You are on page 1of 56

World Bank


Access to Information
The Right to Information
and Privacy: Balancing Rights
and Managing Conflicts
David Banisar

Canadian International Agence canadienne

The World Bank Development Agency developpment international

The Right to Information

and Privacy: Balancing
Rights and Managing
David Banisar*

David Banisar is senior legal counsel for Article 19, the Global Campaign for Free Expression, in London, UK. He is
also a nonresident fellow at the Center for Internet and Society at Stanford Law School, Stanford, CA. Previously, he
was the director of the Freedom of Information Project of Privacy International in London; a research fellow at the
Kennedy School of Government at Harvard University, Cambridge, MA; and a cofounder and policy director of the
Electronic Privacy Information Center in Washington, DC. He has served as an adviser and consultant to numerous or-
ganizations, including the Council of Europe, the Organisation for Economic Co-operation and Development, and the
United Nations Development Programme.
2011 The International Bank for Reconstruction and Development / The World Bank
1818 H Street NW
Washington DC 20433
Telephone: 202-473-1000

All rights reserved

The findings, interpretations, and conclusions expressed in this volume do not necessarily re-
flect the views of the Canadian International Development Agency (CIDA), the government
of Canada, executive directors of the World Bank, or the governments those directors repre-
sent. The World Bank does not guarantee the accuracy of the data included in this work.

This report has been commissioned by the Access to Information (ATI) Program at the World
Bank Institute (WBI) and supported financially by the CIDA-WBI Governance Program.

The WBI Access to Information Program seeks to connect key ATI stakeholders to
jointly identify, prioritize, and implement actions for effective ATI adoption and implemen-
tation. The program aims to improve in-country capacity for the formulation, implementa-
tion, use, and enforcement of ATI legislation through regional knowledge exchange and net-
working, and by fostering the capacity of multistakeholder coalitions to undertake effective
ATI reforms.


Acronyms and Abbreviations......................................................................vii

Executive Summary ....................................................................................1

1. Introduction ..........................................................................................3

2. Rights Defined.......................................................................................5

2.1 The Right to Information...................................................................................5

2.2 The Right to Privacy ..........................................................................................6

3. Complements and Conflicts in RTI and Privacy Laws ...............................9

3.1 Complementary Roles of RTI and Privacy .........................................................9

3.2 Conflicts between RTI and Privacy Interests .....................................................12

3.3 Balancing the Rights of Access and Privacy .......................................................16

4. Legislation ...........................................................................................17

4.1 Model 1A Single RTI and Privacy Law .........................................................17

4.2 Model 2Separate RTI and Privacy Laws: Managing Conflicts.........................18

5. Oversight.............................................................................................23

5.1 Two BodiesSeparate RTI and Privacy Commissions.......................................23

5.2 One BodyA Single RTI and Privacy Commission .........................................24

iv Contents

6. Case Studies.........................................................................................27

6.1 Ireland...............................................................................................................27

6.2 Mexico .............................................................................................................28

6.3 Slovenia.............................................................................................................29

6.4 United Kingdom...............................................................................................30

7. Conclusion ..........................................................................................33

Endnotes ..................................................................................................35

References ................................................................................................39


3.1 Using Publicly Available Personal Information to Fight Fraud ............................14

4.1 Elements to Determine Fairness ........................................................................20


3.1 Complement and Conflict of Privacy and the Right to Information....................9


I would like to thank Heather Brooke, Bojan and peer reviewers Alvaro Herrero, Maria
Bugaric, Elizabeth Dolan, Maurice Frankel, Marvn Laborde, and Andrea Ruiz for their
Juan Pablo Guerrero Amparn, Katherine comments. I would also like to thank my
Gunderson, Gus Hosein, Jose Luis Marzal, colleagues at Article 19; and the World Bank
Natasa Pirc Musar, Maeve McDonagh, Lina Institutes Marcos Mendiburu, Aranzazu
Ornelas Nuez, Graham Smith, and Nigel Guillan-Montero, and Luis Esquivel for their
Waters for providing information and advice; assistance.

and Abbreviations

ACHPR African Commission on Human and Peoples Rights

ACLU American Civil Liberties Union
APEC Asia-Pacific Economic Cooperation
ATIP access to information and privacy
CCPR United Nations Covenant on Civil and Political Rights
CSA Canadian Standards Association International
DCMS Department for Culture, Media, and Sport
DPA Data Protection Act
EC European Commission
ECHR European Convention for the Protection of Human Rights and
Fundamental Freedoms
ECOWAS Economic Community of West African States
EFF Electronic Frontier Foundation
EHRR European Human Rights Report
EO European Ombudsman
EPIC Electronic Privacy Information Center
ETS European Treaty Series
EU European Union
EUECJ Court of Justice for the European Communities
EWHC High Court of England and Wales
FOI freedom of information
FOIA Freedom of Information Act

viii Acronyms and Abbreviations

IACHR Inter-American Commission on Human Rights

ICO Information Commissioners Office
IFAI Instituto Federal de Acceso a la Informacin y Proteccin de Datos
MP member of parliament
NJSBA New Jersey State Bar Association
NZLC New Zealand Law Commission
OAS Organization of American States
ODNI Office of the Director of National Intelligence
OECD Organisation for Economic Co-operation and Development
OSCE Organization for Security and Co-operation in Europe
PI Privacy International
RCMP Royal Canadian Mounted Police
RTI right to information
UDHR Universal Declaration of Human Rights
UKHL United Kingdom House of Lords
UN United Nations
UNHRC United Nations Human Rights Council
USC United States Code
USDA United States Department of Agriculture
Executive Summary

The right to privacy and the right to infor- government bodies. Where the two rights
mation are both essential human rights in the overlap, states need to develop mechanisms
modern information society. For the most for identifying core issues to limit conflicts
part, these two rights complement each oth- and for balancing the rights. This paper ex-
er in holding governments accountable to amines legislative and structural means to
individuals. But there is a potential conflict better define and balance the rights to priva-
between these rights when there is a demand cy and information.
for access to personal information held by


In the words of Michel Gentot (n.d.) during islation.To date, more than 50 countries have
his term as president of the French National adopted both laws.
Data Processing and Liberties Commission, Privacy is increasingly being challenged
freedom of information and data protection by new technologies and practices.The tech-
are two forms of protection against the nologies facilitate the growing collection and
Leviathan state that have the aim of restoring sharing of personal information. Sensitive
the balance between the citizen and the state personal data (including biometrics and
(p. 1). DNA makeup) are now collected and used
On first inspection, it would appear that routinely. Public records are being disclosed
the right of access to information and the over the Internet. In response to this set of
right to protection of personal privacy are ir- circumstances, more than 60 countries have
reconcilable.1 Right to information (RTI) adopted comprehensive laws that give indi-
laws provide a fundamental right for any per- viduals some control over the collection and
son to access information held by govern- use of these data by public and private bod-
ment bodies. At the same time, right to pri- ies. Several major international conventions
vacy laws grant individuals a fundamental have long been in place in Europe, and new
right to control the collection of, access to, ones are emerging in Africa and Asia.
and use of personal information about them At the same time, the publics right to in-
that is held by governments and private bod- formation is becoming widely accepted. RTI
ies. However, the reality is more complex. laws are now common around the world,
Privacy and RTI are often described as two with legislation adopted in almost 90 coun-
sides of the same coinmainly acting as tries. Access to information is being facilitated
complementary rights that promote individ- through new information and communica-
uals rights to protect themselves and to pro- tions technologies, and Web sites containing
mote government accountability. searchable government records are becoming
The relationship between privacy and even more widely available. International
RTI laws is currently the subject of consid- bodies are developing conventions, and rele-
erable debate around the globe as countries vant decisions are being issued by interna-
are increasingly adopting these types of leg- tional courts.

4 The Right to Information and Privacy: Balancing Rights and Managing Conflicts

Availability, legislation, and judicial deci- be considered in a manner that is equal and
sions have led to many debates about rules balanced.
governing access to personal information This paper will examine the two rights
that is held by public bodies. As equal human and the conflicts that arise, and will describe
rights, neither privacy nor access takes prece- institutional models to ensure the exercise of
dence over the other. Thus it is necessary to both rights. It will present short case studies
consider how to adopt and implement the from four countries (Ireland, Mexico, Slove-
two rights and the laws that govern them in nia, and the United Kingdom) that have
a manner that respects both rights. There is adopted different models for addressing the
no easy way to do this, and both rights must conflicts, describing how those models work.
Rights Defined

2.1 The Right to India, have used it to ensure that the poor get
the food they are entitled to receive from
Information corrupt food distributors (Calland and Tilley
2002), and an angry mother in Thailand used
The right of access to information held by it in her efforts to learn why her daughter
government bodies (RTI) provides that indi- was not allowed into a top-quality school
viduals have a basic human right to demand (Coronel 2001). It also is commonly used by
information held by government bodies. It environment-focused nongovernmental or-
derives from the right of freedom of expres- ganizations to reveal pollution dangers in
sion to seek and receive information,2 and communities.
is recognized worldwide as a human right.3 The right is typically recognized at the
Under this right, any person may make a re- national level through constitutional provi-
quest to a public body; the body is legally re- sions and national laws. Some of this legisla-
quired to respond and provide the informa- tion has existed for more than 200 years. Sec-
tion, unless there is a legally compelling tion 6 of the Swedish Freedom of the Press
reason to refuse the request. Act (adopted in 1766) set the principle that
The RTI is a requisite for the very exer- government records were open to the public
cise of democracy (OAS 2003).4 Democra- by default and granted citizens the right to
cy is based on the consent of the citizens, and demand documents from government bod-
that consent turns on the government in- ies. The 1789 French Declaration of the
forming citizens about its activities and rec- Rights of Man called for information about
ognizing their right to participate. The col- the budget to be made freely available: All
lection of information by governments is the citizens have a right to decide, either per-
done on behalf of its citizens, and the public sonally or by their representatives, as to the
is only truly able to participate in the demo- necessity of the public contribution; to grant
cratic process when it has information about this freely; to know to what uses it is put.
the activities and policies of the government.5 Most nations have adopted laws in the past
The RTI is also an important tool for 20 years.
countering abuses, mismanagement, and cor- Today, nearly 90 countries around the
ruption and for enforcing essential economic world have adopted a national law or regula-
and social rights. Civic activists in Rajasthan, tion that sets out specific rights and duties for

