re use regime.

The new Regulations implement Directive 2013/37/EU, which amends Directive 2003/98/EC on the re-use of public sector information (the 2003 Directive). The aim of the latter was to remove obstacles that stood in the way of re-using public sector information. Key obligations for public authorities (including the health, local government and central government sectors) include:

  • being transparent and open about the terms and fees for re-use of information they hold
  • where licences are required to re use information, standard terms and conditions should be offered
  • having accurate notices and statements on documents and websites
  • producing an Asset List so that potential re-users of information know what is available
  • having a complaints process

A full article on the 2005 Regulations can be downloaded here. Key changes made by the new Regulations include:

  • Adding the previously excluded cultural sector (libraries, museums and archives) to the scope of the Regulations
  • Making it an obligation to allow re-use of most public sector information. Previously this was optional.
  • Extending the scope of the information available for re use to not just that which is accessible but anything produced held or disseminated with a public authority’s public task (unless restricted or excluded).
  • Marginal cost pricing is the default (subject to some exceptions) when it comes to charging for re use. Previously a profit could be made.

For the first time the UK re use regime will have teeth similar to FOI. Once the public sector body’s internal complaints procedures have been exhausted, a complainant may turn to the Information Commissioner, who can make a binding decision. A further appeal can be made to the First-Tier Tribunal.

How will the new Regulations overlap with the new dataset obligations under the FOI?  As a result of amendments made by the new Regulations, the requirements relating to datasets under FOI are now as follows.

If you are a public authority making a dataset available in response to an FOI request, you must, so far as is reasonably practicable, make it available in a re-usable, electronic form. You must also make requested datasets available in your publication scheme in a re-usable form unless you are satisfied that it is not appropriate to do so.

However, if the dataset falls under ROPSI, for example because it is produced as part of your “public task”, then you must calculate any charges for allowing re-use and deal with any licences under ROPSI and not FOI. This applies to providing the dataset in response to a request and making it available in the publication scheme.

So, for an FOI public authority, for any dataset that is covered by ROPSI, FOI applies to the format in which it is made available, but ROPSI applies to the charges and licences for re-use.

If the dataset does not fall under ROPSI because you are an FOI public authority but not a public sector body for the purposes of ROPSI, then the provisions in FOI regarding charges and licences for re-use will apply to it. Read the Information Commissioner’s Guide here. Expect lots of appeals to the ICO over these provisions.

The National Archives is the UK policy lead on public sector information. Its website contains useful resources on this topic. All public sector organisations need to carefully consider the new Regulations and how they will impact on the information they produce and disclose.

Want to know more? Ibrahim Hasan will explain the new Regulations in detail our live one-hour web seminar.

Give your career a boost by gaining an internationally recognised qualification in FOI.

Requesting Your Permission

I received an email last week. It was from someone I’d never heard of.

Email

Translating this into PECR speak

We have a list of emails. We don’t think we have your consent to email you which would lead to us breaching PECR so we’re writing to ask for your permission which in itself is breach of PECR. By putting Request for Permission in the subject line we’re hoping you’ll think we know what we’re doing and that we’re a nice company.

I asked them by email to tell me where they obtained my email. A week later they hadn’t replied. I know a week is a long time in politics but a week is a light year in emails.

I upgraded my request to a Subject Access Request and suggested they pass my request to their DPO. Less than 3 hours later I had a reply which appeared to come from near the top.

Dear Sir

Thank you very much for your email and for reaching out to us with regards to our recent emails to you. We have carried out an investigation into your complaint as we take this type of matter very seriously.

As per your inquiry, we have recently acquired a new supplier called “Latest Mailing Database” (latestdatabase.com) who provided us a list of customers’ email addresses interested in travel. They have contractually reassured us that those listed have expressed their consent to be contacted by selected third party partners for marketing purposes.

Upon receiving your inquiry, we have realised that the reassurances we received from this company is in question. While we investigate this further, we have subsequently ceased the use of that mailing list they have provided and all the e-mails, including yours, have now been deleted from our Databases.

We apologise for any inconvenience caused.

Best regards,

Spiros XXXXXXX

Head of International Marketing and Business Development

At least I received a reply but the phrase “They have contractually reassured us that those listed have expressed their consent to be contacted by selected third party partners for marketing purposes” started to worry me. Also a list of people who are interested in travel. Isn’t that a list of everyone in the world? We all travel. Now if they’d asked for a list of those interested in sex and travel we’d have a snappy answer.

