80740 World Bank Institute GOVERNANCE WORKING PAPER SERIES Access to Information Program The Right to Information and Privacy: Balancing Rights and Managing Conflicts David Banisar Canadian International Agence canadienne The World Bank Development Agency developpment international WORKING PAPER The Right to Information and Privacy: Balancing Rights and Managing Conflicts David Banisar* * David Banisar is senior legal counsel for Article 19, the Global Campaign for Free Expression, in London, UK. He is also a nonresident fellow at the Center for Internet and Society at Stanford Law School, Stanford, CA. Previously, he was the director of the Freedom of Information Project of Privacy International in London; a research fellow at the Kennedy School of Government at Harvard University, Cambridge, MA; and a cofounder and policy director of the Electronic Privacy Information Center in Washington, DC. He has served as an adviser and consultant to numerous or- ganizations, including the Council of Europe, the Organisation for Economic Co-operation and Development, and the United Nations Development Programme. © 2011 The International Bank for Reconstruction and Development / The World Bank 1818 H Street NW Washington DC 20433 Telephone: 202-473-1000 Internet: www.worldbank.org E-mail: feedback@worldbank.org All rights reserved The findings, interpretations, and conclusions expressed in this volume do not necessarily re- flect the views of the Canadian International Development Agency (CIDA), the government of Canada, executive directors of the World Bank, or the governments those directors repre- sent. The World Bank does not guarantee the accuracy of the data included in this work. This report has been commissioned by the Access to Information (ATI) Program at the World Bank Institute (WBI) and supported financially by the CIDA-WBI Governance Program. The WBI Access to Information Program seeks to connect key ATI stakeholders to jointly identify, prioritize, and implement actions for effective ATI adoption and implemen- tation. The program aims to improve in-country capacity for the formulation, implementa- tion, use, and enforcement of ATI legislation through regional knowledge exchange and net- working, and by fostering the capacity of multistakeholder coalitions to undertake effective ATI reforms. Contents Acknowledgments.......................................................................................v Acronyms and Abbreviations......................................................................vii Executive Summary ....................................................................................1 1. Introduction ..........................................................................................3 2. Rights Defined.......................................................................................5 2.1 The Right to Information...................................................................................5 2.2 The Right to Privacy ..........................................................................................6 3. Complements and Conflicts in RTI and Privacy Laws ...............................9 3.1 Complementary Roles of RTI and Privacy .........................................................9 3.2 Conflicts between RTI and Privacy Interests .....................................................12 3.3 Balancing the Rights of Access and Privacy .......................................................16 4. Legislation ...........................................................................................17 4.1 Model 1—A Single RTI and Privacy Law .........................................................17 4.2 Model 2—Separate RTI and Privacy Laws: Managing Conflicts.........................18 5. Oversight.............................................................................................23 5.1 Two Bodies—Separate RTI and Privacy Commissions.......................................23 5.2 One Body—A Single RTI and Privacy Commission .........................................24 iii iv Contents 6. Case Studies.........................................................................................27 6.1 Ireland...............................................................................................................27 6.2 Mexico .............................................................................................................28 6.3 Slovenia.............................................................................................................29 6.4 United Kingdom...............................................................................................30 7. Conclusion ..........................................................................................33 Endnotes ..................................................................................................35 References ................................................................................................39 Boxes 3.1 Using Publicly Available Personal Information to Fight Fraud ............................14 4.1 Elements to Determine Fairness ........................................................................20 Figure 3.1 Complement and Conflict of Privacy and the Right to Information....................9 Acknowledgments I would like to thank Heather Brooke, Bojan and peer reviewers Alvaro Herrero, Maria Bugaric, Elizabeth Dolan, Maurice Frankel, Marván Laborde, and Andrea Ruiz for their Juan Pablo Guerrero Amparán, Katherine comments. I would also like to thank my Gunderson, Gus Hosein, Jose Luis Marzal, colleagues at Article 19; and the World Bank Natasa Pirc Musar, Maeve McDonagh, Lina Institute’s Marcos Mendiburu, Aranzazu Ornelas Nuñez, Graham Smith, and Nigel Guillan-Montero, and Luis Esquivel for their Waters for providing information and advice; assistance. v Acronyms and Abbreviations ACHPR African Commission on Human and People’s Rights ACLU American Civil Liberties Union APEC Asia-Pacific Economic Cooperation ATIP access to information and privacy CCPR United Nations Covenant on Civil and Political Rights CSA Canadian Standards Association International DCMS Department for Culture, Media, and Sport DPA Data Protection Act EC European Commission ECHR European Convention for the Protection of Human Rights and Fundamental Freedoms ECOWAS Economic Community of West African States EFF Electronic Frontier Foundation EHRR European Human Rights Report EO European Ombudsman EPIC Electronic Privacy Information Center ETS European Treaty Series EU European Union EUECJ Court of Justice for the European Communities EWHC High Court of England and Wales FOI freedom of information FOIA Freedom of Information Act vii viii Acronyms and Abbreviations IACHR Inter-American Commission on Human Rights ICO Information Commissioner’s Office IFAI Instituto Federal de Acceso a la Información y Protección de Datos MP member of parliament NJSBA New Jersey State Bar Association NZLC New Zealand Law Commission OAS Organization of American States ODNI Office of the Director of National Intelligence OECD Organisation for Economic Co-operation and Development OSCE Organization for Security and Co-operation in Europe PI Privacy International RCMP Royal Canadian Mounted Police RTI right to information UDHR Universal Declaration of Human Rights UKHL United Kingdom House of Lords UN United Nations UNHRC United Nations Human Rights Council USC United States Code USDA United States Department of Agriculture Executive Summary The right to privacy and the right to infor- government bodies. Where the two rights mation are both essential human rights in the overlap, states need to develop mechanisms modern information society. For the most for identifying core issues to limit conflicts part, these two rights complement each oth- and for balancing the rights. This paper ex- er in holding governments accountable to amines legislative and structural means to individuals. But there is a potential conflict better define and balance the rights to priva- between these rights when there is a demand cy and information. for access to personal information held by 1 1 Introduction In the words of Michel Gentot (n.d.) during islation.To date, more than 50 countries have his term as president of the French National adopted both laws. Data Processing and Liberties Commission, Privacy is increasingly being challenged freedom of information and data protection by new technologies and practices.The tech- are “two forms of protection against the nologies facilitate the growing collection and Leviathan state that have the aim of restoring sharing of personal information. Sensitive the balance between the citizen and the state” personal data (including biometrics and (p. 1). DNA makeup) are now collected and used On first inspection, it would appear that routinely. Public records are being disclosed the right of access to information and the over the Internet. In response to this set of right to protection of personal privacy are ir- circumstances, more than 60 countries have reconcilable.1 Right to information (RTI) adopted comprehensive laws that give indi- laws provide a fundamental right for any per- viduals some control over the collection and son to access information held by govern- use of these data by public and private bod- ment bodies. At the same time, right to pri- ies. Several major international conventions vacy laws grant individuals a fundamental have long been in place in Europe, and new right to control the collection of, access to, ones are emerging in Africa and Asia. and use of personal information about them At the same time, the public’s right to in- that is held by governments and private bod- formation is becoming widely accepted. RTI ies. However, the reality is more complex. laws are now common around the world, Privacy and RTI are often described as “two with legislation adopted in almost 90 coun- sides of the same coin”—mainly acting as tries. Access to information is being facilitated complementary rights that promote individ- through new information and communica- uals’ rights to protect themselves and to pro- tions technologies, and Web sites containing mote government accountability. searchable government records are becoming The relationship between privacy and even more widely available. International RTI laws is currently the subject of consid- bodies are developing conventions, and rele- erable debate around the globe as countries vant decisions are being issued by interna- are increasingly adopting these types of leg- tional courts. 3 4 The Right to Information and Privacy: Balancing Rights and Managing Conflicts Availability, legislation, and judicial deci- be considered in a manner that is equal and sions have led to many debates about rules balanced. governing access to personal information This paper will examine the two rights that is held by public bodies. As equal human and the conflicts that arise, and will describe rights, neither privacy nor access takes prece- institutional models to ensure the exercise of dence over the other. Thus it is necessary to both rights. It will present short case studies consider how to adopt and implement the from four countries (Ireland, Mexico, Slove- two rights and the laws that govern them in nia, and the United Kingdom) that have a manner that respects both rights. There is adopted different models for addressing the no easy way to do this, and both rights must conflicts, describing how those models work. 2 Rights Defined 2.1 The Right to India, have used it to ensure that the poor get the food they are entitled to receive from Information corrupt food distributors (Calland and Tilley 2002), and an angry mother in Thailand used The right of access to information held by it in her efforts to learn why her daughter government bodies (RTI) provides that indi- was not allowed into a top-quality school viduals have a basic human right to demand (Coronel 2001). It also is commonly used by information held by government bodies. It environment-focused nongovernmental or- derives from the right of freedom of expres- ganizations to reveal pollution dangers in sion to “seek and receive information,”2 and communities. is recognized worldwide as a human right.3 The right is typically recognized at the Under this right, any person may make a re- national level through constitutional provi- quest to a public body; the body is legally re- sions and national laws. Some of this legisla- quired to respond and provide the informa- tion has existed for more than 200 years. Sec- tion, unless there is a legally compelling tion 6 of the Swedish Freedom of the Press reason to refuse the request. Act (adopted in 1766) set the principle that The RTI is “a requisite for the very exer- government records were open to the public cise of democracy” (OAS 2003).4 Democra- by default and granted citizens the right to cy is based on the consent of the citizens, and demand documents from government bod- that consent turns on the government in- ies. The 1789 French Declaration of the forming citizens about its activities and rec- Rights of Man called for information about ognizing their right to participate. The col- the budget to be made freely available: “All lection of information by governments is the citizens have a right to decide, either per- done on behalf of its citizens, and the public sonally or by their representatives, as to the is only truly able to participate in the demo- necessity of the public contribution; to grant cratic process when it has information about this freely; to know to what uses it is put.” the activities and policies of the government.5 Most nations have adopted laws in the past The RTI is also an important tool for 20 years. countering abuses, mismanagement, and cor- Today, nearly 90 countries around the ruption and for enforcing essential economic world have adopted a national law or regula- and social rights. Civic activists in Rajasthan, tion that sets out specific rights and duties for 5 6 The Right to Information and Privacy: Balancing Rights and Managing Conflicts facilitating access to information (see Banisar ety (including governments, companies, and [2006]).6 The following elements are typical- other individuals). Privacy is considered es- ly found in national RTI laws: sential in protecting an individual’s ability to develop ideas and personal relationships. Al- • A right of an individual, organization, or though it is often summarized as “the right legal entity to demand information from to be left alone,” it encompasses a wide range public bodies, without having to show a of rights—including protection from intru- legal interest in that information. sions into family and home life, control of • A duty of the relevant body to respond sexual and reproductive rights, and commu- and provide the information.This includes nications secrecy.7 It is commonly recog- mechanisms for handling requests and nized as a core right that underpins human time limits for responding to requests. dignity and such other values as freedom of • Exemptions to allow the withholding of association and freedom of speech.8 certain categories of information. These The definitions of privacy and what is sen- exemptions include the protection of na- sitive personal information vary among coun- tional security and international relations, tries and individuals on the basis of past expe- personal privacy, commercial confiden- riences and cultural understandings. Some tiality, law enforcement and public order, cultures focus on community rights over in- information received in confidence, and dividual rights; others, such as countries in internal discussions. Exemptions typically Europe, are sensitive to privacy rights because require that some harm to the interest of abuses going back to World War II. In mat- must be shown before the material can be ters relating