Request regarding Shine/3UK

The request was partially successful.

Dear Information Commissioner’s Office,

The following request details a previous attempt to gain correspondence between the ICO and Shine. In it the ICO redacted most of the response due to s.44 of the FoIA the use of which was based on s.59 of the DPA.

https://www.whatdotheyknow.com/request/u...

However section s.59(2)(e) of the DPA reads:

'having regard to the rights and freedoms or legitimate interests of any person, the disclosure is necessary in the public interest.'

Responses from IoCCO indicate that the trial may well have been illegal. See:

https://patrick.seurre.com/wp-content/up...

I fully intend on taking the matter to the police, but they are unlikely to act without solid evidence. Given the opacity of the trial and the level of correspondence between the ICO and 3UK on this subject it would appear that the responses could well contain that proof.

I believe that the legitimate interest in preventing illegal behaviour needs to be taken into consideration here. The fundamental right to have private communication free of illegal interception also needs to be taken into consideration.

Failing to provide me with that correspondence could well be viewed as having no regard for the rights or legitimate interests of those affected by the trials undertaken by 3UK, and in my view there is a definite public interest in releasing the information since it would be required to take action to defend those rights and legitimate interests.

Yours faithfully,

P Seurre

AccessICOinformation, Information Commissioner's Office

Thank you for contacting the Information Commissioner’s Office. We confirm
that we have received your correspondence.

 

If you have made a request for information held by the ICO we will contact
you as soon as possible if we need any further information to enable us to
answer your request. If we don't need any further information we will
respond to you within our published, and statutory, service levels. For
more information please visit [1]http://ico.org.uk/about_us/how_we_comply

 

If you have raised a new information rights concern - we aim to send you
an initial response and case reference number within 30 days.

 

If you are concerned about the way an organisation is handling your
personal information, we will not usually look into it unless you have
raised it with the organisation first. For more information please see our
webpage ‘raising a concern with an organisation’ (go to our homepage and
follow the link ‘for the public’). You can also call the number below.

 

If you have requested advice - we aim to respond within 14 days.

 

If your correspondence relates to an existing case - we will add it to
your case and consider it on allocation to a case officer.

 

Copied correspondence - we do not respond to correspondence that has been
copied to us.

 

For more information about our services, please see our webpage ‘Service
standards and what to expect' (go to our homepage and follow the links for
‘Report a concern’ and ‘Service standards and what to expect'). You can
also call the number below.

 

If there is anything you would like to discuss with us, please call our
helpline on 0303 123 1113.

 

Yours sincerely

 

The Information Commissioner’s Office

 

Our newsletter

Details of how to sign up for our monthly e-newsletter can be found at
[2]http://www.ico.org.uk/tools_and_resource...

 

Twitter

Find us on Twitter at [3]http://www.twitter.com/ICOnews

 

The ICO's mission is to uphold information rights in the public interest.
To find out more about our work please visit our website, or subscribe to
our e-newsletter at ico.org.uk/newsletter.

If you are not the intended recipient of this email (and any attachment),
please inform the sender by return email and destroy all copies without
passing to any third parties.

If you'd like us to communicate with you in a particular way please do let
us know, or for more information about things to consider when
communicating with us by email, visit ico.org.uk/email

References

Visible links
1. http://ico.org.uk/about_us/how_we_comply
2. http://www.ico.org.uk/tools_and_resource...
3. http://www.twitter.com/ICOnews

Dear Information Commissioner’s Office,

To be clear: I am requesting a copy of the redacted text from the previous request.

Yours faithfully,

P Seurre

AccessICOinformation, Information Commissioner's Office

Thank you for contacting the Information Commissioner’s Office. We confirm
that we have received your correspondence.

 

If you have made a request for information held by the ICO we will contact
you as soon as possible if we need any further information to enable us to
answer your request. If we don't need any further information we will
respond to you within our published, and statutory, service levels. For
more information please visit [1]http://ico.org.uk/about_us/how_we_comply

 

If you have raised a new information rights concern - we aim to send you
an initial response and case reference number within 30 days.

 

If you are concerned about the way an organisation is handling your
personal information, we will not usually look into it unless you have
raised it with the organisation first. For more information please see our
webpage ‘raising a concern with an organisation’ (go to our homepage and
follow the link ‘for the public’). You can also call the number below.

