Privacy and FOICompliments and Conflicts

David BanisarPrivacy International

© Privacy International 2009

2

Complimentary Rights Complimentary rights

“not mutually distinct but form part of the overall information policy in society.” - CoE

“two forms of protection against the Leviathan state that have the aim of restoring the balance between the citizen and the state” - French Privacy Commissioner

“to continue maintaining the non-transparency of citizens in a world that has undergone the information revolution while rendering transparent of the state”. - Hungarian Info Commissioner

“The Swiss legislator rightly considered that these apparently contradictory rights were reconcilable and pursued the same objective, to wit, the defence of a democratic society which respects fundamental rights and freedoms.” Swiss Federal Data Protection and Information Commissioner

3

Complimenting rights

Subject Access ECtHR – Use Article 8 on privacy to obtain

information Use of FOI to reveal government abuses

Use of RIPA by local councils

5

Conflicts

Access to personal information about public employees

Access to personal information about public held by public bodies

6

Defining Personal Information EU Data Protection Directive

'personal data 'shall mean any information relating to an identified or identifiable natural person ('data subject'); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;

UK DPA 1998“personal data” means data which relate to a living individual who can be identified—

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual; “personal data” means data which relate to a living individual who can be identified 7

De-identification and Re-identification

De-identified data not personal information so can be freely released and used.

Newly emerging field that combines identified databases to find commonalities

8

Authorizing access

Not personal information Authorized by law

ECJ – Osterreichischer (2003) C-465/00 Journalistic purposes

• ECJ Tietosuojavaltuutettu (2008) C-73/07

Senior officials have less expectation

9

Public Interest

Personally identifiable information can be released if public interest is higher that harm. Enhance scrutiny Effective oversight of expenditures Dangers to public health or safety

10

Managing conflict

Ireland, Canada, S. African FOI Personal information - “be known only to the

individual or members of the family, or friends, of the individual” or is confidential. 12 paragraphs of examples of personal information including “educational, medical, psychiatric or psychological history”, financial affairs, religion, tax and identification numbers.

11

More Information

www.privacyinternational.org/foisurvey www.privacyinternational.org/phr