Line to take - LTT167 - Consent

• FOI/EIR: FOI, EIR
• Section/Regulation: s40, reg 13
• Issue: Consent
• Source: Policy Team
• Details: Creekside Forum / DCMS; De Mello / Environment Agency
• Related Lines to Take: LTT57, LTT92, LTT163.
• Related Documents: EA/2008/0065 (Creekside), EA/2008/0054 (De Mello)
• Contact: HD
• Date: 17/02/2010
• Policy Reference: LTT167

Line to take

Where the data subject consents to the disclosure of their personal data within the time for statutory compliance with the request, then this disclosure will generally be fair and can be used to satisfy Schedule 2, condition 1.

However, in all other circumstances, the Commissioner will take the data subject’s comments into account insofar as they represent an expression of the views of the data subject at the time of the request had they given any thought to the issue at that time and these views will help to inform the analysis of fairness.

Further Information

The Issue

It is unlikely that the public authority will be in a position to anticipate most FOI requests to enable them to seek the consent of the data subject prior to the processing of their personal data to comply with the FOI request. Instead it is more likely that the public authority will receive a request and then contact the data subject to see whether they would consent to the disclosure of their personal data in complying with the request.

This is problematic for two reasons:

• Given that the consent or refusal has been obtained post-request this represents a change in circumstance from those that existed at the time of the request and the time for statutory compliance and thus, according to LTT92, could not be taken into account. The line says as follows:

Consideration of the exemptions and public interest test is to be based on the circumstances as they existed at the time of the request or at least by the time for compliance with sections 10 and 17 FOIA.

Although, matters which were relevant at the time of the request but which only later came to light may also be taken into account.

• Where the data subject has refused consent it may be argued that having been asked to give consent but having refused this would increase their expectation that their personal data would not be disclosed. If this were to be accepted then this would mean that where a data subject had refused to consent, it would be unlikely to be fair to disclose the information as it would not be within their reasonable expectations.

The Commissioner’s Approach

The Commissioner would not wish to consider a view which had been provided post- request to be taken into account contrary to LTT92 but nor would he wish to dismiss this outright. This is because the data subject may have provided additional and valuable information about the impact of the disclosure on them including any circumstances unique to the data subject and/or the circumstances in which the information was initially obtained and how this established their expectations as to its further use. In addition, in order to comply with his obligations under the Human Rights Act, the Commissioner would also be required to consider any submissions from the data subject.

(1) When asked by the public authority, the data subject HAS consented to disclosure

Where a data subject has consented to a disclosure of their personal data, an informal resolution is more likely. However, if it is necessary to consider this point in a decision notice then the Commissioner will adopt the following approach:

(i) Where a data subject has consented to disclosure of their personal data, it is useful to consider the following to ensure that any informed consent is obtained:

• Was the data subject fully aware that they were consenting to a disclosure to the world at large?
• Was the consent explicit (particularly where sensitive personal data is involved)?
• Was the data subject vulnerable in some way e.g. age?

This approach was supported by the Tribunal in the case of the Creekside Forum v IC & the Department for Culture, Media and Sport when it said that it would “...have been appropriate to have had evidence clarifying the circumstances on which consent was sought...” (para 58).

(ii) Where the informed consent is in place at the time of request or within the time for statutory compliance then the case-officer may want to include the following standard paragraph:

“The Commissioner notes that the data subject has consented to the disclosure of their personal data within the time for statutory compliance with this request. The Commissioner is satisfied that the consent was freely given and informed and in particular that the data subject was aware that a disclosure under the FOIA is effectively to the world at large. As such, the Commissioner considers that it would be fair to disclose the personal data in this instance.

The Commissioner also considers that this consent can satisfy condition 1, Schedule 2.”

Where the data subject provides his/her response outside the time for statutory compliance, then their consent is not valid consent for Schedule 2, condition 1 purposes.