6 The Right to Information and Privacy: Balancing Rights and Managing Conflicts

facilitating access to information (see Banisar ety (including governments, companies, and
[2006]).6 The following elements are typical- other individuals). Privacy is considered es-
ly found in national RTI laws: sential in protecting an individuals ability to
develop ideas and personal relationships. Al-
A right of an individual, organization, or though it is often summarized as the right
legal entity to demand information from to be left alone, it encompasses a wide range
public bodies, without having to show a of rightsincluding protection from intru-
legal interest in that information. sions into family and home life, control of
A duty of the relevant body to respond sexual and reproductive rights, and commu-
and provide the information.This includes nications secrecy.7 It is commonly recog-
mechanisms for handling requests and nized as a core right that underpins human
time limits for responding to requests. dignity and such other values as freedom of
Exemptions to allow the withholding of association and freedom of speech.8
certain categories of information. These The definitions of privacy and what is sen-
exemptions include the protection of na- sitive personal information vary among coun-
tional security and international relations, tries and individuals on the basis of past expe-
personal privacy, commercial confiden- riences and cultural understandings. Some
tiality, law enforcement and public order, cultures focus on community rights over in-
information received in confidence, and dividual rights; others, such as countries in
internal discussions. Exemptions typically Europe, are sensitive to privacy rights because
require that some harm to the interest of abuses going back to World War II. In mat-
must be shown before the material can be ters relating to modern information and com-
withheld. munications technologies, there is more agree-
Internal appeals mechanisms for request- ment about the importance of privacy and the
ors to challenge the withholding of infor- control of information (this will be covered in
mation. more detail later in this report).9
Mechanisms for external review of the The legal right to privacy is recognized in
withholding of information.This includes nearly every national constitution and in most
setting up an external body or referring international human rights treaties, including
cases to an existing ombudsman or to the the Universal Declaration of Human Rights,10
court system. the International Covenant on Civil and Po-
Requirement for government bodies to litical Rights,11 the European Convention on
affirmatively publish some types of infor- Human Rights,12 the American Declaration
mation about their structures, rules, and of the Rights and Duties of Man,13 and the
activities. This is often done using infor- American Convention on Human Rights.14
mation and communications technologies. International bodies, including the European
Court of Human Rights and the United Na-
tions (UN) Human Rights Committee, also
2.2 The Right to Privacy have ruled on the right to privacy.15
In the information age, the right to priva-
Privacy is a broad concept relating to the cy has evolved to address issues relating to
protection of individual autonomy and the the collection, use, and dissemination of per-
relationship between an individual and soci- sonal data in information systems. New tech-
Rights Defined 7

nologies have driven the collection of per- Purpose specification principleThe

sonal information by governments and pri- purposes for which personal data are col-
vate bodies into databases of unprecedented lected should be specified no later than at
breadth and depth. Governments and private the time of data collection; and the subse-
organizations that collect information related quent use should be limited to fulfilling
to government services and obligations (in- those purposes, or fulfilling such other
cluding tax, medical, employment, criminal, purposes as are compatible with the stated
and citizenship records) and identification purposes and specified on each occasion
technologies (including identity card sys- where a change of purpose occurs.
tems, fingerprints, and DNA mapping) have Use limitation principlePersonal data
quickly evolved and expanded. New com- should not be disclosed, made available, or
munications technologies create and collect otherwise used for purposes other than
substantial records about individuals in the those specified above, except under the
process of providing communications. Serv- following conditions: with the consent of
ices run by governments and private opera- the data subject, or by the authority of law.
tors collect information about individuals, Security safeguards principleRea-
including emails, records of persons commu- sonable security safeguards should be used
nicated with, lists of Web sites visited, and to protect personal data against such risks
mobile locations. And, of course, people as loss or unauthorized access, destruction,
share information through social networking use, modification, or disclosure.
sites. All of these have led to concerns about Openness principleThere should be
abuses, including misuse of information for a general policy of openness about devel-
unlawful purposes and identity theft. opments, practices, and policies relating to
Since the 1960s, principles governing the personal data. Means of establishing the
collection and handling of this information existence and nature of personal data and
(known as fair information practices) have the main purposes of their use should be
been developed and adopted by national gov- readily available, as should the identity
ernments and international bodies (OECD and usual residence of the data controller.
[1980]; also see U.S. Department of Health, Individual participation principle
Education and Welfare [1973]; and CSA An individual should have the right
[1996]). The principles generally are these: a. to obtain from a data controller (or
otherwise) a confirmation that the data
Collection limitation principleThere controller either does or does not have
should be limits to the collection of per- data relating to the individual;
sonal data; and all such data should be ob- b. to obtain such data within a reason-
tained by lawful and fair means and, where able time
appropriate, with the knowledge or con- at a charge (if any) that is not ex-
sent of the data subject. cessive,
Data quality principlePersonal data in a reasonable manner, and
should be relevant to the purposes for in a form that is readily intelligible
which they are to be used; and, to the ex- to the receiving individual;
tent necessary for those purposes, should be c. to be given reasons if a request made
accurate, complete, and kept up-to-date. under subparagraphs (a) and (b) is de-
8 The Right to Information and Privacy: Balancing Rights and Managing Conflicts

nied, and to be able to challenge such sec. 2[a]).18 Under a decision from the Euro-
denial; and pean Court of Human Rights, these data in-
d. to challenge relevant data and, if the clude information collected under public em-
challenge is successful, have the data rec- ployment.19
tified, completed, amended, or erased. National constitutions also have been
Accountability principleA data con- evolving to specifically recognize the control
troller should be accountable for comply- of personal data as a right. Many recent con-
ing with measures that give effect to the stitutions include specific rights to protect
principles stated above. the collection and use of personal data in in-
formation systems.20 Many countries in Latin
These principles have been incorporated America include a right of habeas data to
into important international treaties on data control and access personal data. The May
protection by the Council of Europe (1981) 2010 Constitution of Kenya states, Every
and the European Union (EC 1995); they person has the right to privacy, which in-
have also been adopted by the UN General cludes the right not to have . . . information
Assembly (1990) and the Commonwealth relating to their family or private affairs un-
Secretariat (2002). Similar principles are un- necessarily required or revealed (sec. 31).
der consideration by the Asia-Pacific Eco- What is more directly related to the subject
nomic Cooperation (APEC) forum16 and of this report is the fact that the governments
the Economic Community of West African of more than 60 countries around the world
States (ECOWAS 2008).17 have adopted comprehensive data protection
Of those international instruments, the acts based on the fair information practices that
European Union (EU) Data Protection Di- apply to personal data held by the public and
rective is now the most influential, having private sectors (see EPIC/PI [2007]).21 A
been adopted by the 27 EU member-states number of other countriesincluding the
(plus three European Economic Area coun- United States,22 Georgia,23 and Thailand24
tries) and by numerous other countries in have adopted legislation that protects only per-
Africa, Europe, and Latin America that trade sonal data held by government bodies. Malay-
with the EU.The directive takes a broad ap- sia recently adopted a law that protects person-
proach to personal information. Personal data al data held by companies, but has not adopted
are defined as any information relating to an legislation protecting personal information
identified or identifiable natural person (data held by governments.25 In a significant number
subject); an identifiable person is one who of countries where no data protection law has
can be identified, directly or indirectly, in par- been adopted, there may be more general pro-
ticular by reference to an identification num- visions in the criminal and civil codes that re-
ber or to one or more factors specific to his strict the use of personal information (see
physical, physiological, mental, economic, cul- EPIC/PI [2007]).
tural or social identity (Directive 95/46/EC,
Complements and
Conflicts in RTI and
Privacy Laws

Right to information (RTI) and privacy laws Figure 3.1: Complement and Conflict of
can both complement and conflict with each Privacy and the Right to Information
other, depending on the situation. As figure
3.1 shows, the two rights play different roles
in most cases, and only in a small number of
Protecting Access to
cases do they overlap and lead to potential personal Potential government
conflict. data conflict information

3.1 Complementary
Roles of RTI and Source: Authors illustration.
RTI and privacy often play complementary parency of citizens in a world that has under-
roles. Both are focused on ensuring the ac- gone the information revolution while ren-
countability of powerful institutions to indi- dering transparent the state.
viduals in the information age. The Council In many countries, the two rights are in-
of Europe stated in a 1986 recommendation tertwined constitutionally. Under the con-
that the roles are not mutually distinct but cept of habeas dataa constitutional right
form part of the overall information policy that permits individuals to demand access to
in society (Council of Europe 1986). The their own information and to control its
U.K. data protection registrar noted, Data usecountries in Latin America have adopt-
protection and freedom of information can ed both types of laws.27 Santiago Canton (the
be seen as complementary rights, with the first Organization of American States special
potential to be mutually supportive in prac- rapporteur for freedom of expression and the
tice.26 Lszl Majtnyi (2002), the first par- executive secretary of the Inter-American
liamentary commissioner for data protection Commission on Human Rights) said, The
and freedom of information in Hungary, says action of habeas data, or the right to obtain
that the common purpose of the two rights personal information contained in public or
is to continue maintaining the non-trans- private databases, has been very important in

10 The Right to Information and Privacy: Balancing Rights and Managing Conflicts

many countries in exacting accountability notes, ones own personal information will
for human rights abuses and helping coun- very often be released under FOI [freedom
tries scarred by human rights abuses recon- of information], while under the Data Pro-
cile and move forward, which can only be tection Act there is a presumption in favour
accomplished by exposing the truth and of access to ones own personal data (Gov-
punishing the guilty.28 ernment of Ireland 2006). In cases where
In many cases, the two rights overlap in a there is a request for information about the
complementary manner. Both rights provide individual and other persons, both acts will
an individual access to his or her own per- be considered.
sonal information from government bodies, In some countries, the RTI act is the pri-
and privacy laws allow for access to personal mary legislation used by individuals to access
information held by private entities. They their own personal information held by gov-
also mutually enhance each other: privacy ernment departments. In Australia, all requests
laws are used to obtain policy information in under the Privacy Act are filtered through the
the absence of an RTI law, and RTI laws are Freedom of Information Act (FOIA), result-
used to enhance privacy by revealing abuses. ing in more than 80 percent of all FOIA re-
quests being from people seeking their own
Obtaining Personal Information
information (Law Reform Commission 2010).
Held by Government Bodies
In Ireland, where both laws allow for individ-
The most obvious commonality between the uals access, even with the presumption above,
two types of laws is the right of individuals to the FOIA is still the act most people use: ap-
obtain information about themselves that is proximately 70 percent of all requests are
held by government bodies. This access is an made by individuals for their own informa-
important safeguard to ensure that individuals tion.30
are being treated fairly by government bodies In countries such as India and South
and that the information kept is accurate. Africa, where there is no general privacy law
When a country has both laws, the gen- giving individuals a right of access to their
eral approach is to apply the data protection own records, the RTI laws are the only means
act to individuals requests for personal infor- to access personal records. In India, RTI laws
mation; requests for information that con- are regularly used by advocates for the poor
tains personal data about other parties are to obtain records on distribution of food sub-
handled under the right to information act. sidies to show that individuals names have
In some jurisdictions, such as Bulgaria and been forged and records have been falsified.31
Ireland, applications by people for their own Some RTI acts also provide for privacy
personal information can be made under protections where there is no general privacy
both acts.29 In these cases, it is possible that law. In South Africa, section 88 of the Promo-
slightly different outcomes may result be- tion of Access to Information Act provides
cause of the differences in exemptions and that, in the absence of other legislation (cur-
oversight bodies. Often, data protection laws rently under consideration), public and pri-
give greater rights for access to personal in- vate bodies must make reasonable efforts to
formation because there is a stronger right of establish internal measures to correct personal
access. In Ireland, the official policy guidance information held by the relevant bodies.32
Complements and Conflicts in RTI and Privacy Laws 11

Applying Privacy Laws to Obtain The Court reiterates that severe environ-
Information from the Private Sector mental pollution may affect individuals
well-being and prevent them from enjoying
Typically, RTI laws do not apply to the pri-
their homes in such a way as to affect their
vate sector, except where the body is con-
private and family life adversely. . . . In the
ducting government functions (such as where
instant case the applicants waited, right up
a contractor is operating a hospital). Only a
until the production of fertilisers ceased in
few countries, including South Africa, have
1994, for essential information that would
adopted RTI laws that extend the right of ac-
have enabled them to assess the risks they
cess to nongovernment bodies for their non-
and their families might run if they contin-
government functions.33
ued to live at Manfredonia, a town partic-
Data protection laws provide an impor-
ularly exposed to danger in the event of an
tant complement to RTI provisions by ex-
accident at the factory.35
tending individuals right of access to private
bodies. As noted above, more than 60 coun-
tries have adopted comprehensive data pro- Data protection laws can also be used to
tection laws that apply to private organiza- obtain government information that sheds
tions as well as to government bodies. These light on policy. Prior to the United King-
laws give individuals the right to obtain per- doms adoption of its FOIA, the Data Pro-
sonal information from private bodies. The tection Act was used by individuals to obtain
use of the laws may reveal abuses by corpo- information from government bodies (see
rations or other private organizations, such as Hencke [2001]; Hencke and Evans [2002,
malfeasance by banks, information and com- 2003]; BBC News [2001]). Even following
munication technology companies, and pre- the implementation of the FOIA, reporters
vious employers.34 have used the Data Protection Act to discov-
er that officials have been spying on their
Using Privacy Laws to Obtain phone records to discover their sources of in-
Policy Information formation (Daily Mail 2006).
In the absence of an RTI law, privacy and
Using RTI to Promote Privacy
data protection acts can be used to reveal im-
portant policy information. As mentioned at In many countries, RTI laws are a primary
the beginning of this section, habeas data has tool used by privacy advocates to identify
been used to demand accountability and in- abuses and to campaign effectively against
formation. In a similar manner, Article 8 of them. In the United States, groups such as the
the European Convention on Human Rights American Civil Liberties Union, the Electron-
has been used often to obtain personal infor- ic Privacy Information Center, and the Elec-
mation, and the article has granted the disclo- tronic Frontier Foundation routinely use the
sure of nonpersonal information in some cas- U.S. FOIA and state laws to demand govern-
es. In 1998, using Article 8 as a basis, the ment records on new and existing government
European Court of Human Rights ruled that programs (communications surveillance, body
in cases where a lack of information could scanners, and spying on groups) and use the
endanger their health, individuals may de- records to campaign against those programs
mand information from government bodies: and proposals.36 In the United Kingdom, the
12 The Right to Information and Privacy: Balancing Rights and Managing Conflicts