Globehunters have a privacy policy which looks pretty good. Just for fun I looked up their company name and their postcode on the ICO Register of Data Controllers. The ICO doesn’t have any record of their name and there are only 2 notifications from their postcode both from the next door building.

I couldn’t resist looking at his source for the emails.

http://www.latestdatabase.com A quick scan through showed their address was Majira Bypass Sajahanpur, Bogra, Bangladesh and they sold email lists. Google maps zeroes in rapidly on a company called seoexparte. A touching review of the company is available.

 

Email 2

 

They had a privacy policy too. http://www.latestdatabase.com/privacy-security-policy/ which was last updated in 2009.

Their UK customer list boasted 2 million records or just $300

Listing Include:

* Frist Name (sic)

* Last Name

* Age

* address

* Email Address

* Ip address

* Phone number

They also have a blog (http://www.latestdatabase.com/appearance-adele-gaga/) and although it would be churlish to mock their poor English if they’re operating in a global marketplace and assuring their customers contractually of the quality of their product it might be a good idea to use a spell checker.

They also seem to run http://emailmarketinglists.bloggets.net. And http://buyemaillists.yolasite.com/contact.php and https://emaillistsforsales.wordpress.com and http://mailinglsit.over-blog.com and http://issuu.com/emaillistsforsale and I gave up at this point.

So where are we now? For £190 a start up company has bought 2 million customer emails. This means that my email is worth 1/100th of a penny. When prodded they realize that they may have bought in a dodgy list so apologise and take my name off their list. A good response but no mention of my Subject Access Request. No Notification for their business and a lead to a major list seller who may just not check their lists that well.

All in day’s work for a PECR vigilante. I’ll see if Spiros comes back.

Act Now Training is one of the UK’s leading provider of seminars and workshops on all aspects of Data Protection, Freedom of Information, Surveillance Law and Records Management. More details www.actnow.org.uk

And so, the end is near, and now we face, the final curtain… or do we?

[ File # csp9290038, License # 2694086 ] Licensed through http://www.canstockphoto.com in accordance with the End User License Agreement (http://www.canstockphoto.com/legal.php) (c) Can Stock Photo Inc. / nasir1164In case you missed it over the last week or so it has been confirmed that the European Council have agreed a text of the Draft EU Data Protection Regulation. You would think that would be the final stage but alas no. Instead we now present this version back to the Commission & Parliament for tri-partide discussion and agreement. This really is the final stage of the legal process in which the Council, the EU Parliament and the EU Commission will now negotiate on this document to agree a final text that can become law (promise… it really is the last stage).

However, in typical governmental fashion of not being able to do anything smoothly 2 versions were ‘released’. One is the text of the Council of Minister’s final text agreed on June 15th: Council of Ministers text minus objections from Member States.

The other was a copy of the text of the Council of Minister’s final text agreed on June 15th including the 649 paragraphs of ‘disagreements’ from the member states (oops). Council of Ministers text plus objections from Member States

There is still some discussion to be had however and in the comments version the Council acknowledges this. First up, with regards to police processing of personal data the regulation now includes as a purpose for processing “safeguarding against and the prevention of threats to public security”. Which, at face value, seems rather wide and “loose” in its wording. We all know that defining a “threat to public security” can be open to various interpretations therefore this may meet with some stiff opposition.

The Council has also said that there needs to be some discussion around the “lawfulness of processing” under Article 6 recital (40 and Article 19 (1). The Council is looking to approve final wording on legitimacy of processing data that is incompatible with the original purpose for which it was collected. The current proposal looks to allow such processing but as a condition allows the data subject a means to legitimately object. Again, how this will work in the real world is open to interpretation but given that this is a move away from the current Directive’s standards then it will be interesting to see if the Council and Parliament accept that.

The Council also appears to be looking for further discuss on the right to compensation and liability outlined in Article 77 and recitals (112), (113a), (118), (118b). The current proposal clarifies the roles and liabilities for processing that is not compatible with the regulation. Namely it is looking to narrow the extent of liability for a processor or controller where it can be demonstrated that the controller or processor concerned is not fully liable (IE, it can be clearly demonstrated that it wasn’t their fault). It makes sense but again, how that will go down with the Parliament and Commission will be interesting.

