Thursday, 20 June 2013

End of year report

I attended the ICO annual report launch in London today and it was a good event. There was a different mix of sectors there which I’ve not experienced at other, more practitioner focussed conferences, including plenty of legal firms and private sector organisations.

The question and answer session following the presentation gave a level of interaction and immediacy that the 2012 video presentation obviously lacked. This allowed a dialogue with journalists regarding the CQC story, meaning the report was presented in the context of the latest issues (see the excellent Information Rights and Wrongs blog for a thoughtful DP perspective on CQC).

Every annual report is in some ways a spin or a narrative. Yet I still think the slides after slides of numbers gave a fairly rounded picture: the ICO is, like any other public sector organisation, struggling with funding cuts and juggling resources. The future is also far from certain. Proposed notification changes in the new DP regulation fundamentally challenge the ICO’s funding model and realistically questions the ICO’s future without some serious government support.

The ICO do sometimes get a bit of a battering from campaigners, particularly around FOI enforcement. But I think a bit of credit is due for the speed in turning complaints round, as volume increases and resources shrink, to timescales unrecognisable from those of 3-4 years ago. And this in a context of Freedom of Information getting around only a quarter of the funding that Data Protection gets. 

I was a little disappointed in the dismissive statement that local authorities are making a 'pig's ear' of Data Protection. LAs are one of the soft targets against which the ICO can claim to talk tough around enforcement, whilst everyone knows more formidable Data Controllers lurk in the private sector that the ICO are either unwilling or unable to take on in a really effective way. 

But overall a good event and a thumbs up for the ICO. Some interesting points that I scribbled down from the presentations:
  • Guidance documents, which is a real ICO strength, were added or updated at the rate of around one a week in the last year
  • Their own FOIA compliance is good 98% compliance from 1700 requests a year, which is a big number for an public authority of the ICO’s size
  • As Chris Graham noted, the ICO is sometimes a convenient punch bag for politicians, ignoring ICO action or recommendations on the press and the construction blacklist until it suited them to do so 
  • Whilst I sometimes feel I exist in a fairly small world of FOI/DP ‘geeks’, the DP and PECR enforcement on cold calling / spam texting reaches a much wider world of consumers. 150,000 complaints about this area shows that the public is getting increasingly informed about how to act and who to ask
  • 10-15% of the complaints regarding Cookies came from people hating the way that it has affected their web experience, which provoked a chuckle from those present 

Tuesday, 14 May 2013

The new exemption

The Intellectual Property Bill includes a commitment to develop a 'research data' exemption in the Freedom of Information Act. This outcome is a big success for Universities as a result of their lobbying both at the time of the Protection of Freedoms Bill and in the FOI post-legislative scrutiny.

I think that the exemption is good for Universities and researchers. It provides flexibility and scope for a University to make reasoned, evidence based arguments about how disclosure may prejudice research outcomes or dissemination. 

One could also say that, to an extent, the exemption is good news for FOI campaigners. This exemption does not provide a ‘magic bullet’ to exempt all research data. The public interest will apply and there will be sets of research data that might not fit the criteria as drafted.

There are also wider contexts in academia away from FOIA, where the 'open access' issue is a vital parallel development. The new research exemption also adds another driver for Universities to continue their work on research data management, data management plans and approaches to making research data available.

As leading information law blogger FOIMan noted on Twitter this morning, the new clause mirrors Section 27 (2) of the Freedom of Information (Scotland) Act, which has had a research data exemption since its inception. It is notable that this exemption has never been tested in a Decision Notice. 

I checked a few of the England / Wales ICO Decision Notices around research data and the outcomes have been varied. I'm not sure what difference the new exemption would have made to the outcome of any of them.

1. The QUB 'tree ring data' request is one of the most famous early DNs for Universities. Firstly, this was eventually treated under EIR which has no research exemption. The closest to S22, and therefore the new research exemption, is Regulation 12(4)(d) – unfinished or incomplete information. The ICO was unconvinced:

...the Commissioner considers that the exception at regulation 12(4)(d) cannot be applied in this way. QUB has advised that the raw data was collected over a period of 40 years, and is now being used for research. This does not suggest to the Commissioner that the data is unfinished or incomplete, rather that, whilst the research utilising this data is ongoing i.e. the analysis of the data, the data itself has already been collected and is therefore not unfinished or incomplete. (Para 49)
The new exemption's reference to 'ongoing programmes of research' may mean that research could be withheld in similar scenarios. But research data that includes ‘environmental information’ as defined in Section 2 of EIR may be caught in somewhat of a loophole.

2. A more recent DN involved a request for data used to produce a report into “Alcohol Involved Deaths” was withheld under Section 41. The date of future publication was therefore irrelevant. This case shows that other exemptions (personal data, information provided in confidence, commercial interest) will still apply to research data and will probably provide a stronger basis for not disclosing in many cases.

3. This request concerned chronic fatigue syndrome research data. Section 22 was claimed and the ICO agreed it was engaged. The Commissioner, however, felt the public interest favoured disclosure. This would arguably still apply even if the s22 'research data' clause was engaged, as it remains a qualified exemption.

The ICO will now have to revisit and update its guidance for Higher Education and for Section 22. 

NOTE - I’ve blogged previously on FOI and research data and Universities and FOI