Taxpayers Alliance37 and Genewatch oversee net sites. Questions about the relevance of
the government, using the FOIA; and State- data protection laws for the reuse of personal
watch uses the European Unions (EU) access information (even if it is publicly available)
regulations to oversee the EU bodies. are important. Under EU data protection
law, the mere public access to information
does not mean it can be used for any purpose
3.2 Conflicts between (Working Party 1999).
RTI and Privacy In many countries, the privacy exemption
Interests is one of the exemptions used most often. In
the United States, the exemptions for personal
Inevitably, as figure 3.1 shows, there are over- privacy (b6) and law enforcement records con-
laps in RTI and privacy interests that can cerning individuals (b7c) have consistently
lead to conflicts. Governments collect large been the two most-used exemptions. These
amounts of personal information, and some- data include the names of recipients of home
times there is a demand to access that infor- loans, citizenship records, and criminal records.
mation for various reasons. The requestors In Canada, the privacy exemption was used in
include journalists investigating stories, civil 31 percent of all denialsfar more than the
society groups fighting for accountability, in- next-most-used exemption (see U.S. Depart-
dividuals demanding to know why a deci- ment of Justice [2010]; Government of Canada
sion was made in a certain way, companies [2002]; and U.K. Ministry of Justice [2009]).
seeking information for marketing purposes, The following sections will review some
and historians and academics researching re- of the common types of information that are
cent and not-so-recent events. requested and the conflicts that arise.
Every national RTI law has an exemption
Information about Public Officials
for personal privacy. As discussed in the fol-
lowing section, these laws vary greatly. As Many of the records held by public bodies
noted earlier, many countries have adopted contain information that identifies officials
separate privacy and data protection laws that who were involved in the subject at some
may interact with the RTI law in determin- point. This includes the names of officials
ing the release of information. who wrote memorandums, attended meet-
Given the often complex relationship be- ings, and approved decisions. Other records
tween privacy and RTI laws, the conflict fre- contain contact information, official expen-
quently arises from misunderstandings about ditures, or e-mail and phone logs. It is useful
what is intended to be protected. Officials to categorize this information as relating to
must deal with numerous issues: Should offi- their official capacities.
cials names and other details be considered Government bodies also hold more di-
private? Is information in public registers rectly personal information about officials,
available for any use? Are court and criminal including their biographical data, photo-
records public? Clarity in law, policy, and graphs, salary records, employment records,
practice to limit these problems is essential. home addresses, records of financial assets,
These issues have taken on greater im- and medical histories.
portance as information increasingly is being There is no global consensus about which
disclosed in database format and over Inter- information is nonpersonal and which is per-
Complements and Conflicts in RTI and Privacy Laws 13

sonal. As discussed above, the right of privacy general recognition that personal infor-
is complex and defined by each culture.There mation about senior officials should be
are some points that can be summarized: more available than that of junior officials.
So although the salaries of junior officials
Official capacitiesOverall, the ma- may not be made available or only by
jority of countries take the position that scale rather than by exact numbers, the
most information relating to official ca- salaries of more-senior officials may be af-
pacities is not considered personal infor- firmatively published. Similarly, require-
mation for the purposes of withholding. ments for asset disclosure forms are im-
It may be considered personal because it posed in more than 100 countries for
relates to a particular identifiable individ- senior and elected officials, and some may
ual, but generally is not related to his or be publicly available.41 Biographical data
her personal or family life and is less likely of decision makers and those who are be-
to be sensitive. In most cases, documents ing considered for very-senior positions
cannot be withheld just because an offi- are more commonly released than those
cials name is listed as the author or recip- for more-junior positions.
ient of a document. In 2007, the Euro- Elected officialsThere is also signifi-
pean Ombudsman found that it was cant agreement that information about
maladministration for the European Par- elected or high-rank public officials is less
liament to refuse to disclose the expenses restricted, even when it relates to their
of members of parliament, including their personal lives. In 2004, the European
travel and subsistence allowances (EO Court of Human Rights said, the public
2007). The Irish and U.K. information has a right to be informed . . . that is, cer-
commissions have also ordered the release tain circumstances can even extend to as-
of parliament members expense infor- pects of the private life of public figures,
mation, whereas all U.S. congressional ex- particularly where politicians are con-
penditures are published biannually. cerned.42 In Hungary, the Constitutional
Employment informationAlthough Court ruled in 1994 that there are nar-
there is variation across cases, information rower limits to the constitutional protec-
more closely related to an officials per- tion of privacy for government officials
formance in his or her job (including ex- and politicians appearing in public [. . .
act salary38 and details of employee per- than to that of] the ordinary citizen.43 In
formance reviews) is withheld in many India, the Supreme Court ruled that the
jurisdictions and is available in others.39 criminal records of persons running for
Personal lifeInformation relating sole- parliament should be released.44 In some
ly to a public employees personal life cases, the medical records of the highest-
rather than to his or her public actions is ranking officials (such as the president)
less likely to be released. Medical records may be publicly released.45
of nonelected officials are generally con-
Information Held by Governments
sidered sensitive and are not released in
about Private Individuals
any system.40 For officials, criminal records
not related to their positions are often Governments also hold a significant amount
withheld (for example, see Scottish Infor- of information about private individuals.This
mation Commissioner [2009]).There is a is why data protection or privacy laws were
14 The Right to Information and Privacy: Balancing Rights and Managing Conflicts

first conceived and continue to be adopted. Box 3.1: Using Publicly Available
The materials include great amounts of bu- Personal Information to Fight Fraud
reaucratic records with information that most
people consider sensitivesuch as records re- In India, a review of the data by a single in-
lating to citizens interactions with govern- dividual using information gathered under
the National Rural Employment Guarantee
ment bodies for taxation and to their health Scheme found that millions of rupees were
care. In the majority of jurisdictions, most of being siphoned off because fake identity
these records are considered private.46 cards in the names of children and public
employees were created and used. Previous
Court Records social audits had not revealed the fraud.
In Mexico, an analysis of the agricultural
There is no consensus on access to court subsidies register by the transparency advo-
records. In Europe, court records naming in- cacy group FUNDAR found that the families
dividuals are considered very sensitive (see of the minister of agriculture and wanted
drug barons were receiving public money.
Leith and McDonagh [2009]); in the United
States, it has been a matter of long-standing
principle that the information is public.47 In
Hungary, the data protection and freedom of
information commissioner negotiated an there is sensitivity about individuals receiving
agreement between the police and media social support, so personal information held
that access would be provided to criminal by government bodies is not generally made
cases, but only the individuals initials would public.48
be used until charges were filed (Govern- In some developing countries, however,
ment of Hungary 1998b). many of these records are publicly released
There has been increasing sensitivity over and play a crucial role in fighting corruption.
access in many countries as more records have In India, all people are guaranteed the right
become available via computer networks, and to a certain annual minimum of food and
there is greater concern about financial infor- employment. A key element of ensuring that
mation being used for fraudulent purposes these guarantees are protected is making the
(see NJSBA [2002] and Cannon [2004]). In muster rolls and other information publicly
response to these concerns, many courts now available so that social audits may be accom-
redact certain types of information, such as fi- plished.49 This information is increasingly be-
nancial data and identification numbers, prior ing made available on the Internet.50 In
to making material publicly available electron- Mexico, registers of scholarship recipients
ically (see Administrative Office of the U.S. and other social beneficiaries are made avail-
Courts [2008]). In Europe, many countries re- able online.51 This information can be crucial
quire that identities be removed from cases be for identifying fraud in these programs. Box
before they are made public. 3.1 points out two examples of fraud discov-
ered through a review of public information.
Social Program Records
Public Registers
There are also differences of opinion over the
release of information relating to social sup- An increasing controversy relates to access to
port programs. In most developed countries, information in public registers, such as birth,
Complements and Conflicts in RTI and Privacy Laws 15

marriage, and death registers; electoral regis- privacy interests (including the protection
ters; land records; lists of license holders; and of personal information),
other similar records. In many countries, accountability for fair handling of person-
there has been a long history of public access al information, and
to these records. However, concern over their public safety and security (NZLC 2008).
use for commercial purposes, for stalking, and
Professional Records
for other reasons not related to their original
purposes has grown as the registers have been Government bodies also maintain records re-
digitized and made available over the Internet lating to people who have more of a business
(see NZLC [2008]). Countries vary widely in relationship with government, including
their approaches to making public registers those who donate money and meet with of-
available and to permitting third parties to ficials in their capacity as employees of a
reuse the information for other reasons.52 company or organization. In this regard, there
Some countries laws limit disclosure of is an increasing demand that lobbyists be reg-
information for certain reasons, such as com- istered and that such information be made
mercial purposes. The New Zealand public public.55
register privacy principles state, Personal in- In general, these individuals are consid-
formation obtained from a public register ered to have less of a private interest guaran-
shall not be re-sorted, or combined with tee because the information is related to their
personal information obtained from any oth- professional activities rather than to their
er public register, for the purpose of making personal opinions or lives. U.K. and U.S. tri-
available for valuable consideration personal bunals have found that in the absence of
information assembled in a form in which compelling reasons to the contrary, the iden-
that personal information could not be ob- tities of corporate lobbyists should be re-
tained directly from the register.53 In 1999, vealed.56 However, the European Court of
the U.S. Supreme Court upheld a law that Justice ruled recently that businesspeople
restricted access to a computerized list of re- who met with officials could have their
cently arrested individuals for use in com- names withheld.57
mercial marketing.54 The U.K. government
Public Subsidies for Business
makes available a limited version of the elec-
toral roll (from which people may opt to
have their names removed) that can be used Governments also often provide subsidies to
for commercial purposes, and it prohibits use individuals as a business matter, in areas such
of the full roll for such purposes. as agriculture. There has been considerable
Following a review of legislation related debate over agricultural subsidies in Euro-
to public registers and public access, the New pean countries in the past few years, with the
Zealand Law Commission recently recom- result that most of the information is now
mended that any legislation that creates a publicly available.58 There is a growing agree-
public register keep the following principles ment that these records are not particularly
in mind: sensitive because they relate to a business ac-
tivity (although they may reveal the amount
free flow of information, of income that a small farmer may receive in
transparency, a single year). However, the European Court
16 The Right to Information and Privacy: Balancing Rights and Managing Conflicts

of Justice recently ruled that information in name. This makes a major contribution to
this area concerning individuals must be re- the widespread jaundiced media view of pri-
stricted.59 vacy law, even though it is not actually priva-
cy law that is to blame.
Misuse of the Privacy Exemption
Not all arguments for privacy made by offi-
cials are legitimate. A conflict sometimes aris- 3.3 Balancing the Rights
es when government officials attempt to of Access and Privacy
shield their decision making from scrutiny by
misrepresenting their demand for secrecy as It should again be emphasized that the RTI
a privacy interest. Documents and informa- and privacy are not always conflicting rights.
tion are withheld, claiming privacy of offi- They are both laws designed, in part, to ensure
cials or of third parties. In Argentina, the gov- the accountability of the state.The important
ernment claimed that information about issue is how the legislation and the imple-
official spending on advertising was personal menting and oversight bodies balance the two
information (see Knight Center [2010]). rights. As discussed above, both the RTI and
Former U.K. Cabinet Secretary Sir Richard privacy are internationally recognized human
Wilson, the highest-ranking U.K. civil ser- rights with long histories and important func-
vant, best articulated this belief, testifying, I tions. Under human rights law, typically no
believe that a certain amount of privacy is es- right is accorded a greater weight than anoth-
sential to good government.60 er.61 The rights must be decided on a case-by-
The misuse of privacy exemptions often case basis with a view toward the relative im-
leads to needless conflict between the media portance of various interests.
and privacy campaigners as the media comes
to believe that any privacy law is an attempt * * *
to hide government activities. As noted by
Australian freedom of information expert The next chapter will discuss legislative and
Nigel Waters (2002), There is a continued structural means to minimize conflicts be-
problem of privacy exemptions in FOI law tween the two rights.
being misused and getting privacy a bad