to modern information and com- withheld. munications technologies, there is more agree- • Internal appeals mechanisms for request- ment about the importance of privacy and the ors to challenge the withholding of infor- control of information (this will be covered in mation. more detail later in this report).9 • Mechanisms for external review of the The legal right to privacy is recognized in withholding of information.This includes nearly every national constitution and in most setting up an external body or referring international human rights treaties, including cases to an existing ombudsman or to the the Universal Declaration of Human Rights,10 court system. the International Covenant on Civil and Po- • Requirement for government bodies to litical Rights,11 the European Convention on affirmatively publish some types of infor- Human Rights,12 the American Declaration mation about their structures, rules, and of the Rights and Duties of Man,13 and the activities. This is often done using infor- American Convention on Human Rights.14 mation and communications technologies. International bodies, including the European Court of Human Rights and the United Na- tions (UN) Human Rights Committee, also 2.2 The Right to Privacy have ruled on the right to privacy.15 In the information age, the right to priva- Privacy is a broad concept relating to the cy has evolved to address issues relating to protection of individual autonomy and the the collection, use, and dissemination of per- relationship between an individual and soci- sonal data in information systems. New tech- Rights Defined 7 nologies have driven the collection of per- • Purpose specification principle—The sonal information by governments and pri- purposes for which personal data are col- vate bodies into databases of unprecedented lected should be specified no later than at breadth and depth. Governments and private the time of data collection; and the subse- organizations that collect information related quent use should be limited to fulfilling to government services and obligations (in- those purposes, or fulfilling such other cluding tax, medical, employment, criminal, purposes as are compatible with the stated and citizenship records) and identification purposes and specified on each occasion technologies (including identity card sys- where a change of purpose occurs. tems, fingerprints, and DNA mapping) have • Use limitation principle—Personal data quickly evolved and expanded. New com- should not be disclosed, made available, or munications technologies create and collect otherwise used for purposes other than substantial records about individuals in the those specified above, except under the process of providing communications. Serv- following conditions: with the consent of ices run by governments and private opera- the data subject, or by the authority of law. tors collect information about individuals, • Security safeguards principle—Rea- including emails, records of persons commu- sonable security safeguards should be used nicated with, lists of Web sites visited, and to protect personal data against such risks mobile locations. And, of course, people as loss or unauthorized access, destruction, share information through social networking use, modification, or disclosure. sites. All of these have led to concerns about • Openness principle—There should be abuses, including misuse of information for a general policy of openness about devel- unlawful purposes and identity theft. opments, practices, and policies relating to Since the 1960s, principles governing the personal data. Means of establishing the collection and handling of this information existence and nature of personal data and (known as “fair information practices”) have the main purposes of their use should be been developed and adopted by national gov- readily available, as should the identity ernments and international bodies (OECD and usual residence of the data controller. [1980]; also see U.S. Department of Health, • Individual participation principle— Education and Welfare [1973]; and CSA An individual should have the right [1996]). The principles generally are these: a. to obtain from a data controller (or otherwise) a confirmation that the data • Collection limitation principle—There controller either does or does not have should be limits to the collection of per- data relating to the individual; sonal data; and all such data should be ob- b. to obtain such data within a reason- tained by lawful and fair means and, where able time appropriate, with the knowledge or con- ° at a charge (if any) that is not ex- sent of the data subject. cessive, • Data quality principle—Personal data ° in a reasonable manner, and should be relevant to the purposes for ° in a form that is readily intelligible which they are to be used; and, to the ex- to the receiving individual; tent necessary for those purposes, should be c. to be given reasons if a request made accurate, complete, and kept up-to-date. under subparagraphs (a) and (b) is de- 8 The Right to Information and Privacy: Balancing Rights and Managing Conflicts nied, and to be able to challenge such sec. 2[a]).18 Under a decision from the Euro- denial; and pean Court of Human Rights, these data in- d. to challenge relevant data and, if the clude information collected under public em- challenge is successful, have the data rec- ployment.19 tified, completed, amended, or erased. National constitutions also have been • Accountability principle—A data con- evolving to specifically recognize the control troller should be accountable for comply- of personal data as a right. Many recent con- ing with measures that give effect to the stitutions include specific rights to protect principles stated above. the collection and use of personal data in in- formation systems.20 Many countries in Latin These principles have been incorporated America include a right of habeas data to into important international treaties on data control and access personal data. The May protection by the Council of Europe (1981) 2010 Constitution of Kenya states, “Every and the European Union (EC 1995); they person has the right to privacy, which in- have also been adopted by the UN General cludes the right not to have . . . information Assembly (1990) and the Commonwealth relating to their family or private affairs un- Secretariat (2002). Similar principles are un- necessarily required or revealed” (sec. 31). der consideration by the Asia-Pacific Eco- What is more directly related to the subject nomic Cooperation (APEC) forum16 and of this report is the fact that the governments the Economic Community of West African of more than 60 countries around the world States (ECOWAS 2008).17 have adopted comprehensive data protection Of those international instruments, the acts based on the fair information practices that European Union (EU) Data Protection Di- apply to personal data held by the public and rective is now the most influential, having private sectors (see EPIC/PI [2007]).21 A been adopted by the 27 EU member-states number of other countries—including the (plus three European Economic Area coun- United States,22 Georgia,23 and Thailand24— tries) and by numerous other countries in have adopted legislation that protects only per- Africa, Europe, and Latin America that trade sonal data held by government bodies. Malay- with the EU.The directive takes a broad ap- sia recently adopted a law that protects person- proach to personal information. Personal data al data held by companies, but has not adopted are defined as “any information relating to an legislation protecting personal information identified or identifiable natural person (‘data held by governments.25 In a significant number subject’); an identifiable person is one who of countries where no data protection law has can be identified, directly or indirectly, in par- been adopted, there may be more general pro- ticular by reference to an identification num- visions in the criminal and civil codes that re- ber or to one or more factors specific to his strict the use of personal information (see physical, physiological, mental, economic, cul- EPIC/PI [2007]). tural or social identity” (Directive 95/46/EC, 3 Complements and Conflicts in RTI and Privacy Laws Right to information (RTI) and privacy laws Figure 3.1: Complement and Conflict of can both complement and conflict with each Privacy and the Right to Information other, depending on the situation. As figure 3.1 shows, the two rights play different roles in most cases, and only in a small number of Protecting Access to cases do they overlap and lead to potential personal Potential government conflict. data conflict information 3.1 Complementary Roles of RTI and Source: Author’s illustration. Privacy RTI and privacy often play complementary parency of citizens in a world that has under- roles. Both are focused on ensuring the ac- gone the information revolution while ren- countability of powerful institutions to indi- dering transparent the state.” viduals in the information age. The Council In many countries, the two rights are in- of Europe stated in a 1986 recommendation tertwined constitutionally. Under the con- that the roles are “not mutually distinct but cept of habeas data—a constitutional right form part of the overall information policy that permits individuals to demand access to in society” (Council of Europe 1986). The their own information and to control its U.K. data protection registrar noted, “Data use—countries in Latin America have adopt- protection and freedom of information can ed both types of laws.27 Santiago Canton (the be seen as complementary rights, with the first Organization of American States special potential to be mutually supportive in prac- rapporteur for freedom of expression and the tice.”26 László Majtényi (2002), the first par- executive secretary of the Inter-American liamentary commissioner for data protection Commission on Human Rights) said, “The and freedom of information in Hungary, says action of habeas data, or the right to obtain that the common purpose of the two rights personal information contained in public or is “to continue maintaining the non-trans- private databases, has been very important in 9 10 The Right to Information and Privacy: Balancing Rights and Managing Conflicts many countries in exacting accountability notes, “one’s own personal information will for human rights abuses and helping coun- very often be released under FOI [freedom tries scarred by human rights abuses recon- of information], while under the Data Pro- cile and move forward, which can only be tection Act there is a presumption in favour accomplished by exposing the truth and of access to one’s own personal data” (Gov- punishing the guilty.”28 ernment of Ireland 2006). In cases where In many cases, the two rights overlap in a there is a request for information about the complementary manner. Both rights provide individual and other persons, both acts will an individual access to his or her own per- be considered. sonal information from government bodies, In some countries, the RTI act is the pri- and privacy laws allow for access to personal mary legislation used by individuals to access information held by private entities. They their own personal information held by gov- also mutually enhance each other: privacy ernment departments. In Australia, all requests laws are used to obtain policy information in under the Privacy Act are filtered through the the absence of an RTI law, and RTI laws are Freedom of Information Act (FOIA), result- used to enhance privacy by revealing abuses. ing in more than 80 percent of all FOIA re- quests being from people seeking their own Obtaining Personal Information information (Law Reform Commission 2010). Held by Government Bodies In Ireland, where both laws allow for individ- The most obvious commonality between the uals’ access, even with the presumption above, two types of laws is the right of individuals to the FOIA is still the act most people use: ap- obtain information about themselves that is proximately 70 percent of all requests are held by government bodies. This access is an made by individuals for their own informa- important safeguard to ensure that individuals tion.30 are being treated fairly by government bodies In countries such as India and South and that the information kept is accurate. Africa, where there is no general privacy law When a country has both laws, the gen- giving individuals a right of access to their eral approach is to apply the data protection own records, the RTI laws are the only means act to individuals’ requests for personal infor- to access personal records. In India, RTI laws mation; requests for information that con- are regularly used by advocates for the poor tains personal data about other parties are to obtain records on distribution of food sub- handled under the right to information act. sidies to show that individuals’ names have In some jurisdictions, such as Bulgaria and been forged and records have been falsified.31 Ireland, applications by people for their own Some RTI acts also provide for privacy personal information can be made under protections where there is no general privacy both acts.29 In these cases, it is possible that law. In South Africa, section 88 of the Promo- slightly different outcomes may result be- tion of Access to Information Act provides cause of the differences in exemptions and that, in the absence of other legislation (cur- oversight bodies. Often, data protection laws rently under consideration), public and pri- give greater rights for access to personal in- vate bodies must make reasonable efforts to formation because there is a stronger right of establish internal measures to correct personal access. In Ireland, the official policy guidance information held by the relevant bodies.32 Complements and Conflicts in RTI and Privacy Laws 11 Applying Privacy Laws to Obtain The Court reiterates that severe environ- Information from the Private Sector mental pollution may affect individuals’ well-being and prevent them from enjoying Typically, RTI laws do not apply to the pri- their homes in such a way as to affect their vate sector, except where the body is con- private and family life adversely. . . . In the ducting government functions (such as where instant case the applicants waited, right up a contractor is operating a hospital). Only a until the production of fertilisers ceased in few countries, including South Africa, have 1994, for essential information that would adopted RTI laws that extend the right of ac- have enabled them to assess the risks they cess to nongovernment bodies for their non- and their families might run if they contin- government functions.33 ued to live at Manfredonia, a town partic- Data protection laws provide an impor- ularly exposed to danger in the event of an tant complement to RTI provisions by ex- accident at the factory.35 tending individuals’ right of access to private bodies. As noted above, more than 60 coun- tries have adopted comprehensive data pro- Data protection laws can also be used to tection laws that apply to private organiza- obtain government information that sheds tions as well as to government bodies. These light on policy. Prior to the United King- laws give individuals the right to obtain per- dom’s adoption of its FOIA, the Data Pro- sonal information from private bodies. The tection Act was used by individuals to obtain use of the laws may reveal abuses by corpo- information from government bodies (see rations or other private organizations, such as Hencke [2001]; Hencke and Evans [2002, malfeasance by banks, information and com- 2003]; BBC News [2001]). Even following munication technology companies, and pre- the implementation of the FOIA, reporters vious employers.34 have used the Data Protection Act to discov- er that officials have been spying on