Recently in HO Comms Data Retention regulations ISP list Category

How many months or years will this Complaint to the Information Commissioner's Office drag on for ?

Information Commissioner's Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF

Email to: mail@ico.gsi.gov.uk

Freedom of Information Act 2000 Complaint against the Home Office
regarding the non-disclosure of the Names of the Communications
Service Provider companies which have been formally Notified under
the Data Retention (EC Directive) Regulations 2009

Tuesday 1st December 2009

Dear Sir or Madam

Please find attached my email correspondence with the Home Office and the Information Commissioner's Office, regarding my Freedom of Information Act 2000 request from the 2nd of June 2009.

1) the Names of the Public Communications Providers

and / or the

2) the Categories of Public Communications Providers

to which the Secretary of State has given a Written Notice, bringing them under the mandatory Communications Data Retention scheme, which came into force on 6th April 2009, under Regulation 10 of the

The Data Retention (EC Directive) Regulations 2009

http://www.opsi.gov.uk/si/si2009/draft/ukdsi_9780111473894_en_1

The Home Office eventually refused to disclose any of the requested Names of the Public Communications Providers who have been issued with Notices whatsoever, apart from saying that they did hold such information, and that there were no Notices issued to "Categories
of Public Communications Providers" (a term from the text of the Data Retention (EC Directive) Regulations 2009), implying that they have been issued to specific individual companies only.

After informal contact from the ICO, after the Home Office failed to acknowledge let alone respond with a substantial reply, the Home Office did eventually reply.

The Home Office also conducted an Internal Review of the handling of the timing of their response and, admitted to failing to respond with the 20 working day statutory limit.

The Home Office have, after the eventual Internal Review, claimed Exemptions under

Section 31(1) and (2)

"Information which is not exempt information by virtue of section
30 is exempt information if its disclosure under this Act would, or
would likely to, prejudice-
(1)(a) the prevention or detection of crime
(1)(b) the apprehension or prosecution of offenders
(1)(e) the operation of the immigration controls.

(2)(a) the purpose of ascertaining whether any person has failed to
comply with the law. "

"Arguments against disclosure

If the information were to be released, a considerable degree of harm would be caused to the law enforcement purposes that the regulations are designed to serve (including in relation to
immigration). Disclosure would damage the effectiveness of the arrangements in place and therefore law enforcement, as a result of the likely harm to the working relationship between the law enforcement community and communications providers in relation to this issue. This is not in the public interest. "

I fail to understand how making public just the names of the Communications Service Providers will in way "damage the effectiveness of the arrangements in place and therefore law
enforcement, as a result of the likely harm to the working relationship between
the law enforcement community and communications providers in relation to this issue"

It will have no effect whatsoever on the Single Point of Contact system, through which Police forces and Intelligence Agencies etc.channel their Data Protection Act 1998 section 29 requests for Communications Data, which will still operate with Internet Service
Providers and Telecommunications companies which have *not* been formally Notified that they are subject to the Data Retention Regulations.

As the Home Office's Internal review itself notes, those companies which have been Notified under these Data Retention (EC Directive) Regulations 2009, "have no option but to comply with these regulations.", whether they have been named in public or not.

There are, however, no legal sanctions available in the Regulations if a Communications Service Provider completely or partially fails to comply with them. It would be inconceivable for a public limited company to fail to do so, if it their own staff and shareholders were actually aware that the company had been Notified under the Regulations. This beneficial aspect of transparency has not been considered by the Home Office.

The Home Office have also claimed an Exemption under:

Section 43(2)

"Information is exempt information if its disclosure under this Act would, or would be likely to, prejudice the commercial interests of any person (including the public authority holding it). "

When I asked for an Internal Review of this refusal, I pointed out that, according to the Information Commissioner's Office Guidance on such Commercial interests exemptions, that they should have contacted the third party companies concerned.

The Home Office have not bothered to do so, and they have not even contacted the relevant independent industry and market regulatory body OFCOM (www.ofcom.org.uk) .

