United Kingdom Information Tribunal including the National Security Appeals Panel

Information Tribunal

Appeal Number: EA/2005/0001

Freedom of Information Act 2000 (FOIA)

Heard at Procession House London

On I November 2005

Decision Promulgated 15/11/2005

Before

INFORMATION TRIBUNAL

CHAIRMAN John Angel

and

LAY MEMBERS

John Randall and Henry Fitzhugh

Between

PAUL HARPER

Appellant

And

THE INFORMATION COMMISSIONER

Respondent

and

ROYAL MAIL Group PLC

Representation:

For the Appellant: In person For the Respondent: Mr T Pitt-Payne For the Royal Mail: Mrs C Wardle

Decision

The Tribunal upholds the Information Commissioner s Decision Notice in this case and dismisses the Appeal.

Reasons for Decision

The request for information

1. On 4 January 2005 Mr Harper requested by email to the Royal Mail for confirmation that there were no requests for access to my personal file under ref. numbers 310/917 or 330/11376 between 23 October 2002 and 25 June 2003 . This email followed a similar request by Mr Harper relating to an alleged incident during the period referred to in his request, which the Royal Mail had not provided. By email dated 5 January 2005 Karen Whitehead, the Royal Mail manager responsible for personnel files, responded

I am declining your request for information as we are not obligated to provide this information to yourself . Mr Harper then emailed Martin Rush, head of information compliance, on 5 January pointing out that his email of 4 January was an FOI request, and Mr Rush responded by email on the same day that he would look into the matter. On 4 February 2005 Colin Young, the Royal Mail s Freedom of Information Manager, sent an email to Mr Harper stating Your request has now been considered as a request for information under the Freedom of Information Act. However, I can confirm that we hold no record of the information you have asked for.

2. Mr Harper complained to the Information Commissioner that he considered the Royal Mail did hold the information and provided evidence which he considered supported his assertion. Christopher Williams the Commissioner s complaints officer then investigated the complaint. He wrote to Mr Harper on 16 May enclosing a Decision Notice. Mr Williams explained that in issuing their response (email of 4 February 2005) the Royal Mail complied with their duty under section 1(1) of the Act. However, as the response was not sent until after the twentieth working day since receipt of the request the Royal Mail did not comply with their duties under section 10(1) of the Act. In the Decision Notice, also dated 16 May 2005, the Commissioner went on to find that The Royal Mail has now confirmed that it does not hold the information requested by the complainant. The Commissioner hereby gives notice that in exercise of his powers under section 50 of the Act he does not require any remedial steps to be taken by the Royal Mail.
3. In this case there are two issues for the Tribunal to consider. Firstly whether having determined the Royal Mail had contravened section 10(1) of the Act the Commissioner ought to have required any remedial step to be taken by the Royal Mail. Secondly, whether the Commissioner was wrong to accept that the Royal Mail did not hold the information requested by Mr Harper.

