The NHS COVID 19 Contact Tracing App: Part 3 The Human Rights Angle

Everyone will agree that the government needs to do everything it can to prevent the further spread of the Coronavirus and to “save lives” (except if your name is Dominic Cummings -Ed). However, there is much less consensus about the what it should do, and this can be seen in the current debate about the proposal to roll out a contact tracing  system and the NHS COVID App. This is the third in a series of blog posts where we examine the COVID App from different perspectives.

On May 7 2020, the  Parliamentary Joint Committee on Human Rights (PJCHR) published its report on the proposed contact tracing system and made a series of important recommendations to address its concerns about the compatibility of the scheme with data protection laws and the Human Rights Act 1998. After waiting for two weeks, the Secretary of State for Health, Matt Hancock, replied to the Committee rejecting its proposals as “unnecessary!” Let us examine those proposals in detail.

The Human Rights Considerations

Section 6 of the Human Rights Act 1998 makes it unlawful for any public authority (that includes the UK government and the NHSX) to act in a way that is incompatible with a Convention right. Article 8(1)of the ECHR states that “Everyone has the right to respect for his private and family life, his home and his correspondence.” This is not an absolute right. Article 8(2) provides that an interference with the right to privacy may be justified if it:

“…is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.”

However, the government also has an obligation to protect the “right to life” enshrined in Article 2 of the ECHR. This means that if the NHS COVID App really can prevent the spread of the virus and save lives, then this is going to a major consideration in deciding whether the interference with Article 8 is necessary and proportionate.

On 7 May the Parliamentary Joint Committee on Human Rights  (PJCHR) published a Report on the NHS COVID App and this provides a very detailed assessment of some of the human rights implications of the “centralised” approach that the NHS has proposed. The overall conclusion of the report is that if the app is effective it could help pave the way out of current lockdown restrictions and help to prevent the spread of Coronavirus. However, it also concludes that the app, in its current form, raises “significant concerns regarding surveillance and the impact on other human rights which must be addressed first.”

How will the COVID App interfere with the right to privacy?

At first glance it would appear that the COVID App does not involve the transfer of any personal data. As explained in the first blog in this series, app user will be given a unique ID which will be made up of a set of random numbers and the first half of a person’s post code. The NHS web site suggests that this ‘anonymises’ the information. However, as the Parliamentary Report notes, there are parts of England where less than 10,000 people live in a post code area and as little as 3 or 4 “bits” of other information could be enough to identify individuals. The report also notes that relying upon people self-reporting alone (without requiring conformation that a person has tested positive for COVID 19) may carry the risks of false alerts thereby impacting on other people’s rights if they have to self-isolate unnecessarily.

Necessary interference?

An interference with a person’s right to privacy under ECHR Article 8 may be justified under Article 8(2) if it is “in accordance with the law” and is “necessary” for the protection of “health” (see above).

To be in accordance with the law, the app must meet the requirements of the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 “http://www. legislation.gov.uk/ukpga/2018/12/contents” (DPA). However, as noted below, the PJCHR believes that the “current data protection framework is contained in a number of different documents and it is nearly impossible for the public to understand what it means for their data which may be collected by the digital contact tracing system”. The Committee’s recommendations in relation to this are considered below.

The remaining  human rights consideration is whether the interference with peoples’ private lives is “necessary”. The answer to this depends on whether the use of the app will contribute to reducing the spread of COVID 19 and whether it will save lives.
This in turn depends on whether the app works and on the uptake of the app.

Although it was reported that uptake of the app in the Isle of Wight has exceeded 50% of the population, this falls short of the 60% that the government had previously suggested was necessary for the app to be effective. It is also debatable whether it necessarily follows that the uptake will be the same on the mainland. If the App is not capable of achieving its objective of preventing the spread of the virus, then the interference with peoples’ privacy rights will not be proportionate and will not fulfil the requirement of necessity in Article 8(2).

Although many people will probably download the app without thinking about privacy issues (how often do any of us download apps without checking Privacy Notices?), many others may have some real privacy concerns, particularly after the recent media debates. This has not been helped by reports that Serco (the company contracted to train call centre staff for the contact tracing scheme) has accidentally shared the email addresses of 300 contact tracers. Or by the fact that in other parts of the world there is growing concern about the privacy issues related to the use of contact tracing apps. Uptake of the app may be adversely affected if people lack confidence in the way in which data is being processed and why, and in the light of above they may have concerns about data security.

Consequently, the PJCHR’s report includes a series of recommendations aimed at ensuring that “robust privacy protections” are put in place as these are key to ensuring the effectiveness of the app .

Central to their recommendations was a proposal that the government introduce legislation to provide legal certainty about how personal data will be processed by the COVID App. Although individuals’ data protection rights are protected by the GDPR and DPA 2018 the Committee believes that it is “nearly impossible” for the public to understand what will happen to their data and also that it is necessary to turn government assurances about privacy into statutory obligations. The PJCHR sent a copy of their draft Bill to Secretary of State, Matt Hancock. However, on 21 May Matt Hancock rejected that proposal on the basis that the existing law provides “the necessary powers, duties and protections” and that participation in contact tracing and use of the app is voluntary.
In contrast the Australian government has passed additional new privacy protection legislation specifically aimed at the collection, use and disclosure of its COVID safe app data.

