Another Decision by the Information Commissioner's Office, colluding with Whitehall, against the interests of the vast majority of the law abiding public:
Information Commissioner's Office
Upholding information rights
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
T. 0303 123 1113 F. 01625 524510
Case Reference Number FS50259480
Freedom of Information Act 2000: Section 50(1)
The Home Office
Please find enclosed a Decision Notice issued under section 50(1) of the Freedom of Information Act 2000. This Decision Notice relates to your complaint about a request for information that you submitted to the Home Office on 2 June 2009.
Your complaint has been carefully considered and the enclosed Decision Notice sets out the reasons for the Commissioner's decision.
If you disagree with any aspect of the attached Decision Notice, you have the right to appeal to the First-Tier Tribunal (Information Rights). Contact details for the First-Tier Tribunal (Information Rights) are included in the Decision Notice.
The Decision Notice includes details about you and the public authority. This is to ensure that there is no doubt as to the request for information to which the Notice relates. The Commissioner will publish the decision on the ICO website, but will remove all names and addresses of complainants.
Although public authorities may choose to reproduce this Decision Notice, the Commissioner would expect that they would take similar steps. The Commissioner considers that these may be necessary in order to comply with the requirements of the Data Protection Act.
[name of ICO official]
Senior Case Officer
Freedom of Information Act 2000 (Section 50)
Date: 15 November 2010
Public Authority: Address:
The Home Office
2 Marsham Street
The complainant requested information concerning the names and / or the categories of the Public Communications Providers to which the Secretary of State has given a written notice bringing them under the Communications Data Retention scheme.
The Home Office confirmed it held the requested information but refused to provide it on the basis that it was exempt from disclosure by virtue of sections 31 (law enforcement) and 43 (commercial interests). The Home Office subsequently told the complainant that it did not in fact hold any information about the categories of providers.
The Commissioner has investigated and concluded that section 43(2) was correctly applied. However, he identified procedural shortcomings relating to delay. He requires no steps to be taken.
The Commissioner's Role
1. The Commissioner's duty is to decide whether a request for information made to a public authority has been dealt with in accordance with the requirements of Part 1 of the Freedom of Information Act 2000 (the "Act"). This Notice sets out his decision.
2. The UK Government first introduced legislation on communications data retention in 2001. The Anti-Terrorism, Crime and Security Act 2001 (ATCSA) included at Part 11 provisions for a voluntary regime for the retention of communications data by communications companies. This scheme started in 2003 and involved a number of key communications companies being paid to retain their data, for the purpose of being accessed by the police, security and intelligence agencies and additional public authorities under the Regulation of Investigatory Powers Act 2000 (RIPA).
3. The Notice system arises from The Data Retention (EC Directive) Regulations 2009 which came into force on 6 April 2009. The regulations oblige notified communication service providers (CSPs) to retain communications data for 12 months from the date of communication. The regulations cover fixed, mobile and e-mail telephony, communications over the internet and email data.
4. Although the regulations do not require CSPs to retain the content of communications, CSPs must retain electronic and traffic data that might identify the sender and recipient of the communication, the date and time of the call or e-mail, and the geographical location (and direction of travel) of users.
5. The complainant wrote to the Home Office on 2 June 2009 making the following request:
Under the Freedom of Information Act, please disclose:
1. the names of the public communications providers and / or
2. the categories of public communications providers
to which the Secretary of State has given a Written Notice, bringing them under the mandatory Communications Data Retention scheme which came into force on 6 April 2009, under Regulation 10 of the Data Retention (EC Directive) Regulations 2009.
6. The Home Office responded on 18 September 2009 confirming that it had issued Notices to "several" Communication Service Providers (CSP's) since the Regulations came into effect on 6 April 2009. It also confirmed that it held the related details the complainant had requested but cited the exemptions in sections 31(l)(a), 31(l)(e) and 31(2) (law enforcement) and 43 (commercial interests) of the Act.