In the past 10 years, there has been a marked 4.1 Model 1A Single
convergence of policy and legislation in both
right to information (RTI) and data protec-
RTI and Privacy Law
tion laws. Most data protection laws follow
the structure of the Council of Europe Con- For those jurisdictions that have not adopted
vention for the Protection of Individuals either law but plan to do so, one possibility is
with Regard to Automatic Processing of Per- to adopt both laws in a single act. This allows
sonal Data and the European Union (EU) for common definitions and internal consis-
Data Protection Directive. There is more di- tency and for limiting conflict and establish-
vergence around RTI laws, but they general- ing a balance from the start. Here are several
ly follow the principles set out in preceding examples:
chapters of this report. The convergence in
both areas results from the influence of inter- In Canada, Bill C-43, adopted in 1982,
national treaties and agreements and the ef- contained both the Access to Information
forts of a more global civil society connected Act and the Privacy Act. The two sections
through modern communication technolo- then became separate laws with separate
gya society that is constantly sharing ideas commissions to enforce them, but with
and good practices. common definitions and relationships.
There has also been convergence in de- The Canadian Supreme Court has de-
veloping policies on the relationship be- scribed the two laws as a seamless code
tween RTI and privacy laws and how best to with complementary provisions that can
make them interact. Although no consensus and should be interpreted harmonious-
on good practice has yet emerged, a number ly.62 Many Canadian provincial laws also
of common areas are now clear. This chapter address both rights in a single law.
will review the most common policy choices In Hungary, the 1992 Act on the Protec-
made by governments and highlight their tion of Personal Data and Public Access
strengths and weaknesses. to Data of Public Interest is both a gener-

18 The Right to Information and Privacy: Balancing Rights and Managing Conflicts

al RTI law and a data protection law that 4.2 Model 2Separate
protects personal information held by
public and private bodies.63 It created a
RTI and Privacy Laws:
single oversight body with jurisdiction Managing Conflicts
over both. The parliamentary commis-
sioner for data protection and freedom of In many jurisdictions, either an RTI or a data
information oversees them. protection law has been adopted and is in
In Mexico, the Federal Law on Trans- force, or a decision has been made to intro-
parency and Access to Public Information duce the laws as separate pieces of legislation.
lists both access to information and the Therefore, the new law or laws must be
protection of privacy for records held by adopted in a way that ensures the greatest
federal government bodies as its primary harmony between the operations of the two
goals. It is overseen by the Federal Institute laws. If the goal of harmony is ignored at the
for Access to Information (more common- outset, the laws will conflict and further leg-
ly known by its Spanish acronym IFAI). islative efforts will be required later.
More recently, legislation to extend its re- Here are some important considerations
mit to include personal data held by the when adopting new legislation:
private sector has been adopted.
In Thailand, the Official Information Act Definition of personal information
both gives citizens rights to access infor- Ideally, a common definition will be used
mation held by government bodies and for both acts. If not, then the definitions
controls how government bodies may use from both laws will be considered each
personal data. Both are overseen by the time that access to personal information
Official Information Council. Legislation is sought.
to protect records held by the private sec- Primacy of legislationBecause both
tor is currently being debated. access to information and privacy are
equally fundamental rights, neither law
There are some disadvantages to adopting may arbitrarily trump the other. How will
a single act to address both rights. For one, the legislation address this issue?
having both functions together may cause Privacy exemption in RTI lawAll
legislative confusion over the intent of the national RTI laws provide for the with-
laws and may lead to opposition by some holding of personal information.There is
parties who would otherwise support one wide variance in the scope of these ex-
act or another. A more practical issue is the emptions, ranging from a presumption
complexity of the legislation, which may that all information is private and should
lead to legislators being unwilling to review be withheld to a presumption of open-
it because they lack the time.64 An act that ness with limited exceptions for sensitive
covers both areas comprehensively will need information.
to be as detailed as two single acts because Subject access requestsAs noted ear-
there is little overlap in the two (except for lier in this report, some jurisdictions allow
the definitions and the oversight body). for individuals to request their own per-
Legislation 19

sonal information under either act. A bet- tion and what is excluded from the defini-
ter choice would be to select one act that tion in relation to public activities. In South
gives greater access and to focus those re- Africa, the Promotion of Access to Informa-
quests through that law. In most European tion Act65 requires that disclosure of informa-
countries, this is the Data Protection Act. tion be declined if it would involve the un-
Oversight and appealsWhat type of reasonable disclosure of personal information
body will rule on the balancing of the about a third party, including a deceased in-
rights? It should be a specialized body that dividual. However, the information can be
can develop clear standards on the subject. disclosed if it is about an individual who is or
was an official of a public entity and if it re-
Personal Information Defined
lates to the position or functions of the indi-
Data protection laws typically take an expan- vidual, including, but not limited to
sive view of what is personal information.
EU Directive 95/46/EC, section 2(a), defines the fact that the individual is or was an
personal information broadly as any infor- official of that public body;
mation that identifies an individual. Such the title, work address, work phone num-
breadth can lead to a conflict with the RTI ber, and other similar particulars of the
because the core principle of data protection individual;
is that information collected for one purpose the classification, salary scale, or remuner-
should not be used for other purposes with- ation and responsibilities of the position
out the consent of the individualand this held or services performed by the indi-
is often viewed as covering everything that vidual; and
mentions a person. the name of the individual on a record
Countries have addressed this in different prepared by the individual in the course
ways. The Canadian access to information of employment (section 34).
and privacy acts use a single definition in the
Privacy Act that sets out in detail the bound- Curiously, a few laws passed more recent-
aries of personal information and public in- lyincluding the Indian Right to Informa-
formation. In contrast, the Irish Freedom of tion Act and the Indonesian Act on Public
Information Act (FOIA) and the Data Pro- Information Disclosure66do not provide
tection Act use different definitions, but re- for a definition of private information; they
quire that the FOIA definition be used when rely instead on common language definitions
considering the exemption. for interpretation.
Some countries define in more detail the
Fairness and Data Protection
types of information to be protected. Doing
so enables the legislature to define some of In many countries, the privacy exemption
the boundaries rather than leave them to the requires that all personally identifiable infor-
oversight bodies or courts to determine. mation must be withheld. Frequently, the
Many laws specifically exclude informa- RTI law specifically defers to the law on data
tion relating to public functions from cover- protection for the definition of personal in-
age under the privacy exemption. As noted formation to be protected and the rules gov-
before, Canadas Privacy Act includes de- erning its release. This approach is found in
tailed descriptions of both personal informa- many European countries, including Croatia,
20 The Right to Information and Privacy: Balancing Rights and Managing Conflicts

Kosovo, Romania, Slovakia, and the United Box 4.1: Elements to Determine
Kingdom. Fairness
Under this approach, it is then necessary
to use the data protection law to determine The U.K. Ministry of Justice recommends
if information can be released. An initial in- that the following factors be used in deter-
mining if disclosure under the U.K. FOIA
quiry will determine if consent has been ob- would be considered fair:
tained and can be used to justify the release
How the information was obtained.
of the information. A best practice is to in-
The data subjects likely expectations
form individuals at the time of collection regarding the disclosure of the informa-
that the information may be made public tion. For example, would the party ex-
under RTI legislation.67 If consent from the pect that his or her information might
person is not forthcoming, the data protec- be disclosed to others? Or had the per-
son been led to believe that his or her
tion principles must be reviewed to deter- information would be kept secret?
mine if release can be justified. The effect that disclosure would have
Among the pertinent principles, fairness on the data subject. For example,
is the most important one to consider. Fair- would the disclosure cause unneces-
ness typically depends on the circumstances sary or unjustified distress or damage
to the data subject?
under which the information was collected
Whether the party expressly refused
and the expectation at that time that the in- consent to disclosure of the information.
formation would be used in certain ways. If The content of the information.
the processing (in this case, the public release) The public interest in disclosure of the
of the information can be found to be fair, it information.
can proceed and the information can be dis-
closed. Box 4.1 sets out guidelines used by Source: U.K. Ministry of Justice 2008.
the U.K. government to determine fairness.
Public Interest Test
In the United States, the primary privacy
Increasingly, many RTI laws provide for a exemption protects personnel and medical
balancing test to be used when determining files and similar files the disclosure of which
whether personal information should be re- would constitute a clearly unwarranted inva-
leased. Under this test, even if the informa- sion of personal privacy.68 The courts have
tion is determined to be personal and its re- found that there is an implicit public interest
lease would cause harm, it may be disclosed test balancing the individuals right to pri-
if it is found that the public interest in release vacy against the basic purpose of the FOIA
is more important than the privacy interest. to open up agency action to the light of
This allows for independent arbiters such as public scrutiny.69
commissions, courts, or ombudsmen to weigh The Slovenian information commissioner
the different values and determine, case by has identified some areas where public inter-
case, when information should be released. est would be strong:
This test is used to evaluate privacy interests
in a number of countries, including Ireland, where the disclosure will assist public un-
New Zealand, Slovenia, and the United derstanding of an issue of current national
States. debate,
Legislation 21

where the issue has generated public or their Constitutional responsibilities with-
parliamentary debate, out being put in a position where they
where proper debate cannot take place are or may be subjected to unjust attack
without wide availability of all relevant for claiming financial entitlements which
information, are theirs as a matter of law and the
where an issue affects a wide range of in- amounts of which are not, in the normal
dividuals or companies, course, relevant to the members perform-
where the issue affects public safety or ance as a public representative.
public health, The possibility of prejudice to, or distortion
where the release of information would of, the democratic process by equation, in
promote accountability and transparency the eyes of members of the public, of the
in decision making, and level of payment of expenses to members
where the issue concerns the making or with individual performance of members,
spending of public money (Pirc Musar with possible adverse consequences for the
2006). careers of individual members.
The possibility that disclosure of records
In a leading case in Ireland, the Irish in- which are, or may not be, comparable,
formation commissioner set out public inter- and which are likely to be used for com-
est arguments to consider when balancing parison purposes, may mislead the public
requests for information: and result in comment based on partially
or wholly unreliable conclusions which
The public interest in the public having may be damaging to the interests of in-
access to information. dividual members.
The public interest in the accountability The possibility that such comparisons may
of elected representatives. result in certain members being forced to
The public interest in a free and informed release further personal information relat-
debate on the level of remuneration/ex- ing to their financial affairs in order to deal
penses paid to elected representatives. with inaccurate public speculation as to
The public interest in accountability for their income and to repair perceived dam-
use of public funds. age to their interests.70
The public interest in an individuals
right to privacy in respect of information Thus, it is clear from the different models
relating to his/her financial affairs. described above that both the RTI and the
The possibility of damage to the image data protection laws must clearly define how
of Parliament as an institution in the personal information is going to be consid-
event of reduced public confidence in the ered. Under the most effective legislation,
integrity of members of the Houses of this is set out lucidly and provides for specific
the Oireachtas. boundaries on types of personal information
The public interest in the entitlement of to be protected and a balancing test that ex-
members of the Houses of the Oireachtas amines both harms and the public interest
(Irish national parliament) to discharge (Pirc Musar 2010).