The Committee’s other recommendations are:

1. The appointment of a Digital Contact Tracing Human Rights Commissioner to oversee the use, effectiveness and privacy protections of the app and any data associated with digital contact tracing. It calls for the Commissioner to have the same powers as the Information Commissioner. It would appear that Matt Hancock has also rejected this proposal on the basis that there is already sufficient governance in place.
2. Particular safeguards for children under 18 to monitor children’s use, ensure against misuse and allow for interviews with parents where appropriate. It is noticeable that the Committee has set the age at 18.
3. The app’s contribution to reducing the severity of the lockdown and to helping to prevent the spread of COVID 19 must be demonstrated and improved at regular intervals for the collection of the data to be reasonable. Therefore the Secretary of State for Health must review the operation of the app on a three weekly basis and must report to Parliament every three weeks.
4. Transparency. In the second of this series of blog posts, we noted some of the issues relating to the publication of the Data Protection Impact Assessment. The PJCHR calls for this to be made public as it is updated.
5. Time limited. The data associated with the contact tracing app must be permanently deleted when it is no longer required and may not be kept beyond the duration of the health emergency. However these terms may be open to some interpretation.

Matt Hancock has written that he will respond to these other issues “in due course”.
It is unclear what this means, but it does not suggest any immediate response.

The Draft Bill

The PJCHR’s draft bill (rejected by Matt Hancock) proposed a number of important provisions, some of which are set out below.

The Bill specifically limited the purpose of the COVID App to:

1. Protecting the health of individuals who are or may become infected with Coronavirus; and
2. Preventing or controlling the spread of Coronavirus (a) preventing the spread of Coronavirus.

Additionally it contained provisions  that prohibited the use of centrally held data without specific statutory authorisation; limited the amount of time that data could be held on a smart phone to 28 days followed by automatic deletion unless a person has notified that they have COVID 19 or suspected COVID 19. It also prohibited “data reconstruction” in relation to any centrally held data. The fact that the Bill includes this, seems to suggest an implicit recognition that the Unique IDs are not truly anonymous.

The ‘status’ of the NHS COVID App keeps changing and it still remains to be seen when (and if) it will be rolled out. But the Northern Ireland Assembly has already announced it will be working with the Irish government to produce a coordinated response based on a  decentralised model.  It is reported to be doing this because of the difficulties and uncertainties surrounding the app, and the human rights issues arising from a centralised app.

This and other GDPR developments will be covered in our new online GDPR update workshop. Our  next online   GDPR Practitioner Certificate  course is  fully booked. We have  1 place left   on the course starting on 11th  June. 

The NHS COVID 19 Contact Tracing App Part 2: The Data Protection Impact Assessment

Yesterday the Prime Minister said England will have a “world-beating” Covid 19 contact tracing system from June. Part of this system is the introduction of the NHS contact tracing app (“the Covid App”) which is currently being trialled on the Isle of Wight.
The app was initially meant to be launched across England in mid-May. Yesterday No.10 suggested this will be done “at a later date.” Why the delay? Well if you look at the recently published Data Protection Impact Assessment (DPIA) for the trial it’s obvious that much more work needs to be done. Here is our analysis of some of the issues raised. (If you are new to this subject we suggest you read the first blog in our series which discussed how such apps work and the different models which can be used.)

Background to the DPIA

The start of the App project has not been auspicious; nor does it instil confidence in the people running it. How can the public, let alone privacy professionals, trust the government when they say that the app will respect their privacy?

The trial of the app started on the Isle of Wight before the Information Commissioner’s Office (ICO) had been given sight of the DPIA. Although they have now seen a copy, the ICO is yet to give a formal opinion. Should the trial have gone ahead in this situation?

As demands grew to see the DPIA, NHSX published it as a .pdf document! However embedded documents including the all-important risk register could not be accessed.
So much for transparency! A few days later the word version of the DPIA was published revealing all the documents but there were typos and some names were not redacted. More importantly, those scrutinising it raised concerns that “high risks” in the original documentation had been listed as only “medium risks” in the risk register. NHSX quickly removed the word document and only the .pdf version is now available (here). For the trial to go ahead before all of the promised and finalised accurate documentation had been released again does not engender faith in the app’s ability to protect users’ privacy.

Oversight

An Ethics Advisory Board has been set up to oversee the Covid App project. In a letter to the Secretary of Health and Social Care, the Board spelt out the 6 principles it expected to be followed; value, impact, security and privacy, accountability, transparency and control.

Some members of the Board have since raised their concerns to the press over how the Board has been responded to. They were also unhappy not to have seen the final DPIA before being asked to comment.

Parliament’s Joint Committee on Human Rights has also been scrutinising the Covid App. It has said that it is not reassured that the app protects privacy and believes that it could be unlawful if the large amount of data gathered proved ineffectual. The Committee has even taken the unusual step of drafting a bill which would require all of the collected data to be deleted after the pandemic is over. (We will look at what data the NHS wants to keep for research purposes and why in our fourth and final blog in this series.)

These serious concerns being raised being by experts and parliamentarians will have a big impact on the public uptake of the app.

Privacy by Design

In line with Article 25 of the GDPR, the app’s DPIA states that it was designed and will continue to evolve with the Privacy by Design principles embedded. They include collecting the minimal amount of data necessary; data not leaving the device without the permission of the user; users’ identities obscured to protect their identity; no third-party trackers; proximity data deleted on users’ phones when no longer required; user can delete the app and its data at any time; personal data will not be kept for longer than is necessary in the central database; data in the central database will not be available to those developing in the app apart from in exceptional circumstances; and provision of any data from the central database will be subject to a data protection impact assessment and establishment of legal basis for the disclosure.

Interestingly, the ICO and European Data Protection Board have both favoured the de-centralised model as it is more with Article 25 and the principle of data minimisation under Article 5 of the GDPR.