Contrary to the ICO guidance,

Information Commissioners Office FOIA Guidance - Section 43 - Commercial detriment of third parties

http://www.ico.gov.uk/upload/documents/library/freedom_of_informatio
n/detailed_specialist_guides/commercialdetrimentof3rdparties.pdf

The Home Office has speculated wildly, on possible future market conditions in areas completely out of their expertise, such as future consumer behaviour in the market, credit ratings, brand images, the ability to raise finance etc.

"Arguments against disclosure

Releasing the names of the companies who have agreed to retain information about their
customers' use of their communication networks is likely to result in customers changing their supplier which would have a detrimental impact on the commercial revenues of these companies. A reduction in the number of customers is also likely to threaten their ability to secure finance on world money markets and harm their brand image, as well as offer employment. This is likely to weaken their position in what is a very competitive environment. It
is also worth noting that these companies have no option but to comply with these regulations.

Balance

I am satisfied that it is not in the public interest to release details of which telecommunication companies have been asked to retain information about their customers' use of their networks. I
am of the view that it is likely customers would change suppliers which would weaken the market share of those served with notices to retain information. If the credit ratings and brand images of these companies were to be harmed this is likely to reduce their abilities to raise funds for future improvements to their networks and services, as well as offer employment, which is not in the public interest. "

My FOIA request does *not* ask for details of the amount of financial compensation (or state subsidy) being promised to individual companies which have been Notified, only for the Names of the companies affected by the Regulations.

Small or Medium sized Internet Service Providers or Telecommunications companies, or New Entrants into the market(s), who are not receiving state subsidies from the Home Office, for the
implementation of the Data Retention Regulations, may very well have something to say to the Competition Authorities, both in the UK and at the European Union level, but they need to know for sure which of their bigger rivals are being Notified and therefore subsidised.

More generally, Retained Communications Data is just as likely to be used in *Civil Court* cases e.g. a Court Orders in Copyright Infringement or Divorce cases.

So there is a much wider Public Interest in the disclosure of names of the companies which are subject to these Regulations, which is *not* directly concerned with Criminal Law enforcement, which is all that the Home Office seems to have considered.

Please contact me if you need any further details, in order to consider this complaint.

Yours sincerely

[name]
[address]
[email]

The text of the Home Office's delayed Internal Review:

The Home Office has rejected the Freedom of Information Act request made
on 2nd June 2009 i.e. after 78 working days, and a complaint to the Information Commissioner's Office.

It is hard to believe that any of the Fixed Line or Mobile Phone companies would not be on this list of companies to which the Data Retention (EC Directive) Regulations 2009 have been made to apply, so it is really only which Internet Service Providers or the ISP divisions of larger companies, have or have not, been forced to comply with the Regulations, which are of interest.

[Home Office logo]
Direct Communications Unit
2 Marsham Street, London SW1P 4DF
Switchboard 020 7035 4848 Fax: 020 7035 4745 Textphone: 020 7035 4742
E-mail: public.enquiries@homeoffice.gsi.gov.uk Website: www.homeoffice.gov.uk

[name]
[email]

Reference: Tnnnn/n

Dear [name]

Thank you for your e-mail of 02/06/2009 requesting the names of companies that have received notices under the Data Retention (EC Directive) Regulations 2009. I am writing further to my letter of 26 August to provide you with a final response. I am sorry for not meeting the 16 September date as indicated in that letter.

I can confirm the Home Office has issued Notices to several Communication Service Providers (CSPs) since the Regulations came into effect on 6 April this year. You asked for further details, specifically for the names of the CSPs that have received the Notices and for the dates on which they were sent.

I am writing to confirm that the Home Office holds the information that you requested. However I am not obliged to disclose it to you. After careful consideration we have decided that this information is exempt from disclosure by virtue of Section 31 and Section 43 of the Freedom of Information Act. These provide that information can be withheld where disclosure would prejudice law enforcement operations and harm commercial interests respectively. The public interest in this instance falls in favour of non-disclosure.