All national right to information (RTI) laws A few countries have created an independ-
have some form of external appeals mecha- ent RTI commission as a single-function body.
nism. In approximately two thirds of coun- These countries include Belgium, Canada,
tries (roughly 60), an independent oversight France, and Portugal. More commonly, an al-
body such as a commission or ombudsman ready existing ombudsmans office also en-
has been empowered to receive appeals and forces the RTI law. This is the situation in
make determinations or recommendations New Zealand, Peru, and the Scandinavian
on the release of information.71 These bodies countries. A few jurisdictions (such as Ireland)
can play an important role in balancing pub- have adopted an RTI commission that also
lic interest with the release of personal data. serves as the ombudsman, but with additional
A very strong trend exists for countries to powers.
create information commissioner offices that In nearly all countries, the data protection
can decide appeals and provide oversight and or privacy commission is an independent
guidance.There is a roughly even split in ju- body. This is partly because of requirements
risdictions that have created a commission under European Union law that data protec-
between those that have separate bodies to tion commissions be independent.72
handle the RTI and data protection and There are benefits to having two bodies.
those that have a single body to handle both. A separate commission for each of the two
Each model has its pros and cons. rights can create clear champions for such
rights, unencumbered by the need to balance
potentially competing interests. As stated by
5.1 Two Bodies Canadian Information Commissioner John
Separate RTI and Grace:
Privacy Commissions
The values of openness and privacy each
Many countries have created separate bodies has a clearly identifiable and unambiguous
for enforcing the RTI and the protection of advocate.While both commissioners are re-
privacy. The bodies may have a single func- quired by law to reasonably balance access
tion or have other duties assigned to them. rights and privacy rights, each has a clear

24 The Right to Information and Privacy: Balancing Rights and Managing Conflicts

mandate to be a lightening [sic] rod for, and Two bodies which operate in an area so
champion of, one of the two values.73 closely interlinked would inevitably come
into conflicting situations [with] the insti-
This could be particularly important when tute of an administrative dispute as a tool
one is a new right that is not yet established for settling such conflicts. Such a manner of
in the public mind and the other has long settling mutual conflicts though, would, due
been accepted and championed by a body. to the long time periods of dispute resolu-
A primary concern of having two bodies tions, mean a lessened legal certainty (Pirc
is that there will be conflict between the Musar 2006).
twoand that could become messy, expen-
sive, and embarrassing. In Canada, there have Finally, not related to the scope of this re-
been public fights between the two commis- port but quite relevant to many countries,
sions for both policy and political reasons there is an economic concern relating to the
(see Government of Canada [2001]).There is cost of two commissions. It may be difficult
also concern that public bodies and the pub- to justify two commissions in small jurisdic-
lic will receive conflicting advice from the tions when economic situations are difficult
two commissioners when they disagree. As or as governments are cutting back to create
noted by the Canadian Access to Informa- a new body.
tion Review Task Force in 2002: When there are two agencies, there should
be formal agreements to cooperate to mini-
An institution is required to notify the Pri- mize conflicts. In New Zealand, the privacy
vacy Commissioner before making such a commissioner and the ombudsman have a for-
disclosure, where this can reasonably be mal consultation process that requires the om-
done. A situation can arise where the Infor- budsman to consider the views of the privacy
mation Commissioner advises the institu- commissioner before determining whether to
tion to disclose personal information in the release personal information (Slane 2002). In
public interest, but the Privacy Commis- Ireland, the Data Protection Act requires the
sioner advises the institution to protect the two bodies to cooperate.
information on the grounds that the public
interest in the case does not clearly out-
weigh the invasion of privacy that could re- 5.2 One BodyA Single
sult from disclosure. This puts the institu- RTI and Privacy
tion in the difficult position of having Commission
conflicting recommendations from the two
Commissioners (Government of Canada Countries increasingly have been creating
2002, p. 59).74 single commissions to handle both access to
information and privacy protection. Coun-
If there are two commissioners, there will tries and jurisdictions that have adopted this
need to be a mechanism to resolve conflicts. model include Estonia, Hungary, Malta, Mex-
Previously, the Slovenian system used an ad- ico, Serbia, Thailand, and the United King-
ministrative dispute institute. The Slovenian dom at the national level; and many Canadi-
information commissioner found that the an provinces, German lnder, Mexican states,
system was inefficient: and Swiss cantons at the subnational level.
Oversight 25

In most cases, an existing commission is better exercise their rights. The Slovenian
given additional authority with the adoption commissioner has found that having one en-
of new legislation. In the United Kingdom, tity resulted in greater awareness of both
the Data Protection Commission evolved rights:
into the Information Commission. A similar
process also occurred in Germany, Malta, and The merged body also insures for its greater
Switzerland. In Slovenia, the two bodies were visibility as well as unification of the entire
merged into a single new commission headed legal practice of the field. It will also increase
by the previous information commissioner. the awareness of all other government bod-
The most significant benefit of having a ies while carrying out the stated legislative
single body is the shared expertise and re- provisions to the benefit of all applicants
duction of conflict. As noted earlier, there is (Pirc Musar 2006).
a strong interrelation between the two rights.
Although they have some areas of conflict, The creation of a single body with both
there also are strong areas of commonality. powers also reduces the likelihood that pub-
Having a single body can reduce the pos- lic bodies can misuse data protection, know-
sibility of institutional conflict. In practice, ing that their decisions are subject to review
many requests for information under RTI by an oversight body that is an expert in
legislation will relate to personal informa- both areas of legislation. As Lszl Majtnyi,
tion; having this dual expertise will allow for the first Hungarian information commis-
better balancing. Elizabeth France (1999), the sioner, stated in his first report, [i]t goes
U.K. data protection registrar, commented without saying that nobody can lawfully ob-
during the legislative process in June 1999: struct the freedom of information and the
press in the name of data protection (Gov-
The possibility of institutional conflict ernment of Hungary 1998a, p. 73).
which would exist were there to be separate There is also an important economic ar-
Commissioners for freedom of information gument to having only a single body. None
and data protection matters is avoided. of the administrative costssuch as human
Working within one institution should al- resources, technical infrastructure, and ad-
low more focused and effective consideration ministrative supportare duplicated. When
than working across institutional bound- the Canadian information and privacy com-
aries. Any tension will be contained within missioners, who shared common corporate
the institution. Making the actual decision services, split apart in 2002, the costs for both
about where the balance should lie between bodies increased by an estimated Can$1 mil-
data protection and freedom of information lion each.
in a particular case will not be less difficult The strongest drawback to adopting a
because there is one commissioner. However, single-commission model is the danger that
with experience and understanding of both one interest may be stronger or perceived as
issues in-house, the decision process itself more powerful and that the bodies do not
should be eased. equally protect or balance both interests
(Tang 2002). Any conflicts are likely to be
It is also easier for the public to have a decided internally rather than publicly, where
single point of contact with public bodies to they would receive a public viewing and de-
26 The Right to Information and Privacy: Balancing Rights and Managing Conflicts

bate. The Canadian privacy commissioner new functions added to his mandate have re-
worried that it would diminish or dilute sulted in additional work without enough re-
the profile of privacy at a time when there sources being provided (ABC News 2009).
were profound privacy challenges.75
An imbalance could be especially prob- There is no clear answer for every juris-
lematic where one law has a greater consti- diction on the issue of whether it is better to
tutional protection or has been in force for a have one commission or two. Countries may
significantly longer period of time. In the wish to create a new institution to ensure
United Kingdom, this concern led to the that the profile of one of the rights is clearly
creation of two distinctly separate workforces promoted and not diluted by other func-
for the different rights inside the information tions. In other cases, an existing body (such
commission (which had previously been en- as an ombudsman) may be appropriate. And,
forcing only data protection rights). Only af- of course, economic or political concerns
ter five years are the two workforces being may dictate one model over the other.
There is also a concern that a single body * * *
may not be provided with adequate resources
to take on additional dutiesduties that are In the next chapter, both oversight models
significantly different in some ways. In Aus- will appear in the case studies presented
tralia, the Tasmania ombudsman (who is also thereincluding one jurisdiction that has
the information commissioner and the in- switched from one model to the other. The
tegrity commissioner, and who holds several discussion will examine some of the benefits
other posts) recently expressed concern that and limitations of the different models.
Case Studies

6.1 Ireland These definitions are followed by three para-

graphs of information expressly excluded
Irelands Data Protection Act was adopted in from the definition of personal information,
1988 and amended in 2005 to implement including the activities of an officeholder of
the European Union (EU) data protection a public body and those providing public
directive. The act created the Office of the services under contract, and opinions of the
Data Protection Commission as an oversight individual regarding the public body (includ-
and enforcement body. Irelands Freedom of ing its staff).
Information Act (FOIA), adopted in 1997, Separately, the Data Protection Act defines
created an Office of Information Commis- personal information as data relating to a liv-
sion to enforce the act. The government ap- ing individual who is or can be identified ei-
pointed the ombudsman to act jointly as the ther from the data or from the data in con-
information commissioner.The second com- junction with other information that is in, or
missioner was also jointly appointed as om- is likely to come into, the possession of the data
budsman. Under the Data Protection Act, controller (sec. 1[1]). However, to ensure that
the Commissioner and the Information there is no conflict between that act and the
Commissioner shall, in the performance of FOIA, section 1(5)(a) of the Data Protection
their functions, co-operate with and provide Act provides a specific exemption for release of
assistance to each other (sec. 1[5][b]). personal information under the FOIA.This is
The definition of privacy in the two acts considered by a leading commentator (Mc-
is not identical. Section 2 of the FOIA de- Donagh 2006) to be a trumping of the pri-
fines personal information as data about an vacy right, but subject to constitutional protec-
identifiable person that is normally known tions and international obligations.
only to the individual or members of the Individuals may request personal informa-
family, or friends, of the individual, or is tion about themselves from government bod-
confidential. It provides 12 paragraphs of ex- ies under either the Data Protection Act or
amples of what is personal information, in- the FOIA. Most requests to public bodies are
cluding educational, medical, psychiatric or made under the latter, except requests to bod-
psychological history, financial affairs, reli- ies that are not covered by the FOIAsuch as
gion, and tax and identification numbers. the Guardi (police) and the private sector.

