New FOI obligations on public bodies when providing datasets

Public bodies are under new obligations in respect of the way that they provide information that forms part of a 'dataset', following changes to the Freedom of Information Act 2000 (FOIA) which came into force on 1 September 2013. These changes are in line with the increasing trend towards openness and transparency and in particular with the Government's Open Data White Paper 'Unleashing the Potential' which was published in June 2012.  

Section 102 of the Protection of Freedoms Act 2012 inserts new provisions into section 11 FOIA, amends section 19 FOIA and affects the format in which data should be provided rather than what should be disclosed.

Where an applicant makes a request to a public body for information which is, or forms part of, a dataset and also expresses a preference for communication of that information in an electronic form, the new provisions require public bodies, so far as reasonably practicable, to provide information in an electronic form which is capable of reuse.

What is a 'dataset'?

The term 'dataset' is defined rather widely as:

'Information comprising a collection of information held in electronic form where all or most of the information in the collection –

(a) Has been obtained or recorded for the purpose of providing a public authority with the information in connection with the provision of a service by the authority or the carrying out of any other function of the authority,

(b) Is factual information which –

(i) Is not the product of analysis or interpretation other than calculation, and

(ii) is not an official statistic (within the meaning given by section 6(1) of the Statistics and Registration Service Act 2007), and

(c) remains presented in a way that (except for the purpose of forming part of the collection) has not been organised, adapted or otherwise materially altered since it was obtained or recorded.'

The ICO's guidance note states that information falling within the definition of datasets should have been 'collected for the purpose of providing the public authority with information' in connection with its services or functions. Whilst technically these new obligations do not provide individuals with any information beyond that already available under the FOIA, it is the format and the requestor's ability to reuse the information which has changed.

What is reasonably practicable?

What is considered to be 'reasonably practicable' to provide information in a reusable form, depends on the time and cost of conversion of the information into a reusable form, technical issues and the resources of the public authority. No doubt there will be a flurry of ICO decisions on this point in due course given the likelihood of a variation in approach by authorities to the application of these provisions.

Public bodies must also publish datasets that have been requested on its Publication Scheme unless it is satisfied that it is not appropriate to do so.

Any complaints that a public body has failed to meet its duties under the new provisions will be dealt with by the ICO in consultation with the National Archives as appropriate.

Charging and licensing regime

The new Freedom of Information (Release of Datasets for Re-Use) (Fees) Regulations 2013 also came into force on 1 September 2013 and set out when and how public bodies can charge for providing licences for re-use of datasets. The Regulations state that public bodies may charge a fee for making a dataset available for re-use, and that fee shall not exceed the sum of 'the cost of collection, production, reproduction and dissemination of the relevant copyright work, … and a reasonable return on investment.'

The ICO guidance does not provide any details on the meaning of a 'reasonable return on investment' so this is likely to become a point of contention. The guidance does state, however, that public authorities shall, so far as reasonably practicable, establish standard fees for re-use.

Avoiding the pitfalls of reusable datasets: Increased risks of a data breach?

Like all legislative changes, there will no doubt be teething problems arising from the new obligations. Previously organisations have been able to provide information in a static format which cannot be manipulated. The requirement to provide information in electronic format for re-use is not without problems.

In particular, public bodies should be mindful of avoiding the inadvertent disclosure of personal data when providing datasets in a reusable form. This will be very much at the forefront of information governance officers' minds after the ICO's recent decision to fine Islington LBC £70,000 following their inadvertent disclosure of more than 2,000 residents' personal data which was in a spreadsheet format.

The ICO has stated that the disclosure arose due to a lack of understanding of pivot tables used in Microsoft Excel and other spreadsheet programmes. ICO representatives highlighted the lack of training and expertise in this case.  Organisations should involve their IT specialists when responding to requests for information in datasets in a reusable form in order to avoid such costly breaches, which may become more common place now that the new datasets provisions are in force.

Public bodies must also ensure that they avoid breaches of third party intellectual property rights.

A proactive approach: Benefitting from change

The new statutory provisions may be seen as yet another obligation on already over-burdened public bodies. However, those organisations which take positive steps to establish systems for dealing with requests for datasets are more likely to avoid significant losses in staff time and may even benefit to some extent from the new licensing regime, although the position on charging is uncertain at this early stage. There are some practical steps which organisations should consider taking now: 

• update publication schemes: Changes to section 19 FOIA place an obligation on public bodies to update their publication schemes to include an obligation to publish datasets which can be reused, unless it is not appropriate for them to do so; 
• understand the licensing/charging regime: whilst the new statutory provisions place further obligations on public bodies, they also provide an opportunity to license and charge for information in certain circumstances; 
• involve IT: there is no doubt that the new obligations will to an extent require technical expertise. A proactive approach would be to identify datasets held and where reasonable convert these into a reusable format. This may assist in avoiding a rush and possibly missing statutory deadlines at the last moment when requests are received. However, it is unclear at this stage as to how far the new charging regime will extend to cover the costs associated with making datasets available for re-use;  
• consider intellectual property rights: organisations should consider whether it is they or a third party organisation which holds the copyright in a dataset in order to avoid infringement of third parties' rights; 
• raise awareness: organisations should draw the new ICO guidance on datasets to the attention of all officers who deal with requests for information on a regular basis. In particular, ensure that staff are aware that the applicant does not have to request the information in a reusable form for the new provisions to kick in: if the applicant requests information which happens to form part of a dataset, the new provisions will be triggered. Additionally, organisations should raise general awareness by communications or training in order that staff have a basic understanding of the new obligations and have a point of contact should they need further more detailed guidance.

If you are concerned about the new arrangements and whether your current systems are compliant we would be happy to provide you with specific advice.

Looking to the future

At this early stage is it difficult to determine exactly how significant the impact of these new additions to the FOIA will be to public authorities, and how widely used they will be. The likelihood is that private companies, rather than individuals, will look to profit from the new opportunity to re-use public sector information at minimal cost.

The more significant concern for public bodies is that re-use of public sector information could result in increased competition for the provision of some public services, and consequently a reduction in public bodies' ability to raise revenue. No doubt we will start to see ICO decisions on the application of the provisions during the coming year.