Identified Risks

The key part of any DPIA are the risks identified and what mitigation can be put in place to reduce that risk if possible. The documented risks in the Covid App include:

• Transferring of data outside of the EEA
• Misuse of information by those with access
• Adequate data processing agreements with relevant data processors
• Lack of technical or organisational measures implemented to ensure appropriate security of the personal data
• Personal data not being encrypted both/either in transit or at rest
• Lack of testing which would assess and improve the effectiveness of such technical and organisational measures
• Inadequate or misleading transparency information
• Misuse of reference code issued by app for test requests and results management
• Malicious access to sonar backend by cyber-attack. Extraction and re-identification of sonar backend data by combination with other data
• Identification of infected individual due to minimal contact – e.g. isolated person with carer who is only contact
• Malicious or hypochondriac incorrect self-diagnosis on app
• Absence of controls over access to app by children
• Lower than expected public trust at launch
• Uncertainty about whether users will be able to exercise SRRs in relation to data held in the sonar backend
• Uncertainty over retention of individual data items

It is surprising that the Covid App DPIA only identifies 15 risks in such a major project involving sharing Special Category Data. To assess all those risks as low to medium also casts doubts on the robustness of the risk assessments. Recently we heard that wide-ranging security flaws have been flagged by security researchers involved in the Isle of Wight pilot.

There also seems to be a lack of clarity about the data being processed by the app.
In response to the concerns raised, NHXS itself tweeted that the Covid App “does not track location or store any personal information.”

This was quickly objected to by many from the data protection community who disagreed with both assertions and argued the app used pseudonymised data and trackers.
The ICO itself states on its website:,

“Recital 26 (of the GDPR) makes it clear that pseudonymised personal data remains personal data and within the scope of the GDPR”.

The DPIA itself, however, does state that pseudonymised will be used and is personal data. The mixed messages coming from NHSX will only continue to cause confusion and once again erode trust.

Unidentified Risks

What is even more worrying is that there are some risks that have not been identified in the original DPIA:

• There is a risk that there could be function creep and identification over time as more personal data is added or different research projects add in other identifiable data sets, along with the risk of interpreting smartphone users’ movements and interactions.
• Users’ rights for their data to be erased under Article 17 of the GDPR have been completely removed once the data is used for research purposes. We’ll explore this more in a later blog around research.
• There is no mention of any risk associated with the Privacy and Electronic Communications (EC Directive) Regulations 2003/2426.
• No decision has yet been made on retention periods for research. The data could be kept for too long and breach the GDPR Principle 5.
• The collection of personal data could be unlawful as it may breach the Human Rights Act 1998. If the app does not prove effective, it is arguable that it is not necessary and proportionate for the purpose it was created. More on this in the third blog in this series.
• It also is unclear as to how the NHS risk scoring algorithm works as details have not been published. The Privacy Notice makes no mention of automated processing and is therefore not compliant with Article 13 (2)(f) of the GDPR. 

Conclusion

At this moment in time, there are still far too many questions and unaddressed concerns relating to the Covid App to reassure the public that they can download it in good faith, and know exactly what will happen to their data.

Feedback from the privacy community should result in a revised DPIA and further scrutiny. Only after all the questions and concerns have been addressed should the app be launched. Yesterday outsourcing firm Serco apologised after accidentally sharing the email addresses of almost 300 contact tracers. The company is training staff to trace cases of Covid-19 for the UK government!

This and other GDPR developments will be covered in our new online GDPR update workshop. Our  next online   GDPR Practitioner Certificate  course is  fully booked. We have  1 place left   on the course starting on 11th  June. 

Act Now Expands its Cyber Security Team

Cyber security is one of the Information Commissioner’s regulatory priorities; not surprising when you consider the Notices of Intent (to fine) issued by the ICO on British Airways and Marriott International. Recently we learnt that two companies involved in building emergency coronavirus hospitals have been hit by cyber-attacks. Cyber security is an important subject that Data Protection Officers need to understand to be able to fulfil their role effectively.

Act Now Training is pleased to announce that leading cyber security expert, Olu Odeniyi has joined its team of associates. Olu is a Cyber Security, Information Security and Digital Transformation Trusted Advisor who has 30 years’ experience. During this time, he has held several key senior leadership, strategic and operational positions, in the public and private sectors. As a former trustee of three charities, Olu held the roles of Technical Lead, Treasurer and Chair, where he was responsible for regulatory compliance, operational and project risk management.

Recent projects delivered by Olu include investigation of cyber related breaches, analysis of organisations’ cyber security postures and in-depth risk assessments. Olu has advised companies on requirements for attaining the government backed cyber essentials certification and the coveted ISO 27001 Information Security Management.
Workshops, presentations and lectures at the University of West London were given by Olu on topics such as information security and digital transformation.

At the University’s Enterprise Hub, Olu guided start-up companies on cyber security issues ranging from processes to technical considerations – he continues to support and mentor such companies. Analysis of academic cyber security research on novel ways to secure IoT (Internet of Things) devices using artificial intelligence concluded with Olu reporting his findings to the University.

Olu speaks at various conferences and information sessions on information governance and cyber security. In February this year, Olu spoke at the PrivSec Conference on ‘Deepfakes’ (hyper realistic synthetic video/audio generated by deep neural networks) to a packed theatre at the QEII conference centre in London. The session was hosted within the Threat Intelligence theatre with other speakers such as Mike Hulett, Head of Operations at National Crime Agency (NCA).

Olu is a professional member of the BCS (British Computer Society – The Chartered Institute for IT) and a Microsoft Certified Professional (MCP). Within the BCS, Olu is a member of the Information Risk Management and Assurance (IRMA), Information Security, Artificial Intelligence and the Cybercrime Forensics specialist interest groups. Olu said:

“I am delighted to be joining the Act Now team. I look forward to using my cyber security and digital transformation expertise to help Data Protection Officers understand and overcome the cyber challenges their organisations face. Over the coming months I will be developing practical online training courses that delegates can take from the comfort of their office” 

Ibrahim Hasan, solicitor and director of Act Now Training, said:

“Olu’s reputation proceeds him. His expert knowledge coupled with experience of working for a range or organisations will help us expand our cyber security services. Together with our other cyber expert, Steven Cockroft, we are confident that we will be able to service the increasingly complex cyber needs of clients.”