28 The Right to Information and Privacy: Balancing Rights and Managing Conflicts

Under section 28 of the FOIA, personal der the Social Welfare Acts, where there is an
information must be withheld unless (1) it is expenditure of public money but the pay-
about the requestor, (2) the person gives ment derives from some private aspect of the
consent, (3) the information is of a class that claimants life such as family circumstances
is publicly available or the person has been or inadequacy of means (Government of Ire-
notified that it is part of that type of class, or land 1999).
(3) its release is necessary to avoid a serious
and imminent danger to the life or health of Since that time, the commissioner has ex-
an individual (see Government of Ireland amined numerous other cases related to pri-
[2006]). vacy and access. The breakdown of cases in-
The exemption is subject to a public in- dicates that this question is the one most
terest test that allows for the release of the in- examined by the office. Other information
formation if the public interest that the re- that has been ordered released under the
quest should be granted outweighs the public interest test includes payments of agri-
public interest that the right to privacy of the cultural subsidies and the names of and pay-
individual to whom the information relates ments to experts, outside lawyers, and senior
should be upheld or if it benefits the indi- academics.76 In a recent settled case, the
vidual. The information commissioner ruled commissioner negotiated a settlement for the
in 1999 that the expenses of members of release of detailed expenditure records in
parliament (MPs) should be released as a database form from the Department of Arts,
matter of public interest. In that case, the Sport and Tourism to allow for easy compar-
commissioner examined the questions about isons (Sheridan 2010). However, a complaint
financial privacy and public spending: about the decision has been filed with the
Data Protection Commission.77
As a general proposition I would accept that,
when an individual discloses details of his/
her financial affairs including details of fi- 6.2 Mexico
nancial transactions with third parties to a
public body, there is an understanding that Mexico adopted the Federal Law on Trans-
the information is given in confidence. How- parency and Access to Public Information in
ever, does such an understanding normally 2002.78 The law states that its objective is to
exist in relation to the payment of public both promote transparency and protect per-
money to individuals, be they members of sonal information held by public bodies. It
the Oireachtas [Parliament] or employees of does not apply to personal data held by pri-
a public body? It is pertinent to recall at this vate bodies. In 2010, the Federal Law on
point that the information at issue in this Protection of Personal Data Held by Individ-
case concerns amounts paid to individuals to uals was adopted.79 The more recent law ap-
defray expenses incurred by them in dis- plies to personal data held by private compa-
charging their functions as public representa- nies and individuals. Personal information is
tives.The payments do not arise out of some defined as any information concerning an
private activities or private aspect of their identified or identifiable natural person. A
lives. On this point they can be distinguished new initiative is being considered by Con-
from, say, a payment made to a claimant un- gress to revise and extend the data protection
Case Studies 29

provisions of the right to information (RTI) connection with the purposes for which
law to improve the protection of information they were obtained; to ensure it is accurate,
held by federal bodies. updated, and corrected it if it is incorrect;
As part of a federal system, each of the 32 and to ensure that it is kept secure.
states has adopted its own access to informa- The IFAI rules on all appealed cases con-
tion law, and many are considering data pro- cerning access to government-held informa-
tection laws. In the Federal District (Mexico tion. Many of these cases relate to the per-
City), both RTI and data protection laws sonal information of third parties, both
have been adopted, and a single commission officials and members of the public; and they
handles both issues.80 have required the IFAI to balance the two
The 2002 RTI law created a Federal In- rights. In balancing these rights, the institute
stitute for Access to Information (IFAI) to balances public accountability against pro-
monitor federal government bodies compli- tecting personal data (Irazbal and Nez
ance with both access to information and 2009). In the cases, some of the factors have
protection of personal data legislation. The included the public interest in knowing
IFAI was changed into the Federal Institute about criminal prosecutions, the importance
for Access to Public Information and Data of the public being aware of the elements of
Protection with the adoption of the 2010 a scientific investigation, and the value of
act, and will now have the authority to en- public accountability when public funds are
force the protection of personal information spent. In cases where privacy has been up-
held by the private sector. held, the IFAI has analyzed whether the re-
Personal information is defined in article lease of information would give the public
II(2) of the law as [a]ll information con- insight into the performance of the data sub-
cerning an individual, identified or identifi- jects or their suitability for their jobs. Follow-
able, including their ethnic or racial origin, ing such analysis, it decided that release
or related to their physical, moral or emo- would not provide such insight, and so de-
tional characteristics, their personal and fam- nied release of the information. In a different
ily life, residence, telephone number, patri- case (one that sought the telephone numbers
mony, ideology, political opinions, religious of wildlife units), another decision was
or philosophical beliefs or convictions, phys- reached and the numbers were released. The
ical or mental health, sexual preferences, or IFAI has also denied release of information
any other similar preferences that could have from the Mexican Population Register
an impact on their intimacy. Article 18 pro- even though the information was not con-
tects personal data as confidential and thus sidered confidentialbecause it was available
exempt from release. Personal data related to elsewhere.
public spending or present in public reg-
istries is not considered confidential.
According to chapter IV of the 2010 law, 6.3 Slovenia
federal public bodies are required to provide
individuals access to their own information The Personal Data Protection Act was adopt-
and details on the procedures for correcting ed in 1999 and replaced in 2005 with a new
that information to ensure that all handling act based on EU Directive 95/46/EC. The
is adequate, appropriate and moderated in law created an Inspectorate for Protection of
30 The Right to Information and Privacy: Balancing Rights and Managing Conflicts

Personal Data within the Ministry of Justice Under the Access to Information Act, ac-
as its oversight and enforcement body. The cess cannot be withheld if it is related to the
Access to Public Information Act was adopt- use of public funds or information related to
ed in 2003. The law created a commissioner the execution of public functions or employ-
for access to public information to enforce its ment relationship of the civil servant. It also
provisions. contains a public interest test that provides
The two commissions were merged into that the access to the requested information
a single information commissioner by the is sustained, if public interest for disclosure
Information Commissioner Act in 2005. prevails over public interest or interest of
There were concerns that the inspectorate other persons not to disclose the requested
for data protection was not as strong and in- information.
dependent as required under EU rules. Prior Under the decisions of the commissioner,
to the merger of the offices, disputes were the public interest in the release of informa-
handled through the initiation of an admin- tion is the issue that has been examined nu-
istrative dispute; however, no cases were filed. merous times.82 The commissioner has or-
Following the merger, the National Supervi- dered the release of information relating to
sor for Data Protection was established under the misconduct of officials because it is in the
the authority of the information commis- public interest 83 and the release of the name
sioner, and staff was substantially increased. of a job applicant who was already a public
Slovenias Access to Information Act al- servant,84 and has denied release of video
lows for the withholding of information surveillance records from the state prosecu-
when the disclosure . . . would constitute an tors office.85
infringement of the protection of personal
data in accordance with the Act governing
the protection of personal data. Personal 6.4 United Kingdom
data are defined in the Data Protection Act as
any data relating to an individual, irrespec- The United Kingdom first adopted the Data
tive of the form in which it is expressed. An Protection Act in 1984, in response to the
individual is defined as an identified or Council of Europes Convention for the
identifiable natural person to whom personal Protection of Individuals with Regard to
data relates; an identifiable natural person is Automatic Processing of Personal Data.86
one who can be identified, directly or indi- The act created a data protection registrar to
rectly, in particular by reference to an identi- enforce it. In 1998, the act was replaced to
fication number or to one or more factors implement EU Data Protection Directive
specific to his physical, physiological, mental, 95/46/EC, which changed the data protec-
economic, cultural or social identity, where tion registrar into the data protection com-
the method of identification does not incur mission and granted it stronger powers. In
large costs or disproportionate effort or re- 2000, the FOIA was adopted. The act trans-
quire a large amount of time. However, the formed the data protection commission into
commissioner has said that, based on a Con- the information commission, with authority
stitutional Court ruling, a name is not suffi- to enforce both acts.
cient to constitute personal data in the ab- When the FOIA proposal was first con-
sence of other identifying data.81 sidered, the government position was that
Case Studies 31

there would be a separate information com- in accordance with the rights of the individ-
mission. In the end, the government revised ual, that they are kept secure, and that they are
its position, stating, not transferred to third countries.
Under the FOIA, when an individual re-
Dual enforcement regimes raise serious co- quests personal information about himself or
ordination problems, are confusing to appli- herself, he or she is directed to the subject
cants, wasteful of resources and require com- access provisions of the Data Protection Act.
plicated procedures to ensure that issues of Although this typically is a good solution,
privacy and access to information have both given the stronger requirements under EU
been properly assessed in the many cases in law and the European Convention for the
which they overlap.This is why it has been Protection of Human Rights and Funda-
decided that for the UK FOI Act the role mental Freedoms on access to personal
of Information Commissioner should be records, there is a substantial weakness in the
merged with that of Data Protection Com- United Kingdom. Under the U.K. Data Pro-
missioner (U.K. Home Office 1999). tection Act, individuals who are denied ac-
cess cannot appeal to the information com-
In addition, the Freedom of Information missioner. Rather, they must apply in court.
(Scotland) Act 2002 created a separate Scot- They have fewer rights to demand access
tish information commission that has au- than are available under the FOIA.
thority only over access to information. The When it comes to accessing records that
Scottish information commissioner considers contain personal information about other
the U.K. data protection exemptions when people, there is a complex relationship. A
deciding on the release of information.87 simplified explanation is that requests for in-
The FOIA adopts the definition of per- formation about third parties are generally
sonal data found in the U.K. Data Protection exempt if they violate the data protection
Act: data which relate to a living individual principles of the Data Protection Act. Under
who can be identified(a) from those data, the FOIA, there is an absolute exemption for
or (b) from those data and other information personal information. Thus, any decisions on
which is in the possession of, or is likely to the release of personal data must analyze the
come into the possession of, the data con- information using the data protection prin-
troller, and includes any expression of opinion ciples rather than the FOIA. However, this is
about the individual and any indication of the not to say that information containing per-
intentions of the data controller or any other sonal data is never released. The key issue is
person in respect of the individual. Eight whether the release of the information would
data protection principles set the rules for the be unfair under the principles. This includes
processing of personal information. They re- a consideration of how the information was
quire that the processing is fair and lawful, collected in the first place, the effect on the
that the data are collected and used only for person from whom the information was col-
specific and lawful purposes, that the data are lected, whether consent to release the infor-
adequate and relevant for the purpose for mation was obtained, and the public interest
which they are collected, that they are accu- in releasing the information.88
rate and up to date, that they are kept no According to the U.K. Ministry of Justice
longer than necessary, that they are processed (2010), the privacy exemption is the most
32 The Right to Information and Privacy: Balancing Rights and Managing Conflicts

common one cited by public bodies. Many information was withheld on privacy grounds,
cases before the information commission, the but later leaked. It revealed some corrupt and
information tribunal, and the courts have fo- unethical practices by MPs. In another case in
cused on this subject; and they have required 2008, the House of Lords ruled on the release
balancing by those bodies. A significant case of anonymous health statistics.90 Separately, the
occurred in 2008, one related to MPs. Journal- information tribunal has ruled several times re-
ists had asked for detailed records of the ex- cently91 on the identity of senior officials, es-
penditures of MPsexpenditures that not tablishing that they do not have a reasonable
only related to their official office and travel expectation of anonymity in any document
expenses but also to subsidies they received for (even sensitive ones); at the same time, junior
housing. Following a protracted series of deci- officials may have this expectation, depending
sions by the information commissioner, infor- on the public nature of their jobs and when
mation tribunal, High Court, and Court of they meet with lobbyists. The tribunal also or-
Appeals,89 much of the information was re- dered the release of anonymous statistics on
leased, based on its public interest. Some of this abortion.92

Access to information and protection of pri- Of key importance is that governments

vacy are both rights intended to help the in- take care when writing the laws to ensure
dividual in making government accountable. that the access to information and data pro-
Most of the time, the two rights complement tection laws have compatible definitions of
each other. However, there are conflictsfor personal information. They should adopt ap-
example, privacy laws often are improperly propriate public interest tests that allow for
invoked by governments. And there are cases careful balancing of the two rights. Finally,
where the conflicts are legitimate. they should create appropriate institutional
There is no simple solution to balancing structures that can balance these rights and
the two rights, but most issues can be miti- ensure that data protection and right to in-
gated through the enactment of clear defini- formation officials work together, even if
tions in legislation, guidelines, techniques, they represent different bodies.
and oversight systems.