7. The complainant requested an internal review on 22 September 2009.
8. In its internal review correspondence, which it sent to the complainant on 30 November 2009, the Home Office told him that it did not hold some of the requested information, namely information about the categories of communications providers. It apologised for not having established this in its earlier correspondence.
9. In relation to the remaining information within the scope of the
request, the Home Office upheld its decision. It clarified that, where it has not previously cited the relevant subsection, it was relying on subsections 31(2)(a) and 43(2). It additionally cited 31(l)(b).
Scope of the case
10. On 1 December 2009 the complainant contacted the Commissioner to complain about the way his request for information had been handled. In this correspondence, he disputed the exemptions cited by the Home Office in relation to the requested information it confirmed it held. He also acknowledged that the Home Office had ultimately said that no Notices had been issued to categories of Public Communications Providers (which covered the second element cited in the request), "implying that they have been issued to specific individual companies only". This matter is therefore not addressed further in this Decision Notice.
11. The complainant contacted the Commissioner again on 25 March 2010, at which time he specifically asked the Commissioner to consider the following points:
"This request has nothing to do with any individual communication data records, nor for any details of the analysis algorithms etc. It is NOT about the general usefulness or uselessness of Communications Traffic Data in criminal or intelligence investigations. It asks simply for the names of the companies which have been notified/ordered to comply with the European Union inspired Data Retention Regulations.
Even those companies which have not been served with Notices, will still be providing law enforcement with communications data records, when properly asked under section 29 of the Data Protection Act, via the Single Point of Contact system".
12. During the course of his investigation, the Home Office confirmed to the Commissioner that it was no longer relying on the exemption in section 31(2)(a). However, as outlined in the Chronology section below, it belatedly cited section 24(1) (national security). Accordingly, the Commissioner has focussed his investigation on whether the Home Office was correct to cite the exemptions in sections 24(1), 31(l)(a), (b) and (e) and 43(2) of the Act in relation to part (1) of the complainant's request for information.
13. Following an attempt at informal resolution, the Commissioner wrote to the Home Office on 22 March 2010 asking it for further explanation of its reasons for citing sections 31 and 43 in relation to the request, including its reasons for concluding that the public interest in maintaining the exemptions outweighed the public interest in disclosure of the information requested. The Commissioner also asked the Home Office to clarify references in its correspondence with the complainant to elements of information which the complainant did not appear to have requested.
14. The Home Office provided a substantive response on 14 May 2010. In relation to the extraneous references it told the Commissioner:
"confusion occurred when we were dealing with two simultaneous requests concerning the Notices".
15. During the Commissioner's investigation, the Home Office raised the issue of further exemptions being applicable in this case. On 30 July 2010, it confirmed in writing that it was additionally citing section 24(1).
Section 43 Commercial Interests
16. Section 43(2) provides that:
"Information is exempt information if its disclosure under this Act would, or would be likely to, prejudice the commercial interests of any person (including the public authority holding it)".
17. The term "commercial interests" is not defined in the Act. However, the Commissioner has considered his Awareness Guidance on the application of section 43. This comments that:
"...a commercial interest relates to a person's ability to participate competitively in a commercial activity, i.e. the purchase and sale of goods or services".
18. The Commissioner has also referred, when considering this case, to guidance issued by the Scottish Information Commissioner in relation to commercial interests and section 33(l)(b) of the FOI (Scotland) Act 2002. This guidance states that:
"commercial interests will specifically relate to any commercial trading activity it undertakes, e.g. the ongoing sale and purchase of goods and services, commonly for the purpose of revenue generation. Such activity will normally take place within a competitive environment".
19. The Home Office has explained that the aim of the Notice system within the United Kingdom is to provide clarity to specific companies that they have a responsibility for retaining communications data and what specifically that retained data should be.
20. The Home Office confirmed that it has issued Notices to several
Communications Service Providers (CSPs). However, it explained to the Commissioner that the decision about which companies to serve a Notice upon "is not necessarily obvious".
21. As the withheld information relates to the names of companies providing services relevant to the environment in which communications providers compete (for example to win customers), the Commissioner is satisfied, with respect to the CSPs involved, that the withheld information is commercial in nature and therefore falls within the scope of the exemption contained in section 43(2).