I’ve now had the chance to read through this updated text and in short it smells an awful lot like a beefed up Directive. A lot of the stricter wording that was in the initial draft proposed by the Commission & indeed the Parliament draft have been replaced with general expectations, the finer details of which member state law or local codes of practice are encouraged to work out. Some of the aspects of the regulation even invite member states to write complimentary laws so that those sections can be properly enacted within that member state. (I’m sure that’s the purpose of a Directive you know…).  

Here’s a quick summary for you;

  • Member states can create their own laws on conditions for processing certain types of data (national ID numbers for example). (Article 9 (5)). This also extends to the conditions for processing HR data which can be defined by local member state work agreements.
  • Member states can decide if fines are to be used on public sector bodies.
  • Article 79a – Fines of up to 250,000 euros or 0.5% of previous year global annual turnover for deliberate or negligent breaches & not responding to SARs.
  • Article 79a – Fines of up to 500,000 euros or 1.0% of  previous year global annual turnover for any of the above or;
    • Does not provide information in a timely manner to a data subject
    • Does not provide access or rectify data belonging to the data subject
    • Does not erase personal data belonging to the data subject
    • Processing data in violation of an restrictions on processing outlined in article 17 (Notification obligation regarding rectification, erasure or restriction).
    • Does not communicate any rectification, erasure or restriction requests to 3rd parties
    • Does not provide the data subject with their personal data.
    • Processing of data of objection to processing received and no viable reason for legitimate processing.
    • Does not provide data subject with information about the right to object to processing of information for marketing purposes.  
    • Does not sufficiently determine responsibilities of joint controllers.
    • Does not maintain sufficient documentation pursuant to Articles 28 (Records of categories of personal data processing activities) & 34 (Prior consultation).
  • Article 79a – Fines of up to 1,000,000 euros or 2.0% of  previous year global annual turnover for any of the above or;
    • Processes information without a legal basis for doing so or does not obtain appropriate consent.
    • Does not comply with conditions for automated decision making & profiling.
    • Does not implement measure to demonstrate compliance with articles 22 (Obligations of the controller) and 30 (Security of processing).
    • Does not designate a representative in violation of Article 25 (Representatives of controllers not established in the Union).
    • processes or instructs the processing of personal data in violation of Articles 26 (Processor).
    • does not alert on or notify a personal data breach or does not [timely or] completely notify the data breach to the supervisory authority or to the data subject in violation of Articles 31 (Notification of a personal data breach to the supervisory authority) and 32 (Communication of a personal data breach to the data subject).
    • does not carry out a data protection impact assessment in violation of Article 33 (Data protection impact assessment) or processes personal data without prior consultation of the supervisory authority in violation of Article 34(2) (Prior  consultation).
    • misuses a data protection seal or mark in the meaning of Article 39 (Certification) or does not comply with the conditions and procedures laid down in Articles 38a (Monitoring of approved codes of conduct) and 39a (Certification body and procedure).
    • carries out or instructs a data transfer to a recipient in a third country or an international organisation in violation of Articles 41 to 44 (Transfer of Personal Data to third countries or international organisations).
    • does not comply with an order or a temporary or definite limitation on processing or the suspension of data flows by the supervisory authority pursuant to Article 53 (1b) or does not provide access in violation of Article 53(1) (Powers).
  • Article 38 – Member states can create their own codes of practice and standards for data protection for specific sectors. This need approval by the EU Data Protection Board but can be developed per member per sector.
  • Article 54a – One stop shop concept for regulatory action and complaint handling amongst supervisory authorities remains.
  • Article 12 – Removal of charging for SARs remains.
  • Article 70 – Removal of need to register all processing of personal data remains but instead only high risk processing must be registered (at no charge) and will be published by the supervising authority.
  • Data portability now does not apply to the public sector or any processing for the enactment of a contract. (General  Text, paragraph 55)
  • Article 31 – Breach notification to a supervisory authority is now 72 hours or “without undue delay” if longer than that period.  

This Regulation is as close to a final version as we are going to get for the moment. As we’ve seen in recent weeks and months the majority of Data Protection regulators and even the EU Commission are saying that elements of the Regulation should start to be implemented from this point onwards (e.g. Netherlands are implementing a general DP breach notification law from next year). Some are even using the principle of the Regulation in the interpretation of current law (the ‘right to be forgotten’ for example).

I intend to do a few more articles over the coming weeks to look in more detail at some of the wording and what this could mean if the Parliament and Commission accept the current draft (which is a realistic possibility).

Author:

Scott Sammons CIPP/E, AMIRMS

@privacyminion

Scott is on the Exam Board for the Act Now Data Protection Practitioner Certificate which is a qualification designed to give candidates a head start in understanding and implementing the proposed EU Data Protection Regulation.

