Information law in the Facebook age

Anya Proops reviews two recent cases – one involving a borough council and a planning application – where the use of information of Facebook was central.

Facebook has now been in existence for some eight years. Its active users exceed 900 million. However, we are still very much in the early days of understanding how information law applies to information, including personal data, which is stored and shared on Facebook. In this context, it is worth noting two recent judicial decisions which bring into sharp focus the way in which information on Facebook may be both used and misused.

The first case involved a claim brought in the High Court by Nicola Brookes. Ms Brookes had been subject to extremely serious abuse on Facebook after she posted a comment online supporting a contestant on the X-Factor. The abuse included the setting up of a fake Facebook page which purported to be in her name and which resulted in Ms Brookes being falsely accused of being a paedophile and drug-user. Ms Brookes’ abusers of course operated anonymously so there was no way for Ms Brookes to identify them merely by use of the site.

Having then apparently failed to obtain details of the identity of the abusers directly from Facebook, Ms Brookes was obliged to apply to the court for a Norwich Pharmacal order requiring Facebook to disclose the names, email addresses and IP addresses of the people who had launched the abusive messages. It is understood that this may be the first case in which an individual has been able to secure a court order requiring Facebook to disclose personal data about its users. No doubt, this judgment (which it seems has yet to be reported) sends out an important message to those individuals who would wish to engage in anonymous cyber-bullying. However, query just how much reassurance the judgment gives to those who realistically are not in a position to incur the considerable costs entailed on engaging in the type of litigation which Ms Brookes was obliged to undertake.

The second case involved the application of s. 40 FOIA (the personal data exemption) to the names of a number of Youth Councillors, including a number of Youth Councillors who were minors, in circumstances where it was discovered after the Commissioner issued his decision notice that many of the names could be found by accessing an effectively public-facing Facebook page: Morley v IC & Surrey Heath Borough Council (EA/2011/0173).

The background to the Morley case was as follows: in 2010, the Council approved a planning application to allow for the creation of a recreation park within its area; as part of the planning process the Council unofficially consulted the Surrey Heath Youth Council; the Youth Council is funded by Surrey County Council and comprises youth councillors who are all aged between 13 and 19; after the planning application was approved, Mr Morley, who objected to the development, requested disclosure of the names of the members of the Youth Council who had been consulted by the Council; that request was refused by the Council on the basis that the names amounted to personal data which were exempt from disclosure under s. 40.

It appears that after the Council refused Mr Morley’s request, Mr Morley discovered that the Youth Council had a Facebook page and, further, that information on that page included the names of various Youth Council members along with their photographs. Mr Morley’s position was that all the names should be released on the basis that there is a strong need for the planning process to be fully transparent and that this principle applied equally to those who are unofficially consulted and, indeed, irrespective of whether they may have been minors at the time they were consulted or, further, at the time of the request. He further submitted that there was in any event no proper justification for withholding the names of those Youth Councillors who had voluntarily agreed to place their data on a Facebook page which was open and accessible to anyone who registered with Facebook. The Commissioner and the Council argued before the Tribunal that all of the names should be withheld, not least because it could not be assumed that the individual Youth Councillors listed on the Facebook page had been listed at the time of the request.

By a majority decision, the Tribunal concluded that s. 40 was not engaged with respect to the Youth Councillors who were listed on the Facebook page but that it was engaged in respect of the other Youth Councillors. With respect to those Youth Councillors who were listed on Facebook, the Tribunal held as follows:

"77. … their decision to put their names and photographs into the public domain considerably diminishes the strength of the respondent’s arguments for why disclosure of their names would not be fair. In particular, arguments that they may not have expected that the information would be disclosed, that they have not consented to their names being disclosed, and that disclosure would cause them distress, rapidly fall away, in our view, where the Youth Councilors have themselves chosen to make the information available in a widely used and easily accessible social networking site, without placing any restrictions on access. In our view, it cannot be said to be unfair to disclose the names of the Youth Councillors whose names appear on Facebook."

With respect to the argument that the names should still be withheld because it could not be assumed that the individuals in question were listed on Facebook at the time of the request, the tribunal said this:

"80. However, while we acknowledge the problems identified by the Council and Commissioner, FOIA does not require a public authority to comply with a request only when the information it holds precisely matches what the requester has asked for. A requester will often have the disadvantage of not knowing exactly what the public authority holds. What the public authority must do in this situation is to engage with the requester, pursuant to its obligations under section 16 (obligation to provide advice and assistance), to explore whether the information it does hold, even if imperfect, can satisfy the request. The Council has not done this. We do not criticise it. We are mindful that the Council was not aware of the Facebook page at the time that it refused the request, and in any event has taken the position that the information is exempt. However, the mismatch between what the Appellant has requested and what the Council can provide is not itself a reason for refusing to disclose the information under section 40(2), nor is it a basis on which disclosure can be said to be unfair."

With respect, it is not entirely clear how these points answer the argument which the Commissioner and the Council was advancing. But perhaps the more important point emerging from this decision is that it suggests that individuals, even where they are minors, must have a substantially lower expectation of privacy in respect of their personal data in circumstances where they opt to place that data on an effectively unrestricted Facebook page.

Anya Proops is a barrister at 11KBW. She is a regular contributor to the set’s Panopticon Blog on information law.