Dealing with an out of time response to a request for information

4. The fact the Royal Mail responded to Mr Harper s request out of time by three working days is not in dispute. Mr Pitt-Payne, counsel for the Commissioner, submitted that under section 50 of the Act the Commissioner has no power to specify any steps which must be taken, even though there had been a breach of section 10(1) of the Act. The Tribunal finds that this is a correct interpretation of section 10(1) and such powers only apply to other sections of Part I of the Act, namely sections 11 and 17. Therefore the Tribunal upholds the Commissioner s determination that the Royal Mail had contravened section 10(1) of the Act and that the Commissioner was not required to specify any remedial steps to be taken by the Royal Mail.
5. This does not mean that the Commissioner has no powers to deal with such breaches. Mr Pitt-Payne helpfully set out three ways in which the Commissioner could take action in relation to late compliance.
6. Firstly, he can make a good practice recommendation under section 48 of the Act. This section is specifically designed to deal with the need for conformity with the Codes of Practice under sections 45 and 46. So if the Commissioner felt that there was something in the Codes that was not being complied with and that was leading to late compliance, then he could issue a practice recommendation under section 48 specifying the steps which ought, in his opinion, to be taken for promoting conformity with the Codes.
7. Secondly, under section 49 of the Act the Commissioner is required to make an annual report to Parliament and may make reports at other times. So there is the possibility that public authorities which were repeatedly failing to comply could be singled out for criticism in a report to Parliament.
8. Thirdly, probably the most important power that the Commissioner has is a section 52 Enforcement Notice. Under section 52(1)"If the Commissioner is satisfied that a public authority has failed to comply with any of the requirements of Part 1, the Commissioner may serve the authority with a notice requiring the authority to take, within such time as may be specified of the notice, such steps as may be so specified for complying with those requirements." So if the Commissioner considered that there was, for example, a practice within a particular public authority of not dealing with requests until say 30 working days had passed, on the basis that by the time any complaint was made to the Commissioner the authority would already have complied but the authority had bought themselves a bit more time, the Commissioner could issue an Enforcement Notice saying that in the future that practice was not to be adhered to. That is potentially a very Draconian sanction because ultimately if an Enforcement Notice is not complied with, then there is power for the Commissioner to certify that to the court under section 54 of the Act, and to have the matter dealt with as for a contempt of court. So the fact that section 50 does not provide a mechanism for dealing with late compliance does not mean that there is no mechanism in the Act, because it is there by way of Enforcement Notice.
9. The Tribunal agrees with this analysis of the Commissioner s powers in relation to late compliance with requests. However, it appears to the Tribunal that Parliament may not have intended that section 50(4) of the Act should be so limited. By not adding section 10 to the list of sections in section 50(4)(b) it is now necessary for the Commissioner to pursue the more complex routes set out above, rather than the more straightforward approach of specifying steps to be taken by an authority in the Decision Notice.
10. The Commissioner has not pursued any of the alternative routes for dealing with the late response to the request in this case. In evidence the Tribunal heard that this was one of the first requests the Royal Mail had received under FOIA and that it was not immediately identified as such. In the past when a similar request had been made by Mr Harper the applicability of the Data Protection Act was considered. With Mr Harper s FOI request legal opinion was again sought. Once the Royal Mail had accepted that Mr Harper s request was a valid request under section 1(1) of the Act the appropriate FOI officer asked Karen Whitehead to find the Information. She in turn consulted someone in IT. As a result the response was three days late. Although this was a breach of section 10 of the Act this is unlikely to be the sort of breach which would necessitate the Commissioner using any of the powers outlined above to deal with such matters.
11. Colin Young, the FOI Manager for the Royal Mail, gave evidence that training was now being given to managers, as well as there being an FOI awareness programme. The Tribunal was persuaded that the Royal Mail was now taking steps to recognize FOI requests quickly so that there is every possibility of requests being handled within the 20 day time limit in the future. The Tribunal considers that even if the Commissioner had power under section 50(4) of the Act, it is very unlikely that he would have required any further steps to be taken in this case.

Whether the Royal Mail held the information at the date of the request

12. The second question for the Tribunal is whether the Commissioner was wrong to accept that the Royal Mail did not hold the information requested by Mr Harper. The Tribunal has heard the evidence in this case as outlined above and finds that the Royal Mail did not hold the information at the date of the request. Karen Whitehead admitted that the Royal Mail was likely to have held the information at some time, but because of the practice of deleting databases periodically so as to avoid system crashes the information, the subject of this request, was no longer held by the time the request was received. Ms Whitehead gave evidence that on being instructed to provide the information, she undertook an exercise to find the information with the help of the IT department, but without success. Although Ms Whitehead s evidence as to the timescales when all this happened was a little confused, the Tribunal does not find a basis upon which it would wish to disturb the Commissioner s decision.
13. Mr Harper s request was a proper request for information. Had the Tribunal been persuaded that the information requested was held by Royal Mail, the Tribunal would have substituted for the notice served by the Commissioner a notice requiring the information to be provided. However, the Tribunal was satisfied, from the evidence before us, that the information was no longer held at the time at which Mr Harper s request was received. Therefore we find that the Commissioner correctly found that the Royal Mail did not hold the information requested by Mr Harper.