Identifying the applicable interests
22. In this case, the Home Office has argued that the withheld information constitutes "the names of companies who have agreed to retain information about their customers' use of their communication networks".
This misleadingly implies some sort of voluntary agreement. See paragraph 52 below where it the compulsion is clear.
23. Accordingly, the Commissioner understands the applicable interests in this case to be those of companies in the business of providing communications services. After considering the arguments, the Commissioner is satisfied that the potential prejudicial effects relate to the service providers.
24. During his investigation, the Home Office also argued that the release of the names of the Notice holders would have a financial impact on the Home Office itself.
25. With respect to its argument that the release of the names would have a financial impact on the Home Office, the Commissioner considers there is a distinction to be drawn between commercial interests and financial interests. In this case, he is not persuaded by the arguments put forward by the Home Office, that prejudice to its financial interests may affect its commercial interests. He has therefore only considered the prejudice arguments in relation to the commercial interests of the CSPs.
Nature of the prejudice
26. The Information Tribunal in Hogan and Oxford City Council v The Information Commissioner (EA/2005/2006 and EA/2005/0030) commented:
"An evidential burden rests with the decision maker to be able to show that some causal relationship exists between the potential disclosure and the prejudice and the prejudice is, as Lord Falconer of Thoroton has stated "real, actual or of substance' (Hansard HL (VOL. 162, April 20, 2000, col. 827)".
27. The Commissioner's view is that the use of the term "prejudice" is
important to consider in the context of the exemption at section 43. It implies not just that the disclosure of information must have some effect on the applicable interest, but that this effect must be detrimental or damaging in some way.
28. In support of its reasons for withholding the information under section 43, the Home Office argued:
"given the controversial nature of this issue, and past experience, it is clear that disclosure would be commercially damaging".
29. The Commissioner understands that the reference to "past experience" relates to a story in the national press in November 2009 which resulted in some communications companies receiving "an influx of telephone calls from irate customers". The Home Office argued that one of the impacts of this "unexpected news story" was a financial implication with regard to the companies' brand image.
30. The Commissioner is satisfied that, with respect to detriment to the principle of competition and with respect to brand image, there are commercial interests in this case that are capable of being prejudiced. He has therefore gone on to consider whether the disclosure of the information in question in this case would cause such a prejudice.
Likelihood of prejudice
31. With regard to the likelihood of prejudice, the Home Office told the
complainant that "it would be harmful" to the commercial interests of relevant companies if the requested information was released. It also told him that releasing this information "might change consumer behaviour" which, in its view, would be to the detriment of the companies concerned.
32. However, the Home Office referred to both elements of the likelihood test when it told the Commissioner that:
"disclosure of the names of the CSPs who have been served the Data Retention Notices would cause harm to the companies named as it would be likely to cause financial and reputational harm".
33. Having taken account of the arguments put forward by the Home Office in support of this statement, the Commissioner considers them more relevant to the "would be likely to prejudice" limb. This second limb of the test places a lesser evidential burden on the public authority to discharge and the Commissioner has therefore considered whether, in this case, the lower threshold is met.
34. Importantly, when considering prejudice to a third party's commercial interests, the Commissioner's view is that the public authority must have evidence that this does in fact represent or reflect the view of the third party. The public authority cannot speculate in this respect - the prejudice must be based on evidence provided by the third party, whether during the time for compliance with a specific request or as a result of prior consultation, and the relevant arguments are those made by the third party itself. This approach has been confirmed by the Information Tribunal in the case of Derry City Council v ICO (EA/2006/0014).
35. In response to the Home Office's claim that releasing the requested information might change consumer behaviour, the complainant protested:
"That is just unfounded speculation. ... Predictions of consumer choices and market trends in the telephone, mobile phone and internet markets depend on many factors, and is something well beyond the expertise of the Home Office ...The Home Office does not appear to have consulted any of the commercial internet service providers nor any telecommunications companies ....who are in a far better position than the Home Office to assess any 'consumer behaviour' in several complicated, multiple market places".
