EPC privacy impact screening

The request was partially successful.

Dear Department for Communities and Local Government,

On page 9 of the document "Making better use of energy performance data: Impact Assessment", published 2 March 2010:[1]

"We have performed a Privacy Impact Screening in accordance with the guidance from the Information Commissioners Office. Taking into consideration the responses to the consultation, we will undertake a small-scale Privacy Impact Assessment to consider and manage the risks of sharing potentially personal data, in advance of implementing the data strategy."

Can I have copies of:

(1) this Privacy Impact Screening;

(2) the Privacy Impact Assessment, (or if it has not yet happened, when it is scheduled to happen),

(3) any legal advice or opinions relating to the determination and the extent that EPCs of houses at the point of sale (or at any other time) are "potentially personal data" within the meaning of the Data Protection Act.

[1] http://www.communities.gov.uk/publicatio...

Yours faithfully,

Julian Todd

Department for Levelling Up, Housing & Communities

2 Attachments

  • Attachment

    attachment.delivery status

    0K Download DSN: 4.4.1 No answer from host

  • Attachment

    attachment.bin

    1K Download

Your message has been delayed and is still awaiting delivery
to the following recipient(s):

[DCLG request email]
Message delayed

Your message is delayed
Message for domain communities.gsi.gov.uk delayed at odpm.gsi.gov.uk.
Unable to deliver to domain for 18 hours.
Will continue trying for 30 hours.
No action is required on your part.
Last attempt failed because:
CantConnectToHost

show quoted sections

Eve Martin,

1 Attachment

Dear Julian

Please see the attached acknowledgement letter.
<<100706 - F0003908 - Julian Todd - acknowledgement.doc>>
Eve

show quoted sections

Communications via the GSi may be automatically logged, monitored and/or
recorded for legal purposes.

Eve Martin,

6 Attachments

Dear Julian

Please see the attached letter and documents in response to your FOI
request reference F0003908. I have explained in the covering letter that
I am still considering the release of some documents covered by qualified
exemption and therefore will need an extension to 25th August.

Regards

Eve Martin

<<100726 - F0003908 - Julian Todd - Official reply.doc>> <<FW
Stakeholder data base - Updated version.rtf>> <<EEPH-CLG EPC Consultation
Event - 13 May 2010 - meeting report redacted.doc>> <<EQUALITY IMPACT
ASSESSMENT.doc>> <<FW Need your help.rtf>> <<Stakeholder Data Base -
Organisations interested in sharing personal data.xls>>

show quoted sections

Communications via the GSi may be automatically logged, monitored and/or
recorded for legal purposes.

Dear Eve Martin,

Thank you for the information which you sent to me on 27 July 2010 concerning the EPC privacy policy.

I am glad to see from the consultation feedback that there are others who question the policy of treating EPCs as though they contained private personal information, not for public consumption.

I look forward to receiving copies of the Privacy Impact Screening and the Privacy Impact Assessment next month wherein this policy was officially laid out.

Yours sincerely,

Julian Todd

Eve Martin,

I shall be out of the office on annual until Tuesday 3rd August. If
urgent, please resend to

for non-domestic, [email address]
for data, [email address]

Regards, Eve

show quoted sections

Communications via the GSi may be automatically logged, monitored and/or
recorded for legal purposes.

Jonathan Bramhall,

3 Attachments

Dear Julian Todd,

Please see the attached letter and enclosures which I am sending to you on
behalf of Eve Martin.

Jonathan Bramhall
Home Buying, Selling and Energy Performance Unit
Zone 5/H10
Eland House
Bressenden Place
London
SW1E 5DU

0303 444 1803
<<100818 - F0003908 - Julian Todd - Final reply (3).doc>> <<Privacy
Screening.pdf>> <<Privacy Assessment.pdf>>

show quoted sections

Communications via the GSi may be automatically logged, monitored and/or
recorded for legal purposes.

Eve Martin,

2 Attachments

Dear Julian

Please see the attached letter and final documents in response to your FOI
request reference F0003908. Due to size constraints, I shall send in
batches, this being the first.

Regards

<<101222 - F0003908 - Julian Todd - Final reply.doc>> <<To send after SoR
published.zip>>

Eve

show quoted sections

Communications via the GSi may be automatically logged, monitored and/or
recorded for legal purposes.

Eve Martin,

1 Attachment

Eve Martin,

1 Attachment

Eve Martin,

1 Attachment

Dear Eve Martin,

Thank you for reminding me of the "Making better use of EPCs and data" Summary of responses document,[1] as well as sending me the relevant sections of each response[2] concerning the decision to treat EPCs issued on behalf of a building (often around the point of sale) as personal data. This has allowed me to collate my own interpretation.

