Request
Ms May Docherty requested a copy of the contract from Lothian NHS Board (“the authority”) in January 2005 under FOI(S)A. The authority refused to provide a copy of any part of the Agreement relying on a ‘blanket exemption of confidentiality’ with the contractor. Ms Docherty ultimately appealed the authority’s decision to the Commissioner.
Appeal
In his findings, the Commissioner was strongly critical of the authority for repeatedly failing to provide any justification for relying on the ‘confidentiality’ exemption. However, the authority did provide copy correspondence from the PFI Contractor, Consort, which contained Consort’s reasoning.
The authority also sought to rely on the ‘cost of responding’ exemption, suggesting the costs of responding to the request would exceed the threshold of £600 (above which no response is required). In calculating the costs, authorities cannot take into account the estimated time for considering exemptions – often where the true costs are incurred. As such, the Commissioner did not believe the threshold would be exceeded in this instance.
The Commissioner accordingly found against the authority on all grounds (under exception of some limited personal data which was held to be redactable).
Outcome
Had NHS Lothian taken more care in its response, and complied with the specific requests of the Commissioner, the outcome may have been different. The Commissioner made it clear that it was the responses only of the public authority (here, Lothian NHS Board) that should be taken into account, and that he would not make an independent judgement where the public authority had not put forward a case.
The authority claims that its refusal to release details of the contract was because Consort had threatened legal proceedings for breach of confidence in the event of the authority proceeding to disclose the information.
The decision certainly supports the advice that confidentiality provisions in contracts between public authorities and suppliers should be excluded in so far as they relate to information which may become the subject of an FOI request, as public authorities need complete autonomy in their decisions concerning such requests.
When is Personal Data not Personal Data?
The Information Commissioner has issued new guidance on what is meant by ‘personal data’. The guidance, which takes the form of a flow chart of questions, has been introduced due to concerns that the Court of Appeal decision in Durant –v-FSA had overly restricted the meaning of the term, therefore removing the protection given by the Data Protection Act.
The new guidance is based on the findings of an independent EU Advisory Body on Data Protection and Privacy.
Following Durant, personal data effectively required to be biographical in nature before being afforded the protection of the Data Protection Act. However the guidance now suggests a broader interpretation.
Among other issues, data controllers will have to consider:-
(i) how determined the person wanting to identify an individual is likely to be;
(ii) how cost-effective the available means of identifying individuals are;
(iii) the extent to which the data is linked to an individual.
The full guidance is available at http://www.ico.gov.uk/
Offshore Protection for Credit Card Users
Credit card companies are reeling following a recent decision by the House of Lords supporting an earlier Court of Appeal decision that consumers should be able to claim refunds on credit transactions with foreign businesses, including Internet transactions.
Under the Consumer Credit Act, credit card users may claim refunds from both the supplier and the issuer of their credit card where the goods have been misrepresented, or the seller has breached the terms of sale.
The Court of Appeal had overturned the original High Court decision, which favoured the issuing banks.
Credit card companies have expressed their disappointment at the finding and vowed to continue their fight to lobby Parliament for a change in the law, claiming that such risk is unacceptable to their business.
Communications Data to be Retained under New Rules
From 1 October 2007, suppliers of both fixed and mobile networks have been subject to new data retention rules, which have been implemented across Europe.
The UK has limited the implementation of the new provisions, although it is expected that the rules shall be extended in March next year to cover data relating to Internet access, Internet telephony and Internet e-mail.
The new rules require network suppliers to retain the following information for a period of 12 months:-
(i) the telephone number from which a number is dialled and the name and address of the subscriber and user of that telephone;
(ii) the number dialled, any forwarding number to which the call is diverted or forwarded on, and the name and address of the subscriber for that number;
(iii) the date and time of the start and end of the call; and
(iv) the telephone service used.
Network suppliers of mobile telephony require to retain additional information.
Website ‘TV-Links’ Closes following Arrest of Owner
FACT (the Federation Against Copyright Theft) has arrested the owner of website ‘TV-Links.co.uk’. The website provided users with links to various materials including films allegedly recorded by handheld camcorders in cinemas as well as recordings from television programmes. FACT report that the arrest was made in connection with offences relating to the facilitation of copyright infringement on the Internet on the download website. Since the owner’s arrest, the website has ceased operating.
FACT maintains that the website breached copyright law by linking to other sites which broadcast the illegal content, without the copyright holder’s consent. At the time of writing this article, no charges have been made against the owner.
FACT have also indicated that TV-Links is the first of a number of sites being targeted.
The arrest follows much public debate about the legality or otherwise of the content of other popular download sites, including ‘YouTube’.
YouTube has introduced a new system which it claims, will automatically identify copyrighted materials and report royalty obligations. The system is intended to assist considerably in YouTube’s management of payment to royalty holders.
On the strength of this technological innovation, YouTube has recently signed revenue sharing agreements with a number of global suppliers including Warner Music, Sony and CBS. However, Time Warner (no longer affiliated with Warner Music) has so far failed to negotiate a deal, and has threatened Google (the new owners of YouTube) with legal action in respect of alleged copyright infringement.
Data on Outlook Owned by Employer
The High Court has held that data stored on an employer’s computer system, such as Outlook, belongs to the employer, even if the data includes private data or predates the start of the employee’s employment.
This means that the employee cannot use or copy the data outwith the scope of his/her employment, either during or after the employment period.
The Court highlighted the requirement for employers to adopt adequate computer use policies for employees, and concluded that in the absence of such policies, employees should be allowed to remove private contacts on termination of employment.
The information contained in this newsletter is given for general information only and does not constitute legal advice on any specific matter.