36. The Home Office failed to address this point in its internal review
correspondence. However, during the course of his investigation, the Home Office told the Commissioner that it received representations from service providers during the development of the legislation, arguing that they should not be publically identified "because of the risk that customers would transfer their business to services (or companies) not named on a retention Notice". In this respect, the Commissioner notes the ease with which consumers can move between service providers.
37. On the subject of data retention, the Commissioner considers it reasonable to assume that most customers expect their service providers to retain some data about them for business purposes, for example billing. However, in his view, it is not unreasonable to consider that some customers will have a negative perception of how companies named on a Notice are protecting the privacy of their data, given the nature and extent of the data being retained and the length of time it is kept.
38. The Home Office also argued that identifying which CSPs have been served Notices may prejudice the commercial interests of the communications providers "by revealing the capabilities and inabilities of individual providers". Further, it told the Commissioner that identifying which CSPs have been served Notices may prejudice the commercial interests of the communications providers "in their ability to be competitive when providing services to the public sector".
The Home Office did not expand on this point.
39. The Commissioner has reflected on the actual wording of the request in this case when considering these arguments. He has also taken into account the extracts from the third party representations which the Home Office provided on the subject of disclosure.
40. Examples of these representations are as follows:
"It is my view that such action would represent potential brand damage to [company name redacted] and attendant financial and commercial risk".
"Confidentiality must be assured for the CSP....... in short, the status
quo should be maintained and non disclosure of CSP details to the public should be retained".
"We do not, as such, have any problem with the release of the names of those with notices in itself, as most people assume that we fulfil such obligations, as long as each and every CSP and ISP is on the list. What we do not want is to be part of a select few whose names are made public ... this practice would leave those publicly named with a disadvantage, both reputationally and competitively. ... It is not the naming that concerns us but the creation of an uneven playing field in such a crucial and highly competitive market which may impact our customer's perception (and by default our brand)".
"It should be a level playing field therefore every company should be under the same obligations".
41. Taking into account the arguments put forward by the Home Office and the representations of the third parties whose commercial interests are alleged to be at issue in this case, the Commissioner is satisfied that the public authority has demonstrated a real or significant likelihood of prejudice resulting to the commercial interests of third parties through the disclosure of the information in question. Therefore, the Commissioner finds the exemption provided by section 43(2) is engaged.
Both the Home Office and the Information Commissioner have ignored the argument made to them in the the correspondence, that because the Home Office is only serving Notices on some of the Communications Services Providers, presumably the largest ones and that they are paying them millions of pounds of financial compensation, that this is very far from a "level playing field". from the perspective of their smaller rivals or of new entrants into the market.
The Home Office is too naive and technologically incompetent to know if the money claimed for extra disk storage and database infrastructure and personnel to handle the vast amount of Data Retention is not also in fact secretly subsidising say the customer billing systems of these companies.
Perhaps we should see if Ofcom and the European Commission will investigate such secret financial subsidies to some favoured companies.
Have any Home Office civil servants or Labour politicians retired to take up directorships or consultancy jobs with any of these large Communications Service Providers ?
Public interest arguments in favour of disclosing the requested information
42. The Home Office acknowledged that release of the requested
information would give the public the opportunity to identify which providers have been asked to retain information about their customers' use of their networks. If this were to happen, the Home Office recognises that customers "would then be able to decide if they still wished to use these providers".
43. It also recognised that, in providing the names of the companies who have been served Notices, the public would be in a position to hold them accountable "for the safe, correct and legal use of their data".
44. It also told the complainant that releasing the requested information would increase the transparency of how the Home Office has implemented the European Directive, giving the public the opportunity to see how the regulations are used by government.
45. In correspondence with the Commissioner, the Home Office
acknowledged the public interest in openness and transparency about the use of public funds. The Commissioner understands this to refer to the fact that the Regulations give the Secretary of State a discretionary power to reimburse any expenses incurred by a CSP in complying with the Regulations.
