Thank you for your comments and clarification of
PII.
Consider the following situation:-
"X provides the police with information which it is
determined by the police will be covered by PII. X's identity is
allegedly disclosed by Y to Z. X complains about the disclosure of their
details as their welfare is affected. It is determined there will be no
criminal prosecution of Y.
Y and Z make subject access
requests. Y and Z are mentioned within the PII documents provided by
X, and they are held on computer. The contents of some of these documents
are also known to Y, who was instrumental in the compilation of a few of
them."
Section 7(4a) would apply to some of the data but
Section 7(5) determines that a level of disclosure is required.
Section 7(6a) and 7(6d) would appear to merely help in determining the level of
editing required prior to disclosure.
Even if a court determined PII, disclosure of some
of the data would still seem to be required. An interesting
situation.
Pat Walshe has mentioned the CPIA 1996. My level of knowledge of that
act, as it affects PII and the DPA subject access provisions is clearly in need
of enhancing so some research is indicated. Meanwhile all comments
are most welcome.
Ian Welton
----- Original Message -----
Sent: Thursday, March 16, 2000 7:15
PM
Subject: Re: Public Interest
Immunity
Public interest immunity is not particularly aimed at protecting
individuals. It is also used to protect high level (or sometimes, as the
Scott Inquiry showed, low level) policy advice; the work of the security
services; international relations; the flow of information from confidential
informants to regulatory bodies, etc.
It relates purely to disclosure for the purposes of legal proceedings. Eg
where an application for discovery is made, the public body can ask the court
not to order disclosure of particular information, on the grounds that to do
so would be injurious to the public interest. The court balances the public
interest in non-disclosure of that information against the need to disclose
for the purpose of the administration of justice.
If a data protection case against, say, a police force comes to court,
and the plaintiff applies for discovery of police intelligence files,
the police might ask the court to refrain from ordering disclosure on grounds
of public interest immunity.
Other than that PII is probably not relevant at all to subject
access. Section 27(5) of the DPA 1998, explicitly provids that the
subject information provisions take precedence over "any enactment or rule of
law" restricting disclosure or authorising withholding of information.
This isn't inconsistent, since the concerns that might prompt a PII claim
in legal proceedings are already addressed in the subject information
exemptions in Part IV of the Act (national security, law enforcement,
protection of regulatory functions etc) or the provisions protecting the
identity of sources in 7(4).
The only basis of a PII claim not obviously dealt with in the exemptions
is policy advice, presumably because policy advice is unlikely to consist of
personal data.
Maurice Frankel
At 4:57 pm +0000 16/3/00, Ian Welton wrote:
Subject Access and Public Interest
Immunity (PII)
Has anybody been involved in, any interest in,
or any knowledge of the balances in this area?
PII is where the public interest is believed to
be served by maintaining the confidentiality/secrecy of particular articles
or documents. It is commonly used to protect persons in vulnerable
circumstances.
Where a data subject requests access they have
an entitlement which "should prevail over any provisions to the contrary
contained in any other acts statutory instruments or rules of law." (The
Guidelines. Third Series. November 1994. Section 2.38.) This gives
rise to the circumstance that where a claim of PII is made for a document(s)
and a subject access request is made, the reply must contain the document(s)
covered by PII.
The existence of PII appears to be to protect
individuals. Subject Access does not allow access to data relating to
other individuals without their permission, and as such PII appears to
be incorporated within the data protection regime. e.g. A person
is protected within the subject access regime because their information
cannot be disclosed to others without their permission.
There appear to be many arguments and counter
arguments in this stance. An informed debate would be most
welcome.
Ian Welton
Force Data Protection Officer
Nottinghamshire Police