Review into proposed amendments to Data Protection Law - Campaign for Freedom of Information - Submi

The Campaign for  

Freedom of Information

Suite 102, 16 Baldwins Gardens, London EC1N 7RJ  

Tel:  020 7831 7477  

Fax:  020 7831 7461  

Email:  admin@cfoi.demon.co.uk  

Web:  www.cfoi.org.uk  

Notes on Proposed Amendments to Data Protection (Jersey) Law 2005  Amendment to Article 43 - Information Notices

This amendment would extend the class of person from whom the Data Protection Commissioner can obtain information through the issue of an Information Notice. An Information Notice is the means by which the Commissioner obtains information about a data controller's compliance with the data protection principles and obtains information needed to investigate complaints. Failure to comply with a principle is not an offence and there are separate powers for investigating possible offences.

At present an Information Notice can only be served on the data controller. The amendment would allow such a notice to be served on any person. There are likely to be cases where this wider power would assist the Commissioner in investigating cases where a possible breach of the data protection principles is suspected. The UK  Information  Commissioner  recently,  but  unsuccessfully,  sought  a  similar extension of his powers highlighting, in particular, the need to be able to obtain information from the data processor (eg a company contracted to process payroll or other data on behalf of the data controller). It is hard to see any objection to an extension limited to data processors.

However, the Jersey proposal (like the unsuccessful UK proposals) would allow information  notices  to  be  served  on  "any"  person  who  might  hold  relevant information. This may raise more complex issues. Might it, for example, allow information  about  journalists'  sources  to  obtained  without  following  the  Law's existing safeguards for journalism?

At  present,  media  organisations  have  some  special  protection  from  the  DP provisions,  in  recognition  of  the  need  to  protect  freedom  of  expression  in accordance with Article 10 of the ECHR. Article 32 of the Jersey Law creates an exemption  for  personal  data  which  is  being  processed  with  a  view  to  the publication of any journalistic, artistic or literary material where the data controller (eg the newspaper) reasonably believes that publication would be in the public

Co-Chairs:  James Cornford, Neil McIntosh  Parliamentary Co-Chairs:  Norman Baker MP Director:  Maurice Frankel   Mark Fisher MP

Richard Shepherd MP Campaign for Freedom of Information Ltd. Registered in England no. 1781526. Registered office as above

interest. The exemption then applies if compliance with specified DP provisions is incompatible with the journalistic etc purpose concerned.

The specified DP provisions are most of the data protection principles, the right of access to personal data under Article 7, the right to prevent personal data being used in a manner likely to cause substantial distress or damage (Article 10), the right to prevent automated decision making (Article 12), the right to require the destruction of inaccurate data (Article 14). The exemption also protects against any gagging order' sought prior to publication and before the applicability of this journalistic exemption can be established (Article 13).

In addition, the Commissioner's powers to issue information notices or enforcement notices are subject to particular restraints in relation to journalistic material (Articles 44 - 46).

It seems possible that the enhanced power to serve information notices provided by the proposed amendment might allow a notice to be served on someone suspected of being a journalist's  source,  requiring the individual to provide information confirming that he is the source. At present, no information notice could be served on such individuals. There may also be other implications for media reporting, or for the uncovering of wrongdoing. The result might be to permit an interference with freedom of expression of a kind which the existing Law seeks to restrict.

Amendment to Article 55 - increased penalties for offences

This amendment increases the maximum penalty for the offence under Article 55 of unlawfully obtaining or disclosing personal data. A new penalty of imprisonment for up to 2 years would be created.

A similar amendment to the UK Data Protection Act has been enacted (by section 77 of the Criminal Justice and Immigration Act 2008) but not yet brought into force. It has caused considerable controversy insofar as it is thought capable of affecting legitimate journalistic activity.

However, the new and still dormant UK provision contains a safeguard for journalism not found in the current Jersey proposal. This takes the form of an improved public interest defence for a person who shows that he (a) acted for the special purposes' (ie for journalistic, artistic or literary purposes) (b) with a view to the publication of material for one of those purposes, and (c) in the reasonable belief that in the particular circumstances the obtaining, disclosing or procuring [of the information] was justified as being in the public interest.

This new defence is in addition to an existing public interest defence found in the UK Data Protection Act and in Article 55(3)(d) of Jersey's DP Law. Both apply where disclosure can be shown to have been "justified as being in the public interest".

The additional UK public interest defence goes beyond this in that it introduces a "reasonable belief" element into the public interest test.

This is intended in part to address concerns that legitimate journalistic activity might be otherwise be inhibited by the existing public interest test. The UK Government has said that it "has always been clear that the additional defence should be introduced alongside the increased penalties."[1]

The reasonable belief public interest test is still an objective test (ie the test is whether a reasonable person would have believed the disclosure to be in the public interest). If the current Jersey amendment is proceeded with there would be a strong argument for following the UK precedent and adding such "reasonable belief" public interest test to Article 55. (Such a test is already found in Article 32(1)(b) of the Jersey Law, though it serves a different purpose there.)

Amendment of maximum fee for subject access to health records

It is also proposed to amend the regulations dealing with the fees that can be charged to people applying for access to their own health records. This would make permanent the present transitional access fee of £50.

This is based on a similar provision in the UK Act. The charge was adopted because health records may include X-rays or the results of MRI scans, which were thought to be relatively expensive to reproduce. (Given that in some cases such information may provided on a CD, the expense of reproducing even such complex data may be questionable.)

Experience in the UK is that the £50 often acts as a disproportionate barrier to people  seeking  their  health  records. The  £50  charge  has not  been  limited  to complex forms of data, but has often been adopted as the standard charge, even for requests involving a few sheets of A4 paper. For example, one NHS Trust in the UK has an online application form for patients seeking access to their health records. The first line of the form states: "Please Note: There is a charge for this service – £50 payable with request, cheque payable to Stockport NHS Foundation Trust."[2] The Jersey Data Protection Commissioner has described a case of a hospital seeking a £50 fee plus an additional, unlawful, photocopying fee of £1 per page from a patient.[3]

It seems unlikely that the Data Protection Commissioner would have any power to question even a clearly unreasonable £50 charge, for example, where the request was limited to a copy of a single letter from a hospital to the patient's GP.

It  is  also  possible  that patients  may  be  required  to  pay  multiples  of  £50,  for example, where parents are seeking access to health records of several children or where requests need to be made both to a GP and a hospital.

The amendment would also abolish the free access permitted to an individual's paper-based health records where these have been changed in the past 40 days.[4] Such free access is permitted in the UK. The rationale is that the provision of information about their health to patients currently undergoing treatment is good practice which should be encouraged. The proposed change would make the Jersey provisions more restrictive in this respect than those in the UK.

Other amendments

We have no specific comments on the remaining amendments.

Maurice Frankel 12 March 2010