Guidance for the Royal Mail

14. It was clear to the Tribunal, from the evidence, that at the time Mr Harper s request was handled by the Archive Manager Karen Whitehead, there was an insufficient understanding, on the part of archive staff, of the obligations placed on Royal Mail by FOIA. The Tribunal was pleased to learn that this is a matter that has now been addressed through training. Nevertheless, the Royal Mail should review whether there is now an adequate awareness, on the part of all staff with responsibility for managing information, of the right to information created by FOIA and should undertake periodic reviews thereafter.
15. The practice of deleting data concerning the booking in and out of personnel files appeared to be driven by pragmatic concerns about the risk of the system becoming overloaded. Whilst this is understandable, it creates uncertainty as to whether information is still held at any given time; and the risk that similar requests for information will be treated differently, depending on the timing of the request in relation to ad hoc housekeeping deletions. It would be advisable for the Royal Mail to consider putting in place data retention policies, so as to facilitate a consistent treatment of Freedom of Information requests.

Deleted information

16. A very interesting matter arises from this case and that is the position of deleted electronic records. If a public authority has information that has previously been held on a computer, but has been deleted, does that in itself mean that the information no longer comes within the scope of the Act. It is helpful here to go back to section 1 of the Act. An applicant's entitlement under section 1(1) is firstly to be informed in writing by the public authority whether it holds information of a specified description and if so, secondly, to have that information communicated to him. Both these rights relate to information that is held by the public authority. That then raises the question of what is meant by "held" and the Act only gives limited help here. Section 3(2) states that "For the purposes of this Act, information is held by a public authority if (a) it is held by the authority, otherwise and on behalf of another person, or (b) it is held by another person on behalf of the authority." So that does not help with the specific problem about information that has been deleted from a computer. There is also the definition of "information" in section 84 of the Act. Information, subject to two exceptions that do not apply here, means information recorded in any form . So into section 1(1), where it refers to information, can be read the words "recorded information".
17. The Act plainly does envisage that there can be circumstances where information is held at one time, but not held at the time that the request is received. This is clear from the wording of section 1(4). The information to which the duties apply under the Act is the information in question held at the time when the request is received, except that account may be taken of any amendment or deletion between that time and the time when information is to be communicated under section 1(b) of the Act, being an amendment or deletion that would have been made regardless of the receipt of the request.

What that means is that in some cases information could be held when the request is received, but no longer appear to be held at the time when the request falls to be complied with. If it is no longer held because it has been deleted in the ordinary course of business, then the public authority can take account of this fact and may be able to say we no longer hold that information, subject to what we have to say below. So if, for example, there is a computer database which as a matter of routine is completely erased every six months, and the request is made on 1st January, and the six monthly erasure happens on 10th January, and the time for compliance expires in late January, it is possible to take account of that deletion. But if on receiving a request a public authority decides to delete relevant information, within the period of 20 working days within which a response must be made, such deletion would not be in the ordinary course of business and would be unlawful. For

the purpose of considering the matter of deleted information, it is helpful to note that section 1(4) recognises the possibility that information could be held at one time, but not at another.