If you are dissatisfied with this response you may request an independent internal review of our handling of your request by submitting your complaint within two months to the below address.

Information Rights Team
Information and Record Management Service
Home Office
4th Floor, Seacole Building
2 Marsham Street
London
SW1P 4DF
Email: info.access@homeoffice.gsi.gov.uk

During the independent review the department's handling of your information request will be reassessed by staff who were not involved in providing you with this response. Should you remain dissatisfied after this internal review, you will have a right of complaint to the Information Commissioner as established by section 50 of the Freedom of Information Act.

I realise that you may be disappointed with this response. However we have considered the application of exemptions with great care in this case, and the Home Office always seeks to provide as much information as it is able to.

Yours sincerely

[name of civil servant]

Annex
Section 31 of the FOIA law enforcement interests

Section 31(1)a refers to the prevention or detection of crime. The European Directive on Data Retention was introduced for the prevention and detection of Serious Crime.

Section 31 of the FOIA provides for the protection for law enforcement interests; its application turns on whether disclosure would be likely to prejudice those interests. The law enforcement organisations have confirmed the release of this information is likely to reduce the utility of retained data and thereby reduce law enforcement's ability to prevent and detect crime.

Paragraphs within section 31 of particular relevance are;

• Section 31(1)a; information prejudicial to the prevention or detection of crime.

• Section 31(1)e relates to the operation of the immigration controls; the UK Borders Agency use communications data in policing immigration.

• Section 31(2) refers to additional purposes under which disclosure of information can be withheld if there would be a prejudicial effect on law enforcement.

These Regulations are not about the usefulness of Communications Data in general, or about access to it by Law Enforcement bodies.

It is debatable just how useful the mass retention of millions of innocent people's communications data, which is up to a year out of date, really is, rather than the hundreds of thousands of supposedly narrowly targeted request for Communications Data made each year.

The Information Commissioner's Office latest Guidance (August 2009:

Section 31 Law Enforcement (AG 17) (.pdf)

is clear:

A public authority cannot withhold information, or refuse to confirm or deny that it holds information, unless the disclosure would, or would be likely to, prejudice any of the purposes or activities listed in the exemption. The prejudice must be genuine and of substance and its likelihood must be decided on a case-by-case basis. A public authority must therefore explain why the disclosure of the specific information requested would, or would be likely to, cause prejudice. It is not acceptable to say that disclosure of that type or class of information would, or would be likely to, cause prejudice.

Remember this FOIA request has nothing to do with any individual Communication Data records, or for any details of the analysis algorithms etc., it is simply for the names of the companies which have been ordered to comply with the Data Retention Regulations.

Even those companies which have not been served with Notices, will still be providing Law Enforcement with Communications Data records when properly asked under section 29 of the Data Protection Act, via the Single Point of Contact system.

Therefore it is quite likely that the Information Commissioner's Office will reject this Section 31 exemption, if it goes that far.

Section 43 of the FOIA provides an exemption from disclosure of information where that information would harm commercial interests. It is possible that releasing this information might change consumer behaviour to the detriment of those companies that have been issued with Notices.

That is just unfounded speculation.

"might change consumer behaviour" - by how much, over what period ?

Predictions of consumer choices and market trends in the telephone, mobile phone and internet markets depends on many factors, and is something well beyond the expertise of the Home Office.

Section 43 provides an exemption from disclosure of information where that information would harm commercial interests.

Releasing the requested information would increase the transparency of how the Home Office has implemented the European Directive. However, this public benefit is not sufficient to balance the detrimental effect upon law enforcement and separately the commercial interests at stake. It is therefore not in the public interest to disclose this material.

The Section 43 "justification" totally ignores the Information Commissioner's Office FOIA Guidance on this subject, following the rulings of the Information Tribunal:

Section 43 - Commercial detriment of third parties (.pdf)

[...]

