Out-Law / Your Daily Need-To-Know

Use of cloud-based communications raises challenges over compliance with FOI laws, says watchdog

Out-Law News | 01 Sep 2017 | 2:35 pm | 2 min. read

The use of cloud-based communications tools by employees of public sector bodies presents challenges over the way those organisations comply with freedom of information (FOI) laws in the UK, the information commissioner has said.

Elizabeth Denham said that public sector bodies cannot avoid the potential disclosure of information under the FOI regime by using new communications apps.

However, she said her office had recently backed one government department's refusal of a FOI request for information held on 'Slack', a cloud-based communication tool, because preparing the information for release would have involved "manually reviewing around 65,000 messages". The Cabinet Office relied on an exemption under FOI laws to refuse the request as a result.

"Although we supported the Cabinet Office’s reason not to disclose the communications in Slack cloud in this case, the citizen’s complaint raised novel issues about compliance with the requirements of the Freedom of Information Act." Denham said in a speech on Thursday at the Archives and Records Association annual conference. "Technological changes, such as the advent of cloud based communication tools like Slack, impact the way public servants communicate with each other."

"Our current view is that information held by public bodies, whether in a Whatsapp account, cloud-based tool or text message, is subject to the Freedom of Information Act if that information relates to the official business of the public body. That includes messages by government officials, advisors or ministers," she said. "In the context of information rights, it’s the message, not the medium that matters."

"We cannot maintain integrity of the public record while exempting tools such as Slack from effective procedures. Public authorities as well as private citizens require access to official information, wherever and however it may be stored… Important records captured and communicated through private accounts are easily forgotten or deleted. Use of private email accounts and instant messaging to conduct government business can frustrate good governance and undermine the public’s right to know," Denham said.

Last year, Denham said that organisations subject to FOI rules should also be placed under a new "duty to document". The new duty, she said at the time, would help address the fact that there are greater amounts of information in the digital age, and ensure the recording of that information is done "well".

In her latest speech, the information commissioner again discussed the potential for a new 'duty to document' to be created. She said that such a duty had been successfully introduced in the Canadian province of British Columbia and confirmed that she is looking at whether new legislation to establish a new duty to document in the UK is needed.

"The duty to create records in appropriate circumstances, often called the 'duty to document' has been on information managers’ and regulators’ minds for a decade or more," Denham said. "I am talking about a positive duty in law to create records of significant decisions, actions and events. That means records explaining and providing context to why a specific course of action was taken. Minutes of important meetings, decisions, that led to policy change and new initiatives."

Denham also said she would address the fact that housing associations are not currently subject to FOI laws in the UK in a forthcoming report to parliament. She said that fact "introduces a significant gap in the public’s right to know".