 

If you have requested advice - we aim to respond within 14 days.

 

If your correspondence relates to an existing case - we will add it to
your case and consider it on allocation to a case officer.

 

Copied correspondence - we do not respond to correspondence that has been
copied to us.

 

For more information about our services, please see our webpage ‘Service
standards and what to expect' (go to our homepage and follow the links for
‘Report a concern’ and ‘Service standards and what to expect'). You can
also call the number below.

 

If there is anything you would like to discuss with us, please call our
helpline on 0303 123 1113.

 

Yours sincerely

 

The Information Commissioner’s Office

 

Our newsletter

Details of how to sign up for our monthly e-newsletter can be found at
[2]http://www.ico.org.uk/tools_and_resource...

 

Twitter

Find us on Twitter at [3]http://www.twitter.com/ICOnews

 

The ICO's mission is to uphold information rights in the public interest.
To find out more about our work please visit our website, or subscribe to
our e-newsletter at ico.org.uk/newsletter.

If you are not the intended recipient of this email (and any attachment),
please inform the sender by return email and destroy all copies without
passing to any third parties.

If you'd like us to communicate with you in a particular way please do let
us know, or for more information about things to consider when
communicating with us by email, visit ico.org.uk/email

References

Visible links
1. http://ico.org.uk/about_us/how_we_comply
2. http://www.ico.org.uk/tools_and_resource...
3. http://www.twitter.com/ICOnews

Dear AccessICOinformation,

I would like to bring this reply from Three to your attention as I think it's relevant to this request:

https://twitter.com/patrickseurre/status...

In my opinion the lack of any mention of consent from other parties in the communications in Three's reply strongly implies that they failed to gain consent from both parties. Frankly given the issues raised in internal emails released in response to my last request I think it's doubtful that they ever succeeded in getting appropriate consent from either party in the first place, let alone both of them.

In any case consent from both parties would be required under RIPA s.3(1) and as such their implied admission that they failed to get such consent strengthens the case for releasing the correspondence between you and Three (again in my opinion).

Yours sincerely,

P Seurre

AccessICOinformation, Information Commissioner's Office

Thank you for contacting the Information Commissioner’s Office. We confirm
that we have received your correspondence.

 

If you have made a request for information held by the ICO we will contact
you as soon as possible if we need any further information to enable us to
answer your request. If we don't need any further information we will
respond to you within our published, and statutory, service levels. For
more information please visit [1]http://ico.org.uk/about_us/how_we_comply

 

If you have raised a new information rights concern - we aim to send you
an initial response and case reference number within 30 days.

 

If you are concerned about the way an organisation is handling your
personal information, we will not usually look into it unless you have
raised it with the organisation first. For more information please see our
webpage ‘raising a concern with an organisation’ (go to our homepage and
follow the link ‘for the public’). You can also call the number below.

 

If you have requested advice - we aim to respond within 14 days.

 

If your correspondence relates to an existing case - we will add it to
your case and consider it on allocation to a case officer.

 

Copied correspondence - we do not respond to correspondence that has been
copied to us.

 

For more information about our services, please see our webpage ‘Service
standards and what to expect' (go to our homepage and follow the links for
‘Report a concern’ and ‘Service standards and what to expect'). You can
also call the number below.

 

If there is anything you would like to discuss with us, please call our
helpline on 0303 123 1113.

 

Yours sincerely

 

The Information Commissioner’s Office

 

Our newsletter

Details of how to sign up for our monthly e-newsletter can be found at
[2]http://www.ico.org.uk/tools_and_resource...

 

Twitter

Find us on Twitter at [3]http://www.twitter.com/ICOnews

 

The ICO's mission is to uphold information rights in the public interest.
To find out more about our work please visit our website, or subscribe to
our e-newsletter at ico.org.uk/newsletter.

If you are not the intended recipient of this email (and any attachment),
please inform the sender by return email and destroy all copies without
passing to any third parties.

