Ensure we are giving due consideration to human rights under the ECHR when dealing with takedown requests

[RichardTaylor]

When dealing with requests to remove personal information from WhatDoTheyKnow we focus on the balance between the individual’s interests, rights and freedoms and our legitimate interest (applying the legitimate interests legal basis for processing personal information).

Where relevant we should also note the balance between an individual's "Right to respect for private and family life" under Article 8 of the European Convention on Human Rights with our [and our users'?] Article 10 right to Freedom of Expression.

The factors involved in the two balancing tests are often similar, we can probably usually deal with them together.

We should also set out any public interest case for publication (though noting that given the nature of our service we might not be fully aware of the public interest benefits of publishing specific material).

Actions:

• [ ] Check and update guidance on the wiki
• [ ] Check relevant template documents

See also

• Mention European Convention on Human Rights as access to information legislation in help pages #550

[RichardTaylor]

Addressing this might involve a help page / public policy tweak too.

[RichardTaylor]

This ticket has been raised as a result of monitoring court judgments, there is a related internal email thread.

[garethrees]

Just noting that there was no disagreement with this principle when this was raised as an FYI on the High Risk Cases & Policy call.

[RichardTaylor]

Some notes which will hopefully take us towards some policy, template and help page updates:

Legal background

The UK Human Rights Act 1998 brings the European Convention on Human Rights into UK law by making it "unlawful for a public authority to act in a way which is incompatible with a Convention right". Public bodies are defined as "a court or tribunal, and any person certain of whose functions are functions of a public nature but does not include either House of Parliament or a person exercising functions in connection with proceedings in Parliament".

While mySociety probably isn't subject to the Human Rights Act 1998 directly as courts and tribunals are subject to the Act they will consider human rights arguments which apply to cases which come before them.

See eg.

All courts in the UK must interpret and give effect to the law in a way which is as close to the Human Rights Act as possible. Courts must do this in all cases they deal with. This includes cases against a public authority as well as cases between individuals.

from Citizens Advice: https://www.citizensadvice.org.uk/law-and-courts/civil-rights/human-rights/how-are-your-human-rights-protected-by-the-courts/

Section 12 of the Human Rights Act 1998 contains a statement relating to journalism which may be particularly relevant to the operation of WhatDoTheyKnow:

The court must have particular regard to the importance of the Convention right to freedom of expression and, where the proceedings relate to material which the respondent claims, or which appears to the court, to be journalistic, literary or artistic material (or to conduct connected with such material), to— (a)the extent to which— (i)the material has, or is about to, become available to the public; or (ii)it is, or would be, in the public interest for the material to be published; (b)any relevant privacy code.

https://www.legislation.gov.uk/ukpga/1998/42/section/12

Human Rights Bodies There are a number of bodies with Human Rights related roles the UK:

• The Equality and Human Rights Commission
• The Scottish Human Rights Commission
• The Northern Ireland Human Rights Commission

These organisations do not generally appear to act as bodies individuals can complain to in respect of claimed breaches of Human Rights law, though the Northern Ireland body states one of its roles is: "providing legal assistance to individuals and initiating strategic cases, including own motion legal challenges".

Application in Practice

Often when assessing an individuals' concern about the publication of their personal information on WhatDoTheyKnow we will consider if the individual has a reasonable expectation of privacy and if there is a reasonable expectation of privacy we balance that against our right to freedom of expression. In determining if there is a reasonable expectation of privacy it is often relevant to consider if the material relates to their private life, or, as is often the case in respect of material published on WhatDoTheyKnow, to their public, civic, life. There appears to be some overlap with what is considered special category data under the GDPR and what would be considered private data when considering the Human Rights perspective.

Reference Lots of these issues have been discussed in a recent Supreme Court judgment: https://www.supremecourt.uk/cases/docs/uksc-2020-0122-judgment.pdf

[RichardTaylor]

Section on Human Rights added to

Google Doc template for Legitimate Interest Responses - https://docs.google.com/document/d/1tCdtJyYKJIgrRq-DC8PeCPPdz6txkDIff109GltAF4M/edit#

Also inbox canned responses updated:

• GDPR-RtE refuse single request
• GDPR-RtE refuse multiple requests

Canned response library updated too.

Outstanding actions:

• Help page addition
• Documentation on the wiki (if there's anything we don't make public)

[HelenWDTK]

Closing as complete