A public authority which believes that the commercial interests of a third party will, or are likely to, be prejudiced must explain why this is the case.

• It will not be enough for the public authority to simply speculate as to why the third party's commercial interests would, or would be likely to be prejudiced; the third party where possible must be asked for their opinions.

• If the third party does not put forward any concerns regarding any prejudice to its commercial interests then a public authority should not speculate on their behalf.

[...]

The Home Office does not appear to have consulted any of the commercial internet service providers ad telecommunications companies,or even their industry competition regulator Ofcom about this, so they are just speculating about market conditions, which they have no expertise in.

The FOIA request does not ask for details of the amount of financial compensation (or state subsidy) being promised to individual companies, only for the names of the companies affected by the Regulations.

Smaller Internet Service Providers, or new entrants into the market, who are not receiving state subsidies from the Home Office, for the implementation of the Data Retention Regulations, may very well have something to say to the competition authorities, both in the UK and at the European Union level.

Therefore it is very likely that the Information Commissioner's Office will reject this Section 43 exemption, if it goes that far.

Communications Data is not just of interest to Law Enforcement public authorities, there can be a National Security aspect as well. It is somewhat surprising that the Home Office did not try to use the Section 24 National Security exemption as well.

However, Retained Communications Data is just as likely to be used or abused in civil court cases e.g. a Court Order in Copyright infringement or Divorce cases,

So there is a much wider Public Interest in the names of the companies which are subject to these Regulations, which is not directly concerned with Criminal Law enforcement

This FOIA request has, unusually, already sparked off an Internal Review and a complaint to the Information Commissioner's Office, even before this Substantial Reply / Rejection.

That Internal Review about the apparent silence and lack of any response (despite email Read Receipt acknowledgments of the original 2nd of June 2009 request and of the later reminder emails.

Hopefully the results of that Internal Review will be available by the end of this week.

Spy Blog will put in another Internal Review request (without much hope of the Home Office changing their minds), before having to complain to the Information Commissioner.

There appears to be something seriously wrong with the FOIA request management systems in the Home Office.

Even this Internal Review has now been delayed 3 times !

From: [IMS civil servant]@homeoffice.gsi.gov.uk>
To: "[email]
Date: Tue, 01 Sep 2009 12:07:56 +0100

Dear [name]

Further to my correspondences below, I regret to inform you that your
internal review (Time Complaint) is yet to be completed. I am
experiencing difficulty In ascertaining the specifics of the case and
have elevated these issues up the managerial chain. I apologise for
this ongoing delay and again assure you that I am doing everything in my
power to get the response issued to you as soon as possible. I now aim
to respond to you by no later than the 25th September 2009.

You have the right of complaint to the Information Commissioner, as
established by section 50 of the Freedom of Information Act. Please
find below the address you can write to him at:

Wycliffe House

Water Lane

Wilmslow

Cheshire SK9 5AF

Many Thanks

{IMS civil servant]
Information Management Service | Financial and Commercial Group
Ground Floor | Seacole Building | Home Office | 2 Marsham Street |
London SW1P 4DF
Switchboard Number: 0207 035 4848

-----Original Message-----
From:{IMS civil servant}
Sent: 14 August 2009 11:39 AM
To: [email]
Subject: nnnnn - [name] - Internal Review - Time Complaint -
Further Deadline extension and apology

Dear [name]

Further to my correspondence on the 30th July 2009, I must once again
inform you that your Internal Review (Time Complaint) has not yet been
completed. I apologise for this delay and assure you that I am doing
everything within my power to complete this Time Complaint review and am
also still pushing for the response to be issued in regard to your
original request for information.

I now aim to respond to you by no later than the 1st September 2009.

If you have any questions please feel free to contact me.