If you'd like us to communicate with you in a particular way please do let
us know, or for more information about things to consider when
communicating with us by email, visit ico.org.uk/email

References

Visible links
1. http://ico.org.uk/about_us/how_we_comply
2. http://www.ico.org.uk/tools_and_resource...
3. http://www.twitter.com/ICOnews

Leigh Park Initiative left an annotation ()

What I need to know as a website operator, is - where/when do I as a webmaster get asked for MY consent for my communications with Shine/Three visitors to my sites, to be intercepted (as required under RIPA, in relation to "value added services"), or the data stream mirrored,copied or altered? What happens to personal data in the data stream, that is being passed to a third party, who is not either the sender or the recipient of the original communicaction? And how can I prevent Shine/Three interfering with my communications with my site visitors? Is there a useragent string I can block? A set of IP addresses I can redirect? and when it happens - who do I report it to? The IoCC? The ico? Or the police?

Information Commissioner's Office

2 Attachments

9th September 2016

 

Case Reference Number IRQ0642787

 

Dear Mr Seurre

Thank you for your correspondence of 19 August 2016. We handled your
request in line with your rights under s 1 of the Freedom of Information
Act (FOIA) and our response is below.
 
 
Your request of 19 August 2016 read:
 
“The following request details a previous attempt to gain correspondence
between the ICO and Shine. In it the ICO redacted most of the response due
to s.44 of the FoIA the use of which was based on s.59 of the DPA.
 
https://www.whatdotheyknow.com/request/u...
 
However section s.59(2)(e) of the DPA reads:
 
'having regard to the rights and freedoms or legitimate interests of any
person, the disclosure is necessary in the public interest.'
 
Responses from IoCCO indicate that the trial may well have been illegal.
See:
 
https://patrick.seurre.com/wp-content/up...
 
I fully intend on taking the matter to the police, but they are unlikely
to act without solid evidence. Given the opacity of the trial and the
level of correspondence between the ICO and 3UK on this subject it would
appear that the responses could well contain that proof.
 
I believe that the legitimate interest in preventing illegal behaviour
needs to be taken into consideration here. The fundamental right to have
private communication free of illegal interception also needs to be taken
into consideration.
 
Failing to provide me with that correspondence could well be viewed as
having no regard for the rights or legitimate interests of those affected
by the trials undertaken by 3UK, and in my view there is a definite public
interest in releasing the information since it would be required to take
action to defend those rights and legitimate interests.”
 
 
You later clarified your request as follows;

“To be clear: I am requesting a copy of the redacted text from the
previous request.”
 
 
Our response
 
In relation to the request you refer to, we withheld the correspondence
we received from 3 UK under section 44 of the FOIA by virtue of section 59
of the DPA and section 40 of the FOIA. We have now consulted with 3 UK
again on the redacted information from this request and from other
responses to requests related to 3 UK and Shine for completeness.
 
Having reconsidered the withheld information for disclosure, we still
maintain the exemptions applied. I will explain below why we are relying
on those exemptions.
 
 
Section 44 of the FOIA by virtue of section 59 of the DPA exemption
 
Section 44(1) (a) of the FOIA states;
 
‘(1) Information is exempt information if its disclosure (otherwise than
under this Act) by the public authority holding it -
(a) is prohibited by or under any enactment’
The enactment in question is the Data Protection Act 1998 (DPA) and
specifically section 59 of the DPA. Section 59 states that neither the
Commissioner nor his staff shall disclose;
“any information which :
 
a. has been obtained by, or furnished to, the Commissioner under or for
the purposes of the information Acts.
b .relates to an identified or identifiable individual business, and
c. is not at the time of disclosure, and has not been available to the
public from other sources, unless the disclosure is made with lawful
authority.
 
2)For the purposes of subsection (1) a disclosure of information is made
with lawful authority only if, and to the extent that—
(a)the disclosure is made with the consent of the individual or of the
person for the time being carrying on the business,
(b)the information was provided for the purpose of its being made
available to the public (in whatever manner) under any provision of the
information Acts],
(c)the disclosure is made for the purposes of, and is necessary for, the
discharge of—
(i)any functions under [the information Acts], or
(ii)any  EU] obligation,
(d)the disclosure is made for the purposes of any proceedings, whether
criminal or civil and whether arising under, or by virtue of, [the
information Acts] or otherwise, or
(e)having regard to the rights and freedoms or legitimate interests of any
person, the disclosure is necessary in the public interest.
(3)Any person who knowingly or recklessly discloses information in
contravention of subsection (1) is guilty of an offence.
 