their Using Privacy Laws to Obtain phone records to discover their sources of in- Policy Information formation (Daily Mail 2006). In the absence of an RTI law, privacy and Using RTI to Promote Privacy data protection acts can be used to reveal im- portant policy information. As mentioned at In many countries, RTI laws are a primary the beginning of this section, habeas data has tool used by privacy advocates to identify been used to demand accountability and in- abuses and to campaign effectively against formation. In a similar manner, Article 8 of them. In the United States, groups such as the the European Convention on Human Rights American Civil Liberties Union, the Electron- has been used often to obtain personal infor- ic Privacy Information Center, and the Elec- mation, and the article has granted the disclo- tronic Frontier Foundation routinely use the sure of nonpersonal information in some cas- U.S. FOIA and state laws to demand govern- es. In 1998, using Article 8 as a basis, the ment records on new and existing government European Court of Human Rights ruled that programs (communications surveillance, body in cases where a lack of information could scanners, and spying on groups) and use the endanger their health, individuals may de- records to campaign against those programs mand information from government bodies: and proposals.36 In the United Kingdom, the 12 The Right to Information and Privacy: Balancing Rights and Managing Conflicts Taxpayers’ Alliance37 and Genewatch oversee net sites. Questions about the relevance of the government, using the FOIA; and State- data protection laws for the reuse of personal watch uses the European Union’s (EU) access information (even if it is publicly available) regulations to oversee the EU bodies. are important. Under EU data protection law, the mere public access to information does not mean it can be used for any purpose 3.2 Conflicts between (Working Party 1999). RTI and Privacy In many countries, the privacy exemption Interests is one of the exemptions used most often. In the United States, the exemptions for personal Inevitably, as figure 3.1 shows, there are over- privacy (b6) and law enforcement records con- laps in RTI and privacy interests that can cerning individuals (b7c) have consistently lead to conflicts. Governments collect large been the two most-used exemptions. These amounts of personal information, and some- data include the names of recipients of home times there is a demand to access that infor- loans, citizenship records, and criminal records. mation for various reasons. The requestors In Canada, the privacy exemption was used in include journalists investigating stories, civil 31 percent of all denials—far more than the society groups fighting for accountability, in- next-most-used exemption (see U.S. Depart- dividuals demanding to know why a deci- ment of Justice [2010]; Government of Canada sion was made in a certain way, companies [2002]; and U.K. Ministry of Justice [2009]). seeking information for marketing purposes, The following sections will review some and historians and academics researching re- of the common types of information that are cent and not-so-recent events. requested and the conflicts that arise. Every national RTI law has an exemption Information about Public Officials for personal privacy. As discussed in the fol- lowing section, these laws vary greatly. As Many of the records held by public bodies noted earlier, many countries have adopted contain information that identifies officials separate privacy and data protection laws that who were involved in the subject at some may interact with the RTI law in determin- point. This includes the names of officials ing the release of information. who wrote memorandums, attended meet- Given the often complex relationship be- ings, and approved decisions. Other records tween privacy and RTI laws, the conflict fre- contain contact information, official expen- quently arises from misunderstandings about ditures, or e-mail and phone logs. It is useful what is intended to be protected. Officials to categorize this information as relating to must deal with numerous issues: Should offi- their official capacities. cials’ names and other details be considered Government bodies also hold more di- private? Is information in public registers rectly personal information about officials, available for any use? Are court and criminal including their biographical data, photo- records public? Clarity in law, policy, and graphs, salary records, employment records, practice to limit these problems is essential. home addresses, records of financial assets, These issues have taken on greater im- and medical histories. portance as information increasingly is being There is no global consensus about which disclosed in database format and over Inter- information is nonpersonal and which is per- Complements and Conflicts in RTI and Privacy Laws 13 sonal. As discussed above, the right of privacy general recognition that personal infor- is complex and defined by each culture.There mation about senior officials should be are some points that can be summarized: more available than that of junior officials. So although the salaries of junior officials • Official capacities—Overall, the ma- may not be made available or only by jority of countries take the position that scale rather than by exact numbers, the most information relating to official ca- salaries of more-senior officials may be af- pacities is not considered personal infor- firmatively published. Similarly, require- mation for the purposes of withholding. ments for asset disclosure forms are im- It may be considered personal because it posed in more than 100 countries for relates to a particular identifiable individ- senior and elected officials, and some may ual, but generally is not related to his or be publicly available.41 Biographical data her personal or family life and is less likely of decision makers and those who are be- to be sensitive. In most cases, documents ing considered for very-senior positions cannot be withheld just because an offi- are more commonly released than those cial’s name is listed as the author or recip- for more-junior positions. ient of a document. In 2007, the Euro- • Elected officials—There is also signifi- pean Ombudsman found that it was cant agreement that information about maladministration for the European Par- elected or high-rank public officials is less liament to refuse to disclose the expenses restricted, even when it relates to their of members of parliament, including their personal lives. In 2004, the European travel and subsistence allowances (EO Court of Human Rights said, “the public 2007). The Irish and U.K. information has a right to be informed . . . that is, cer- commissions have also ordered the release tain circumstances can even extend to as- of parliament members’ expense infor- pects of the private life of public figures, mation, whereas all U.S. congressional ex- particularly where politicians are con- penditures are published biannually. cerned.”42 In Hungary, the Constitutional • Employment information—Although Court ruled in 1994 that there are “nar- there is variation across cases, information rower limits to the constitutional protec- more closely related to an official’s per- tion of privacy for government officials formance in his or her job (including ex- and politicians appearing in public [. . . act salary38 and details of employee per- than to that of] the ordinary citizen.”43 In formance reviews) is withheld in many India, the Supreme Court ruled that the jurisdictions and is available in others.39 criminal records of persons running for • Personal life—Information relating sole- parliament should be released.44 In some ly to a public employee’s personal life cases, the medical records of the highest- rather than to his or her public actions is ranking officials (such as the president) less likely to be released. Medical records may be publicly released.45 of nonelected officials are generally con- Information Held by Governments sidered sensitive and are not released in about Private Individuals any system.40 For officials, criminal records not related to their positions are often Governments also hold a significant amount withheld (for example, see Scottish Infor- of information about private individuals.This mation Commissioner [2009]).There is a is why data protection or privacy laws were 14 The Right to Information and Privacy: Balancing Rights and Managing Conflicts first conceived and continue to be adopted. Box 3.1: Using Publicly Available The materials include great amounts of bu- Personal Information to Fight Fraud reaucratic records with information that most people consider sensitive—such as records re- In India, a review of the data by a single in- lating to citizen’s interactions with govern- dividual using information gathered under the National Rural Employment Guarantee ment bodies for taxation and to their health Scheme found that millions of rupees were care. In the majority of jurisdictions, most of being siphoned off because fake identity these records are considered private.46 cards in the names of children and public employees were created and used. Previous Court Records social audits had not revealed the fraud. In Mexico, an analysis of the agricultural There is no consensus on access to court subsidies register by the transparency advo- records. In Europe, court records naming in- cacy group FUNDAR found that the families dividuals are considered very sensitive (see of the minister of agriculture and wanted drug barons were receiving public money. Leith and McDonagh [2009]); in the United States, it has been a matter of long-standing principle that the information is public.47 In Hungary, the data protection and freedom of information commissioner negotiated an there is sensitivity about individuals receiving agreement between the police and media social support, so personal information held that access would be provided to criminal by government bodies is not generally made cases, but only the individuals’ initials would public.48 be used until charges were filed (Govern- In some developing countries, however, ment of Hungary 1998b). many of these records are publicly released There has been increasing sensitivity over and play a crucial role in fighting corruption. access in many countries as more records have In India, all people are guaranteed the right become available via computer networks, and to a certain annual minimum of food and there is greater concern about financial infor- employment. A key element of ensuring that mation being used for fraudulent purposes these guarantees are protected is making the (see NJSBA [2002] and Cannon [2004]). In muster rolls and other information publicly response to these concerns, many courts now available so that social audits may be accom- redact certain types of information, such as fi- plished.49 This information is increasingly be- nancial data and identification numbers, prior ing made available on the Internet.50 In to making material publicly available electron- Mexico, registers of scholarship recipients ically (see Administrative Office of the U.S. and other social beneficiaries are made avail- Courts [2008]). In Europe, many countries re- able online.51 This information can be crucial quire that identities be removed from cases be for identifying fraud in these programs. Box before they are made public. 3.1 points out two examples of fraud discov- ered through a review of public information. Social Program Records Public Registers There are also differences of opinion over the release of information relating to social sup- An increasing controversy relates to access to port programs. In most developed countries, information in public registers, such as birth, Complements and Conflicts in RTI and Privacy Laws 15 marriage, and death registers; electoral regis- • privacy interests (including the protection ters; land records; lists of license holders; and of personal information), other similar records. In many countries, • accountability for fair handling of person- there has been a long history of public access al information, and to these records. However, concern over their • public safety and security (NZLC 2008). use for commercial purposes, for stalking, and Professional Records for other reasons not related to their original purposes has grown as the registers have been Government bodies also maintain records re- digitized and made available over the Internet lating to people who have more of a business (see NZLC [2008]). Countries vary widely in relationship with government, including their approaches to making public registers those who donate money and meet with of- available and to permitting third parties to ficials in their capacity as employees of a reuse the information for other reasons.52 company or organization. In this regard, there Some countries’ laws limit disclosure of is an increasing demand that lobbyists be reg- information for certain reasons, such as com- istered and that such information be made mercial purposes. The New Zealand public public.55 register privacy principles state, “Personal in- In general, these individuals are consid- formation obtained from a public register ered to have less of a private interest guaran- shall not be re-sorted, or combined with tee because the information is related to their personal information obtained from any oth- professional activities rather than to their er public register, for the purpose of making personal opinions or lives. U.K. and U.S. tri- available for valuable consideration personal bunals have found that in the absence of information assembled in a form in which compelling reasons to the contrary, the iden- that personal information could not be ob- tities of corporate lobbyists should be re- tained directly from the register.”53 In 1999, vealed.56 However, the European Court of the U.S. Supreme Court upheld a law that Justice ruled recently that businesspeople restricted access to a computerized list of re- who met with officials could have their cently arrested individuals for use in com- names withheld.57 mercial marketing.54 The U.K. government Public Subsidies for Business makes available a limited version of the elec- Purposes toral roll (from which people may opt to have their names removed) that can be used Governments also often provide subsidies to for commercial purposes, and it prohibits use individuals as a business matter, in areas such of the full roll for such purposes. as agriculture. There has been considerable Following a review of legislation related debate over agricultural subsidies in Euro- to public registers and public access, the New pean countries in the past few years, with the Zealand Law Commission recently recom- result that most of the information is now mended that any legislation that creates a publicly available.58 There is a growing agree- public register keep the following principles ment that these records are not particularly in mind: sensitive because they relate to a business ac- tivity (although they may reveal the amount • free flow of information, of income that a small farmer may receive in • transparency, a single year). However, the European Court 16 The Right to Information and Privacy: Balancing Rights and Managing Conflicts of Justice recently ruled that information in name. This makes a major contribution to this area concerning individuals must be re- the widespread jaundiced media view of pri- stricted.59 vacy law, even though it is not actually priva- cy law that is to blame.” Misuse of the Privacy Exemption Not all arguments for privacy made by offi- cials are legitimate. A conflict sometimes aris- 3.3 Balancing the Rights es when government officials attempt to of Access and Privacy shield their decision making from scrutiny by misrepresenting