For the purposes of this working paper, the terms right (2009); and Bensaid v. United Kingdom 44599/98 [2001]
to information laws, access to information laws, and ECHR 82.
freedom of information laws refer to the same type of For example, see the November 3, 2009, Madrid Privacy
laws that provide for a legal right of access to information Declaration: Global Privacy Standards for a Global World, at
held by public bodies.
2 10
See the Universal Declaration of Human Rights (UDHR), UDHR, art. 12.
art. 19. Ibid., art. 17.
3 12
For a detailed overview of international standards on RTI, Ibid., art. 8.
see Mendel (2008) and Banisar (2006). Ibid., art. 5, 9, and 10.
4 14
In 2006, the Inter-American Court of Human Rights Ibid., art. 11.
ruled that the States actions should be governed by the For example, see NetherlandsCCPR/C/82/D/903/1999
principles of disclosure and transparency in public adminis- [2004] UNHRC 60 (November 15, 2004), http://www1.u
tration that enable all persons subject to its jurisdiction to
exercise the democratic control of those actions, and so that APEC Privacy Framework, 2005, http://www.apec.
they can question, investigate and consider whether public org/About-Us/About-APEC/Fact-Sheets/Collection/AP
functions are being performed adequately. Access to State- EC-Privacy-Framework.aspx.
held information of public interest can permit participation Also see Organisation of Eastern Caribbean States (2004).
in public administration through the social control that can See also Article 29 Data Protection Working Party, Opin-
be exercised through such access (Marcel Claude Reyes et ion 4/2007 on the concept of personal data, June 20, 2007,
al. v. Chile, judgment of September 19, 2006). at
See, for example, ACHPR (2002); and the Joint Declara- asset_id=12058063.
tion of the UN Special Rapporteur on Freedom of Opin- Copland v. United Kingdom (App. No. 62617/00) 2007.
ion and Expression, the OSCE Representative on Freedom For example, see the constitutions of Albania (1998, sec.
of the Media, and the OAS Special Rapporteur on Freedom 35). Cape Verde (1999, sec. 42), the Former Yugoslav Re-
of Expression, November 26, 1999. public of Macedonia (1992, sec.18), Mozambique (1990,
A global map of countries with access to information leg- sec. 71), and Thailand (2007, sec. 35).
islation is available at http://www.privacyinternational.o For a map of data protection laws around the world, see
7 22
Writing on December 17, 1992, in Niemietz v. Germany See the Privacy Act of 1974, 5 USC 552(a). There is also
(16 EHRR 97), the European Court of Human Rights a patchwork of sectoral legislation applying to heath, finan-
noted, The Court does not consider it possible or neces- cial, and credit records; some telecommunications records;
sary to attempt an exhaustive definition of the notion of educational records; and other areas at both the national and
private life. For a detailed overview of the different rights, state levels. For a comprehensive overview, see Solove and
see EPIC/PI (2007). Schwartz (2008).
8 23
For example, see the following documents: UN Human General Administrative Code, sec. 27.
Rights Committee (1988); UN Human Rights Council Official Information Act, B.E. 2540 (1997).

36 The Right to Information and Privacy: Balancing Rights and Managing Conflicts

25 44
Malaysian Personal Data Protection Act, 2010. Union of India v. Association for Democratic Reforms
Freedom of Information: Consultation on Draft Legisla- (2002) 2 LRI 305.
tion Cm 4355, May 1999, Response of the Data Protection The European Court of Human Rights ruled in 2004 that
Registrar. there was a public interest in a doctor revealing information
See Guadamuz (2001); and the Rule on the Writ of that French President Franois Mitterand was seriously ill
Habeas Data, issued by the Philippines Supreme Court (A. while in office and had hid that from the public. The court
M. No. 08-1-16-SC, January 22, 2008, http://www.lawph ruled that a temporary injunction was appropriate, but that a permanent one violated Article 10 of the European Con-
Cantons remarks of October 30, 2002, are available at vention on Human Rights (ditions Plon v. France [Appli- cation No. 58148/00], May 18, 2004). A recent case from
See Decision of the Supreme Administrative Court of India ruled that medical information could be released if
Bulgaria No. 7146, July 30, 2004. An informative discussion there was a sufficient public interest: personal information
of this decision can be found at including tax returns, medical records etc. cannot be dis-
ary/dela/yonchev.htm. closed in view of Section 8(1)(j) of the Act. If, however, the
According to the Ninth FOI Report of the Irish Minister applicant can show sufficient public interest in disclosure,
of Finance, 67 percent of all requests in 2008, 72 percent in the bar (preventing disclosure) is lifted and after duly noti-
2007, and 70 percent in 2006 were for the applicants per- fying the third party (i.e. the individual concerned with the
sonal information. information or whose records are sought) and after consid-
For example, see Times of India (2010). ering his views, the authority can disclose it (Secretary
The text of the act is available at General, Supreme Court of India v. Subhash Chandra Agar-
university/Legal/dokumentasie/access%20to%20informati wal, High Court of Delhi, January 12, 2010).
on.pdf. In some jurisdictions, tax records are publicly available.
Only Antigua and Barbuda and South Africa have adopt- For example, see Tietosuojavaltuutettu v. Satakunnan Mark-
ed laws that apply to private bodies in the protection of kinaprssi Oy, Satamedia Oy (2008), EUECJ C-73/07, De-
any right. cember 16; and Government of India (2009). Also see Ban-
See, for example, Sunday Times (2008). galore Mirror (2010); Luna Pla and Ros Granados (2010);
Guerra and Others v. Italy, 116/1996/735/932, February and Law et al. News (2010).
19, 1998. Nixon v. Warner Communications, Inc., 435 U.S. 589
See EPIC v. DHS (Suspension of Body Scanner Program), (1978); Richmond Newspapers Inc. v.Virginia, 448 U.S. 555 (1980). For a review of Australian law, see Australian Law
sion_of_body.html; EFF (2010); and public FOIA docu- Reform Commission (2008).
ments on spying in Washington, released by the American For example, the U.S. Court of Appeals for the District of
Civil Liberties Union, Columbia noted, The [U.S. FOIA] exemption . . . is phrased
uments. broadly to protect individuals from a wide range of embarrass-
Taxpayers Alliance is available at http://www.taxpayersal ing disclosures. As the materials here contain information re- garding marital status, legitimacy of children, identity of fathers
For salary disclosure in the United States, see Sunshine of children, medical condition, welfare payments, alcoholic
Review (2010). For salary disclosure in the United King- consumption, family fights, reputation, and so on (Rural
dom, see ICO (2009) and BBC News (2010). Housing Alliance v. USDA, 498 F.2d 73 [D.C. Cir. 1974]).
39 49
However, also see Chang v. Navy, Civil Action No. 00- See Social AuditsTracking Expenditures with Com-
0783 (D. D.C.). munities: The Mazdoor Kisan Shakti Sangathan (MKSS) in
Under European law, medical records are considered the India, available at
most sensitive records to be protected from release. For ex- public/documents/un/unpan024549.pdf.
ample, see Z v. Finland (1997) 25 EHRR 371, http://www. For example, see the Web site for the Department of Ru-,ECHR,,FIN,3ae6b71d0,0.html. ral Development of Indias Ministry of Rural Development,
For examples, see Djankov et al. (2009); World Bank
(2006); Peoples Union for Civil Liberties (PUCL) v. Union For example, see Consejo Nacional de Ciencia y Tec-
of. India (2003) 4 SCC 399; CPIO Supreme Court of Delhi nologa, Convocatorias becas en el pas 2009, http://www.
v. Subhash Chandra Agarwal, Delhi High Court, W.P. (C)
288/2009; Reid (2010); and CNN/IBN (2010). cas_Pais2009.aspx.
42 52
Von Hannover v. Germany (Application No. 59320/00), In Mexico, information that is already in the public do-
June 24, 2004. main is not considered confidential and cannot be withheld
Decision 60/1994 (XII, 24) AB. from request. In 2008, the European Court of Justice ruled
Endnotes 37

that a news service using tax information from a public reg- Department of Air Force v. Rose, 425 U.S. 352 (1976).
ister was exempt from the EU Data Protection Directive. Case 99168Mr. Richard Oakley, The Sunday Tribune
See Tietosuojavaltuutettu v. Satakunnan Markkinaprssi Oy, newspaper and the Office of the Houses of the Oireachtas,
Satamedia Oy (2008), EUECJ C-73/07, December 16. July 27, 1999,
The principles are available at http://legislation.knowl isineara/CinntiibhfoirmFhada/Name,1629,ga.htm.
71 For more information on the roles and activities of over-
Also see Stewart (2002). sight and appeals bodies, see Neuman (2009).
54 72
Los Angeles Police Department v. United Reporting Under Article 28(1) of European Union Directive 95/46/
Publishing Corp., 528 U.S. 32 (1999). EC, data protection commissions shall act with complete in-
See the European Transparency Initiative Web site, http:// dependence in exercising the functions entrusted to them. The European Court of Justice recently ruled, [t]he guar-
The few cases considering a private party attempting to antee of the independence of national supervisory author-
influence government policy typically find in favor of disclo- ities is intended to ensure the effectiveness and reliability of
sure, lacking countervailing concerns not present (EFF v. the supervision of compliance with the provisions on pro-
ODNI, 09-17235, February 9, 2010). Individuals are acting tection of individuals with regard to the processing of per-
in a public or representative capacity, and would have an ex- sonal data and must be interpreted in the light of that aim.
pectation that their details might be released to third parties It was established not to grant a special status to those au-
(Creekside Forum v. Information Commissioner and De- thorities themselves as well as their agents, but in order to
partment for Culture, Media, and Sport [2009] UKIT EA- strengthen the protection of individuals and bodies affected
2008-0065 [May 28]). by their decisions. It follows that, when carrying out their
Commission v. Bavarian Lager, Case C-28/08, June 29, duties, the supervisory authorities must act objectively and
2010. impartially. For that purpose, they must remain free from any
For example, see external influence, including the direct or indirect influence
ing/index_en.htm and of the State or the Lnder, and not of the influence only of
EUECJ cases C-92/09 and C-93/09, November 9, 2010. the supervised bodies (Case C-518/07, OJ May 1, 2010).
60 73
Testimony of Sir Richard Wilson before the Select Com- Access to Information Commissioner, Annual Report of
mittee on Public Administration, U.K. House of Commons, 199192, p. 16,
July 11, 2002. archive.aspx.
61 74
See Volker und Markus Schecke (EUECJ C-92/09, No- However, the task force did state that the current situation
vember 9, 2010, at 85): No automatic priority can be con- was acceptable and did not recommend a merger of the two
ferred on the objective of transparency over the right to bodies.
protection of personal data . . . even if important economic Remarks of the information commissioner of Canada to the
interests are at stake. Canadian Access and Privacy Association, October 28, 2003.
62 76
Canada (Information Commissioner) v. Canada (Com- Communication with Maeve McDonagh, April 2010.
missioner of RCMP), 2003 SCC 8, October 29, 2003. Communication with Elizabeth Dolan, Irish Information
Act No. LXIII of 1992, available at http://abiweb.obh. Commission, October 2010.
hu/dpc/index.php?menu=gyoker/relevant/national/1992_ Diario Oficial de la Federacin, June 11, 2002, http://ww
64 79
In Tanzania, a draft bill introduced by the government in Diario Oficial de la Federacin, January 12, 2011, http://d
2006 to address access to information, privacy, and media
rights was more than 85 pages in lengtha fact that led to For more information about the commission, visit http://
its not being considered.
65 81
Text of the act is available at Decision No. 090-59/2009/, July 9, 2009.
rsity/Legal/dokumentasie/access%20to%20information.pdf. See the list of pertinent cases at
Indonesian Act on Public Information Disclosure No. 14 dex.php?id=384.
of 2008. Decision No. 021-124/2008/12, December 19, 2008.
67 84
For public officials, this would be a general notice setting Decision No. 021-80/2005/6, November 2, 2005.
out that information collected in the course of their official Decision No. 090-94/2009, October 7, 2009. According
activities is not considered personal information that will be to the ruling, records had no direct connection with the
withheld. For private individuals, this area is more complex performance of the public function of the body.
because data protection rightsespecially relating to sensi- Treaty No. 108, 1981,
tive personal informationcannot simply be waived in ty/en/Treaties/Html/108.htm.
many cases. For example, see Scottish Information Commissioner
5 USC 552 (b)(6). (2010) concerning the decision that release of childhood
38 The Right to Information and Privacy: Balancing Rights and Managing Conflicts