 
Section 59(1) (a) is satisfied because the information was furnished to
the ICO for the purposes of the information Acts. Data controllers and the
representatives are identifiable businesses and section 59 (1) (b) is
satisfied.
 
In relation to section 59 (1) (c), the information has not been disclosed
to the public and therefore this does not provide a route to disclosure.
Section 59 (2) (b) provides circumstances where lawful authority could be
achieved. We can say that in relation to (a) we do not have consent from
the data controllers to disclose this information and in relation to (b)
the information was not provided to the ICO for the purpose of being made
public. 

In relation to (c) - we do not consider that the ICO must disclose this
information in order to discharge a function under the information Acts or
a Community obligation.

Further, in relation to (d) a disclosure would not be for the purposes of
proceedings.

Finally, we turn to (e). We should clarify that the public interest
threshold here is very high, not least because disclosure in contravention
of section 59 by the Information Commissioner or his staff may constitute
a criminal offence (s.59 (3)). 
 
 
Section 40 (2) by virtue of section 40 (3) (a) (i):
 
We have also withheld the name and contact details of members of staff at
3 UK under section 40 (2) by virtue of section 40 (3) (a) (i) which
relates to personal information.
 
Section 40(2) allows a public authority to withhold information from a
response to a request when the information requested is personal data
relating to someone other than the requestor and either the first or
second condition in section 40(3) is satisfied.  In this instance the
disclosure would satisfy section 40(3) (a) (i) as to disclose such
information would contravene one of the Data Protection principles.
 
We consider that such a disclosure would be unfair to the individuals in
question and in breach of the first Data Protection principle which states
that – “Personal data shall be processed fairly and lawfully.
 
For clarity I am attaching again the withheld information.
 
I realise that this response is disappointing to you but hope that the
above clarifies our position.
 
Yours sincerely
 
Iman Elmehdawy
Information Access Service Manager
 
Next steps
 
 
If you are dissatisfied with the response you have received and wish to
request a review of our decision or make a complaint about how your
request has been handled you should write to the Information Access team
at the address below or e-mail [1][ICO request email].

Your request for internal review should be submitted to us within 40
working days of receipt by you of this response. Any such request received
after this time will only be considered at the discretion of the
Commissioner.
 
If having exhausted the review process you are not content that your
request or review has been dealt with correctly, you have a further right
of appeal to this office in our capacity as the statutory complaint
handler under the legislation.  To make such an application, please visit
the ‘Concerns’ section of our website to make a Freedom of Information Act
or Environmental Information Regulations complaint online.
 
A copy of our review procedure is available [2]here
 
 
 

The ICO's mission is to uphold information rights in the public interest.
To find out more about our work please visit our website, or subscribe to
our e-newsletter at ico.org.uk/newsletter.

If you are not the intended recipient of this email (and any attachment),
please inform the sender by return email and destroy all copies without
passing to any third parties.

If you'd like us to communicate with you in a particular way please do let
us know, or for more information about things to consider when
communicating with us by email, visit ico.org.uk/email

References

Visible links
1. mailto:[ICO request email]
2. https://ico.org.uk/media/about-the-ico/p...

Dear Information Commissioner’s Office,

Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of Information Commissioner’s Office's handling of my FOI request 'Request regarding Shine/3UK'. There are only two possibilities here: either the correspondence contains the details I'm looking for, or it doesn't.

If the details are there then the ICO could potentially be seen as obstructing any potential criminal investigation by failing to provide me with the details so they can be handed on to the police for further investigation. In such a situation I would also not accept that the exceptions listed in the DPA have been appropriately applied. If I have to proceed with my complaint to the police without this correspondence then your perceived obstruction will be noted in that complaint.

If the information is not present then the ICO has not had the answers it had previously sought from Three despite spending months trying to get them. The second possibility raises yet more questions in regards to the competence of the ICO itself since the ICO has spent such a long time looking into this. Any onlooker would expect the ICO to either have their answers by now or to have taken action against those failing to provide them. It seems that neither result has been achieved.