Disclosure of Documents – What they do not teach IG staff

file00030973702 (1)

I have come across several examples in recent practice where great confusion has arisen about the responsibility for complying with court orders which appear to require the disclosure of personal data, often quite sensitive. This can arise where the data controller is a party to the action or where an order has been made as a third party. This then engages the exemption in s35(1) of the Data Protection Act 1998 and the non-disclosure provisions in s27(3) & (4) – disclosures required by the order of a court – and requires a careful consideration of what must be done to comply with the order.

This might arise in all sorts of litigation. Examples I have seen include medical negligence and child protection cases.

The confusion essentially arises for two reasons:

(a) The order is often badly drafted – sometimes appallingly

(b) “Disclosure” in the field of data protection has a very different meaning to that used by the Courts

Information Governance staff who have not been trained in the wiles of litigation may be ill equipped to resolve these issues. It is highly recommended that compliance with such orders is overseen by the lawyers, but even they have been known to err faced with a bad order, so it is well that IG staff and data protection officers in particular understand the issues and can smooth the process.

“Disclosure” is not really defined in the DPA. S1(2)(b) does say that “… disclosing”, in relation to personal data, includes … disclosing the information contained in the data” but that is rather circular. In practice by “disclosure” we actually mean that the information has actually been transmitted or communicated to another person.

The Courts however mean something entirely different. Their focus is initially on documents (widely defined and can include information in databases), not the content. One needs to look at Part 31 of the Civil Procedure Rules and there we can see that “A party discloses a document by stating that the document exists or has existed.” Disclosure does not require that the content is communicated or transmitted at the time of ‘disclosure’. It is not absolute.

The correct procedure from the Rules can be neatly summarised:

1. Court orders ‘disclosure’ to some other person

2. You tell them what you have and whether you object to inspection of any of it – Rule 31.19(3). This might include indicating that you are willing to allow inspection of a redacted copy.

3 Where there are no objections they have a right to ‘inspect’ the documents. In practice they can, and usually do, exercise this right by requesting copies and paying your copying charges

4 Where there are objections if they disagree they must apply to the court Rule 31.19(5)

Objections may be for a number of reasons. The most common is probably legal privilege. Others might include legal prohibitions (Fertilisation and Embryology) or data protection. This might arise if e.g. the documents contain third party personal data which is not relevant to the case – it is a general rule that disclosure should be limited to that which is necessary.

This should be relatively simple but if the Order is defective it can create a very misleading impression.

I have seen recently an Order in a child protection case against Hospital Trust which was not a party to the action and which simply required the Trust “to provide copies” of a named member of staff’s notes to a solicitor for one of the parties. That Order is clearly defective and outside the powers of the Court under part 31. Further Rule 31.17(4) clearly states “An order under this rule must – … require the respondent, when making disclosure, to specify any of those documents … in respect of which he claims a right or duty to withhold inspection.” The particular Order did not do so.

The proviso is clearly an important one as without it someone receiving such an order, without benefit of legal advice (or with benefit of defective advice) would clearly misunderstand what the order required. Having misunderstood it is then impossible to properly apply the s35(1) data protection exemption as it is unclear what is required by the order of the court.

In another example the order was for “disclosure of copies”. That is of course nonsense when you understand what “disclosure” means in a court order. You do not disclose copies – you disclose originals – unless ‘copies’ is all you have – see Rule 31.9. Being pedantic if you only had originals you could comply with such an order with a null response, since no copies exist!

In summary faced with an order of this nature:

1. Make sure you understand what ‘disclosure’ means

2. If you object to actually providing the information you can – whatever the Order may say. If the Order seems black and white it is defective and you may need to apply to the Court for clarification. Refer to your legal team.

3. Until you have this clear you may not have the full protection of s35(1) and in a worst case scenario may breach the data protection principles when you thought you were just doing as the Court ordered.

Phil Bradshaw is one of our expert trainers. Our data protection workshop series contains courses for DP beginners as well DP specialists.

Local Government Transparency Code Re – Issued

  

In February 2015 the Local Government Transparency Code was re issued to require local authorities to publish information about their social housing stock.

The Code was made under Section 3 of the Local Government, Planning and Land Act 1980 which gives the Secretary of State the power to issue a code of practice about the publication of information by local authorities in England (as well as, amongst others, National Park Authorities, Fire and Waste Authorities and Integrated Transport Authorities) relating to the discharge of their functions. In October last year, Eric Pickles (the then Communities and Local Government Secretary) used this power to issue what was then an updated version of the Code.