In addition to training, Olu can help your organisation with personal data breaches, PEN testing, incident management, breach reporting and incident responses. Olu can also act as an outsourced or interim Chief Information Security Officer (CISO) or a Chief Information Officer (CIO).

Olu will be a delivering a free webinar on “Introduction to Cyber Security for DPOs on 26th May 2020 (11am). Places are limited so please book early. Our GDPR Update is ideal for those looking to keep abreast of the latest GDPR developments. Finally, the GDPR Practitioner Certificate course is now available as an online option and filling fast.

The NHS COVID 19 Contact Tracing App: Part 1

This is the first in a series of four blog posts, in which Susan Wolf and Lynn Wyeth, take a closer look at the government’s proposed NHS COVID 19 contact tracing app (COVID App) from different perspectives.

On 12 April 2020, the UK Government announced that NHSX, a unit of the NHS responsible for digital innovation, was developing a COVID 19 contact tracing app to help in its attempts to combat the coronavirus pandemic.  A trial began on the Isle of Wight on 5 May. This could result in the app being improved before it is used more widely across the UK.

In this first blog we explain what the proposed app will look like, how it will work and how it compares with other contact tracing apps. This will be followed by an analysis of the data protection issues raised by the introduction of the app in the UK. The third blog will examine some of the wider privacy and Human Right’s concerns and the fourth blog will look at more detailed issues relating to anonymisation, the use of the data for research purposes and the impact on data subjects’ rights.

What is Contact Tracing?

Contact tracing has been used for many years throughout the world to enable public health organisations to try and identify who people with contagious diseases have been in contact with so that they can be warned that they may be at risk. It has traditionally involved a manual exercise of a health professional working with a diagnosed patient to try and establish who they may have been in close contact with during the infectious period of the disease. However, with the number of smart phone users worldwide surpassing  3.8 billion (more than half the world’s population) mobile phones can provide a much faster and more accurate tracing system.

What is a Contact Tracing App?

A contact tracing app is a smart phone application that automatically warns people if they have been in close contact with someone who later reports that they have COVID 19 symptoms or who has tested positive. App users are allocated a unique identifier that is transmitted by bluetooth signal on their phone. When they come into close contact with other app users their unique ID’s are exchanged, via bluetooth, between phones. The Telegraph Newspaper neatly describes it as a form of “digital handshake.”
According to Wikipedia, 15 countries have developed a contact tracing app and many others are in the process.

The Different App Models

What happens to the information that is stored on a contact tracing app user’s phone depends upon the type of app that is being used. In recent weeks it has become clear that contact tracing these apps fall into two broad “types” and, according to the Guardian Newspaper on 7th May 2020, the world is split between the so-called decentralised and centralised models. What basically differentiates the two models is the way in which the information that is stored on users’ phones is processed and used to notify others.

The distinguishing feature of the “decentralised model” is that unique ID’s are matched on a user’s smart phone and are not transferred to any central server held by a government or private sector organisation. If a user tests positive for COVID 19 they would “inform” the app, which will would then identify and then notify other app users who have been in close contact with them. The “match” takes place entirely on the user’s smart phone.
When a contact receives a notification this too is entirely private to them. In other words, public health or government organisations are not notified that a user has been in proximity to an infected person. The general perception appears to be that the decentralised model is more “privacy friendly”.  According to the Parliamentary Joint Committee on Human Rights , the Information Commissioner’s Office, privacy experts and organisations, as well as the European Parliament and the European Data Protection Board (EDPB) have indicated a preference for a decentralised approach.

Most decentralised models use the Apple and Google programming interface (“APIs”) which supports the contract tracing. This is an important point because it allows the interoperability of bluetooth communication between Apple iPhones and Android phones. The former normally switch off the bluetooth function when the phone is locked; however this API allows bluetooth to function even when an iPhone is locked, thus enabling the contact tracing to operate at all times.

In contrast the “centralised model” involves the transfer of information from the users’ smartphones to a remote server operated by a government organisation or by the private sector on their behalf. The central server then determines who is at risk and who should be notified. The perception is that the centralised model is a less privacy friendly option. However it does allow for useful data to be transferred to a public health organisation and used for epidemiological purposes. A recent BBC article provides a useful graphic illustration of the differences between the two models.

The NHS COVID App

The UK NHS COVID App falls into the general category of “centralised” apps.  It is still being piloted in the Isle of Wight and is currently the subject of considerable media and political debate.

Once it is finalised the app will be available for smart phone users to download from the Apple or Google stores. Take up will be voluntary. The information below is based on our current understanding of how the app will work, although this may change in the coming weeks.

Once the app is downloaded users need to provide the first half of their postcode but no other personal information. This will be used along with a random string of numbers to provide each user with their own unique ID.  We are told that the first part of the postcode is necessary to enable the NHS to see where there are any COVID 19 hotspots.

When NHS COVID App users come into contact with other app users their phones will exchange the unique ID’s. The app can use bluetooth to measure the distance between people who have the app installed on their phones. The NHS website refers to this as “anonymous proximity information.” However it is debatable whether the unique ID is truly anonymised given the very extremely high threshold for complete anonymity.

Once this information is stored on the phone nothing will happen for 28 days.
The information will be deleted unless the app user intervenes by notifying the NHS that they have COVID 19 symptoms or have tested positive. Alternatively app users can delete the app, and this will delete all of the data, although any data already transmitted to the NHS via notification will not be deleted by the app user.

It has been reported that Apple and Google have refused to make their API available to the NHS to support the use of the NHS app. It remains unclear what the current situation is regarding this.

Notification

As it currently stands (and to the best of our knowledge) the app has one central question “How are you feeling today?” If the app user taps that they are feeling unwell they are then they are asked whether they have a high temperature and a persistent cough. If a person indicates that they have both these symptoms, then they are prompted to select a date when the symptoms started.

