Freedom of Information: What it means to you

Transcription

1 Freedom of Information: What it means to you Presented by Rachael Maguire 10 May 2005 Hello, I m Rachael Maguire, the new Records Manager, and I ve been invited to talk to you about Freedom of Information. As this division deals with personal information all the time, I m also going to focus on data protection as the interface between the two is going to be important. 1

2 Freedom of Information: What it means to you What is Freedom of Information What is Data Protection Recognising requests Processing requests Other responsibilities/rights I asked Sofia to give me some idea of what your concerns were so I could tailor the presentation accordingly. So I ll be going through: Read out list 2

3 What is Freedom of Information? Right of access to public information Right to know information exists Right to information if not exempt Two main responsibilities Requests for information Publication Scheme Governing body covered So what is Freedom of Information? It gives the general public 2 rights regarding information produced by public bodies, of which the School is one: Right to know that information exists Right to the information in the format they choose unless the information is exempt This is intended to promote an culture of openness, changing the public sector from a culture where only certain information is released and most kept hidden to one where everything is available except for some information which is subject to exemption e.g. personal information. The Act gives public bodies, including the School, 2 main responsibilities: -To respond to all requests for information as if they were requests under the Act -To publish certain classes of information on a regular basis via a Publication Scheme. I ll talk about the Publication Scheme later on, but I ll go through requests for information now. -Only the governing body is mentioned in the act as being covered. We have taken this to mean, and this has been backed up by the Dept Constitutional Affairs, that this covers the governance and administration of the School rather than the teaching and research materials produced by academics. For example, records relating to the contract for research, staff performance during research, etc are covered, but not the research data itself. Recruitment records are covered unless they relate to a particular person, in which case, they are covered by Data Protection 3

4 What is Data Protection Personal information Normal vs Sensitive personal information Exemption 40 (1) & (2) Some case law JISC Data Protection CoP -Data Protection covers personal information, that is, information that relates to a specific individual who is alive. The act also covers how that information is processed, that is used, stored and distributed. This is specified by the 8 principles detailed in the Act. The recent Act extended the coverage of the Act to structured manual data as well as electronic information. -The Act makes a difference between normal personal data, e.g. name, address, telephone number and what it calls sensitive personal data. Sensitive personal data includes race and ethnicity, sexual orientation, trade union or political party membership, amongst other things. While implicit consent for processing is required for non sensitive personal information, explicit consent is required for sensitive personal data. -The Data Protection and Freedom of Information Act intersect at Section 40 of the FoI Act which sets up exemptions for personal information requests. Section 40(1) deals with an individual requesting information about themselves and automatically and absolutely turns the request into Subject Access request under the DPA. Section 40(2) deals with an individual requesting information about other people. This is a public interest test exemption, if it is in the public interest then we might still need to release the information. For example, Steve Harris was asked for the percentage breakdown of staff by gender and by salary supplement for each gender within a division. Although this is personal, it is in the public interest that the School is seen to be treating staff fairly and as the information being asked for was statistical, it was released. -Being an older Act (the first DP Act came into force 1984 and the current in 1998), there are many judgements by the Information Commissioner and some case law that offer more guidance on DP than we have for FoI. One particular judgement, the Durant case, stated that the mere mention of a name in a record was not personal data. The record has to be about the person to constitute personal data. For example, the forms written during my interview are personal as they are about me, while Rachael spoke about FoI in the notes for a meeting wouldn t be. The main impact of this is to cut out the time taken to search for records about someone. -A useful tool on DP is the Code of Practice written by JISC, which is specifically written for the HE/FE sector. Please me if you want the link at any time. 4

5 Recognising requests FoI vs DP In writing Who receives request FoI Champions So how do you tell the difference between a Data Protection Subject access request and a request that fits under Freedom of Information? It is probably easiest to decide if something is a Subject Access Request under DP. This leaves pretty much all the others as FoI (unless it is environmental information, in which case it is covered by the EIR). The question you need to ask is: Is the request relating to information about a person or for information that could identify a person? If so, it is likely to be covered by DP. Both FoI and DP requests have to be in writing. However, if it sounds like someone is verbally requesting information, you should ask them to put it in writing so they can get the information they need. Requests can be received by any staff member, they don t necessarily have to come in to me and they don t have to say that they are asking for information under FoI or DP though some of them do. This means it is up to us to decide which piece of legislation applies. If it is someone obviously making a subject access request, please send it to me, as I have now taken over responsibility for DP. An example of a request covering both bits of legislation came in recently, where the requestor, a staff member, asked for information relating to them, details of what was required for someone in their position and the details of their staff. The first of these is data protection, and the person is entitled to this information. The second which relates to the position is not personal information and can be released under FoI. Information about other people is also data protection, but in this case because it relates to other people, it cannot be released unless those people put in a request for it. However, as it relates to staff the requestor manages, they could come in to see it in the HR offices. This is fairly complicated, but it gives you an idea of what you could be facing. If you aren t certain which legislation to process a request under, contact one of the HR FoI Champions (Lisa Morrow, Steve Harris or Sally Welch) or me and we can advise you on it. 5

6 Processing requests 20 working days to respond Initial response Clarification Exemptions Does an exemption apply Public interest test & other tests Supplying information Once a request is received, we have 20 working days to respond for FoI requests (and 40 days altogether for DP). I always send out on the day a response confirming that the request has been received and saying what day the School will respond by and I think this is good practice and encourage you to do it If you get a request where you are not sure what is being asked for, if the request is too broad and needs narrowing down or if you have some information but aren t sure if it completely matches the requests, go back to the person requesting the information and ask for further clarification. At this point the clock will stop and only start again when you get a response. There are 23 exemptions, though only 13 are likely to be used by the School. I ve mentioned section 40 which will be the one that you are most likely to be using. Always check with one of the FoI Champions or with me before you apply an exemption as there is quite a process which I ll go through now. Exemptions are subject to several tests: First, does an exemption apply? This can t be decided before you look at the information, it has to be decided once any information relating to the request has been gathered and read through. Then there is the public interest test. Some exemptions are absolute, which means you cannot release the information, while others are qualified. Qualified exemptions are subject to the public interest test. We have to balance whether it is in the public interest to release the information or whether it should remain exempt. Other tests relate to whether releasing the information is likely to do harm (the prejudice test) and how old the information is as only some exemptions are perpetual and last forever whereas others last only for 30 or 60 years. Once you have found all the information, decided whether it is exempt or can be released, send it out to the requestor. It is worth noting on the original what you sent out, I have done so by writing Released under FoI at the top right hand corner of the page. If it is electronic information that has been released, you could easily rename it and add FoI to the title. 6

7 Other responsibilities/rights Publication Scheme Your rights under FoI I mentioned the Publication Scheme earlier. Anything we want to publish on a regular basis should be made available through the Publication Scheme. If you find you are being asked for the same information on a regular basis, please tell me and I can get it up on the Publication Scheme for you. To finish, you also have rights under the Act. If there are any questions you want to put to any organisation, please feel free to ask if you want any help framing the questions or getting a response. 7

8 Freedom of Information Any questions? I ve hopefully covered the areas in Sofia s documet, but are there any further questions? 8