Select Committee on Public Administration Minutes of Evidence


Memorandum submitted by the Data Protection Registrar

5. CHARGES

  5.1 The Registrar does not wish to comment generally on charging, but principally to welcome the provisions of paragraph 2.31 which refer to data protection subject access fees. The Registrar strongly welcomes the attempt to ensure that charging for access to one's own information under FOI would not exceed the £10 chargeable under the 1984 Act. The detailed drafting of these provisions will have to have regard to the final form of the new Data Protection Act and subsequent regulations.

  5.2 The provisions on FOI charges are not entirely clear in relation to information which is already publicly available. In cases where a fee is charged (eg land registration data) the government is understandably reluctant to give up the income and the service has to be financed. It is not clear what regime will be applied to information freely published under statutory arrangements, for example, information available to the public on the audit of a local authority. Will the access fee be charged, but no additional charge? Or will the existing regime be preserved? The Registrar would suggest that where information is published whether under the FOI Act (as mentioned in paragraph 2.32 of the White Paper) or under some other statutory provision, then the regime most favourable to the applicant should apply. In the absence of a detailed review of all access provisions, the FOI charging regime would be a cap to the charge and not a replacement for other less expensive routes.

6. HARM AND PUBLIC INTEREST

  6.1 The White Paper expresses the view that under the existing Code of Practice it is not clear how to assess "public interest" and "harm". The Registrar agrees and the FOI Act should attempt to give some guidance. It is not clear how the White Paper clarifies this process. Certain specified interests are to be measured against a test of substantial harm or simple harm. It is still not clear what would count as harming some of those interests. Is mere disclosure enough in some cases or does there have to be more? Does the harm have to be physical, economic or financial? Will distress to an individual suffice? What is the precise meaning of difference between "substantial" and "simple"?

  6.2 If some balance has to be struck between harm to specified interests and the public interest, it will also be necessary to have a more precise notion of public interest. The existing law, as helpfully summarised by the Campaign for Freedom of Information,[2] well be used as a basis; so, for example, disclosures to prevent crime or fraud, to secure individual safety, to reveal serious misconduct in a public office or prevent wrongful conviction, would be permitted despite harm to the specified interests. There is still the difficulty of how to weigh the seriousness of the harm against the important competing public interest.

  6.3 Perhaps not all the questions in the previous paragraphs can be answered. One could compare the use of "fair" in the data protection legislation which has been left to the Registrar, the Tribunal and the Courts to determine as a matter of fact. If that is the case, it should be clear that uncertainty will have to remain until the Information Commissioner has built up a series of decided cases on which organisations can rely. There should not be a promise of greater legislative certainty than is realistic.

7. PERSONAL PRIVACY AND INFORMATION SUPPLIED IN CONFIDENCE

  7.1 The White Paper tells us that it is to be presumed (paragraph 3.1) that personal information including that held under a duty of confidence will be made available to third parties unless the disclosure would cause substantial harm to the personal privacy or rights of confidentiality of the individual. There is no indication that existing statutory rules of confidentiality will be preserved. This is the approach which the NHS would have to adopt to the medical records of an individual, a local authority to social work (including adoptions) records of an individual, and the Inland Revenue to an individual's tax records. The Registrar suggests that this approach is wrong in principle and likely to conflict with the new Data Protection Act and other legislation.

  7.2 In the examples cited, some of the information is held under existing statutory duties of confidentiality, in others the information is of an intimate personal nature held under legal obligations of confidence. The Registrar in such cases is likely to start from the position that processing such data in order to disclose it without the consent of the individual or some over-riding compelling public interest (such as the saving of life or the prevention or detection of serious crime) is either unlawful or unfair processing of personal data. That processing could be restrained by enforcement notice under the 1984 Act and similar powers are likely to remain in any future Data Protection Act. In the Registrar's view, it is wrong to have to satisfy any test of harm and particularly one of substantial harm in order to protect personal records from disclosure to third parties. Indeed, there is a strong public interest in preserving the privacy and confidentiality of individuals. We should not have to live in a society where the expectation is that our private and intimate lives will be exposed to public view. The presumption should be that the privacy and confidentiality of an individual will only be over-ridden (in the absence of consent) on limited compelling grounds of public interest or for the protection of the vital interests of the individual.

  7.3 As paragraph 3.11 of the White Paper says, " . . . the right to personal privacy cannot be absolute - there may be circumstances where disclosure of personal information may be in the public interest". Some of these weighty and compelling grounds have been mentioned in paragraph 6.2 above. That is an approach with which the Registrar agrees, but it is not consistent with the general approach of Chapter 3 of the White Paper. Further, it does not seem to adopt the approach found in Article 8 of the European Convention on Human Rights[3] ("the ECHR") and to be found in the Human Rights Bill now before Parliament. Article 8 of the Convention runs as follows:

    "1.   Everyone has the right to respect for his private and family life, his home and his correspondence.

    2.   There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others."

  The exemptions in Article 8(2) have to be in accordance with law necessary in a democratic society and for a limited list of important public purposes or to protect the rights and freedoms of others. To satisfy the test of necessity in a democratic society, the European Court of Human Rights has decided that there must be a pressing social need for the exemption, and that infringement on the right to private life should be proportionate to the legitimate aim pursued. The whole tenor of Article 8(2) and the Strasbourg jurisprudence is that the presumption is in favour of the privacy of the individual. In the Registrar's view, the White Paper proposals do not make proper provision for the protection of the privacy and confidentiality of individuals and they run the risk of conflict both with the new Data Protection and Human Rights legislation and the European and International obligations of the United Kingdom which lie behind that legislation.