As with the previous version, the re issued code requires quarterly publication of the same categories information namely:

  • Each individual item of expenditure exceeding £500 e.g. invoices, grant payments, expense payments, rent etc.
  • Government Procurement Card transactions
  • Procurement information

Part 2.2 of the code sets out nine sets of data, which must be published annually. This includes local authority land, grants to voluntary bodies, trade union facility time, parking information and senior salaries. Here a new category of data, about social housing assets, has been added.

Local authorities owning housing must now publish details (set out in paragraph 38 to 44) of the value of social housing stock that is held in their Housing Revenue Account. This information must be published on the first occasion not later than 1 September 2015 (based on the most up to date valuation data available at the time of publishing the information), then in April 2016 and every April thereafter.

The Government believes that local people are interested in how their authority manages the social housing assets they hold. The move will give people the information they need to ask questions of how their council is managing stock to ensure this is put to best use, including considering whether higher value, vacant properties could be used to fund the building of new homes and reduce waiting times.

We could see more developments in this area. As I said in my recent blog post about the future of FOI, the Conservatives are keener on transparency through such codes than through extending FOI. Their election manifesto says:

“Transparency has also been at the heart of our approach to government. Over the last five years, we have been open about government spending, provided access to taxpayer-funded research, pursued open data and helped establish the Open Government Partnership. We will continue to be the most transparent government in the world.”

Smaller councils, including parish councils have to comply with the Transparency Code for Smaller Authorities, which was published in December last year.

Give your career a boost by gaining an internationally recognised qualification in FOI. No time/budget to attend courses? Keep up to date with all the latest FOI decisions by viewing our live one-hour web seminars.

Sell your friend’s email for £25!

refer a friend edited

It’s quite simple. You’ve just bought a product and the company who just sold it to you asks for a friend’s email so they can market to them. If they buy then you (and them) get a cheque for £25. What a great idea!

Unfortunately they seem to have chosen to breach some regulations. To market electronically by email requires prior consent or consideration of the soft opt in option as defined in Section 22 (3) of the Privacy and Electronic Communications (EC Directive) Regulations 2003.

To market by email three conditions should apply.

a) You must have obtained the email address in the course of a sale or negotiations for a sale

b) You should only market similar products

c) You should offer an opt out with every message.

They clearly miss the first one as they have made no sale nor negotiated with your friend. The second one falls by the wayside for the same reason as your friend won’t have bought anything from them, so there is no “similar” test. Finally, we’ll credit them with offering an opt out (although based on their understanding of email marketing so far that’s being generous).

There is a safety valve. If your friend, after being sold down the river does not buy from the company, then their email will never be used by the company. In fact it will be destroyed securely within 30 days. And of course it will never be passed to any other organisation or sold to a list broker.

Unfortunately the company doesn’t offer any of the guarantees in the previous paragraph. They may well do so but they don’t bother with any concept of a fair processing notice. How do you feel about sending your friend’s email to this organisation? If they’re happy to pay £25 to buy an email address that makes a sale what price do they put on a prospect?

I’m not a hacker. I’ve started an online course to learn how to be one. There is no course literature or reading list. The exam which can be taken at any time has one task. “ Your grade is held in a secure area at Hacker’s University. Change it to Pass and email yourself a PDF of your certificate”.

But if I was a hacker I’m sure I could find a way to flood this business that’s trying to buy email addresses with a few long lists of emails. All those on JISCmail data protection list; All people with NHS.net; I have many lists that people have sent me by accident.

Paul Simpkins is a Director and trainer at Act Now Training Ltd.

No time to attend our PECR courses? Try our on demand PECR webinars. One hour of  learning for only £39 plus vat.

A Conservative Majority Government with Michael Gove as Justice Secretary! What now for Freedom of Information?

canstockphoto16242260

So now we have Conservative majority government, contrary to the pollsters’ predicted. I know what you are thinking; what now for Freedom of Information?

Unlike Labour and the Liberal Democrats, the Conservatives did not mention FOI in their election manifesto choosing to talk about transparency instead:

“Transparency has also been at the heart of our approach to government. Over the last five years, we have been open about government spending, provided access to taxpayer-funded research, pursued open data and helped establish the Open Government Partnership. We will continue to be the most transparent government in the world.”