However, the data subject’s response can be taken into account insofar as it represents an expression of the views of the data subject which they already held at the time of the request had they given any thought to the issue at that time i.e. the data subject already held these views at the time of the request but they only came to light when they were asked for their consent. Further, although the presence of consent is not entirely determinative, it is likely to be an important factor to take into account as part of the wider analysis of whether it would be fair to disclose the personal data in the case.

(2) The complainant indicates that the data subject HAS consented to the disclosure

Where a complainant indicates that the data subject has consented to the disclosure of their personal data, the Commissioner would need to confirm that this consent was genuine. This may require the public authority checking with the data subject or confirming the authenticity of the email or letter containing the consent. Once this has been confirmed, then points (i) to (iii) above should be considered.

(3) The data subject HAS NOT consented to disclosure (or the data subject has not been asked to give consent))

Where the data subject has expressed a refusal to consent to the disclosure of their personal data either within the time for statutory compliance or at some later date, then the Commissioner will adopt the following approach when considering fairness:

(i) The expression of a refusal to consent is not absolutely determinative in the decision as to whether the data subject’s personal data will be disclosed.

(ii) Instead, the data subject’s comments will be taken into account insofar as they represent an expression of the views of the data subject which they held at the time of the request had the data subject given any thought to the issue at that time i.e. the data subject already had these views at the time of the request but these views only came to light when they were asked for their consent. As such, the data subject’s views can be taken into account in any analysis of fairness.

However, as part of the fairness analysis includes a consideration of the data subject’s reasonable expectations, a data subject may argue that their expectations have been shaped or reinforced by the process of seeking, and their refusing to provide, consent.

The Commissioner’s view is that where a data subject refuses consent this will be based on how they already feel about the information even though they may not have actively considered their views on a potential disclosure and thus the act of seeking consent simply prompts the data subject to consciously form a view on the issue of disclosure and to articulate that view to the public authority. Therefore although the refusal of consent can be seen as a reflection of the expectations of the data subject, it should not be seen as something that affects or informs those expectations.

It also remains important to still consider whether it is reasonable for the data subject to object to the disclosure. In some cases, it may also be possible for the data subject to provide details of the reasons why their individual circumstances may affect fairness, or shed light onto the circumstances which may lead the public authority to conclude that the data subject had a reasonable expectation that the information would remain confidential.

Therefore, the Commissioner will not give any further weight or consider that the data subject’s expectations have been reinforced where the public authority has returned to the data subject claiming to be seeking their ‘consent’ but will take into account the additional detail provided by the data subject as to the circumstances and issues that existed at the time of the request.

(*) — This should not be confused with cases involving s10 DPA notices.

Note for Case-Work / Investigations

There is no obligation on a public authority to seek the data subject’s consent to disclosure.

It is up to the case-officer to decide whether it would be useful to suggest to the public authority that the views of the data subject be sought as in borderline cases or those involving a small number of data subjects, it may be worth pursuing this point. However, in other cases where a large number of data subjects are involved or where it may over- complicate the investigation and any decision notice, it may be impractical or a disproportionate use of public funds to pursue this point.

In the EIR case of De Mello and the Environment Agency (EA/2008/0054), the Tribunal commented:

“50. The Tribunal has, however, some sympathy with the Appellant’s point that -- in this kind of situation -- a check by the EA with the original complainant, to see whether there was any objection to releasing the letter, might have resolved the situation and saved a significant cost to the public (even in the limited circumstances of a paper hearing of the appeal). It may be that the EA and other such public bodies wish to review their initial procedures in situations such as this -- not because it is a matter of law but simply because it is a matter of common sense -- but that is a matter for them. There may well be cost implications that make such procedures difficult to introduce but, if the writer of a letter of complaint is happy for it and the personal data within it to be disclosed in the end, anything that saves public bodies and Appellant’s such as Mr de Mello from having to spend time and effort debating the disclosure of such information should be encouraged”.