I'm a Three customer and I would like the ICO to come to a formal determination on the adequacy of the wording used by Three. This is something your organisation has repeatedly failed to do - or perhaps somehow managed to deliberately avoid doing - despite the amount of time you've managed to spend on this. What if anything do I need to do to ensure such a determination is made?

A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.whatdotheyknow.com/request/r...

Yours faithfully,

P Seurre

AccessICOinformation, Information Commissioner's Office

Thank you for contacting the Information Commissioner’s Office. We confirm
that we have received your correspondence.

 

If you have made a request for information held by the ICO we will contact
you as soon as possible if we need any further information to enable us to
answer your request. If we don't need any further information we will
respond to you within our published, and statutory, service levels. For
more information please visit [1]http://ico.org.uk/about_us/how_we_comply

 

If you have raised a new information rights concern - we aim to send you
an initial response and case reference number within 30 days.

 

If you are concerned about the way an organisation is handling your
personal information, we will not usually look into it unless you have
raised it with the organisation first. For more information please see our
webpage ‘raising a concern with an organisation’ (go to our homepage and
follow the link ‘for the public’). You can also call the number below.

 

If you have requested advice - we aim to respond within 14 days.

 

If your correspondence relates to an existing case - we will add it to
your case and consider it on allocation to a case officer.

 

Copied correspondence - we do not respond to correspondence that has been
copied to us.

 

For more information about our services, please see our webpage ‘Service
standards and what to expect' (go to our homepage and follow the links for
‘Report a concern’ and ‘Service standards and what to expect'). You can
also call the number below.

 

If there is anything you would like to discuss with us, please call our
helpline on 0303 123 1113.

 

Yours sincerely

 

The Information Commissioner’s Office

 

Our newsletter

Details of how to sign up for our monthly e-newsletter can be found at
[2]http://www.ico.org.uk/tools_and_resource...

 

Twitter

Find us on Twitter at [3]http://www.twitter.com/ICOnews

 

The ICO's mission is to uphold information rights in the public interest.
To find out more about our work please visit our website, or subscribe to
our e-newsletter at ico.org.uk/newsletter.

If you are not the intended recipient of this email (and any attachment),
please inform the sender by return email and destroy all copies without
passing to any third parties.

If you'd like us to communicate with you in a particular way please do let
us know, or for more information about things to consider when
communicating with us by email, visit ico.org.uk/email

References

Visible links
1. http://ico.org.uk/about_us/how_we_comply
2. http://www.ico.org.uk/tools_and_resource...
3. http://www.twitter.com/ICOnews

Information Commissioner's Office

29th September 2016

 

Case Reference Number RCC0646920

 

Dear Mr Seurre

Case Reference Number RCC0646920
 
Your request for an internal review of the handling of your information
request reference number IRQ642787 has been passed to me to undertake.  I
have carefully considered all the relevant information, including your
request, your request for review and the information withheld from you.   
 
I uphold the refusal of the redacted information, for the reasons given in
our letter to you of 9^th September 2016.
 
If you are dissatisfied with the outcome of the review you may make a
section 50 complaint to the ICO. 

How to complain

Information on how to complain is available on the ICO website at:
[1]https://ico.org.uk/concerns/

By post: If your supporting evidence is in hard copy, you can fill in the
Word version of our complaint form, print it out and post it to us with
your supporting evidence. A printable Freedom of Information Act
complaints form is available from the ICO website. Please send to:

Advice Services
Information Commissioner's Office, Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

By email: If all your supporting evidence is available electronically, you
can fill in our online complaint form. Important: information included in
the form, and any supporting evidence will be sent to us by email.

Yours sincerely

 
Lisa Atkinson
Group Manager
Policy Delivery
 
 

The ICO's mission is to uphold information rights in the public interest.
To find out more about our work please visit our website, or subscribe to
our e-newsletter at ico.org.uk/newsletter.

If you are not the intended recipient of this email (and any attachment),
please inform the sender by return email and destroy all copies without
passing to any third parties.

If you'd like us to communicate with you in a particular way please do let
us know, or for more information about things to consider when
communicating with us by email, visit ico.org.uk/email

References

Visible links
1. https://ico.org.uk/concerns/