18. However section 1(4) says that account may be taken of any amendment or deletion (word in italics our emphasis) and not that it must be taken into account and the applicant provided with the amended version, or no information where deleted by the time when the information is to be communicated to the applicant. The Tribunal interprets this as meaning that where the deleted or unamended information is still readily accessible and this is the information that the applicant wants, then the deleted or original version of the information should be recovered and that is what should be communicated to the applicant, with perhaps an explanation of what has happened to the information since the request was received.
19. Having said this the Tribunal takes the view that an authority which has routinely deleted information before a request is made should not be in a worse position than an authority that deletes information, in the normal course of business, after a request is made.
20. Against this background it is still necessary to consider the question: if a public authority has information that has been deleted from computer records is it still held? The Tribunal understands that information which is held electronically and then deleted (and even emptied later from a recycle bin or trash can ) is in fact still retained in its original form on the computer system until it is subsequently and actually overwritten by other information. In other words, information may be deleted and emptied but it is not actually eliminated from the system at that point. This is the case with most computer systems today, although no two systems will be identical, in terms of their treatment of deleted material. It will thus be a matter of fact and degree, depending on the circumstances of the individual case, whether potentially recoverable information is still held, for the purposes of the Act.
21. In view of the Tribunal s finding on the definition of information earlier in this decision, it may be incumbent on a Public Authority to make attempts to retrieve deleted information. Accordingly, the authority should establish whether information is completely eliminated, or merely deleted. In the latter case, the authority should consider whether the information can be recovered and if so by what means. There is computer software available that can be used to recover information that has been deleted from a computer system. If information has been deleted but can be recovered by various technical means, is that information still held by the public authority? The Tribunal finds that the answer to this question will be a matter of fact and degree depending on the circumstances of the individual case.

Methods to recover data

22. The actual methods which can be employed to recover data vary both in name and practice from one system to another, but broadly the Tribunal understands that the methods by which recovery can be achieved reasonably easily are as follows
23. Firstly, systems can be restored entirely to a previous state using software that is part of the computer s own operating system. For example, the RESTORE facility in WINDOWS will restore the system to the way it existed on a previous date chosen by the operator, including information that existed at that date.
24. A second method involves backup tapes. Networked systems will be

backed up using tapes, i.e. recording tapes that are made at intervals which preserve the state of the entire system at the chosen time. These can in principle be searched for information which was deleted after the time at which the tape was recorded. These tapes are usually recycled and re-recorded after a certain specified time, after which recovery of the original information from a tape would generally no longer be possible.

25. A third method involves Un-delete or Recovery which is a readily available process which uses special software, but commercially available in a large number of programmes, to search a disk or other medium to find deleted data tracks which remain on the disk but are not as yet overwritten, as described above. These programs operate by finding all such tracks of recorded information on the disk and then matching up tracks one with another to put the information file back together and bring it into view.
26. It is, of course, desirable that such procedures are carried out by IT personnel who have relevant experience as otherwise material which was added after the date chosen for restoration may be lost.
27. In a situation where deleted but not eliminated information exists and an undeleted version also exists, it will be necessary to consider which should be subject to disclosure. This would also apply to a situation where no undeleted version exists but where there are multiple deleted versions that can be recovered. In general, the version that was extant at the time at which the request was received should be supplied, save that an authority may wish to take account of any subsequent amendment, as provided for in s.1(4) of the Act.

How far should a public authority have to go to retrieve data?

28. The extent of the measures that could reasonably be taken by a Public Authority to recover deleted data will be a matter of fact and degree in each individual case. Simple restoration from a trash can or recycle bin folder, or from a back-up tape, should normally be attempted, as the Tribunal considers that such information continues to be held. Any attempted restoration that would involve the use of specialist staff time, or the use of specialist software, would have cost implications, which could be significant. In that event, the exemption arising from exceeding the appropriate limit , set from time to time under Section 12 of the Act, might be relied upon by an authority. Also it is relevant that the 20 day time limit itself gives an indication of the period for which an authority should strive diligently to comply with a request.
29. The Information Commissioner should give serious consideration to issuing guidance to Public Authorities on this matter, and to enquiring himself, where appropriate, in relation to complaints made to him, whether an authority has considered the recovery of deleted material.

Signed John Angel Chairman

Date: 14/11/2005