The ‘centralised’ feature of this app is that if somebody is reporting that they are ill with COVID 19 or have symptoms, then the NHS will receive the unique ID of the person reporting that they are ill along with the unique ID’s of all the other people who they have come into proximity with. It is this transfer of data from the app user’s phone to a remote server that makes this system ‘centralised’.

However, it remains unclear whether notification is mandatory or voluntary. According to the NHS website, users can “allow the NHS COVID 19 app to inform the NHS”.
This wording suggests that this notification to the NHS is voluntary. If this is the case, then this raises some concerns about the value of the system since it would appear to depend upon voluntary notification. There are concerns that if people notify on the basis of symptoms alone it could result in over notification. In Germany the contact tracing app will only trigger alerts if users have tested positive for COVID 19.

On receipt of the information the NHS will use a “risk algorithm” to determine whether the people the user has come into contact with need to be notified. If it identifies that other users need to be notified, they will receive an alert.

The success of the app relies upon various factors including:

• The sufficient take up by members of the public. At the moment it looks like the app will be voluntary. It has been reported that government aides think that the app will need to be downloaded by 60% of the population in order to be effective.
  Transport Secretary Grant Shapps said at the daily briefing on Thursday that more than 72,300 out of 140,000 residents in the Isle of Wight have downloaded the app.
• The technology working (see above regarding the Apple and Google programming interface).
• The willingness of members of the public to notify the app that they have tested positive or have COVID 19 symptoms.  The former depends upon the availability of testing facilities and the fast turnaround of test results. In a letter to Health Secretary Matt Hancock, the chairman of the Royal College of GPs said long wait times were “undermining confidence” in the results.

The extent to which members of the public will be willing to install and use the app will no doubt depend on whether members of the public believe that the use of the app will help reduce the spread of the virus and save lives. But for others there will inevitably be concerns about the privacy implications of using the app. Some important questions need to be answered:

• What will happened to the data after it has been used?
• How long will it be held?
• Is there a danger of the data being used for other purposes?
• What ifs use of the app is made a condition for an “immunity passport”?

The answers to these questions will have a big impact on the extent to which the app complies with GDPR and Human Rights law. We will be looking at these issues in more detail these questions in forthcoming blogs. Stay tuned!

Susan Wolf and Lynn Wyeth and are Associates with Act Now Training. This and other GDPR developments will be covered in our new online GDPR update workshop. Our  next online   GDPR Practitioner Certificate  course is  fully booked. We have  1 place left   on the course starting on 11th  June. 

The Public Interest Test under EIR and FOI: Weighting the Arguments

A recent decision of the Upper Tribunal, under the Freedom of Information Act 2000 (FOI), provides a useful reminder of what a public authority needs to do when applying the public interest test.

FOI practitioners will be familiar with conducting public interests tests when considering whether to apply one of the qualified FOI exemptions and the exceptions in the Environmental Information Regulations 2004 (EIR). Both sets of exemptions/exceptions require a public authority to weigh the public interest in maintaining the exemption against the public interest in disclosure. A public authority can only withhold the information if the public interest in maintaining the exemption outweighs the public interest in disclosure.

Public interest arguments in favour of withholding the information must relate specifically to that exemption. In addition, the public authority must consider all the circumstances of the case. This means that two identical requests to different public authorities may result in different disclosure decisions if the circumstances of the case are different.
Practitioners should be particularly cautious about relying on other cases to help decide where the public interest lies and must not apply blanket refusals to certain types of information. In one of its earlier decisions, the First Tier Tribunal (Information Rights) made it clear that a public authority may have a general policy that the public interest is likely to be in favour of maintaining an exemption in respect of a specific type of information, but any such policy must be flexibly applied, with genuine consideration being given to the circumstances of the particular request (see Guardian Newspaper and Heather Brooke v Information Commissioner (EA/2006/0011)).

Essentially, this ‘weighting’ exercise requires a public authority to consider, in the specific circumstances of each case, whether it is in the public interest to disclose the information or to withhold it. Arguments against disclosure must focus on the factors associated with the particular exemption in question and the interest it seeks to protect (see Oxford City Council and Hogan v Information Commissioner EA/2005/0026). Where, an exemption is about prejudice (under FOI) or adverse effect (under the EIR) then there is an inherent public interest in avoiding that prejudice or adverse effect.

The Ryan Case

The recent Upper Tribunal decision, in Ryan v Information Commissioner [2020] UKUT 54 (AAC), involved a request by Mr Ryan to Kent County Council for information about the Council’s negotiations with Tesco in relation to the sale of council land to Tesco in 2004. Mr Ryan wanted to see the correspondence between the Council, the Council’s agent and Tesco. The land in question was a two-acre site that included an Adult Education Centre and car park. As part of the sale contract, Tesco agreed to provide a shop unit for community use to be leased back to the Council at a nominal rent, with the Council paying the costs of constructing the building. However, in 2015 Tesco decided that it would not proceed with its development plans and subsequently sold the land on to a company for residential development. Consequently the community lost the use of the adult education centre that had to be relocated elsewhere. The health and social care centre that was supposed to have been based in the community shop was forced to move into a smaller space inside a library. Mr Ryan argued that there was a  strong public interest in knowing what the Council’s negotiation strategy had been, since the failure of the negotiations with Tesco had clearly caused “ongoing pain” to the community through the loss of these community services.

Following an investigation by the Information Commissioner’s Office (ICO), the Council disclosed the majority of the information requested but continued to withhold one section of a document (“Negotiating Strategy”) relating to its negotiations with Tesco. The Council claimed that disclosure would prejudice its commercial interests and used EIR regulation 12 (5)(e) to withhold this one section. This permits a public authority to refuse a request for environmental information to the extent that its disclosure would adversely affect the confidentiality of commercial or industrial information where such confidentiality is provided by law to protect a legitimate economic interest.