The reasoning behind this determination is given in the Small scale Privacy Impact Assessment, which says:[3]

p1: "The certificate itself concentrates very much on the house and talks in very general terms about its energy efficiency. On the other hand, we think it is significant that the sharing of EPCs will allow recipient organisations to take certain action in relation to a particular individual ie they will put the EPC together with other information to decide that the house needs energy improvements and so the individual should be contacted. On balance by far the safest course of action is to treat the un-anonymised EPC as personal data."

...

p5: "The Department has consulted the Information Commissioner on the question of disclosures from the register of energy performance certificates generally and the Commissioner's view was that the information to be disclosed was not prima facie personal data. We are currently consulting with the Ministry of Justice in relation to the proposal. The MoJ have approved the approach taken in relation to the processing of personal data. We have chosen to treat this material as personal data and take the appropriate steps to comply with the Data Protection Act 1998 requirements for the handling of personal data."

The determination that EPCs constituted personal data was presented as background to Question 2.1 in the 2 March 2010 consultation,[4] a question to which it was reported that 81% of responses were in agreement.[1]

From the feedback you have sent me I have been able to determine that 31% (22) of respondents argued that the EPCs are not personal data and should be made public in order to be any use, and somewhere between 27% and 50% of respondents showed any indication that they agreed that this was personal data. I have included my list at the bottom of this email, below the references.

This is an interesting result in light of the fact that the consultation document left readers in no doubt that the EPC information was personal data, in spite of the fact that it seems that it has been determined primarily on a precautionary basis, having informally consulted with only one expert in this area of law (the Information Commissioner), who said that it was not obviously personal data.

Now, matters of law are not normally given to a public vote, and the right result is not necessarily the most popular one, so I should like to return to part (3) of my original FOI request of 26 June 2010 which was for:

"any legal advice or opinions relating to the determination and the extent that EPCs of houses at the point of sale (or at any other time) are "potentially personal data" within the meaning of the Data Protection Act."

Can you confirm that no actual professional legal advice has been sought by the Department regarding the question about whether it has a right to treat any EPC data as not constituting "personal data", should it decide in future that it requires such leeway to implement policy?

I ask because in my opinion any such legal advice would necessarily pick up on the logical inconsistency between EPCs having to be published during the process of selling a house, and then mysteriously becoming personal data of the eventual buyer.

Thank you very much for your time and help on this matter. I really appreciate it.

Yours sincerely,

Julian Todd

[1] http://www.communities.gov.uk/publicatio...

[2] http://www.whatdotheyknow.com/request/ep...

[3] http://www.whatdotheyknow.com/request/ep...

[4] http://www.communities.gov.uk/publicatio...

*Analysis of responses*

Document DC_3535_14467.pdf

p1: Yes (concurs with the advice that house data=sensitive personal data)
p2: No (too restrictive and inappropriate to the nature of the data)
p3: Maybe
p4: No (greater access required)
p6: No comment
p8: No (should be accessible as house prices are)
p10: Maybe (worries about targeted marketing, but supports improved access)

Document DC_3535_14468.pdf

p2: No (much greater transparency required)
p3: Answer redacted beyond all use
p4: Yes (privacy of householders and businesses should be respected)
p5: Maybe (though outside our expertise)
p6: Yes (fear abusive selling techniques)
p7: Yes (there must be safeguards)
p8: Yes (sees advantages of LA's having the data, but no comment about publication)
p9: Yes
p10: No comment (outside of expertise)
p11: Yes
p12: No (safeguards too onerous and prevent action)

Document DC_3535_14469.pdf

p1: No (support widest access possible)
p2: Maybe (though with complex caveats)
p5: No (current restrictions should be reconsidered)
p7: No (make EPC data public)
p8: No (this is not "personal data", and you can opt out of junk mail)
p10: No comment
p11: No (unjustifiably restrictive)