their demand for secrecy as It should again be emphasized that the RTI a privacy interest. Documents and informa- and privacy are not always conflicting rights. tion are withheld, claiming privacy of offi- They are both laws designed, in part, to ensure cials or of third parties. In Argentina, the gov- the accountability of the state.The important ernment claimed that information about issue is how the legislation and the imple- official spending on advertising was personal menting and oversight bodies balance the two information (see Knight Center [2010]). rights. As discussed above, both the RTI and Former U.K. Cabinet Secretary Sir Richard privacy are internationally recognized human Wilson, the highest-ranking U.K. civil ser- rights with long histories and important func- vant, best articulated this belief, testifying, “I tions. Under human rights law, typically no believe that a certain amount of privacy is es- right is accorded a greater weight than anoth- sential to good government.”60 er.61 The rights must be decided on a case-by- The misuse of privacy exemptions often case basis with a view toward the relative im- leads to needless conflict between the media portance of various interests. and privacy campaigners as the media comes to believe that any privacy law is an attempt * * * to hide government activities. As noted by Australian freedom of information expert The next chapter will discuss legislative and Nigel Waters (2002), “There is a continued structural means to minimize conflicts be- problem of privacy exemptions in FOI law tween the two rights. being misused and getting privacy a bad 4 Legislation In the past 10 years, there has been a marked 4.1 Model 1—A Single convergence of policy and legislation in both right to information (RTI) and data protec- RTI and Privacy Law tion laws. Most data protection laws follow the structure of the Council of Europe Con- For those jurisdictions that have not adopted vention for the Protection of Individuals either law but plan to do so, one possibility is with Regard to Automatic Processing of Per- to adopt both laws in a single act. This allows sonal Data and the European Union (EU) for common definitions and internal consis- Data Protection Directive. There is more di- tency and for limiting conflict and establish- vergence around RTI laws, but they general- ing a balance from the start. Here are several ly follow the principles set out in preceding examples: chapters of this report. The convergence in both areas results from the influence of inter- • In Canada, Bill C-43, adopted in 1982, national treaties and agreements and the ef- contained both the Access to Information forts of a more global civil society connected Act and the Privacy Act. The two sections through modern communication technolo- then became separate laws with separate gy—a society that is constantly sharing ideas commissions to enforce them, but with and good practices. common definitions and relationships. There has also been convergence in de- The Canadian Supreme Court has de- veloping policies on the relationship be- scribed the two laws as a “seamless code tween RTI and privacy laws and how best to with complementary provisions that can make them interact. Although no consensus and should be interpreted harmonious- on good practice has yet emerged, a number ly.”62 Many Canadian provincial laws also of common areas are now clear. This chapter address both rights in a single law. will review the most common policy choices • In Hungary, the 1992 Act on the Protec- made by governments and highlight their tion of Personal Data and Public Access strengths and weaknesses. to Data of Public Interest is both a gener- 17 18 The Right to Information and Privacy: Balancing Rights and Managing Conflicts al RTI law and a data protection law that 4.2 Model 2—Separate protects personal information held by public and private bodies.63 It created a RTI and Privacy Laws: single oversight body with jurisdiction Managing Conflicts over both. The parliamentary commis- sioner for data protection and freedom of In many jurisdictions, either an RTI or a data information oversees them. protection law has been adopted and is in • In Mexico, the Federal Law on Trans- force, or a decision has been made to intro- parency and Access to Public Information duce the laws as separate pieces of legislation. lists both access to information and the Therefore, the new law or laws must be protection of privacy for records held by adopted in a way that ensures the greatest federal government bodies as its primary harmony between the operations of the two goals. It is overseen by the Federal Institute laws. If the goal of harmony is ignored at the for Access to Information (more common- outset, the laws will conflict and further leg- ly known by its Spanish acronym IFAI). islative efforts will be required later. More recently, legislation to extend its re- Here are some important considerations mit to include personal data held by the when adopting new legislation: private sector has been adopted. • In Thailand, the Official Information Act • Definition of personal information— both gives citizens rights to access infor- Ideally, a common definition will be used mation held by government bodies and for both acts. If not, then the definitions controls how government bodies may use from both laws will be considered each personal data. Both are overseen by the time that access to personal information Official Information Council. Legislation is sought. to protect records held by the private sec- • Primacy of legislation—Because both tor is currently being debated. access to information and privacy are equally fundamental rights, neither law There are some disadvantages to adopting may arbitrarily trump the other. How will a single act to address both rights. For one, the legislation address this issue? having both functions together may cause • Privacy exemption in RTI law—All legislative confusion over the intent of the national RTI laws provide for the with- laws and may lead to opposition by some holding of personal information.There is parties who would otherwise support one wide variance in the scope of these ex- act or another. A more practical issue is the emptions, ranging from a presumption complexity of the legislation, which may that all information is private and should lead to legislators being unwilling to review be withheld to a presumption of open- it because they lack the time.64 An act that ness with limited exceptions for sensitive covers both areas comprehensively will need information. to be as detailed as two single acts because • Subject access requests—As noted ear- there is little overlap in the two (except for lier in this report, some jurisdictions allow the definitions and the oversight body). for individuals to request their own per- Legislation 19 sonal information under either act. A bet- tion and what is excluded from the defini- ter choice would be to select one act that tion in relation to public activities. In South gives greater access and to focus those re- Africa, the Promotion of Access to Informa- quests through that law. In most European tion Act65 requires that disclosure of informa- countries, this is the Data Protection Act. tion be declined if it “would involve the un- • Oversight and appeals—What type of reasonable disclosure of personal information body will rule on the balancing of the about a third party, including a deceased in- rights? It should be a specialized body that dividual.” However, the information can be can develop clear standards on the subject. disclosed if it is about an individual who is or was an official of a public entity and if it re- Personal Information Defined lates to the position or functions of the indi- Data protection laws typically take an expan- vidual, including, but not limited to sive view of what is personal information. EU Directive 95/46/EC, section 2(a), defines • the fact that the individual is or was an personal information broadly as any infor- official of that public body; mation that identifies an individual. Such • the title, work address, work phone num- breadth can lead to a conflict with the RTI ber, and other similar particulars of the because the core principle of data protection individual; is that information collected for one purpose • the classification, salary scale, or remuner- should not be used for other purposes with- ation and responsibilities of the position out the consent of the individual—and this held or services performed by the indi- is often viewed as covering everything that vidual; and mentions a person. • the name of the individual on a record Countries have addressed this in different prepared by the individual in the course ways. The Canadian access to information of employment (section 34). and privacy acts use a single definition in the Privacy Act that sets out in detail the bound- Curiously, a few laws passed more recent- aries of personal information and public in- ly—including the Indian Right to Informa- formation. In contrast, the Irish Freedom of tion Act and the Indonesian Act on Public Information Act (FOIA) and the Data Pro- Information Disclosure66—do not provide tection Act use different definitions, but re- for a definition of private information; they quire that the FOIA definition be used when rely instead on common language definitions considering the exemption. for interpretation. Some countries define in more detail the Fairness and Data Protection types of information to be protected. Doing so enables the legislature to define some of In many countries, the privacy exemption the boundaries rather than leave them to the requires that all personally identifiable infor- oversight bodies or courts to determine. mation must be withheld. Frequently, the Many laws specifically exclude informa- RTI law specifically defers to the law on data tion relating to public functions from cover- protection for the definition of personal in- age under the privacy exemption. As noted formation to be protected and the rules gov- before, Canada’s Privacy Act includes de- erning its release. This approach is found in tailed descriptions of both personal informa- many European countries, including Croatia, 20 The Right to Information and Privacy: Balancing Rights and Managing Conflicts Kosovo, Romania, Slovakia, and the United Box 4.1: Elements to Determine Kingdom. Fairness Under this approach, it is then necessary to use the data protection law to determine The U.K. Ministry of Justice recommends if information can be released. An initial in- that the following factors be used in deter- mining if disclosure under the U.K. FOIA quiry will determine if consent has been ob- would be considered fair: tained and can be used to justify the release • How the information was obtained. of the information. A best practice is to in- • The data subject’s likely expectations form individuals at the time of collection regarding the disclosure of the informa- that the information may be made public tion. For example, would the party ex- under RTI legislation.67 If consent from the pect that his or her information might person is not forthcoming, the data protec- be disclosed to others? Or had the per- son been led to believe that his or her tion principles must be reviewed to deter- information would be kept secret? mine if release can be justified. • The effect that disclosure would have Among the pertinent principles, fairness on the data subject. For example, is the most important one to consider. Fair- would the disclosure cause unneces- ness typically depends on the circumstances sary or unjustified distress or damage to the data subject? under which the information was collected • Whether the party expressly refused and the expectation at that time that the in- consent to disclosure of the information. formation would be used in certain ways. If • The content of the information. the processing (in this case, the public release) • The public interest in disclosure of the of the information can be found to be fair, it information. can proceed and the information can be dis- closed. Box 4.1 sets out guidelines used by Source: U.K. Ministry of Justice 2008. the U.K. government to determine fairness. Public Interest Test In the United States, the primary privacy Increasingly, many RTI laws provide for a exemption protects “personnel and medical balancing test to be used when determining files and similar files the disclosure of which whether personal information should be re- would constitute a clearly unwarranted inva- leased. Under this test, even if the informa- sion of personal privacy.”68 The courts have tion is determined to be personal and its re- found that there is an implicit public interest lease would cause harm, it may be disclosed test “balancing the individual’s right to pri- if it is found that the public interest in release vacy against the basic purpose of the FOIA is more important than the privacy interest. to open up agency action to the light of This allows for independent arbiters such as public scrutiny.”69 commissions, courts, or ombudsmen to weigh The Slovenian information commissioner the different values and determine, case by has identified some areas where public inter- case, when information should be released. est would be strong: This test is used to evaluate privacy interests in a number of countries, including Ireland, • where the disclosure will assist public un- New Zealand, Slovenia, and the United derstanding of an issue of current national States. debate, Legislation 21 • where the issue has generated public or their Constitutional responsibilities with- parliamentary debate, out being put in a position where they • where proper debate cannot take place are or may be subjected to unjust attack without wide availability of all relevant for claiming financial entitlements which information, are theirs as a matter of law and the • where an issue affects a wide range of in- amounts of which are not, in the normal dividuals or companies, course, relevant to the member’s perform- • where the issue affects public safety or ance as a public representative. public health, • The possibility of prejudice to, or distortion • where the release of information would of, the democratic process by equation, in promote accountability and transparency the eyes of members of the public, of the in decision making, and level of payment of expenses to members • where the issue concerns the making or with individual performance of members, spending of public money (Pirc Musar with possible adverse consequences for the 2006). careers of individual members. • The possibility that disclosure of records In a leading case in Ireland, the Irish in- which are, or may not be, comparable, formation commissioner set out public inter- and which are likely to be used for com- est arguments to consider when balancing parison purposes, may mislead the public requests for information: and result in comment based on partially or wholly unreliable conclusions which • The public interest in the public having may be damaging to the interests of in- access to information. dividual members. • The public interest in the accountability • The possibility that such comparisons may of elected representatives. result in certain members being forced to • The public interest in a free and informed release further personal information relat- debate on the level of remuneration/ex- ing to their financial affairs in order to deal penses paid to elected representatives. with inaccurate public speculation as to • The public interest in accountability for their income and to repair perceived dam- use of public funds. age to their interests.70 • The public interest in an individual’s right to privacy in respect of information Thus, it is clear from the different models relating to his/her financial affairs. described above that both the RTI and the • The possibility of damage to the image data protection laws must clearly define how of Parliament as an institution in the personal information is going to be consid- event of reduced public confidence in the ered. Under the most effective legislation, integrity of members of the Houses of this is set out lucidly and provides for specific the Oireachtas. boundaries on types of personal information • The public interest in the entitlement of to be protected and a balancing test that ex- members of the Houses of the Oireachtas amines both harms and the public interest (Irish national parliament) to discharge (Pirc Musar 2010). 