Open season

The GLA's London Data Store has been hailed as a major step forward in making information available to the public. Elaine Fletcher looks at the legal challenges involved.

The Greater London Authority's commitment to establishing the “London Data Store" website will be welcome news for many supporters of freedom of information. The GLA proposes “all GLA Group data that would be released under Freedom of Information requests will be available via the Data Store”.

The GLA’s stated aim of facilitating greater transparency and more efficient management of information requests, is in principle simple and to be applauded. However the legal complexities of ensuring information is not unlawfully published, and the practicalities of selecting information suitable for website publication, may not be so simple.

Under the Freedom of Information Act 2000, ("FOIA"), the GLA is obliged to adopt and maintain a publication scheme setting out the classes of information which the authority publishes and how it intends to publish the information, and respond to individual requests for information under the general right of access to information (“general requests”).

It is not yet clear whether London Data Store is merely intended as a massive “upgrade” to the GLA’s existing publication scheme, or alternatively to merely create an online mechanism for making general requests. It may even intend to incorporate both these elements. Making the distinction will be fundamental to ensuring the GLA properly discharges its freedom of information law (“FOI”) obligations, and applies the correct charging regime. Under Section 21 FOIA, information is exempt from disclosure under a general request if it is reasonably accessible to the applicant without making such a request. Therefore, in practice, information referred to in a publication scheme is generally exempt information.

An important consideration is whether information which is only available from the GLA through the particular medium in question, ie the proposed website, and not reasonably accessible elsewhere, would be “reasonably accessible” for the purpose of the Section 21 exemption. Not all households and businesses have internet facilities or easy access to such facilities. If this exemption did not apply, the emphasis could return to using general requests to obtain the information, thus calling into question whether the efficiencies envisaged are achievable.

Using a website as a medium to provide information, whether this be through the publication scheme or general request route, appears an economical method to adopt. However, London Data Store would need to be underpinned by a very sophisticated process. Licensing, confidentiality, and data protection laws, and contractual obligations to its suppliers and commercial partners are but a few risks that the GLA would need to mitigate. The information would need to be assessed and possibly cleansed before appearing on London Data Store. “Volunteering” the information ie providing it where there is no requirement to do so under FOI, and doing so in a way which makes it available en masse, presents much a greater risk than leaving it to people to make general requests. The magnitude of the task of ensuring legitimate disclosure should not be underestimated, and could potentially defeat the key objectives of the scheme.

Limiting information on London Data Store to raw or statistical data would not of itself address these concerns. To take but two examples of data sets proposed for publication which are far from risk free in terms of information law:

• Health statistics may not necessarily name specific individuals, but the potential for indirectly identifying an individual, and revealing private or particularly sensitive information about them, cannot be ignored, especially where the volume of information involved is significant.
• Information about gifts and in hospitality registers could include personal data about the GLA staff and other individuals.

There are a number of exemptions in FOIA which allow information to be withheld, for example if it is personal data the disclosure of which would otherwise breach the Data Protection Principles in the Data Protection Act 1998 (“DPA”) - Section 40 or where disclosure of information obtained by the GLA would constitute an actionable breach of confidence - Section 41.

Data protection and confidentiality laws would not necessarily prevent disclosure. Should they do so, then generally the information would be exempt from disclosure under FOI. Voluntary publication of exempt information therefore requires detailed scrutiny to avoid legal exposure. The disclosure exemptions and inherent public interest considerations in FOIA, the definition of "personal data" and requirements of fair and lawful processing in the DPA, and the twists and turns in evolving case law on confidentiality and privacy are complex issues. Experience shows that the practical application of FOI in relation to these regimes is challenging, time-consuming, and legally uncertain.

Personal information is not the only type of information that is potentially problematic. Disclosure of information even in its rawest state could be commercially damaging to the GLA itself and/or third parties or could reveal trade secrets. Similarly the exemption and public interest test in Section 43 FOIA, designed to address such issues, would need careful analysis before such information could safely be routinely published. Often in these situations it is necessary to seek and consider the views of potentially affected third parties.

Given the broad reach the GLA is seeking to achieve, it seems inevitable that London Data Store would provide “environmental information”. Such information falls to be considered under the separate regime of the Environmental Information Regulations 2004 (“EIR”). Although they share a common theme, FOIA and EIR provisions do not mirror each other, and again disclosure of environmental information would merit careful consideration.

Crucially, FOI exemptions cannot safely be applied to information or datasets in a blanket or wholesale fashion. General requests have to be considered in context - what is sensitive or damaging in one case may not be so in another. The timing of publication can be of fundamental importance as the sensitivity or confidentiality of information may erode with time. Also, the use of the same information in two different sets of circumstances may amount to the processing of personal data in one but not in the other.

It is not to say that certain GLA information cannot be cheaply and readily identified as suitable, or cleansed in preparation for general publication through London Data Store. An important consideration is whether the cost of doing so would be proportionate to the number of people who would otherwise have been genuinely interested in or made a general request for such information. The GLA itself acknowledges that there are a number of risks associated with this proposal that need to be mitigated, and that robust protocols, guidance and training must be developed and put in place. It remains to be seen whether a scheme could cope with the significant underlying demands of legitimately publishing information on such a grand scale. The intention is undoubtedly good - the devil will be in the detail.

Elaine Fletcher is a Senior Associate with Eversheds' Information Law practice, and can be contacted at This email address is being protected from spambots. You need JavaScript enabled to view it.