Whilst local authorities are busy working on the front line of the current pandemic, much of their day to day work will be affected by the way that information law rights are handled.
Right now, data is key. Whether the sharing of personal data to assist in providing effective care to communities; understanding how freedom of information rights are designed to ensure transparency in public decision making; or reframing processes and procedures to deal with resourcing pressures, local authorities have a lot to consider when it comes to information law rights.
So, the way that the Information Commissioner's Office (ICO) reacts to the crisis and adapts its regulatory position is more important than ever and, as a public authority itself, the ICO must regulate appropriately and take into account these extraordinary circumstances.
The ICO's earlier guidance on compliance with the information rights framework during the current pandemic, and its focus on being a "reasonable and pragmatic regulator", has now been updated. In its latest and more substantive update, the ICO has provided more detail about how it is reassessing its priorities and resourcing to focus on those areas that is considers likely to cause the greatest public harm. It has specifically recognised the current pressures and challenges faced by the public sector meaning that resources are being re-deployed, and the impact of the virus is being felt on finances and cash flows.
A welcome change?
So what can we expect to see from the ICO in the coming months when it is dealing with data protection and freedom of information matters - is it all still business as usual? Not quite.
Whilst local authorities must keep both personal data and freedom of information law rights in mind as they make decisions under pressure, it is welcome news that the ICO will take into account the impact of the potential economic or resource burden that its actions could have.
The updated guidance from the ICO on its regulatory position highlights the following key issues for local authorities.
Advice and assistance
- Advice and guidance for public authorities and those on the front line will be fast tracked to assist with tackling the pandemic, including how information rights are affected and can be protected. Any practical advice that the ICO can provide, particularly around data sharing initiatives designed to respond to the crisis will be welcomed.
- For those within local authorities charged with dealing with information law rights, the public will be advised on how they can expect to exercise their rights during the crisis, with longer wait times for responses to Data Protection Act (DPA), Freedom of Information Act (FOIA) and Environmental Information Regulation (EIR) requests being anticipated.
Enforcement
- The ICO will continue to act proportionately and balancing the "benefit to the public of taking regulatory action against the potential detrimental effect of doing so". When considering public complaints, the ICO will take into account the impact of the crisis, possibly by resolving issues without reference to the organisation in question, or providing longer timescales than usual to remedy issues or respond to investigations. This will be particularly welcome news in the public sector where resources and finances are being hit.
- Data breaches should continue to be reported within the usual timescales, but where those tight timescales cannot be met as a result of the impact of the current crisis – perhaps due to resource challenges - the ICO will take an "appropriately empathetic and proportionate approach".
- There may be less use of formal ICO powers when investigating organisations for breaches of the legislation, and there are likely to be fewer investigations as the ICO focuses on key issues of serious non-compliance. Fines may also reduce in number and magnitude as the ICO takes into account the financial and resource impact of COVID19. However, any organisation breaching the legislation to take advantage of the current crisis can expect strong regulatory action from the ICO.
- Formal regulatory action in relation to outstanding information request backlogs will be suspended.
- In relation to freedom of information rights, the ICO will remain pragmatic and empathetic to the current crisis and its affects on resourcing, but will balance this with the need to ensure transparency in public decision-making at this critical time.
- Whilst public authorities may find it difficult to process FOIA or EIR requests and to address back logs, the importance of transparency should not be underestimated. Public authorities should continue to comply as far as they are able to do so, particularly in respect of high risk or high profile matters.
- Where information is particularly important to the communities they serve, public bodies should be proactive in publishing relevant information.
How can local authorities benefit?
The ICO's regulatory position will be kept under review, with any further updates being provided in due course. For now, the key message from the ICO is that the challenges being faced by all organisations, but particularly within the public sector, are understood by the ICO as it adapts its regulatory regime accordingly.
Whilst the ICO is keen to stress its flexible and pragmatic approach to regulation, the crisis cannot be used as a reason to ignore information rights altogether. At the forefront of dealing with the pandemic, more than ever local authorities are rapidly making key decisions that will affect the lives of many, and are handling personal data in new and innovative ways. Whilst data protection should not be used as an unnecessary barrier to innovation, to furthering the public interest, or to protecting lives, the importance of data protection rights cannot be underestimated.
Likewise, the interest of the public, press and partners in local authorities' decision making processes, strategic aims and political views, will increase as the crisis continues, and will no doubt continue once the peak of the pandemic has passed. The use of FOI requests to gain information from local authorities is not a new concept, but we expect that these will become a vital tool for individuals or groups seeking to make political capital from the crisis, or to scrutinise decision making. The ICO has been clear that it will continue to champion FOI rights to ensure that public bodies can be held to account, long after the crisis has abated.
Whilst the ICO's latest update is welcome news for public bodies, in order to make the best of the ICO's approach, transparency, risk assessments and appropriate record keeping will be key. Those that cannot demonstrate that information law rights remain an important part of democracy will be unlikely to be at the receiving end of the ICO's generosity.