8. APPEALS AND THE INFORMATION COMMISSIONER

  8.1 The objective of resolving complaints in weeks not months is laudable but hard to achieve. The Registrar has some experience of handling large numbers of complaints, currently about 4000 per annum. Where a complaint needs investigation, the practicalities of exchanging correspondence and conducting interviews makes it difficult to dispose of any case in less than three months. This is especially so when a voluntary approach is adopted. The Registrar applauds the formal introduction of a mediation phase, but that needs to be supported by efficient compulsory investigative systems. The Information Commissioner needs to be placed in the position where if he is faced with delay or obstruction by a government department or other organisation, he is entitled to presume that the complaint is well-founded and order disclosure of the information. That approach would be consistent with the presumption of disclosure set out in paragraph 3.1 of the White Paper. There then needs to be some consideration of what sanction might be applied to a recalcitrant government department. The problem of crown immunity from prosecution and the power of the courts to grant injunctions against the Crown will have to be considered. The Commissioner should not be left sanctionless.

  8.2 It is intended that the Information Commissioner should be the final appeal subject to judicial review by the Courts, but without any judicial appeal on the merits. It is not clear whether the Information Commissioner will be a Tribunal subject to the supervision of the Council on Tribunals, as is the case with the Data Protection Registrar. The Council normally expects certain formalities in those decision-making processes which will have a legal consequence. These processes which require the giving of notice and an opportunity to be heard will be of particular importance if the rights of third-parties are to be affected by an FOI disclosure. These processes are not readily compatible with the disposal of complaints in weeks rather than months.

  8.3 Paragraph 5.19 expressly raises the issue of third-party rights and the question of third-party appeals. It follows from section 7 of this memorandum that the Data Protection Registrar strongly believes that individuals must have a right of appeal if it is proposed to disclose information about them. Notice should be given to the individual by the organisation proposing to make the disclosure. The individual should not have to demonstrate 'substantial harm'; it should be for the disclosing organisation or the applicant for the information to demonstrate that there is a sufficiently strong public interest that the test in Article 8(2) of the ECHR can be satisfied and the right of privacy over-ridden. In this context one should bear in mind Article 6 of the ECHR which requires that 'in the determination of his civil rights . . . everyone is entitled to a fair and public hearing within a reasonable time by an independent and impartial tribunal established by law." It seems to the Registrar that the decision to disclose information prima facie in breach of Article 8(1) of the ECHR is a question of determination of an individual's civil rights and there is no alternative other than to provide a proper appeal for the individual affected.

  8.4 In paragraph 5.7 the White Paper draws comparisons between the Data Protection Registrar, the Parliamentary Commissioner (the Ombudsman) and the proposed Information Commissioner. The paragraph is written in a way which might give a misleading impression. It is true that the Registrar is not a servant of Parliament and that she is appointed by the Crown and her actions can be controlled by the courts through the mechanism of judicial review. On the other hand, the Registrar is expressly required to report directly to Parliament which she does at least annually. Independence in enforcing statutory responsibilities should not mean lack of accountability.

  8.5 The Registrar greatly values her independence as a consequence of which she is answerable to the courts and reports to Parliament, but is not responsible to Ministers for the execution of her office. The Registrar believes her office to be an apt analogy for the roÃle and status of the Information Commissioner, given the Commissioner's function in enforcing the law on government. The Registrar, however, believes that a close association with a select committee is valuable. The functions of the Information Commissioner are inherently sensitive and political. The opportunity to report regularly to and consult parliamentarians, as does the Parliamentary Commissioner, could be combined with the independent status of the Commissioner and might well provide the post with valuable support.

9. CONCLUSION

  9.1 FOI and privacy laws overlap and conflict. It is doubtful whether there can be a neat interface between the two types of legislation. Overlapping access rights are acceptable and the White Paper sets out to give individuals straightforward and extensive rights to information about themselves under whatever legislation it is obtained and at a charge not exceeding that payable under the 1984 Act.

  9.2 In the area of conflict between the laws, the Registrar would ask for some further thought to be given to the interface between regimes to be applied. The general presumption of disclosure is unexceptionable in the case of general, factual or anonymous information. It raises serious issues of principle in the case of private or confidential personal information. There will be entirely proper occasions for the release of such information on public interest grounds, but the presumption needs to be in favour of individual privacy.

  9.3 It will be important to ensure that so far as practicable the principles enforced by the Information and Data Protection Commissioners are compatible, that the rights of third parties, especially individuals, are protected, and that mechanisms are created to resolve conflicts between the FOI and privacy jurisdictions. If those steps are taken, the Data Protection Registrar looks to the new Information Commissioner as a valuable colleague in a new era of open public administration.

January 1998


2   pp. 13 and 14 of Freedom of Information: Key Issues, The Campaign for Freedom of Information, December 1997. Back

3   Council of Europe Convention for the Protection of Human Rights and Fundamental Freedoms, European Treaty Series 5. Back


 
previous page contents next page

House of Commons home page Parliament home page House of Lords home page search page enquiries

© Parliamentary copyright 1998
Prepared 12 March 1998