2010-05-25_RESPONSE TO CONSULATION ON EPCs.doc:
No (overcautious)
2010 05 25 BCSC Submission - DECs and EPCs.doc:
Yes
100513.txt
No (This was my submission)
100525 CLG EPC consultation - CLA response.doc
No comment (insufficient knowledge)
100525 EPC consultation Hammerson Response.doc
No (data should be made publicly available)
Better Use of EPCs Consultaion.doc
Yes
Carbon Buzz response to Making Better Use.doc
Maybe (but increase use of data and lower effort on safeguards)
CIBSE response to making better use of energy certificates.docx
repeat of above
consulation response -making better use of EPC's 20 5 10.doc
Yes (if there are difficulties around data protection)
DCLG EPC Consultation response.doc
Yes (no comments included)
EIC EPC Consultation Response.doc
No (make it public)
Energy Efficiency Certificates Reply.doc
No comment
Energy Performance Data.doc
Yes (strict guidelines and data anonymized)
EPC consulation Final 24May10.doc
No (concerned that access is to restrictive to be useful)
EPC consultation - May 2010.doc
No (if you put EPCs in advertisements, why are they secret?)
EPC consultation letter 21 May.doc
Maybe (agrees information should be more available)
EPC consultation response draft April 10.doc
Yes (and with anonimized access)
EPCs_consultation1.doc
Yes (shared and anonymized)
FW .htm
Yes (But the Welsh Assembly needs access)
FW Consultation Feedback.htm
Wrong questions
FW Consultation Making better use of Energy Performance Certificates and data.htm
Maybe (more multiple data uses)
FW EPBD II Consultation questions answered.htm
Yes (blank answer)
FW EPC Consultation Response.htm
Yes (name of occupier should not be disclosed)
FW HBF response to the consultation.htm
Maybe (purchasers need access to information)
FW HVCABESCA response to Making better use of Energy Performance Certificates and data Consultation .htm
No comment
FW Making better use of Energy Performance Certificates and data.htm
Yes (blank comment)
FW Making better use of Energy Performance Certificates and data2.htm
No (EPC should be freely available in an open database)
FW Making better use of Energy Performance Certificates and data Consultation.htm
Yes (blank comment)
FW Making better use of energy Performance Certificates and data - Consultation.htm
No (access should be free)
FW Making better use of Energy Performance Certificates and data -- Response to consultation.htm
No (What's so secret about it anyway)
FW Making better use of Energy Performance Certificates and data Consultation .htm
Yes (blank comment)
FW Making better use of Energy Performance Certificates and data Consultation response.htm
Maybe (we want better use of data)
FW Making better use of Energy Performance Certificates and data Consultation responses.htm
Yes (basically blank comment)
FW Making Better Use of EPC's and Data Consultation.htm
Yes (blank comment)
FW Response to consultation document.htm
Yes (blank comment)
FW South Tyneside response to Consultation on Energy Performance Certificates and Data.htm
Yes (we agree with your approach)
LACORS.doc
No content
Lambeth Council Response - Making better use of EPCs.doc
Yes (the data will be useful to us as a council)
Making Better Use of Energy Performance Certificates and Data.doc
Yes (blank comment)
Making Better Use of EPCs Data- DCHI Final DRAFT April 2010.doc
Yes (this data is personal)
Making better use of EPCs and data 25 May 2010.doc
No (data should be public)
Response.doc
Yes (data will facilitate direct marketing of advice)
Response to EPC.doc
Yes (but too much discression with Secretary of state)
Response to EPC consultation Final.docx
No (unclear the threats you are safeguarding)
Sponge response.doc
No content
SunderlandEPC.doc
Yes (address level data to council for any use)
UKLPG Response to Making better Use of EPC's and data.doc
No comment (data quality is major concern)

Eve Martin,

Julian

I refer to your e-mail of 4 January. In answer to your query:

* Can you confirm that no actual professional legal advice has been
sought by the Department regarding the question about whether it has a
right to treat any EPC data as not constituting "personal data",
should it decide in future that it requires such leeway to implement
policy?

We have sought legal advice on this question. In addition, we have
clarified the position with ICO and their position is that an address is
personal data because it can be linked to and have an impact on an
individual. ICO guidance on this issue (Data Protection Technical
Guidance - Determining what is personal data) can be found at:
[1]http://www.ico.gov.uk/upload/documents/d....

Regards

Eve

show quoted sections

Dear Eve Martin,

Sorry to trouble you about this matter again, but I am still unclear as to the foundation of the Department's legal position.

My question (3) in my original 26 June 2010 FOI request was for 'any legal advice or opinions relating to the determination and the extent that EPCs of houses at the point of sale (or at any other time) are "potentially personal data" within the meaning of the Data Protection Act.'

It is standard practice on questions of law, or before signing a one-off contract, to hire the services of a professional independent lawyer by the hour to review the matters at hand and give his written opinion as to the legal risks of the agreement or the position and how it relates to any relevant statute or case law that is known about.

It is clear to me that this particular question about the Department's right to disclose EPC information about buildings needs to be informed by some professional legal advice in order to systematically lay out the matters of:
A) the public interest (regarding energy use policy),
B) apparent irregularities with this dataset (ie the way that non-personal data somehow becomes personal at the point of sale),
C) the fact that very similar data sets of house purchases and domestic planning applications are fully and publicly available.

You have asserted that legal advice has been sought.

Can you provide me with the following information about this advice:
1) The name (or law practice) of any lawyer or solicitor that has been hired to deliver their professional legal opinion as to the position of whether the Department has a right (should it choose) to disclose EPC information,
2) The number of hours and fee for which they were paid for this service,
3) A copy of the written legal advice received.