Public interest arguments in favour of maintaining the exemption
46. The public interest factors in favour of withholding the information
requested should be seen in the context of, and in connection with, the prejudice-based arguments, described above, which the Home Office has made to the Commissioner.
47. According to the Home Office Explanatory Memorandum to the Data Retention (EC Directive) Regulations, communications data has proved valuable for law enforcement purposes, for example in identifying suspects, tracing criminal contacts, placing people in specific locations at specific times, and confirming or disproving suspects' alibis. Nevertheless, the Home Office recognised that the retention of data is a controversial issue. In this respect, the Commissioner notes the extent of the media coverage on the topic of opposition to the increasing amount of surveillance in Britain.
48. Arguing against disclosure, the Home Office told the complainant that releasing the names of the companies who have agreed to retain information about their customers' use of their communications networks "is likely to result in customers changing their supplier", which would have a detrimental impact on the commercial revenues of those companies. It also said that a reduction in the number of customers "is likely to threaten their ability to secure finance on world money markets and harm their brand image, as well as offer employment".
49. In this respect, the Commissioner notes the concerns expressed by the service providers, when they contacted the Home Office, in relation to the adverse effect of disclosure on their commercial interests. As an example, one company stated that it willingly met all its obligations laid down by the law as well as those it fulfils "in what it sees as its corporate responsibility". The Commissioner notes, however, that the company qualified this, stating that it did so "on the assumption that there will be no competitive disadvantage by doing so".
50. The Home Office argued that a reduction in customer numbers as a result of damage to its brand image would be likely to weaken a CSP's position "in what is a very competitive environment". It went on to argue that it would not be in the public interest if the credit ratings and brand images of service providers were harmed as this would not only affect their ability to offer employment but also their ability to fund future improvements to their networks and services.
We would be reluctant to trust the Treasury on such matters. The Home Office has no expertise or knowledge of such things whatsoever, so they should not be allowed to speculate about them, which is just what they have done, exactly contrary to the ICO Guidance.
51. The Commissioner gives weight to the argument that the impact of disclosure would potentially not only be on the companies themselves but also on their employees and those members of the public who use their services.
52. The Home Office also told the complainant:
"It is also worth noting that these companies have no option but to comply with these regulations".
This makes a nonsense of the claim in para 22 above that the companies had somehow voluntarily "agreed" to retain information about their customers' use of their communications networks i.e. our data.
53. The Commissioner recognises the public interest in ensuring that companies are able to compete fairly. In this respect, the Commissioner understands that on receiving a Notice, CSPs must buy or construct data retention solutions that meet the needs of UK law enforcement and intelligence agencies in terms of their ability to retrieve information "without delay" as well as meeting the commercial requirements of the provider.
Balance of the public interest arguments
54. The Commissioner is mindful of the strong public interest arguments for disclosure of the information in this case. However, in balancing the public interest arguments, the Commissioner is mindful that he has found that disclosure of the withheld information would be likely to cause actual prejudice to the commercial interests of the third parties concerned.
55. Notwithstanding this, the Commissioner accepts that there are many scenarios where companies may be prepared to accept greater public access to information about their business as a cost of doing business with the public sector: the overall value of public sector contracts is a great incentive to tender for them. In this case, however, the service providers who receive Notices are not involved in the decision-making process as to who receives a Notice. In other words, they neither volunteer to participate in the scheme, nor submit a tender for consideration. Rather, they are required by the Home Office to comply.
56. However, he must take account too of the level of prejudice that may be caused to the commercial interests of the CSPs and the wider effects that any such prejudice would have on the public, particularly the customers to which they provides services.
57. In this case, he considers that those publicly named would be
disadvantaged both reputationally and competitively as a result of negative customer perception about the collection and retention of communications data.
58. Having carefully balanced the opposing factors involved, the
Commissioner has concluded that, in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosure of the information in this instance. Accordingly his decision is that the Home Office correctly withheld the requested information by reference to section 43(2).