Many Thanks

[IMS civil servant]
Information Management Service | Financial and Commercial Group
Ground Floor | Seacole Building | Home Office | 2 Marsham Street |
London SW1P 4DF
Switchboard Number: 0207 035 4848

-----Original Message-----
From: [IMS civil servant]
Sent: 30 July 2009 3:14 PM
To: [email]
Subject: nnnnn - Internal Review - Time Complaint - Deadline extension
and apology letter

Dear [name]

I write further to my original correspondence below sent on the 20th
July 2009. I regret to inform you that the Internal Review (Time
Complaint) has not yet been completed. This is due to a number of
issues surrounding this case. I offer my sincerest apologies and now
aim to complete the review no later than the 14th August 2009.

In the mean time I will still be pressing that a response to your case
should be issued as soon as possible.

If you have any questions please feel free to contact me.

Yours Sincerely

[IMS civil servant]
Information Management Service | Financial and Commercial Group
4th Floor | Seacole Building | Home Office | 2 Marsham Street | London
SW1P 4DF
Switchboard Number: 0207 035 4848

-----Original Message-----
From:[IMS civil servant]
Sent: 20 July 2009 9:50 AM
To: [email]
Subject: nnnnn - Internal Review - Time Complaint - Acknowledgement
letter

[name]

I am writing to you in response to your request for an Internal Review
(Time Complaint) of the handling of your request within your email
received by the Home Office on the 16th July 2009.

I will be conducting the procedural review and the request case number
is nnnnn We aim to send you a response to this complaint by the 29th
July 2009. I will be in touch again shortly, but please do not hesitate
to contact me if you have any queries about the handling of your request
in the meantime.

Many Thanks

[IMS civil servant]
Information Management Service | Financial and Commercial Group
4th Floor | Seacole Building | Home Office | 2 Marsham Street | London
SW1P 4DF
Switchboard Number: 0207 035 4848

**********************************************************************
This email and any files transmitted with it are private and intended
solely for the use of the individual or entity to whom they are addressed.I
f you have received this email in error please return it to the address
it came from telling them it is not for you and then delete it from your system.

This email message has been swept for computer viruses.

**********************************************************************

The original of this email was scanned for viruses by the Government Secure Intranet virus scanning service supplied by Cable&Wireless in partnership with MessageLabs. (CCTM Certificate Number 2009/09/0052.) On leaving the GSi this email was certified virus free.
Communications via the GSi may be automatically logged, monitored and/or recorded for legal purposes.

Finally after a request for an Internal Review (which itself has been delayed 3 time - see next blog article), aand a complaint to the Information Commissioner's Office (which was to be resolved informally), here is the sort of reply we were expecting in the early part of June 2009:

From: public.enquiries@homeoffice.gsi.gov.uk Add contact
To: [email]
Date: Wed, 26 Aug 2009 16:14:53 +0100

Reference : Tnnnn/9

Thank you for your e-mail enquiry of 02/06/2009 11:06:56 AM

An Interim reply is attached.

---------------------

Direct Communication switchboard 020 7035 4848
Fax: 020 7035 4745
Textphone: 020 7035 4742
E-mail: public.enquiries@homeoffice.gsi.gov.uk Website: www.homeoffice.gov.uk

[email]
[name]

Reference: Tnnnn/9

Dear [name],

Thank you for your e-mail of 02/06/2009 requesting the names of companies that have received notices under the Data Retention (EC Directive) Regulations 2009. I can confirm that this information is held, but I regret that we are unable to send you a full response to your request within 20 working days, as required by the Freedom of Information Act. This is because we are considering whether or not the information should be disclosed.

In reaching that decision, we need to consider whether Section 31 (Prejudice to Law Enforcement Concerns) or Section 43 (Commercial Interests) apply and whether disclosure of the information would be in the public interest.

I would like to apologise for this delay and for any inconvenience that this may cause. I would like to assure you that we are dealing with your request as a matter of urgency, and that we will send you a full reply as soon as possible. We now aim to send you a full reply by 16 September

If you have any queries about the handling of your information request in the meantime then please do not hesitate to contact me.

Yours sincerely,

[name of civil servant]