Under the Freedom of Information Act you may, if you choose, invoke Section 42 (Legal professional privilege) to exempt disclosure of part 3) above, but in order to do that the protected legal information must exist.

Yours sincerely,

Julian Todd

Eve Martin,

Dear Julian Todd

DCLG has its own in-house legal advice team. I am not disclosing the name
of the legal adviser who provided us with advice on this matter as they
work at a grade below the Senior Civil Service grades and do not currently
work in the Department. I consider that to disclose their name would be
in contravention of the first data protection principle in Schedule 1 to
the Data Protection Act and hence this information is exempt information
in accordance with section 40(2) and (3)(a) of the Freedom of Information
Act. We hold no recorded information about the time or associated costs
spent by legal on advising on the personal attributes of the EPC
information - especially as the legal adviser in question has now departed
on long term leave. In respect of the legal advice they provided, I refer
you to my letter of 27 July 2010, in which I said that:

Section 42: legal professional privilege. This is a qualified
exemption and is therefore subject to the public interest test. Some
documents may also be covered under section 35. The public interest
favours maintaining the exemption of legal advice for the following
reasons:

• There is strong public interest in a maintaining the
confidential nature of the relationship between a person seeking access
to legal advice and their legal advisers.

• If such advice were routinely disclosed, legal advisers may
qualify their advice which could have the effect of removing its value.

• Legal advisers are required to give a full assessment of an
issue that might include arguments for and against, publication of which
might undermine confidence in the policy making process.

I have considered those documents which relate to correspondence with
our legal advisers and in my opinion, the public interest lies in
non-disclosure of correspondence with our legal advisers.

Regards

Eve Martin

show quoted sections

Dear Eve Martin,

Thank you for confirming to me the existence of documents authored by an in-house legal adviser who has now departed on long term leave on which the DCLG rests its determination that EPCs constitute private personal data.

Your letter of 27 July 2010 was not clear on the actual existence of any advice by a person with a professional legal training, only that a Section 42 (Legal professional privilege) may apply to "some of the documents".

Please consider this letter as a request for an internal review. According to the guidance, the review should be "impartial and undertaken by someone senior to the person who took the original decision where practicable, or if not, by someone different to the original decision maker but who is trained and
understands freedom of information."

Please disclose as much of these documents as possible and redact only those parts which are sensitive in respect to the public interest test.

To help with this review I can explain that reason for my request is my concern over the quality of the legal advice which underlies the determination that EPCs are private personal information.

In particular, I would like to know if this determination was made taking account of practices relating to many other sets of private dwelling related data (eg house price sales, planning applications) which exist in the public domain -- or if it was made on the basis of theory in isolation.

I see no reason that the introductory sections of the legal advice, stating what effects are to be considered, could not be provided without disclosing to me the actual advice (if the person doing the review decides that it must remain exempt).

The outcome of disclosure would be to provide evidence as to whether the legal position is either weak and provisional or firmly founded, which I believe would be in the public interest going forward.

Yours sincerely,

Julian Todd

Eve Martin,

I shall be out of the office until Thursday 3rd February. If your query
is urgent, please resend to [email address].
Regards, Eve

show quoted sections

Communications via the GSi may be automatically logged, monitored and/or
recorded for legal purposes.

Eve Martin,

Julian

I have forwarded your request for an internal review to our Freedom of Information Team. No doubt they will allocate the case to an internal reviewer and that person will be contacting you in due course. Regards,

Eve

show quoted sections

CLG-FOIAdvice,

Dear Mr Todd

REQUEST FOR INTERNAL REVIEW

Thank you for your email of 3rd February 2011, in which you seek a
review of the response provided by Communities and Local Government to
your request for information under the Freedom of Information Act.

The review will be considered under the Department's internal review
procedures. A full re-evaluation of your request will be undertaken.

I will today allocate this request to an Internal Review Officer and you
should receive a reply by 3rd March 2011.

Yours sincerely

FOI Advice Team
Knowledge Management Division
Zone 2/A3, Eland House
0303 444 3973

show quoted sections

CLG-FOIAdvice,

1 Attachment

<<110303 FoI response to Julian Todd 39925-4249 F0003908 MC.doc>>
Dear Mr Todd

Please find attached a response to your request for an Internal review of
your Freedom of Information request Ref (39925-4249) F0003908.

Yours sincerely

FOI Advice Team
Knowledge Management Division
Zone 2/A3, Eland House
0303 444 3973

show quoted sections

Julian Todd left an annotation ()

I have got a representation about this matter into the Energy Bill Committee both as written evidence:

http://www.publications.parliament.uk/pa...

And in the transcript:

http://www.theyworkforyou.com/pbc/2010-1...