In her Decision Notice (FER0713831) the Commissioner concluded that disclosing the requested information would highlight a tactic used by the council in the negotiations which might well be used in similar circumstances in the future. She decided that the exception was engaged and that the public interest favoured withholding this one piece of information.

The First Tier Tribunal (Information Rights) agreed that the exception was engaged (Ryan v Information Commissioner EA/2018/019). Although the negotiations with Tesco had ended some time ago, the Tribunal decided that disclosure of the relevant tactic may lead parties considering future negotiations with the Council to change their negotiating strategy and that the confidentiality of this commercial information would be adversely affected by disclosure. The Tribunal decided that there was a significant public interest in understanding what happened with the deal and why attempts to obtain the adult education centre and the health and social care centre failed. Disclosure of information about how and why the situation had happened would further the public interest in holding the Council to account for its conduct of this matter and could help to ensure that the same thing does not happen again. On the other hand the Tribunal considered that there was a clear public interest in allowing the Council to approach negotiations on a level playing field; that disclosure would the undermine its negotiating position in future similar negotiations and this would  prevent it from obtaining the best value in its land deals, with a consequential effect on the public purse. On balance the Tribunal decided that taking into account the specific information, the public interest arguments and the amount of information that had already been disclosed, that the public interest favoured withholding the small amount of information regarding negotiating tactics. In particular the Tribunal noted that the disputed information would not greatly further the public’s understanding of what had happened, and disclosure would cause substantial damage to the public interest.

On appeal the Upper Tribunal decided that the First Tier Tribunal’s approach was wrong. The latter had not taken into account the content of the disputed information, which in the Upper Tribunal’s view contained nothing “unique or unusual”. The Upper Tribunal stated that the information was about the sort of advice that a local authority would generally be given in the circumstances and that it was also the sort of advice that would be anticipated by the other side. In its view disclosure would not adversely affect the Council in the ways identified by the First Tier Tribunal. However, the Upper Tribunal has remitted the case back to a differently constituted First Tier Tribunal for reconsideration of the public interest.

In doing this the Upper Tribunal, referring to one of its earlier decisions (FCO v Information Commissioner and Plowden [2013] UKUT 275 (AAC), made some important observations about the public interest test:

1. It is important to look at the disputed information and consider whether its disclosure would further the public interest. In this case the Upper Tribunal suggests that if the information regarding tactics is well known to anyone advising on development issues, disclosure would not do much to further the public interest in disclosure. If the disputed information is not particularly informative then it is important to explain what the public interest in disclosure is that will outweigh the public interest in maintaining an exemption.
2. The test for the balance of public interests is a comparative one; so that the weaker the case for one side, the less public interest is needed on the other side to outweigh it.
3. Under the EIR it is necessary to show how the presumption in favour of disclosure has been factored into the consideration. This applies to public authorities, the Commissioner, and the First Tier Tribunal.

This case concerned a qualified exception under EIR and therefore technically only provides a precedent in relation to that legislation. When a public authority is applying one of the EIR exceptions it must show how it has factored the presumption in favour of disclosure into its considerations. A public authority would be well advised to explain how it has done this in the Refusal Notice.

The FOI does not include an expressly stated presumption in favour of disclosure, so this aspect of the judgment has no bearing on it. However, this case provides some useful lessons for practitioners when dealing with qualified exemptions under the FOI. The first two observations listed above have equal force when dealing with qualified exemptions under the FOI and serve to remind us that it is always necessary to consider whether and how disclosure of the disputed information will further the public interest, and to deal with each case on its own set of facts.

This and other developments will be discussed in our FOI and EIR workshops which are now available as an online option. If you are looking for a qualification in freedom of information, our FOI Practitioner Certificate is ideal.

First Prosecution For Deleting Files under S.77 FOI

Section 77 of the Freedom of Information Act 2000 (FOI) makes it a criminal offence for a person to do anything with the intention of preventing the disclosure of information pursuant to an FOI request. This offence is often briefly discussed in our FOI workshops. We say “briefly” because nobody has ever been prosecuted and our delegates reliably assure us that “that sort of thing never happens.” However, in March 2020, a town clerk became the subject of the first successful criminal prosecution under section 77 of FOI.

Nicola Young worked for Whitchurch Town Council in Shropshire. After pleading guilty to the charges, she was fined £400 and ordered to pay £1,493 costs and a victim surcharge of £40. The facts of the case are that a person had made an FOI request to Whitchurch Town Council for a copy of an audio recording of a council meeting.
They believed that the written minutes of the meeting had been fabricated and so they wanted to listen to the recording of the meeting. Ms Young deliberately deleted the audio recording a few days later and then advised the requestor that the audio file had been deleted as part of the council’s destruction policy. The Information Commissioner became involved when the requestor complained to her office. Readers may think that the fine is very low but it is important to remember that Ms Young now has a criminal conviction that will almost certainly affect her career prospects.

The Section 77 Offence

The S.77 offence requires three things to be proven:

1. The information was requested by an applicant and they would have been entitled to receive the information (subject to the payment of any fee). If the deletion or alteration occurs before the information request is received, then no offence is committed.
2. The person charged with the offence did one of the following things to the information; namely altered it, defaced it, blocked it, erased it or destroyed it.
3. And the person charged, intended to prevent the public authority from disclosing some or all of the information to the applicant. In other words their actions were deliberate.

Section 77 does not provide any statutory defence. However, a prosecution will fail if the prosecution cannot prove that the defendant had the necessary intent (what lawyers call “mens rea”). Prosecutions are brought by the Information Commissioner or by or with the consent of the Director of Public Prosecutions. Cases can only be tried in the magistrates’ court. The offence can be committed by any public authority and any person who is employed by, is an officer of, or is subject to the direction of a public authority. Regulation 19 of the Environmental Information Regulations 2004 creates an identical offence, albeit with slightly different provisions governing government departments.

