Access to information: mind the gaps

EARLIER this year the Information Commissioner’s Office published its “case for reforming access to information law” in which the Information Commissioner, Elizabeth Denham, said the current law was “no longer fit for purpose”. The report was called Outsourcing Oversight because it focused on concerns about the lack of access to information about private companies working for public organisations. These concerns had been raised in 2016 by the Independent Commission on Freedom of Information Report and were amplified by the tragic events at Grenfell Tower and the collapse of Carillion. But while the law needs to change, the ICO continues its day job. Gill Bull is Director of FOI Complaints and Compliance at the Information Commissioner’s Office (ICO). She leads a team of around 55 information rights professionals who ensure public authorities give people access to the information that they have a legal right to. And while she is keen for the law’s reach to extend and give the public the access they have a right to, she is also addressing the problems that prevent the existing legal framework from achieving its potential.

Big picture
The gap between the world now and the world when information rights were created is growing: the old laws remain unchanged while the information world changes at speed. Gill says this is a pitfall of being an early adopter: “Sweden was first [to enshrine the public right to access information] and UK laws are in the second tranche. It’s an inevitability of the way public services are provided, and how public expectations change – it means that legislation becomes out of date and that’s the case that we make in Outsourcing Oversight. Once our legislation was at the forefront but, in some ways we are now lagging behind.” While crises like Grenfell have highlighted the issue of access to information from public sector contracts with private sector firms – outsourcing – Gill points to another fundamental area that the law is not yet addressing. She says: “The context is more challenging now, not least because of the digital age that we are living in. When the legislation was designed it was very much a paper-based world and the way that decisions are made now is faster and not necessarily documented on paper. We’re making decisions in a digital age and I think that’s presenting challenges for access to information. But a digital environment for decision making shouldn’t be at odds with people’s access to information rights. We need to work just as hard to make sure that the legislation is fit for operating in a digital age.” She said: “Some other countries have already made changes and it’s interesting what’s happening in Scotland where housing associations have already been brought within the scope of legislation. So we’re watching developments in other places as well.”

Interface
Alongside this growing gap between information law and the real world, another reason an update is needed is because access to information has fallen out of sync with the other side of the ICO coin – data protection. On one side is the law that gives us our right to access information, and on the other is the law protecting our information. The latter has been boosted by the GDPR. It’s a point made by the commissioner who, in the outsourcing report, said: “The recent reforms introduced by the Data Protection Act 2018 (DPA) and the General Data Protection Regulation (GDPR) have shown the importance of keeping privacy rights under review and adapting them to changing circumstances. FOIA and the EIR now face similar challenges.” Gill says that while these two areas of ICO business are separate, she expects more activity at their interface. “I think there is a very wide range of skills that our casework team needs. They need to be investigators, negotiators, they need to be information seekers, they need to be communicators. These are very interesting roles requiring a wide range of skills in the context of information rights. But FOI is just one part of what the ICO as a whole does. Much larger numbers of people are focussed on our data privacy side and there are lots of interfaces between these two. These are two sides of the same coin – access to information from organisations and privacy rights for individuals – and there are some connections between how the two bits of legislation interface. For example when people are making requests for personal information it’s part of our data protection casework – but I think there will be increasing numbers of queries and information requests about how organisations are creating their artificial intelligence algorithms and I expect in the future we will be seeing a lot more information requests about these sorts of data protection issues. I think it will be a very interesting space.”

Current landscape
The largest volume of requests for the ICO are about local government. She says: “I think the emphasis on FOI is often on the big central government departments but what I’d call ‘every day’ FOI is local people asking about what is happening in their local area and in some ways is the backbone of access to information.” “One of the challenges is that there isn’t comprehensive data about the performance of all public authorities within current reporting frameworks. So it can be quite hard to have that overview and understand about why some organisations are performing better than others. There are sometimes resource issues and the complexity of cases varies dramatically from organisation to organisation depending on what they do. Organisations can also have particular spikes in terms of interest of particular areas – that’s one of the fascinating things about the legislation; how volatile it can be in terms of where there is interest.”

Leadership gap
Having said that, she made one generalisation: “When things go wrong often the root cause is something to do with leadership or governance that means that organisations are not in a position to comply as well as they could to the detail of the legislation. I think the most important thing is that information rights are taken seriously at the most senior levels – that leaders do have both insight into what is happening and an oversight of how their own organisation is performing. What is important is how the issues are surfaced at the most senior level and how we make sure that the leadership of organisations is being accountable for information rights. There are very dedicated information rights professionals working in public authorities in lots of places and we need to make sure they are given the support internally by the leaders at the most senior level… and that’s the challenge; that people need to step up and make sure that they are creating the conditions in which organisations can fulfil their obligations in both the spirit and the letter. If you look at public authorities in general there’s always room for ­improvement – we say this in our access to information strategy – Openness by Design.” Asked if information rights professionals shared knowledge and supported each other she said: “There’s lots more that could be done in terms of peer support and best practice and I hope that’s something we can do more of. But the organisations in the wider access to information ecosystem are doing things as well, so The Campaign for Freedom of Information runs training programmes and networking opportunities so I think there are a range of things out there, they are not all dependent upon the regulator, far from it.”

Data gap
Linked to the issues about how to interpret the data – the quantitative performance data – Gill says that the ICO also wants to deepen its understanding of its customers. Every year the ICO carries out a Trust and Confidence research survey which shows there are gaps in awareness between gender, age and nationality. “One of the things we need to think about as an organisation is how to better understand the people who are raising queries with us and how to make sure that we are promoting our services as much as we can.”

Insights
One figure that suggests more work is needed on the education of existing customers and that the ICO could improve the way it communicates with them, is that 40 per cent of the complaints it receives are rejected as premature. Gill says: “Some people get involved in making lots of information requests but not everyone. For people who make information requests as a once off it can be complicated to understand how processes and procedures work. As a regulator we are doing as much as we can to make it as accessible as it can be for people to use our services. We are working to take stock of our processes and think about how we describe them. Often the reason the cases are coming too early to us is because people haven’t had the final letter from the public authority or it is being reviewed internally.” Gill says this could be addressed by incorporating the documents people need to make a request “so we are looking at developing more online forms encouraging people to have the information they need in order for us to be working on the case.”

Education
So while the data show awareness of FOI rights have increased, there are disparities between different parts of society. Gill says the ICO hopes to address this: “There’s still room for doing more work to raise awareness and we need to think about particular groups where awareness is not as high as in others. Because for example younger people, according to our survey, are less aware of some of their information rights than others. That’s why an education programme would be quite useful and it’s something that we’re likely to look at over the period of our three-year plan to see if there is work that we can usefully do to promote information rights within education settings.” Asked if there could be any role for libraries in such a programme Gill says: “It’s probably a bit early to say because we haven’t shaped a programme but libraries are very interesting in terms of the different ways that library services are provided now. So we’d need to think about that in the round. But if we designed any campaign it would be very important to think about the role of information professionals – your readers – in promoting information rights. IP