5 Oversight All national right to information (RTI) laws A few countries have created an independ- have some form of external appeals mecha- ent RTI commission as a single-function body. nism. In approximately two thirds of coun- These countries include Belgium, Canada, tries (roughly 60), an independent oversight France, and Portugal. More commonly, an al- body such as a commission or ombudsman ready existing ombudsman’s office also en- has been empowered to receive appeals and forces the RTI law. This is the situation in make determinations or recommendations New Zealand, Peru, and the Scandinavian on the release of information.71 These bodies countries. A few jurisdictions (such as Ireland) can play an important role in balancing pub- have adopted an RTI commission that also lic interest with the release of personal data. serves as the ombudsman, but with additional A very strong trend exists for countries to powers. create information commissioner offices that In nearly all countries, the data protection can decide appeals and provide oversight and or privacy commission is an independent guidance.There is a roughly even split in ju- body. This is partly because of requirements risdictions that have created a commission under European Union law that data protec- between those that have separate bodies to tion commissions be independent.72 handle the RTI and data protection and There are benefits to having two bodies. those that have a single body to handle both. A separate commission for each of the two Each model has its pros and cons. rights can create clear champions for such rights, unencumbered by the need to balance potentially competing interests. As stated by 5.1 Two Bodies— Canadian Information Commissioner John Separate RTI and Grace: Privacy Commissions The values of openness and privacy each Many countries have created separate bodies has a clearly identifiable and unambiguous for enforcing the RTI and the protection of advocate.While both commissioners are re- privacy. The bodies may have a single func- quired by law to reasonably balance access tion or have other duties assigned to them. rights and privacy rights, each has a clear 23 24 The Right to Information and Privacy: Balancing Rights and Managing Conflicts mandate to be a lightening [sic] rod for, and Two bodies which operate in an area so champion of, one of the two values.73 closely interlinked would inevitably come into conflicting situations [with] the insti- This could be particularly important when tute of an administrative dispute as a tool one is a new right that is not yet established for settling such conflicts. Such a manner of in the public mind and the other has long settling mutual conflicts though, would, due been accepted and championed by a body. to the long time periods of dispute resolu- A primary concern of having two bodies tions, mean a lessened legal certainty (Pirc is that there will be conflict between the Musar 2006). two—and that could become messy, expen- sive, and embarrassing. In Canada, there have Finally, not related to the scope of this re- been public fights between the two commis- port but quite relevant to many countries, sions for both policy and political reasons there is an economic concern relating to the (see Government of Canada [2001]).There is cost of two commissions. It may be difficult also concern that public bodies and the pub- to justify two commissions in small jurisdic- lic will receive conflicting advice from the tions when economic situations are difficult two commissioners when they disagree. As or as governments are cutting back to create noted by the Canadian Access to Informa- a new body. tion Review Task Force in 2002: When there are two agencies, there should be formal agreements to cooperate to mini- An institution is required to notify the Pri- mize conflicts. In New Zealand, the privacy vacy Commissioner before making such a commissioner and the ombudsman have a for- disclosure, where this can reasonably be mal consultation process that requires the om- done. A situation can arise where the Infor- budsman to consider the views of the privacy mation Commissioner advises the institu- commissioner before determining whether to tion to disclose personal information in the release personal information (Slane 2002). In public interest, but the Privacy Commis- Ireland, the Data Protection Act requires the sioner advises the institution to protect the two bodies to cooperate. information on the grounds that the public interest in the case does not clearly out- weigh the invasion of privacy that could re- 5.2 One Body—A Single sult from disclosure. This puts the institu- RTI and Privacy tion in the difficult position of having Commission conflicting recommendations from the two Commissioners (Government of Canada Countries increasingly have been creating 2002, p. 59).74 single commissions to handle both access to information and privacy protection. Coun- If there are two commissioners, there will tries and jurisdictions that have adopted this need to be a mechanism to resolve conflicts. model include Estonia, Hungary, Malta, Mex- Previously, the Slovenian system used an ad- ico, Serbia, Thailand, and the United King- ministrative dispute institute. The Slovenian dom at the national level; and many Canadi- information commissioner found that the an provinces, German länder, Mexican states, system was inefficient: and Swiss cantons at the subnational level. Oversight 25 In most cases, an existing commission is better exercise their rights. The Slovenian given additional authority with the adoption commissioner has found that having one en- of new legislation. In the United Kingdom, tity resulted in greater awareness of both the Data Protection Commission evolved rights: into the Information Commission. A similar process also occurred in Germany, Malta, and The merged body also insures for its greater Switzerland. In Slovenia, the two bodies were visibility as well as unification of the entire merged into a single new commission headed legal practice of the field. It will also increase by the previous information commissioner. the awareness of all other government bod- The most significant benefit of having a ies while carrying out the stated legislative single body is the shared expertise and re- provisions to the benefit of all applicants duction of conflict. As noted earlier, there is (Pirc Musar 2006). a strong interrelation between the two rights. Although they have some areas of conflict, The creation of a single body with both there also are strong areas of commonality. powers also reduces the likelihood that pub- Having a single body can reduce the pos- lic bodies can misuse data protection, know- sibility of institutional conflict. In practice, ing that their decisions are subject to review many requests for information under RTI by an oversight body that is an expert in legislation will relate to personal informa- both areas of legislation. As László Majtényi, tion; having this dual expertise will allow for the first Hungarian information commis- better balancing. Elizabeth France (1999), the sioner, stated in his first report, “[i]t goes U.K. data protection registrar, commented without saying that nobody can lawfully ob- during the legislative process in June 1999: struct the freedom of information and the press in the name of data protection” (Gov- The possibility of institutional conflict ernment of Hungary 1998a, p. 73). which would exist were there to be separate There is also an important economic ar- Commissioners for freedom of information gument to having only a single body. None and data protection matters is avoided. of the administrative costs—such as human Working within one institution should al- resources, technical infrastructure, and ad- low more focused and effective consideration ministrative support—are duplicated. When than working across institutional bound- the Canadian information and privacy com- aries. Any tension will be contained within missioners, who shared common corporate the institution. Making the actual decision services, split apart in 2002, the costs for both about where the balance should lie between bodies increased by an estimated Can$1 mil- data protection and freedom of information lion each. in a particular case will not be less difficult The strongest drawback to adopting a because there is one commissioner. However, single-commission model is the danger that with experience and understanding of both one interest may be stronger or perceived as issues in-house, the decision process itself more powerful and that the bodies do not should be eased. equally protect or balance both interests (Tang 2002). Any conflicts are likely to be It is also easier for the public to have a decided internally rather than publicly, where single point of contact with public bodies to they would receive a public viewing and de- 26 The Right to Information and Privacy: Balancing Rights and Managing Conflicts bate. The Canadian privacy commissioner new functions added to his mandate have re- worried that it would “diminish” or “dilute” sulted in additional work without enough re- the profile of privacy at a time when there sources being provided (ABC News 2009). were profound privacy challenges.75 An imbalance could be especially prob- There is no clear answer for every juris- lematic where one law has a greater consti- diction on the issue of whether it is better to tutional protection or has been in force for a have one commission or two. Countries may significantly longer period of time. In the wish to create a new institution to ensure United Kingdom, this concern led to the that the profile of one of the rights is clearly creation of two distinctly separate workforces promoted and not diluted by other func- for the different rights inside the information tions. In other cases, an existing body (such commission (which had previously been en- as an ombudsman) may be appropriate. And, forcing only data protection rights). Only af- of course, economic or political concerns ter five years are the two workforces being may dictate one model over the other. merged. There is also a concern that a single body * * * may not be provided with adequate resources to take on additional duties—duties that are In the next chapter, both oversight models significantly different in some ways. In Aus- will appear in the case studies presented tralia, the Tasmania ombudsman (who is also there—including one jurisdiction that has the information commissioner and the in- switched from one model to the other. The tegrity commissioner, and who holds several discussion will examine some of the benefits other posts) recently expressed concern that and limitations of the different models. 6 Case Studies 6.1 Ireland These definitions are followed by three para- graphs of information expressly excluded Ireland’s Data Protection Act was adopted in from the definition of personal information, 1988 and amended in 2005 to implement including the activities of an officeholder of the European Union (EU) data protection a public body and those providing public directive. The act created the Office of the services under contract, and opinions of the Data Protection Commission as an oversight individual regarding the public body (includ- and enforcement body. Ireland’s Freedom of ing its staff). Information Act (FOIA), adopted in 1997, Separately, the Data Protection Act defines created an Office of Information Commis- personal information as “data relating to a liv- sion to enforce the act. The government ap- ing individual who is or can be identified ei- pointed the ombudsman to act jointly as the ther from the data or from the data in con- information commissioner.The second com- junction with other information that is in, or missioner was also jointly appointed as om- is likely to come into, the possession of the data budsman. Under the Data Protection Act, controller” (sec. 1[1]). However, to ensure that “the Commissioner and the Information there is no conflict between that act and the Commissioner shall, in the performance of FOIA, section 1(5)(a) of the Data Protection their functions, co-operate with and provide Act provides a specific exemption for release of assistance to each other” (sec. 1[5][b]). personal information under the FOIA.This is The definition of privacy in the two acts considered by a leading commentator (Mc- is not identical. Section 2 of the FOIA de- Donagh 2006) to be a “trumping” of the pri- fines personal information as data about an vacy right, but subject to constitutional protec- “identifiable person” that is normally “known tions and international obligations. only to the individual or members of the Individuals may request personal informa- family, or friends, of the individual,” or is tion about themselves from government bod- confidential. It provides 12 paragraphs of ex- ies under either the Data Protection Act or amples of what is personal information, in- the FOIA. Most requests to public bodies are cluding “educational, medical, psychiatric or made under the latter, except requests to bod- psychological history,” financial affairs, reli- ies that are not covered by the FOIA—such as gion, and tax and identification numbers. the Guardi (police) and the private sector. 