The Conservatives have always been keener on pro active publication of information than FOI. In July 2012, in a speech at the Policy Exchange, Francis Maude said:

“I’d like to make Freedom of Information redundant, by pushing out so much [open] data that people won’t have to ask for it.”

We could see more requirements on local authorities to publish information. Last October, an updated version of the Local Government Transparency Code was published. This requires councils (as well as, amongst others, National Park Authorities, Fire and Waste Authorities and Integrated Transport Authorities) to proactively publish certain categories information (in Part 2 of the code) whilst also recommending that they go beyond the minimum (in part 3 of the code). It could be that Part 2 of the code (the mandatory publication requirements) is extended to include more categories of information. There is also a Transparency Code for Smaller Authorities published in December last year, which could similarly be extended.

Could the Tories make an assault on FOI now that there is no coalition partner to hold them back? David Cameron has, in the past, expressed his irritation with FOI. In March 2012, giving evidence to a Select Committee, he said that FOI was “furring up the arteries” of government. More recently, speaking to the Times newspaper, he said:

“I wish we’d spent more time in opposition thinking about how to declutter government. What I call the buggeration factor, of consulting and consultations and health and safety and judicial review and FOI [the Freedom of Information Act] … Just generally, if you want to do something, build a road, start a new college, launch a programme to encourage people to build more houses – it takes a bloody long time.”

Until yesterday there were no post election clues about the fate of FOI. And then came the appointment of Michael Gove as Justice Secretary; the head of the government department that is responsible for, among other things, Freedom of Information. To say that Gove is no fan of FOI is like saying George Galloway does not like losing elections. This is the same Michael Gove who, a few years ago, was at the wrong end of an Information Commissioner Decision Notice. This related to his time as Education Secretary when he and his officials had routinely used personal email accounts to discuss official, often controversial, Department business. Apparently this was done in the belief that such emails would not be disclosable pursuant to an FOI request.

At present Gove has more pressing matters to deal with. Scrapping the Human Rights Act seems to be the Tories’ top priority. But when he does get round to FOI, it is very likely that the FOI Fees Regulations will be amended to make it easier to refuse requests for information on costs grounds. In July 2012, the Justice Select Committee published its Report into Post-Legislative Scrutiny of the Freedom of Information Act 2000. The Government published its official response in December 2012. The Committee recommended that consideration be given to reducing the amount of time an authority need take in searching for and compiling information:

“We would suggest something in the region of two hours, taking the limit to 16 hours rather than 18, but anticipate the Government would want to carry out further work on how this would affect the number of requests rejected.”

The Government, in its response, said that it doubts that much will be achieved through the reduction of the costs limit. It was though in favour of allowing additional factors to be taken into account in deciding whether the 18 hour limit has been reached:

“The Government does not share the assessment of the Committee that it is unfeasible to develop an objective and fair methodology for calculating the cost limit which includes further time spent dealing with information in response to a request. As such, the Government is minded to explore options for providing that time taken to consider and redact information can be included in reaching the cost limit.”

So whilst the Committee rejected the suggestion that reading, consideration and redaction time should also be taken into account when deciding whether the 18 hour limit has been reached, it could be that the Fees Regulations are amended to allow this.

At present the costs of different FOI requests can be aggregated only where the requests relate to the same or similar information. The Government may change this to make it even easier to aggregate costs. At paragraph 19 of its response, it stated:

“We will also look at addressing where one person or group of people’s use of FOIA to make unrelated requests to the same public authority is so frequent that it becomes inappropriately or disproportionately burdensome.”

Fees could also be introduced for FOI tribunal appeals. The Committee never considered the issue but the Government (at paragraph 24 of its response) indicated that it was considering the idea:

“…the Government is keen explore the potential for users to contribute more towards the costs of tribunals. Fees are already charged in some jurisdictions (for example, in the Immigration and Asylum tribunal) and we will examine the scope for extending this approach to other types of tribunal, including the Information tribunal.”

One thing is for certain. The Police Federation will be made subject to FOI. In a speech in May 2014 the Home Secretary, Theresa May, said that the Police Federation needs to be more accountable to the public. In March this year she announced that there was no time to amend FOI to add it to the list of public authorities but she also published a draft clause “that demonstrates how that change could be made in legislation, with the intention this would be fulfilled in the next Parliament.”

Interesting times ahead for FOI officers.

No time to attend our FOI Update workshops? Try our live FOI webinars. One hour of interactive learning for only £39 plus vat.