Why is this the First Prosecution?

There are two main reasons why we have not seen successful prosecutions under S.77 of FOI before this case.

Firstly, the ICO only has six months to bring a prosecution. This period runs from the date that the offence is committed, not from the date that the ICO becomes aware of it.  In practice the ICO will not be called to investigate a complaint until an applicant has exhausted a public authority’s internal review procedures. The Act doesn’t specify how quickly a public authority should complete an internal review, but the S.45 Code of Practice states that this should normally be within 20 working days. This effectively means that the ICO is unlikely to be investigating a complaint until at least a month, or probably two, has elapsed since the request. That assumes that the ICO can investigate as soon as the complaint is received, which is not normally the case.

Secondly, for a successful prosecution under S.77 there must be proof of intent to destroy, conceal, deface etc. Given that this is a criminal offence the proof must be “beyond reasonable doubt.” This may be difficult to do so long after the event and if there is insufficient evidence to prove that the destruction etc was deliberate. During an investigation, the ICO will almost certainly want to see a public authority’s information disposal schedule. Its guidance notes that a disposal schedule will also offer an authority a defence to any suggestion that a S.77 offence has been committed. It will be able to explain that a record containing the requested information was destroyed as part of its routine disposal process.

This is the first prosecution in 15 years under S.77 of FOI which demonstrates the difficulties mentioned above. It does not necessarily mean that offences have not been committed before, but more likely that the ICO’s investigations have not been conclusive within the six-month period.

It is worth noting that the Data Protection Act 2018 introduces a new criminal offence in almost identical terms. Under  S.173 DPA a person commits an offence where they, upon receiving a data subject access request, alter, deface, block, erase, destroy or conceal personal data with the intention of preventing disclosure. There are two defences available. Firstly it is a defence if the alteration, defacing, etc would have occurred in the absence of a subject access request. For example, if the information is destroyed as part of an organisation’s data destruction schedule. The second defence is where a person can prove that they acted in the reasonable belief that the person making the request was not entitled to receive the information. To the best of our knowledge there have been no prosecutions under S.173 to date. It remains to be seen whether the Information Commissioner will face the same problems, as under S.77 FOI, in relation to bringing proceedings. However, she has brought a successful prosecution under S.170 DPA 2018 which relates to the unlawful obtaining of personal data.

This and other FOI developments will be discussed in our FOI workshops which are now available as an online option. If you are looking for a qualification in freedom of information, our FOI Practitioner Certificate is ideal.

Act Now Launches Revised Foundation Certificate in Information Governance

Act Now Training is proud to announce the launch of its revised Foundation Certificate in Information Governance. This qualification is designed for information management professionals who need a foundation in the basics of information rights law and information governance. It is a fully online and interactive course designed by leading Information Governance experts Scott Sammons and Ibrahim Hasan. Scott said:

“I am pleased to be involved in the revision of this ground-breaking online qualification. With up to date content on a range of Information Governance issues it is a great starter qualification for new information governance professional across the public and private sectors.”

The course contains three learning streams namely Data Protection, Freedom of Information and Records Management. These streams now contain additional exclusive content covering cyber security and data subjects’ rights. Using the latest web based technology, delegates will be able to learn (without leaving their desks) by attending three live webinars. In addition they will have exclusive access to four recorded modules. Finally they will do a short online assessment to achieve the certificate.

Since the launch of the first version in 2016, hundreds of delegates have successfully completed this course. They represent a diverse range of organisations from the UK and abroad including multinational corporations, local authorities, universities, NHS, government departments and regulators. Feedback has been very positive:

“The course covered the main topics that are important to my job, and answered queries that regularly arise. After completing the course I felt reassured that I could apply this knowledge on a day to day basis in my job.” EF, Brighton and Hove City Council

Modules were interesting and packed full of useful content. As someone relatively new to the sector, this was the perfect course for me. JH, Healthcare Improvement 

I’ve learnt a lot and I am confident I will be more of an asset to my team because of it. The tutor was also open to discussions which really helped us to relate the information to our own areas. LW, Milton Keynes Council

“Good course, well delivered, offering a good grounding in the subject matter.
Many thanks.” MB, Flintshire County Council

These are difficult times when traditional face-to-face training is not an option.
However the learning cannot stop. The revised Foundation Certificate in Information Governance allows delegates to learn about all the important information governance subjects from the comfort of their home office and gain a qualification. It is also an ideal starter qualification for those who wish to progress to more advanced qualifications such as the as the GDPR Practitioner Certificate which is also now available as an online option.

See the full range of certificate courses available from Act Now here. 

The Coronavirus and Information Sharing: What are “vital interests” under GDPR?

During the current coronavirus pandemic, the health and social care sector as well as the emergency services are all providing an amazing service to those who are in need of urgent medical treatment. This will almost always require the sharing of personal data between organisations.

Even during a pandemic, it is important to note that GDPR still applies to ensure individuals’ privacy is protected whilst vital services are provided. On 19th March 2020 the European Data Protection Board has issued a statement on the processing of personal data in the context of the COVID 19 in which it emphasised this point:

“Data protection rules (such as the GDPR) do not hinder measures taken in the fight against the coronavirus pandemic. The fight against communicable diseases is a valuable goal shared by all nations and therefore, should be supported in the best possible way.
It is in the interest of humanity to curb the spread of diseases and to use modern techniques in the fight against scourges affecting great parts of the world. Even so, the EDPB would like to underline that, even in these exceptional times, the data controller and processor must ensure the protection of the personal data of the data subjects.”