27 28 The Right to Information and Privacy: Balancing Rights and Managing Conflicts Under section 28 of the FOIA, personal der the Social Welfare Acts, where there is an information must be withheld unless (1) it is expenditure of public money but the pay- about the requestor, (2) the person gives ment derives from some private aspect of the consent, (3) the information is of a class that claimant’s life such as family circumstances is publicly available or the person has been or inadequacy of means (Government of Ire- notified that it is part of that type of class, or land 1999). (3) its release is necessary to avoid a serious and imminent danger to the life or health of Since that time, the commissioner has ex- an individual (see Government of Ireland amined numerous other cases related to pri- [2006]). vacy and access. The breakdown of cases in- The exemption is subject to a public in- dicates that this question is the one most terest test that allows for the release of the in- examined by the office. Other information formation if “the public interest that the re- that has been ordered released under the quest should be granted outweighs the public interest test includes payments of agri- public interest that the right to privacy of the cultural subsidies and the names of and pay- individual to whom the information relates ments to experts, outside lawyers, and senior should be upheld” or if it benefits the indi- academics.76 In a recent settled case, the vidual. The information commissioner ruled commissioner negotiated a settlement for the in 1999 that the expenses of members of release of detailed expenditure records in parliament (MPs) should be released as a database form from the Department of Arts, matter of public interest. In that case, the Sport and Tourism to allow for easy compar- commissioner examined the questions about isons (Sheridan 2010). However, a complaint financial privacy and public spending: about the decision has been filed with the Data Protection Commission.77 As a general proposition I would accept that, when an individual discloses details of his/ her financial affairs including details of fi- 6.2 Mexico nancial transactions with third parties to a public body, there is an understanding that Mexico adopted the Federal Law on Trans- the information is given in confidence. How- parency and Access to Public Information in ever, does such an understanding normally 2002.78 The law states that its objective is to exist in relation to the payment of public both promote transparency and protect per- money to individuals, be they members of sonal information held by public bodies. It the Oireachtas [Parliament] or employees of does not apply to personal data held by pri- a public body? It is pertinent to recall at this vate bodies. In 2010, the Federal Law on point that the information at issue in this Protection of Personal Data Held by Individ- case concerns amounts paid to individuals to uals was adopted.79 The more recent law ap- defray expenses incurred by them in dis- plies to personal data held by private compa- charging their functions as public representa- nies and individuals. Personal information is tives.The payments do not arise out of some defined as “any information concerning an private activities or private aspect of their identified or identifiable natural person.” A lives. On this point they can be distinguished new initiative is being considered by Con- from, say, a payment made to a claimant un- gress to revise and extend the data protection Case Studies 29 provisions of the right to information (RTI) connection with the purposes for which law to improve the protection of information they were obtained”; to ensure it is accurate, held by federal bodies. updated, and corrected it if it is incorrect; As part of a federal system, each of the 32 and to ensure that it is kept secure. states has adopted its own access to informa- The IFAI rules on all appealed cases con- tion law, and many are considering data pro- cerning access to government-held informa- tection laws. In the Federal District (Mexico tion. Many of these cases relate to the per- City), both RTI and data protection laws sonal information of third parties, both have been adopted, and a single commission officials and members of the public; and they handles both issues.80 have required the IFAI to balance the two The 2002 RTI law created a Federal In- rights. In balancing these rights, the institute stitute for Access to Information (IFAI) to balances public accountability against pro- monitor federal government bodies’ compli- tecting personal data (Irazábal and Núñez ance with both access to information and 2009). In the cases, some of the factors have protection of personal data legislation. The included the public interest in knowing IFAI was changed into the Federal Institute about criminal prosecutions, the importance for Access to Public Information and Data of the public being aware of the elements of Protection with the adoption of the 2010 a scientific investigation, and the value of act, and will now have the authority to en- public accountability when public funds are force the protection of personal information spent. In cases where privacy has been up- held by the private sector. held, the IFAI has analyzed whether the re- Personal information is defined in article lease of information would give the public II(2) of the law as “[a]ll information con- insight into the performance of the data sub- cerning an individual, identified or identifi- jects or their suitability for their jobs. Follow- able, including their ethnic or racial origin, ing such analysis, it decided that release or related to their physical, moral or emo- would not provide such insight, and so de- tional characteristics, their personal and fam- nied release of the information. In a different ily life, residence, telephone number, patri- case (one that sought the telephone numbers mony, ideology, political opinions, religious of wildlife units), another decision was or philosophical beliefs or convictions, phys- reached and the numbers were released. The ical or mental health, sexual preferences, or IFAI has also denied release of information any other similar preferences that could have from the Mexican Population Register— an impact on their intimacy.” Article 18 pro- even though the information was not con- tects personal data as confidential and thus sidered confidential—because it was available exempt from release. Personal data related to elsewhere. public spending or present in public reg- istries is not considered confidential. According to chapter IV of the 2010 law, 6.3 Slovenia federal public bodies are required to provide individuals access to their own information The Personal Data Protection Act was adopt- and details on the procedures for correcting ed in 1999 and replaced in 2005 with a new that information to ensure that all handling act based on EU Directive 95/46/EC. The is “adequate, appropriate and moderated in law created an Inspectorate for Protection of 30 The Right to Information and Privacy: Balancing Rights and Managing Conflicts Personal Data within the Ministry of Justice Under the Access to Information Act, ac- as its oversight and enforcement body. The cess cannot be withheld if it is “related to the Access to Public Information Act was adopt- use of public funds or information related to ed in 2003. The law created a commissioner the execution of public functions or employ- for access to public information to enforce its ment relationship of the civil servant.” It also provisions. contains a public interest test that provides The two commissions were merged into that “the access to the requested information a single information commissioner by the is sustained, if public interest for disclosure Information Commissioner Act in 2005. prevails over public interest or interest of There were concerns that the inspectorate other persons not to disclose the requested for data protection was not as strong and in- information.” dependent as required under EU rules. Prior Under the decisions of the commissioner, to the merger of the offices, disputes were the public interest in the release of informa- handled through the initiation of an admin- tion is the issue that has been examined nu- istrative dispute; however, no cases were filed. merous times.82 The commissioner has or- Following the merger, the National Supervi- dered the release of information relating to sor for Data Protection was established under the misconduct of officials because it is in the the authority of the information commis- public interest 83 and the release of the name sioner, and staff was substantially increased. of a job applicant who was already a public Slovenia’s Access to Information Act al- servant,84 and has denied release of video lows for the withholding of information surveillance records from the state prosecu- when “the disclosure . . . would constitute an tor’s office.85 infringement of the protection of personal data in accordance with the Act governing the protection of personal data.” Personal 6.4 United Kingdom data are defined in the Data Protection Act as “any data relating to an individual, irrespec- The United Kingdom first adopted the Data tive of the form in which it is expressed.” An Protection Act in 1984, in response to the individual is defined as “an identified or Council of Europe’s Convention for the identifiable natural person to whom personal Protection of Individuals with Regard to data relates; an identifiable natural person is Automatic Processing of Personal Data.86 one who can be identified, directly or indi- The act created a data protection registrar to rectly, in particular by reference to an identi- enforce it. In 1998, the act was replaced to fication number or to one or more factors implement EU Data Protection Directive specific to his physical, physiological, mental, 95/46/EC, which changed the data protec- economic, cultural or social identity, where tion registrar into the data protection com- the method of identification does not incur mission and granted it stronger powers. In large costs or disproportionate effort or re- 2000, the FOIA was adopted. The act trans- quire a large amount of time.” However, the formed the data protection commission into commissioner has said that, based on a Con- the information commission, with authority stitutional Court ruling, a name is not suffi- to enforce both acts. cient to constitute personal data in the ab- When the FOIA proposal was first con- sence of other identifying data.81 sidered, the government position was that Case Studies 31 there would be a separate information com- in accordance with the rights of the individ- mission. In the end, the government revised ual, that they are kept secure, and that they are its position, stating, not transferred to third countries. Under the FOIA, when an individual re- Dual enforcement regimes raise serious co- quests personal information about himself or ordination problems, are confusing to appli- herself, he or she is directed to the subject cants, wasteful of resources and require com- access provisions of the Data Protection Act. plicated procedures to ensure that issues of Although this typically is a good solution, privacy and access to information have both given the stronger requirements under EU been properly assessed in the many cases in law and the European Convention for the which they overlap.This is why it has been Protection of Human Rights and Funda- decided that for the UK FOI Act the role mental Freedoms on access to personal of Information Commissioner should be records, there is a substantial weakness in the merged with that of Data Protection Com- United Kingdom. Under the U.K. Data Pro- missioner (U.K. Home Office 1999). tection Act, individuals who are denied ac- cess cannot appeal to the information com- In addition, the Freedom of Information missioner. Rather, they must apply in court. (Scotland) Act 2002 created a separate Scot- They have fewer rights to demand access tish information commission that has au- than are available under the FOIA. thority only over access to information. The When it comes to accessing records that Scottish information commissioner considers contain personal information about other the U.K. data protection exemptions when people, there is a complex relationship. A deciding on the release of information.87 simplified explanation is that requests for in- The FOIA adopts the definition of per- formation about third parties are generally sonal data found in the U.K. Data Protection exempt if they violate the data protection Act: “data which relate to a living individual principles of the Data Protection Act. Under who can be identified—(a) from those data, the FOIA, there is an absolute exemption for or (b) from those data and other information personal information. Thus, any decisions on which is in the possession of, or is likely to the release of personal data must analyze the come into the possession of, the data con- information using the data protection prin- troller, and includes any expression of opinion ciples rather than the FOIA. However, this is about the individual and any indication of the not to say that information containing per- intentions of the data controller or any other sonal data is never released. The key issue is person in respect of the individual.” Eight whether the release of the information would data protection principles set the rules for the be unfair under the principles. This includes processing of personal information. They re- a consideration of how the information was quire that the processing is fair and lawful, collected in the first place, the effect on the that the data are collected and used only for person from whom the information was col- specific and lawful purposes, that the data are lected, whether consent to release the infor- adequate and relevant for the purpose for mation was obtained, and the public interest which they are collected, that they are accu- in releasing the information.88 rate and up to date, that they are kept no According to the U.K. Ministry of Justice longer than necessary, that they are processed (2010), the privacy exemption is the most 32 The Right to Information and Privacy: Balancing Rights and Managing Conflicts common one cited by public bodies. Many information was withheld on privacy grounds, cases before the information commission, the but later leaked. It revealed some corrupt and information tribunal, and the courts have fo- unethical practices by MPs. In another case in cused on this subject; and they have required 2008, the House of Lords ruled on the release balancing by those bodies. A significant case of anonymous health statistics.90 Separately, the occurred in 2008, one related to MPs. Journal- information tribunal has ruled several times re- ists had asked for detailed records of the ex- cently91 on the identity of senior officials, es- penditures of MPs—expenditures that not tablishing that they do not have a reasonable only related to their official office and travel expectation of anonymity in any document expenses but also to subsidies they received for (even sensitive ones); at the same time, junior housing. Following a protracted series of deci- officials may have this expectation, depending sions by the information commissioner, infor- on the public nature of their jobs and when mation tribunal, High Court, and Court of they meet with lobbyists. The tribunal also or- Appeals,89 much of the information was re- dered the release of anonymous statistics on leased, based on its public interest. Some of this abortion.92 7 Conclusion Access to information and protection of pri- Of key importance is that governments vacy are both rights intended to help the in- take care when writing the laws to ensure dividual in making government accountable. that the access to information and data pro- Most of the time, the two rights complement tection laws have compatible definitions of each other. However, there are conflicts—for personal information. They should adopt ap- example, privacy laws often are improperly propriate public interest tests that allow for invoked by governments. And there are cases careful balancing of the two rights. Finally, where the conflicts are legitimate. they should create appropriate institutional There is no simple solution to balancing structures that can balance these rights and the two rights, but most issues can be miti- ensure that data protection and right to in- gated through the enactment of clear defini- formation officials work together, even if tions in legislation, guidelines, techniques, they represent different bodies. and oversight systems. 33 Endnotes 1 For the purposes of this working paper, the terms “right (2009); and Bensaid v. United Kingdom 44599/98 [2001] to information laws,” “access to information laws,” and ECHR 82. 9 “freedom of information laws” refer to the same type of For example, see the November 3, 2009, Madrid Privacy laws that provide for a legal right of access to information Declaration: Global Privacy Standards for a Global World, at held by public bodies. http://thepublicvoice.org/madrid-declaration/. 2 10 See the Universal Declaration of Human Rights (UDHR), UDHR, art. 12. 11 art. 19. Ibid., art. 17. 3 12 For a detailed overview of international standards on RTI, Ibid., art. 8. 13 see Mendel (2008) and Banisar (2006). Ibid., art. 5, 9, and 10. 4 14 In 2006, the Inter-American Court of Human Rights Ibid., art. 11. 