The Home Office and the Information Commissioner have ignored the fact, pointed out to them in the correspondence, that if any such major shifts of consumers from CSPs who have been served with a Notice under the Data Retention regulations does actually happen, then they can simply serve Notices on to the CSPs where the privacy and security aware law abiding members of the public have moved their business to.
Yet again The Information Commissioner seems to be colluding with Whitehall rather than standing up for the rights of the law abiding tax paying public.
59. As the Commissioner has concluded that the exemption in section
43(2) was correctly applied, he has not gone on to consider the other exemptions cited by the Home Office in this case.
60. Section 10(1) provides that:-
"Subject to subsections (2) and (3), a public authority must comply with section 1(1) promptly and in any event not later than the twentieth working day following the date of receipt."
61. Section 17(1) provides that:-
"A public authority which, in relation to any request for information, is to any extent relying on a claim that any provision of Part II relating to the duty to confirm or deny is relevant to the request or on a claim that information is exempt information must, within the time for complying with section 1(1), give the applicant a notice which -
(a) states that fact,
(b) specifies the exemption in question, and
(c) states (if that would not otherwise be apparent) why the exemption applies."
62. In this case, the complainant's request was received by the Home Office on 2 June 2009 but the Home Office did not issue its refusal letter until 18 September 2009. It therefore took the Home Office more than 50 working days to respond to the information request. Accordingly, the Commissioner finds that, in failing to confirm or deny within 20 working days whether it held the requested information, the Home Office breached the requirements of section 10(1) and that it also breached section 17(1) by failing to provide the details required by that section within 20 working days.
63. The Commissioner's decision is that the public authority dealt with the following elements of the request in accordance with the requirements of the Act:
• it correctly applied section 43(2).
However, the Commissioner has also decided that the following elements of the request were not dealt with in accordance with the Act:
• the Home Office breached section 10(1) by failing to inform the complainant whether it held the requested information within 20 working days of the request; and
• it breached section 17(1) by failing to issue the refusal notice within the statutory time limit.
64. The Commissioner requires no steps to be taken.
65. Part VI of the section 45 Code of Practice makes it desirable practice that a public authority should have a procedure in place for dealing with complaints about its handling of requests for information, and that the procedure should encourage a prompt determination of the complaint. As he has made clear in his 'Good Practice Guidance No 5', published in February 2007, the Commissioner considers that these internal reviews should be completed as promptly as possible. While no explicit timescale is laid down by the Act, the Commissioner has decided that a reasonable time for completing an internal review is 20 working days from the date of the request for review. In exceptional circumstances it may be reasonable to take longer but in no case should the time taken exceed 40 working days. The Commissioner is concerned that in this case, it took over 40 working days for an internal review to be conducted, despite the publication of his guidance on the matter.
Time and time again the Home Office and other Public Bodies simply shrug off the fact that they have cynically broken the law (FOIA sections 10(1) and 17(1)) and have also totally ignored the ICO's "Good Practice Guidance"
When will there be some financial or criminal sanctions which can be applied to these bureaucrats when they obstruct our right to public information ?
Right of Appeal
66. Either party has the right to appeal against this Decision Notice to the First-tier Tribunal (Information Rights). Information about the appeals process may be obtained from:
First-tier Tribunal (Information Rights)
GRC & GRP Tribunals,
PO Box 9300,
31, Waterloo Way,
Tel: 0845 600 0877
If you wish to appeal against a decision notice, you can obtain information on how to appeal along with the relevant forms from the Information Tribunal website.
Any Notice of Appeal should be served on the Tribunal within 28 calendar days of the date on which this Decision Notice is sent.
Dated the 15th day of November 2010
Information Commissioner's Office
Section 43(1) provides that -
"Information is exempt information if it constitutes a trade secret."
Section 43(2) provides that -
"Information is exempt information if its disclosure under this Act would, or would be likely to, prejudice the commercial interests of any person (including the public authority holding it)."
Section 43(3) provides that -
"The duty to confirm or deny does not arise if, or to the extent that, compliance with section l(l)(a) would, or would be likely to, prejudice the interests mentioned in subsection (2)."