Lawful Processing

The first data protection principle in Article 5 (1) requires Data Controllers to process  personal information “lawfully, fairly and in a transparent manner”. Processing personal data is only lawful if one or more of the six lawful bases listed in Article 6 (1) applies.
If a Data Controller processes personal data about a person’s health (which is a class of Special Category Data) then they must additionally identify one of the ten lawful bases set out in Article 9 (2). These are more detailed than those in Article 6, and are fleshed out further in Schedule 1 of the Data Protection Act 2018. However, there are some overlaps. For example ‘consent’ is a lawful basis in Article 6 (1)(a) and ‘explicit consent’ appears in Article 9(2)(a). Similarly ‘vital interests’ appears in both Articles 6 and 9, however there are differences between the two which we explore below.

Article 6 (1) (d) provides that the processing of personal data is lawful if the processing is necessary to protect the vital interests of the data subject or of another natural person. This raises three points for discussion.

1. What are vital interests?

1. When will processing be ‘necessary’?

1. When can it be used to protect the vital interests of ‘another natural person’?

Vital Interests

GDPR Recital 46, specifically refers to processing for the monitoring of epidemics and it seems this lawful basis is intended to be used in situations such as the current pandemic. But what about other interests? Are they vital?

During a recent GDPR workshop one delegate asked whether a person’s financial interests could be classed as a ‘vital interest’ (after all, we all need money to live). The answer is no because the word ‘vital’ is interpreted very narrowly. Recital 46 refers to processing that is “necessary to protect an interest which is essential for the life of the data subject or that of another natural person”. The ICO’s interpretation of this is that this generally only applies where it is necessary to protect someone’s life.

Our Example. Sam becomes acutely ill at work and his employer phones the ambulance service. The employer gives the paramedics Sam’s name and address. The employer can rely on the vital interest’s lawful basis to share this information. If the paramedics need access to Sam’s health records, then the GP will be able to share them for the same reason but will additionally require an Article 9 lawful basis (see below).

However, in our view vital interests can also include situations where there is a risk of significant harm to life. Therefore if an elderly person is forced to self-isolate and depends upon a group of volunteers collecting their essential prescription medicines, then sharing that person’s name and address is arguably necessary to protect their vital interests.

Necessary 

The processing must be “necessary” in order to protect a person’s vital interests. The key question is whether a Data Controller can reasonably protect a person’s vital interests without the processing (sharing their personal data). If they can then the processing will not be necessary. If they cannot then it will be lawful. In the above example, if the employers refused to give the paramedics Sam’s name and address then this could potentially threaten their ability to offer him life-saving treatment. Therefore the sharing of Sam’s personal data is necessary to protect Sam’s vital interests. 

Protecting the Vital Interests of Other Persons

Those familiar with the Data Protection Act 1998 will know that the lawful basis in Article 6 (1)(d) is very similar to the one listed in paragraph 4 of Schedule 2 of the 1998 Act. Unlike the old DPA, the  GDPR extends this lawful basis to processing that is necessary to protect the vital interests of “another natural person.” However, Recital 46 cautions that “Processing of personal data based on the vital interest of another natural person should in principle take place only where the processing cannot be manifestly based on another legal basis”.

Back to our example. When the paramedics take Sam away in the ambulance, they ask for the names of any employees she may have come into contact with because they are concerned for their health. Can the employer rely on Article 6 (1) (d) to share their names? The answer is no if the employer can find an alternative lawful basis such as consent. 

Consequently, as the ICO notes, the processing of one individual’s personal data to protect the vital interests of another is likely to happen only rarely. The ICO gives an example of the processing of a parent’s personal data to protect the vital interests of their child.

What about processing of personal data to save the lives of many others, for instance in a pandemic situation? Recital 46 suggest that this lawful basis may be used to process personal data for this purpose. But it also states that this basis should only be used where processing cannot be based on another legal basis. This could include “legal obligation” or “official authority”.

Special Category Data

A Data Controller sharing health information (or any other Special Category Data) also needs to identify a lawful basis under Article 9 of GDPR. This allows processing if is “is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent.”

This basis is more rigorous than its counterpart in Article 6. It permits the processing of Special Category Data if the processing is necessary to protect the vital interest of the data subject or of another natural person but only “where the data subject is physically or legal incapable of giving consent.” This clearly allows medical practitioners to share health data in emergency medical situations where a patient is unable to consent to it.
If a patient is fit and able (physically and mentally) of giving consent, then a Data Controller cannot rely on Article 9 (2)(c).

Example, a volunteer group has compiled a database of the names and addresses of residents who need their prescriptions collecting. They share these names and addresses with volunteers. The group has asked volunteers to log details of any residents who have COVID 19 symptoms in order that they can take steps to protect the lives of the volunteers. The group can only process this information if the person with symptoms explicitly consents to their information being shared (and they understand exactly why their information is being shared). If they are physically able to consent (or refuse to give consent) then the group cannot rely on the vital interests condition.  

Although the temptation may be to assume that sharing health data is permissible in the circumstances, the vital interests’ condition in Article 9 (2) (c) has its limits.
Volunteer groups may need to take steps to obtain consent from data subjects and be prepared to explain exactly why they want this information. Article 9 does provide further lawful conditions which may be relevant (Articles 9 (2) (h) and (I)). We will consider the use of these in a future blog post.

Many established charities and recently formed volunteer groups are also now providing essential support services for those members of the community who are at risk, or vulnerable or in need. In order to do this these services may need to share personal data about such people, and often about their health. Whilst this is laudable, they too must be mindful of the GDPR implications. Our recent blog post about Covid 19 volunteer groups goes into more detail.

This and other GDPR developments will be covered in our new online GDPR update workshop. Our  next online   GDPR Practitioner Certificate  course is  fully booked. We have  1 place left   on the course starting on 11th  June.