15 ruled that “the State’s actions should be governed by the For example, see Netherlands—CCPR/C/82/D/903/1999 principles of disclosure and transparency in public adminis- [2004] UNHRC 60 (November 15, 2004), http://www1.u tration that enable all persons subject to its jurisdiction to mn.edu/humanrts/undocs/html/903-1999.html. 16 exercise the democratic control of those actions, and so that APEC Privacy Framework, 2005, http://www.apec. they can question, investigate and consider whether public org/About-Us/About-APEC/Fact-Sheets/Collection/AP functions are being performed adequately. Access to State- EC-Privacy-Framework.aspx. 17 held information of public interest can permit participation Also see Organisation of Eastern Caribbean States (2004). 18 in public administration through the social control that can See also Article 29 Data Protection Working Party, Opin- be exercised through such access” (Marcel Claude Reyes et ion 4/2007 on the concept of personal data, June 20, 2007, al. v. Chile, judgment of September 19, 2006). at http://www.gov.gg/ccm/cms-service/download/asset/? 5 See, for example, ACHPR (2002); and the Joint Declara- asset_id=12058063. 19 tion of the UN Special Rapporteur on Freedom of Opin- Copland v. United Kingdom (App. No. 62617/00) 2007. 20 ion and Expression, the OSCE Representative on Freedom For example, see the constitutions of Albania (1998, sec. of the Media, and the OAS Special Rapporteur on Freedom 35). Cape Verde (1999, sec. 42), the Former Yugoslav Re- of Expression, November 26, 1999. public of Macedonia (1992, sec.18), Mozambique (1990, 6 A global map of countries with access to information leg- sec. 71), and Thailand (2007, sec. 35). 21 islation is available at http://www.privacyinternational.o For a map of data protection laws around the world, see rg/foi/foi-laws.jpg. http://www.privacyinternational.org/survey/dpmap.jpg. 7 22 Writing on December 17, 1992, in Niemietz v. Germany See the Privacy Act of 1974, 5 USC 552(a). There is also (16 EHRR 97), the European Court of Human Rights a patchwork of sectoral legislation applying to heath, finan- noted, “The Court does not consider it possible or neces- cial, and credit records; some telecommunications records; sary to attempt an exhaustive definition of the notion of educational records; and other areas at both the national and ‘private life.’” For a detailed overview of the different rights, state levels. For a comprehensive overview, see Solove and see EPIC/PI (2007). Schwartz (2008). 8 23 For example, see the following documents: UN Human General Administrative Code, sec. 27. 24 Rights Committee (1988); UN Human Rights Council Official Information Act, B.E. 2540 (1997). 35 36 The Right to Information and Privacy: Balancing Rights and Managing Conflicts 25 44 Malaysian Personal Data Protection Act, 2010. Union of India v. Association for Democratic Reforms 26 Freedom of Information: Consultation on Draft Legisla- (2002) 2 LRI 305. 45 tion Cm 4355, May 1999, Response of the Data Protection The European Court of Human Rights ruled in 2004 that Registrar. there was a public interest in a doctor revealing information 27 See Guadamuz (2001); and the Rule on the Writ of that French President François Mitterand was seriously ill Habeas Data, issued by the Philippines Supreme Court (A. while in office and had hid that from the public. The court M. No. 08-1-16-SC, January 22, 2008, http://www.lawph ruled that a temporary injunction was appropriate, but that il.net/judjuris/juri2008/jan2008/am_08-1-16_sc_2008.html). a permanent one violated Article 10 of the European Con- 28 Canton’s remarks of October 30, 2002, are available at vention on Human Rights (Éditions Plon v. France [Appli- http://www.wpfc.org/index.php?q=node/221. cation No. 58148/00], May 18, 2004). A recent case from 29 See Decision of the Supreme Administrative Court of India ruled that medical information could be released if Bulgaria No. 7146, July 30, 2004. An informative discussion there was a sufficient public interest: “personal information of this decision can be found at http://www.aip-bg.org/libr including tax returns, medical records etc. cannot be dis- ary/dela/yonchev.htm. closed in view of Section 8(1)(j) of the Act. If, however, the 30 According to the Ninth FOI Report of the Irish Minister applicant can show sufficient public interest in disclosure, of Finance, 67 percent of all requests in 2008, 72 percent in the bar (preventing disclosure) is lifted and after duly noti- 2007, and 70 percent in 2006 were for the applicants’ per- fying the third party (i.e. the individual concerned with the sonal information. information or whose records are sought) and after consid- 31 For example, see Times of India (2010). ering his views, the authority can disclose it” (Secretary 32 The text of the act is available at http://www.sun.ac.za/ General, Supreme Court of India v. Subhash Chandra Agar- university/Legal/dokumentasie/access%20to%20informati wal, High Court of Delhi, January 12, 2010). 46 on.pdf. In some jurisdictions, tax records are publicly available. 33 Only Antigua and Barbuda and South Africa have adopt- For example, see Tietosuojavaltuutettu v. Satakunnan Mark- ed laws that apply to private bodies “in the protection of kinapörssi Oy, Satamedia Oy (2008), EUECJ C-73/07, De- any right.” cember 16; and Government of India (2009). Also see Ban- 34 See, for example, Sunday Times (2008). galore Mirror (2010); Luna Pla and Ríos Granados (2010); 35 Guerra and Others v. Italy, 116/1996/735/932, February and Law et al. News (2010). 47 19, 1998. Nixon v. Warner Communications, Inc., 435 U.S. 589 36 See EPIC v. DHS (Suspension of Body Scanner Program), (1978); Richmond Newspapers Inc. v.Virginia, 448 U.S. 555 http://epic.org/privacy/body_scanners/epic_v_dhs_suspen (1980). For a review of Australian law, see Australian Law sion_of_body.html; EFF (2010); and public FOIA docu- Reform Commission (2008). 48 ments on spying in Washington, released by the American For example, the U.S. Court of Appeals for the District of Civil Liberties Union, http://www.aclu-wa.org/public-doc Columbia noted, “The [U.S. FOIA] exemption . . . is phrased uments. broadly to protect individuals from a wide range of embarrass- 37 Taxpayers’ Alliance is available at http://www.taxpayersal ing disclosures. As the materials here contain information re- liance.com/. garding marital status, legitimacy of children, identity of fathers 38 For salary disclosure in the United States, see Sunshine of children, medical condition, welfare payments, alcoholic Review (2010). For salary disclosure in the United King- consumption, family fights, reputation, and so on” (Rural dom, see ICO (2009) and BBC News (2010). Housing Alliance v. USDA, 498 F.2d 73 [D.C. Cir. 1974]). 39 49 However, also see Chang v. Navy, Civil Action No. 00- See “Social Audits—Tracking Expenditures with Com- 0783 (D. D.C.). munities: The Mazdoor Kisan Shakti Sangathan (MKSS) in 40 Under European law, medical records are considered the India,” available at http://unpan1.un.org/intradoc/groups/ most sensitive records to be protected from release. For ex- public/documents/un/unpan024549.pdf. 50 ample, see Z v. Finland (1997) 25 EHRR 371, http://www. For example, see the Web site for the Department of Ru- unhcr.org/refworld/publisher,ECHR,,FIN,3ae6b71d0,0.html. ral Development of India’s Ministry of Rural Development, 41 For examples, see Djankov et al. (2009); World Bank http://www.nrega.nic.in/netnrega/home.aspx. 51 (2006); People’s Union for Civil Liberties (PUCL) v. Union For example, see Consejo Nacional de Ciencia y Tec- of. India (2003) 4 SCC 399; CPIO Supreme Court of Delhi nología, Convocatorias becas en el país 2009, http://www. v. Subhash Chandra Agarwal, Delhi High Court, W.P. (C) conacyt.gob.mx/Convocatorias/Paginas/Convocatoria_Be 288/2009; Reid (2010); and CNN/IBN (2010). cas_Pais2009.aspx. 42 52 Von Hannover v. Germany (Application No. 59320/00), In Mexico, information that is already in the public do- June 24, 2004. main is not considered confidential and cannot be withheld 43 Decision 60/1994 (XII, 24) AB. from request. In 2008, the European Court of Justice ruled Endnotes 37 69 that a news service using tax information from a public reg- Department of Air Force v. Rose, 425 U.S. 352 (1976). 70 ister was exempt from the EU Data Protection Directive. Case 99168—Mr. Richard Oakley, The Sunday Tribune See Tietosuojavaltuutettu v. Satakunnan Markkinapörssi Oy, newspaper and the Office of the Houses of the Oireachtas, Satamedia Oy (2008), EUECJ C-73/07, December 16. July 27, 1999, http://www.oic.gov.ie/ga/CinntianChoim 53 The principles are available at http://legislation.knowl isineara/CinntiibhfoirmFhada/Name,1629,ga.htm. 71 edge-basket.co.nz/gpacts/reprint/text/2006/se/026se59.html. For more information on the roles and activities of over- Also see Stewart (2002). sight and appeals bodies, see Neuman (2009). 54 72 Los Angeles Police Department v. United Reporting Under Article 28(1) of European Union Directive 95/46/ Publishing Corp., 528 U.S. 32 (1999). EC, data protection commissions “shall act with complete in- 55 See the European Transparency Initiative Web site, http:// dependence in exercising the functions entrusted to them.” ec.europa.eu/transparency/index_en.htm. The European Court of Justice recently ruled, “[t]he guar- 56 “The few cases considering a private party attempting to antee of the independence of national supervisory author- influence government policy typically find in favor of disclo- ities is intended to ensure the effectiveness and reliability of sure, lacking countervailing concerns not present” (EFF v. the supervision of compliance with the provisions on pro- ODNI, 09-17235, February 9, 2010). “Individuals are acting tection of individuals with regard to the processing of per- in a public or representative capacity, and would have an ex- sonal data and must be interpreted in the light of that aim. pectation that their details might be released to third parties” It was established not to grant a special status to those au- (Creekside Forum v. Information Commissioner and De- thorities themselves as well as their agents, but in order to partment for Culture, Media, and Sport [2009] UKIT EA- strengthen the protection of individuals and bodies affected 2008-0065 [May 28]). by their decisions. It follows that, when carrying out their 57 Commission v. Bavarian Lager, Case C-28/08, June 29, duties, the supervisory authorities must act objectively and 2010. impartially. For that purpose, they must remain free from any 58 For example, see http://ec.europa.eu/agriculture/fund external influence, including the direct or indirect influence ing/index_en.htm and http://farmsubsidy.org/. of the State or the Länder, and not of the influence only of 59 EUECJ cases C-92/09 and C-93/09, November 9, 2010. the supervised bodies” (Case C-518/07, OJ May 1, 2010). 60 73 Testimony of Sir Richard Wilson before the Select Com- Access to Information Commissioner, Annual Report of mittee on Public Administration, U.K. House of Commons, 1991–92, p. 16, http://www.oic-ci.gc.ca/eng/rp-pr-ar-ra- July 11, 2002. archive.aspx. 61 74 See Volker und Markus Schecke (EUECJ C-92/09, No- However, the task force did state that the current situation vember 9, 2010, at 85): “No automatic priority can be con- was acceptable and did not recommend a merger of the two ferred on the objective of transparency over the right to bodies. 75 protection of personal data . . . even if important economic Remarks of the information commissioner of Canada to the interests are at stake.” Canadian Access and Privacy Association, October 28, 2003. 62 76 Canada (Information Commissioner) v. Canada (Com- Communication with Maeve McDonagh, April 2010. 77 missioner of RCMP), 2003 SCC 8, October 29, 2003. Communication with Elizabeth Dolan, Irish Information 63 Act No. LXIII of 1992, available at http://abiweb.obh. Commission, October 2010. 78 hu/dpc/index.php?menu=gyoker/relevant/national/1992_ Diario Oficial de la Federación, June 11, 2002, http://ww LXIII. w.ifai.org.mx/transparencia/LFTAIPG.pdf. 64 79 In Tanzania, a draft bill introduced by the government in Diario Oficial de la Federación, January 12, 2011, http://d 2006 to address access to information, privacy, and media of.gob.mx/nota_detalle_popup.php?codigo=5175251. 80 rights was more than 85 pages in length—a fact that led to For more information about the commission, visit http:// its not being considered. www.infodf.org.mx/web/. 65 81 Text of the act is available at http://www.sun.ac.za/unive Decision No. 090-59/2009/, July 9, 2009. 82 rsity/Legal/dokumentasie/access%20to%20information.pdf. See the list of pertinent cases at http://www.ip-rs.si/in 66 Indonesian Act on Public Information Disclosure No. 14 dex.php?id=384. 83 of 2008. Decision No. 021-124/2008/12, December 19, 2008. 67 84 For public officials, this would be a general notice setting Decision No. 021-80/2005/6, November 2, 2005. 85 out that information collected in the course of their official Decision No. 090-94/2009, October 7, 2009. According activities is not considered personal information that will be to the ruling, records had “no direct connection with the withheld. For private individuals, this area is more complex performance of the public function of the body.” 86 because data protection rights—especially relating to sensi- Treaty No. 108, 1981, http://conventions.coe.int/Trea tive personal information—cannot simply be waived in ty/en/Treaties/Html/108.htm. 87 many cases. For example, see Scottish Information Commissioner 68 5 USC 552 (b)(6). (2010) concerning the decision that release of childhood 38 The Right to Information and Privacy: Balancing Rights and Managing Conflicts leukemia statistics for a local area would violate the data 0035); Robin Makin v. Information Commissioner and protection law. Ministry of Justice (EA/2008/0048); Creekside Forum v. 88 For a detailed analysis, see U.K. Ministry of Justice (2008). Information Commissioner and Department for Culture, 89 Corporate Officer of the House of Commons v. Informa- Media, and Sport (EA/2008/0065). 92 tion Commissioner and others [2008] EWHC 1084 (Admin). Department of Health v. IC (Additional Party: the Pro 90 Common Services Agency v. Scottish Information Com- Life Alliance) (EA/2008/0074). missioner [2008] UKHL 47. 91 Alasdair Roberts v. Information Commissioner and De- partment for Business, Innovation and Skills (EA/2009/ References ABC News. 2009. “Ombudsman Calls for c.co.uk/2/hi/uk_news/politics/110614 More Resources.” November 2. http://w 2.stm. ww.abc.net.au/news/stories/2009/11/0 ———. 2010. “Thousands of Whitehall Sal- 2/2730603.htm. aries Published.” October 15. http://w ACHPR (African Commission on Human ww.bbc.co.uk/news/uk-politics-11551 and Peoples’ Rights). 2002. “Declaration 683. of Principles on Freedom of Expression Calland, Richard, and Alison Tilley, eds. 2002. in Africa.” Banjul, The Gambia. http:// The Right to Know, the Right to Live: Access www.achpr.org/english/declarations/de to Information & Socio-economic Justice. Cape claration_freedom_exp_en.html. Town, South Africa: Open Democracy Administrative Office of the U.S. Courts. Advice Centre. 2008. “Judicial Conference Policy on Cannon, Andrew. 2004. “Policies to Control Privacy and Public Access to Electronic Electronic Access to Court Databases.” Case Files.” March. http://www.uscour University of Technology, Sydney, Law Re- ts.gov/RulesAndPolicies/JudiciaryPriva view 6: 37–46. http://www.austlii.edu.a cyPolicy/March2008RevisedPolicy.aspx. u/au/journals/UTSLRev/2004/3.html. Australian Law Reform Commission. 2008. CNN/IBN. 2010. “PM to Disclose Assets of ForYour Information: Australian Privacy Law Cabinet Ministers.” November 14. http: and Practice. Report 108, 3 vols. Sydney, //ibnlive.in.com/news/pm-to-disclose- NSW. http://www.austlii.edu.au/au/oth assets-of-cabinet-ministers/134964-37- er/alrc/publications/reports/108/. 64.html?from=tn. Bangalore Mirror. 2010. “Taxmen Deluged Commonwealth Secretariat. 2002. “Model with “Ex” Files.” September 23. Data Protection Act.” London, UK. http: Banisar, David. 2006. Freedom of Information //www.thecommonwealth.org/shared_a Around the World 2006: A Global Survey of sp_files/uploadedfiles/{82BDA409-2C8 Access to Government Information Laws. Lon- 8-4AB5-9E32-797FE623DFB8}_prote don, UK: Privacy International. http://w ction%20of%20privacy.pdf. ww.privacyinternational.org/foi/foisurvey Coronel, Sheila, ed. 2001. The Right to Know: 2006.pdf. Access to Information in Southeast Asia. Que- BBC News. 2001. “DTI Denies Smear Cam- zon City: Philippine Center for Inves- paign Claims.” January 8. http://news.bb tigative Journalism. 39 40 The Right to Information and Privacy: Balancing Rights and Managing Conflicts Council of Europe. 1981. “Convention for EFF (Electronic Frontier Foundation), 2010. the Protection of Individuals with Re- “EFF Posts Documents Detailing Law gard to Automatic Processing of Personal Enforcement Collection of Data from Data.” European Treaty Series 108. Stras- Social Media Sites.” Blog post, March 16. bourg, France. http://conventions.coe.i http://www.eff.org/deeplinks/2010/03/ nt/treaty/en/treaties/html/108.htm. eff-posts-documents-detailing-law-enfo ———. 1986. “Recommendation 1037: On rcement. Data Protection and Freedom of Infor- EO (European Ombudsman). 2007. “Draft mation.” In Texts Adopted at the 2nd Part Recommendation to the European Par- of the 38th Ordinary Session of the Parlia- liament in Complaint 3643/2005/(GK) mentary Assembly, September 1986. Stras- WP.” September 24. Strasbourg, France. bourg, France. http://www.ombudsman.europa.eu/rec CSA (Canadian Standards Association Inter- ommen/en/053643.htm. national). 1996. “Model Code for the EPIC/PI (Electronic Privacy Information Protection of Personal Information.” Center/Privacy International). 2007. Pri- Toronto, Ontario. vacy and Human Rights 2006: An Interna- Daily Mail. 2006. “Anger as Police Obtain tional Survey of Privacy Laws and Develop- Journalist’s Mobile Records to Discover ments. Washington, DC. http://www.pri Source.” December 1. http://www.daily vacyinternational.org/survey/dpmap.jpg. mail.co.uk/news/article-419986/Anger- France, Elizabeth. 1999. Third Report of police-obtain-journalists-mobile-record 1998–99, Freedom of Information Draft s-discover-source.html. Bill, vol. II: HC 570-II of 1998–99, Djankov, Simeon, Rafael La Porta, Florencio memorandum 2. London, UK. Lopez-de-Silanes, and Andrei Shleifer. Gentot, Michel. n.d. “Access for Information 2009. “Disclosure by Politicians.” Work- and Protection of Personal Data.” Com- ing Paper 2009-60.Tuck School of Busi- mission Nationale de l’Informatique et ness at Dartmouth, Hanover, NH. http: des Libertés. http://www.pcpd.org.hk/e //papers.ssrn.com/sol3/papers.cfm?abs nglish/infocentre/files/gentot-paper.doc. tract_id=1334126. Government of Canada. 2002. Access to Infor- EC (European Commission). 1995. “Direc- mation: Making It Work for Canadians. Re- tive 95/46/EC on the Protection of In- port of the Access to Information Review Task dividuals with Regard to the Processing Force.Ottawa, Ontario. http://www.atirtf- of Personal Data and on the Free Move- geai.gc.ca/accessReport-e.pdf. ment of Such Data.” Official Journal of the ———. 2009. “Info Source Bulletin Num- European Union L281: 31–50. http://e ber 32B; Statistical Reporting. Statistical c.europa.eu/justice/policies/privacy/law Tables 2008–2009, Access to Informa- /index_en.htm. tion.” Ottawa, Ontario. http://www.in ECOWAS (Economic Community of West fosource.gc.ca/bulletin/2009/b/bulletin African States). 2008. “Telecommunica- 32b/bulletin32b02-eng.asp#k. tions Ministers Adopt Texts in Cyber Government of Canada, Office of the Priva- Crime, Personal Data Protection.” Press cy Commissioner. 2001. “Privacy Com- release 100/2008. missioner George Radwanski Writes to References 41 Information Commissioner John Reid tion Annual Conference, University of Regarding Prime Minister’s Agendas Edinburgh, Scotland, April 9–16. http:// Case.” News release, May 10. http://ww www.bileta.ac.uk/Document%20Librar w.privcom.gc.ca/media/nr-c/02_05_b_ y/1/Habeas%20Data%20-%20An%20U 010510_e.asp. pdate%20on%20the%20Latin%20Amer Government of Hungary, Parliamentary Com- ica%20Data%20Protection%20Constitu missioner for Data Protection and Free- tional%20Right.pdf. dom of Information. 1998a. “Annual Re- Hencke, David. 2001. “MP Challenges Se- port 1998.” Budapest. http://abiweb.ob crecy Culture.” The Guardian, June 27. h.hu/dpc/index.php?menu=reports/19 http://www.guardian.co.uk/politics/20 98. 01/jun/27/freedomofinformation.uk. ———. 1998b. “The First Three Years of the Hencke, David, and Rob Evans. 2002. Parliamentary Commissioner for Data “Ashcroft Memos May Spur Data Law Protection and Freedom of Informa- Repeal.” The Guardian, February 5. http:// tion.” Annual reports 1991-96-97. Bu- www.guardian.co.uk/politics/2002/feb/0 dapest. http://abiweb.obh.hu/dpc/inde 5/uk.freedomofinformation. x.php?menu=reports/1995. ———. 2003. “Ashcroft Wins Apology over Government of India, Central Information Political Vendetta.” The Guardian, June 6. Commission. 2009. “Decision No. CIC/ http://www.guardian.co.uk/politics/20 LS/A/2009/000647/SG/5887.” Decem- 03/jun/06/uk.conservatives. ber 14. http://rti.india.gov.in/cic_decis ICO (U.K. Information Commissioner’s Of- ions/SG-14122009-32.pdf. fice). 2009. “When Should Salaries Be Government of Ireland, Department of Fi- Disclosed?” Version 1, February 23. nance. 2006. “Data Protection and Free- http://www.ico.gov.uk/for_organisatio dom of Information in the Public Sec- ns/freedom_of_information/informatio tor.” Central Policy Unit, Notice No. 23. n_request/~/media/documents/library/ Dublin. http://www.dataprotection.ie/ Freedom_of_Information/Practical_app docs/%22Important_new_data_protect lication/SALARY_DISCLOSURE.ashx. ion_guidance_for_all_public_/411.htm. Irazábal, Alonso Lujambio, and Lina Ornelas Government of Ireland, Information Commis- Núñez. 2009. “Personal Data Protection sioner. 1999. “Case 99168—Mr. Richard by the Government: The Action of the Oakley,The Sunday Tribune newspaper Federal Institute for Access to Public In- and the Office of the Houses of the Oi- formation.” Mexico City, Mexico: Insti- reachtas.” July 27. Dublin. http://www.o tuto Federal de Acceso a la Información y ic.gov.ie/en/DecisionsoftheCommission Protección de Datos. er/LongFormDecisions/Name,1629,en. Knight Center for Journalism in the Ameri- htm. cas. 2010. “How Much Does Argentina’s Guadamuz, Andreas. 2001. “Habeas Data: An President Spend on Ads? An NGO Fights Update on the Latin America Data Pro- to Find Out.” Journalism in the Americas tection Constitutional Right.” Paper news blog, March 26. http://knightcent prepared for the 16th British and Irish er.utexas.edu/archive/blog/?q=en/node/ Law, Education and Technology Associa- 6772. 42 The Right to Information and Privacy: Balancing Rights and Managing Conflicts Law et al. News. 2010. “Information on Re- pdf/Public%20Access%20to%20Court% ligion Cannot Be Obtained under RTI.” 20Records%2012-11-02.pdf. November 29. http://www.lawetalnew NZLC (New Zealand Law Commission). s.com/NewsDetail.asp?newsid=2903. 2008. Public Registers: Review of the Law of Law Reform Commission, New South Wales. Privacy, Stage 2. Report 101, January. 2010. “Access to Personal Information.” Wellington, New Zealand. http://www.l Report 126. Sydney, Australia. http://ww awcom.govt.nz/sites/default/files/publi w.lawlink.nsw.gov.au/lawlink/lrc/ll_lrc.n cations/2008/02/Publication_129_391_ sf/pages/LRC_r126toc. Public_registers_web_72.pdf. Leith, Philip, and Maeve McDonagh. 2009. OAS (Organization of American States). 2003. “New Technology and Researchers’ Ac- “Access to Public Information: Strength- cess to Court and Tribunal Information: ening Democracy.” AG/RES. 1932 (XXX- The Need for European Analysis” Script- III-O/03) June 10. Washington, DC. ed 6 (1/April). http://www.oas.org/juridico/english/ga Luna Pla, Issa, and Gabriela Ríos Granados. 03/agres_1932.htm. 2010. Transparencia, Acceso a la Información OECD (Organisation for Economic Co- Tributaria y el Secreto Fiscal. Desafíos en operation and Development). 1980. México. Mexico City: Universidad Na- “OECD Guidelines on the Protection of cional Autónoma de México. http://ww Privacy and Transborder Flows of Per- w.bibliojuridica.org/libros/libro.htm?l=2 sonal Data.” Paris, France. http://www.o 861. ecd.org/document/18/0,3343,en_2649_ Majtényi , László. 2002. “Freedom of Infor- 34255_1815186_1_1_1_1,00.html. mation,The Hungarian Model.” http://w Organization of Eastern Caribbean States. ww.lda.brandenburg.de/sixcms/media.ph 2004. “Privacy Bill.” Proposed draft. http: p/2232/maitenyi.pdf. //unpan1.un.org/intradoc/groups/pub McDonagh, Maeve. 2006. Freedom of Informa- lic/documents/TASF/UNPAN024634. tion Law in Ireland. 2nd ed. Dublin: pdf. Round Hall Sweet & Maxwell. Pirc Musar, Natasa. 2006. “New Principles of Mendel,Toby. 2008. Freedom of Information: A the Amended Act on Access to Public In- Comparative Legal Survey. 2nd ed. Paris, formation in Slovenia: Commissioner or France: United Nations Educational, Sci- Ombudsman.” Ljubljana, Slovenia. http:// entific, and Cultural Organization. www.ip-rs.si/fileadmin/user_upload/P Neuman, Laura. 2009. “Enforcement Mod- df/konference/Novosti_ZDIJZ_Manch els: Content and Context.” Access to In- ester_ang.pdf. formation Working Paper Series. Wash- ———. 2010. “How to Strike the Right ington, DC: World Bank. http://siteres Balance between Freedom of Informa- ources.worldbank.org/EXTGOVACC/R tion and Personal Data Protection: Using esources/LNEumanATI.pdf. a Public Interest Test.” PhD diss., Leiden NJSBA (New Jersey State Bar Association). University, The Netherlands. 2002. “Privacy and Electronic Access to Reid,Tyrone. 2010. “Crusade Against Secre- Court Records in New Jersey.” Decem- cy—Public Barred from Viewing Finan- ber 11. http://www.graysonbarber.com/ cial Disclosures of Elected Officials.” Ja- References 43 maica Gleaner. November 14. http://jama Information: Conflicting Principles or ica-gleaner.com/gleaner/20101114/lea Complementary Rights?” Paper present- d/lead1.html. ed at the 24th International Conference Scottish Information Commissioner. 2009. of Data Protection and Privacy Commis- “Decision Notice: Decision 115/2007, sioners, Cardiff, Wales, September 9–11. Mr. Joseph Millbank and Dundee City http://www.pcpd.org.hk/english/infoc Council.” St. Andrews. http://www.its entre/speech_200210911.html. publicknowledge.info/UploadedFiles/De The Times of India. 2010. “RTI Helps Poor cision115-2007.pdf. Diamond Polishers Get Back Cancelled ———. 2010. “Decision Notice: Decision BPL Cards.” August 24. http://timesof 21/2005, Mr. Michael Collie and the india.indiatimes.com/city/rajkot/RTI- Common Services Agency for the Scot- helps-poor-diamond-polishers-get-back tish Health Service.” St. Andrews. http: -cancelled-BPL-cards/articleshow/6428 //www.itspublicknowledge.info/Uploa 102.cms. dedFiles/Decision021-2005.pdf. U.K. Home Office. 1999. “Freedom of In- Sheridan. Gavin. 2010. “Department of Arts, formation: Preparation of Draft Legisla- Sport and Tourism Expenses Database.” tion: Background Material.” May. Lon- The Story, March 12. http://thestory.i don. http://www.publications.parliame e/2010/03/12/departments-expenses-d nt.uk/pa/cm199899/cmselect/cmpuba atabase/. dm/570/57007.htm. Slane, Bruce. 2002. “Freedom of Information U.K. Ministry of Justice. 2008. “Freedom of and Privacy: Competing Interests with Information Guidance: Exemptions Guid- Complementary Aims.” Paper prepared ance, Section 40-Personal Information.” for the International Symposium on Free- May 14. London. http://www.justice.gov. dom of Information and Privacy, Auck- uk/about/docs/foi-exemption-s40.pdf. land, New Zealand, March 28. ———. 2009. “Freedom of Information Act Solove, Daniel J., and Paul Schwartz. 2008. 2000. Fourth Annual Report on the Op- Information Privacy Law. 3rd ed. New eration of the FOI Act in Central Gov- York: Aspen Publishers. ernment 2008.” June. London. http://w Stewart, Blair. 2002. “Public Register Provi- ww.justice.gov.uk/freedom-of-informati sions—Addressing Privacy Issues.” Paper on-annual-report-2008.pdf. prepared for the International Symposium ———. 2010. “Freedom of Information Act on Freedom of Information and Privacy, 2000. 2009 Annual Statistics on Imple- Auckland, New Zealand, March 28. mentation in Central Government.” Sunday Times. 2008. “Couple Stung by April 29. London. http://www.justice.go £100,000 ‘Secret’ Loan.” December 7. v.uk/foi-statistics-report-2009.pdf. http://www.timesonline.co.uk/tol/news UN (United Nations). 1948. “Universal Dec- /uk/article5299156.ece. laration of Human Rights.” New York. Sunshine Review. 2010. “Public Employee http://www.un.org/en/documents/udh Salary.” http://sunshinereview.org/inde r/index.shtml. x.php/Public_employee_salary. UN General Assembly. 1990. “Guidelines for Tang, Raymond. 2002. “Data Protection, the Regulation of Computerized Person- Freedom of Expression and Freedom of al Data Files” A/RES/45/95, December 44 The Right to Information and Privacy: Balancing Rights and Managing Conflicts 14. New York. http://www.un.org/doc U.S. Department of Justice, Office of Infor- uments/ga/res/45/a45r095.htm. mation Policy. 2010. “Summary of Annu- UN Human Rights Committee. 1988. Cov- al FOIA Reports for Fiscal Year 2009.” enant on Civil and Political Rights Gen- Washington, DC. http://www.justice.go eral Comment 16 (Article 17:The Right v/oip/foiapost/2010foiapost18.htm. to Respect of Privacy, Family, Home and Waters, Nigel. 2002. “Privacy Exemptions in Correspondence, and Protection of Ho- FOI Laws—An Unnecessary Barrier to nour and Reputation), April 8. http:// Accountability” Paper prepared for the www.bayefsky.com/general/ccpr_genco International Symposium on Freedom of mm_16.php. Information and Privacy, Auckland, New UN Human Rights Council. 2009. Report Zealand, March 28. of the Special Rapporteur on the Pro- Working Party on the Protection of Individ- motion and Protection of Human Rights uals with Regard to the Processing of and Fundamental Freedoms While Coun- Personal Data. 1999. “Opinion No. 3/99 teringTerrorism.A/HRC/13/37. Decem- on Public Sector Information and the ber 28. http://www2.ohchr.org/eng Protection of Personal Data.” May 3. lish/bodies/hrcouncil/docs/13session/A Brussels, Belgium. http://ec.europa.eu/ -HRC-13-37.pdf. justice/policies/privacy/docs/wpdocs/1 U.S. Department of Health, Education, and 999/wp20en.pdf. Welfare. 1973. “Records, Computers and World Bank. 2006. “Income & Asset Disclo- the Rights of Citizens: Report of the Sec- sure Requirements for Heads of State retary’s Advisory Committee on Auto- and Governments, World Bank Client mated Personal Data Systems July, 1973.” Countries.” Washington, DC. http://site Washington, DC. http://aspe.hhs.gov/ resources.worldbank.org/INTLAWJUST DATACNCL/1973privacy/tocpreface INST/Resources/IncomeAssetDisclosur members.htm. einWBClientsasofJune62006.pdf. About the World Bank Institute’s Governance Practice Governance is one of seven priority themes in the World Bank Institute’s recently launched renewal strate- gy—a strategy that responds to client demand for peer-to-peer learning by grounding WBI’s work in the dis- tillation and dissemination of practitioner experiences. The Institute is committed to building knowledge and capacity on the “how to” of governance reforms, with emphasis on supporting and sustaining multistake- holder engagement in bringing about such reforms. WBI’s Governance Practice works with partners, including networks of country and regional institutions, to develop and replicate customized learning programs. Its programmatic approach aims at building multistake- holder coalitions and in creating collaborative platforms and peer networks for knowledge exchange. For further information: WBI The World Bank 1818 H Street, NW Washington, DC 20433 Fax: 202-522-1492 Visit us on the web at: http://wbi.worldbank.org/wbi/topics/governance Photo Credit: (Front Cover) iphotostock.com.