leukemia statistics for a local area would violate the data 0035); Robin Makin v. Information Commissioner and
protection law. Ministry of Justice (EA/2008/0048); Creekside Forum v.
For a detailed analysis, see U.K. Ministry of Justice (2008). Information Commissioner and Department for Culture,
Corporate Officer of the House of Commons v. Informa- Media, and Sport (EA/2008/0065).
tion Commissioner and others [2008] EWHC 1084 (Admin). Department of Health v. IC (Additional Party: the Pro
Common Services Agency v. Scottish Information Com- Life Alliance) (EA/2008/0074).
missioner [2008] UKHL 47.
Alasdair Roberts v. Information Commissioner and De-
partment for Business, Innovation and Skills (EA/2009/
ABC News. 2009. Ombudsman Calls for
More Resources. November 2. http://w 2.stm. . 2010. Thousands of Whitehall Sal-
2/2730603.htm. aries Published. October 15. http://w
ACHPR (African Commission on Human
and Peoples Rights). 2002. Declaration 683.
of Principles on Freedom of Expression Calland, Richard, and Alison Tilley, eds. 2002.
in Africa. Banjul, The Gambia. http:// The Right to Know, the Right to Live: Access to Information & Socio-economic Justice. Cape
claration_freedom_exp_en.html. Town, South Africa: Open Democracy
Administrative Office of the U.S. Courts. Advice Centre.
2008. Judicial Conference Policy on Cannon, Andrew. 2004. Policies to Control
Privacy and Public Access to Electronic Electronic Access to Court Databases.
Case Files. March. http://www.uscour University of Technology, Sydney, Law Re- view 6: 3746.
cyPolicy/March2008RevisedPolicy.aspx. u/au/journals/UTSLRev/2004/3.html.
Australian Law Reform Commission. 2008. CNN/IBN. 2010. PM to Disclose Assets of
ForYour Information: Australian Privacy Law Cabinet Ministers. November 14. http:
and Practice. Report 108, 3 vols. Sydney, //
NSW. assets-of-cabinet-ministers/134964-37-
er/alrc/publications/reports/108/. 64.html?from=tn.
Bangalore Mirror. 2010. Taxmen Deluged Commonwealth Secretariat. 2002. Model
with Ex Files. September 23. Data Protection Act. London, UK. http:
Banisar, David. 2006. Freedom of Information //
Around the World 2006: A Global Survey of sp_files/uploadedfiles/{82BDA409-2C8
Access to Government Information Laws. Lon- 8-4AB5-9E32-797FE623DFB8}_prote
don, UK: Privacy International. http://w ction%20of%20privacy.pdf. Coronel, Sheila, ed. 2001. The Right to Know:
2006.pdf. Access to Information in Southeast Asia. Que-
BBC News. 2001. DTI Denies Smear Cam- zon City: Philippine Center for Inves-
paign Claims. January 8. tigative Journalism.

40 The Right to Information and Privacy: Balancing Rights and Managing Conflicts

Council of Europe. 1981. Convention for EFF (Electronic Frontier Foundation), 2010.
the Protection of Individuals with Re- EFF Posts Documents Detailing Law
gard to Automatic Processing of Personal Enforcement Collection of Data from
Data. European Treaty Series 108. Stras- Social Media Sites. Blog post, March 16.
bourg, France. http://conventions.coe.i
nt/treaty/en/treaties/html/108.htm. eff-posts-documents-detailing-law-enfo
. 1986. Recommendation 1037: On rcement.
Data Protection and Freedom of Infor- EO (European Ombudsman). 2007. Draft
mation. In Texts Adopted at the 2nd Part Recommendation to the European Par-
of the 38th Ordinary Session of the Parlia- liament in Complaint 3643/2005/(GK)
mentary Assembly, September 1986. Stras- WP. September 24. Strasbourg, France.
bourg, France.
CSA (Canadian Standards Association Inter- ommen/en/053643.htm.
national). 1996. Model Code for the EPIC/PI (Electronic Privacy Information
Protection of Personal Information. Center/Privacy International). 2007. Pri-
Toronto, Ontario. vacy and Human Rights 2006: An Interna-
Daily Mail. 2006. Anger as Police Obtain tional Survey of Privacy Laws and Develop-
Journalists Mobile Records to Discover ments. Washington, DC. http://www.pri
Source. December 1. http://www.daily France, Elizabeth. 1999. Third Report of
police-obtain-journalists-mobile-record 199899, Freedom of Information Draft
s-discover-source.html. Bill, vol. II: HC 570-II of 199899,
Djankov, Simeon, Rafael La Porta, Florencio memorandum 2. London, UK.
Lopez-de-Silanes, and Andrei Shleifer. Gentot, Michel. n.d. Access for Information
2009. Disclosure by Politicians. Work- and Protection of Personal Data. Com-
ing Paper 2009-60.Tuck School of Busi- mission Nationale de lInformatique et
ness at Dartmouth, Hanover, NH. http: des Liberts.
// nglish/infocentre/files/gentot-paper.doc.
tract_id=1334126. Government of Canada. 2002. Access to Infor-
EC (European Commission). 1995. Direc- mation: Making It Work for Canadians. Re-
tive 95/46/EC on the Protection of In- port of the Access to Information Review Task
dividuals with Regard to the Processing Force.Ottawa, Ontario. http://www.atirtf-
of Personal Data and on the Free Move-
ment of Such Data. Official Journal of the . 2009. Info Source Bulletin Num-
European Union L281: 3150. http://e ber 32B; Statistical Reporting. Statistical Tables 20082009, Access to Informa-
/index_en.htm. tion. Ottawa, Ontario.
ECOWAS (Economic Community of West
African States). 2008. Telecommunica- 32b/bulletin32b02-eng.asp#k.
tions Ministers Adopt Texts in Cyber Government of Canada, Office of the Priva-
Crime, Personal Data Protection. Press cy Commissioner. 2001. Privacy Com-
release 100/2008. missioner George Radwanski Writes to
References 41

Information Commissioner John Reid tion Annual Conference, University of

Regarding Prime Ministers Agendas Edinburgh, Scotland, April 916. http://
Case. News release, May 10. http://ww y/1/Habeas%20Data%20-%20An%20U
010510_e.asp. pdate%20on%20the%20Latin%20Amer
Government of Hungary, Parliamentary Com- ica%20Data%20Protection%20Constitu
missioner for Data Protection and Free- tional%20Right.pdf.
dom of Information. 1998a. Annual Re- Hencke, David. 2001. MP Challenges Se-
port 1998. Budapest. http://abiweb.ob crecy Culture. The Guardian, June 27.
98. 01/jun/27/
. 1998b. The First Three Years of the Hencke, David, and Rob Evans. 2002.
Parliamentary Commissioner for Data Ashcroft Memos May Spur Data Law
Protection and Freedom of Informa- Repeal. The Guardian, February 5. http://
tion. Annual reports 1991-96-97. Bu-
dapest. 5/uk.freedomofinformation.
x.php?menu=reports/1995. . 2003. Ashcroft Wins Apology over
Government of India, Central Information Political Vendetta. The Guardian, June 6.
Commission. 2009. Decision No. CIC/
LS/A/2009/000647/SG/5887. Decem- 03/jun/06/uk.conservatives.
ber 14. ICO (U.K. Information Commissioners Of-
ions/SG-14122009-32.pdf. fice). 2009. When Should Salaries Be
Government of Ireland, Department of Fi- Disclosed? Version 1, February 23.
nance. 2006. Data Protection and Free-
dom of Information in the Public Sec- ns/freedom_of_information/informatio
tor. Central Policy Unit, Notice No. 23. n_request/~/media/documents/library/
Dublin. Freedom_of_Information/Practical_app
docs/%22Important_new_data_protect lication/SALARY_DISCLOSURE.ashx.
ion_guidance_for_all_public_/411.htm. Irazbal, Alonso Lujambio, and Lina Ornelas
Government of Ireland, Information Commis- Nez. 2009. Personal Data Protection
sioner. 1999. Case 99168Mr. Richard by the Government: The Action of the
Oakley,The Sunday Tribune newspaper Federal Institute for Access to Public In-
and the Office of the Houses of the Oi- formation. Mexico City, Mexico: Insti-
reachtas. July 27. Dublin. http://www.o tuto Federal de Acceso a la Informacin y Proteccin de Datos.
er/LongFormDecisions/Name,1629,en. Knight Center for Journalism in the Ameri-
htm. cas. 2010. How Much Does Argentinas
Guadamuz, Andreas. 2001. Habeas Data: An President Spend on Ads? An NGO Fights
Update on the Latin America Data Pro- to Find Out. Journalism in the Americas
tection Constitutional Right. Paper news blog, March 26. http://knightcent
prepared for the 16th British and Irish
Law, Education and Technology Associa- 6772.
42 The Right to Information and Privacy: Balancing Rights and Managing Conflicts

Law et al. News. 2010. Information on Re- pdf/Public%20Access%20to%20Court%

ligion Cannot Be Obtained under RTI. 20Records%2012-11-02.pdf.
November 29. http://www.lawetalnew NZLC (New Zealand Law Commission). 2008. Public Registers: Review of the Law of
Law Reform Commission, New South Wales. Privacy, Stage 2. Report 101, January.
2010. Access to Personal Information. Wellington, New Zealand. http://www.l
Report 126. Sydney, Australia. http://ww cations/2008/02/Publication_129_391_
sf/pages/LRC_r126toc. Public_registers_web_72.pdf.
Leith, Philip, and Maeve McDonagh. 2009. OAS (Organization of American States). 2003.
New Technology and Researchers Ac- Access to Public Information: Strength-
cess to Court and Tribunal Information: ening Democracy. AG/RES. 1932 (XXX-
The Need for European Analysis Script- III-O/03) June 10. Washington, DC.
ed 6 (1/April).
Luna Pla, Issa, and Gabriela Ros Granados. 03/agres_1932.htm.
2010. Transparencia, Acceso a la Informacin OECD (Organisation for Economic Co-
Tributaria y el Secreto Fiscal. Desafos en operation and Development). 1980.
Mxico. Mexico City: Universidad Na- OECD Guidelines on the Protection of
cional Autnoma de Mxico. http://ww Privacy and Transborder Flows of Per- sonal Data. Paris, France. http://www.o
Majtnyi , Lszl. 2002. Freedom of Infor- 34255_1815186_1_1_1_1,00.html.
mation,The Hungarian Model. http://w Organization of Eastern Caribbean States. 2004. Privacy Bill. Proposed draft. http:
p/2232/maitenyi.pdf. //
McDonagh, Maeve. 2006. Freedom of Informa- lic/documents/TASF/UNPAN024634.
tion Law in Ireland. 2nd ed. Dublin: pdf.
Round Hall Sweet & Maxwell. Pirc Musar, Natasa. 2006. New Principles of
Mendel,Toby. 2008. Freedom of Information: A the Amended Act on Access to Public In-
Comparative Legal Survey. 2nd ed. Paris, formation in Slovenia: Commissioner or
France: United Nations Educational, Sci- Ombudsman. Ljubljana, Slovenia. http://
entific, and Cultural Organization.
Neuman, Laura. 2009. Enforcement Mod- df/konference/Novosti_ZDIJZ_Manch
els: Content and Context. Access to In- ester_ang.pdf.
formation Working Paper Series. Wash- . 2010. How to Strike the Right
ington, DC: World Bank. http://siteres Balance between Freedom of Informa- tion and Personal Data Protection: Using
esources/LNEumanATI.pdf. a Public Interest Test. PhD diss., Leiden
NJSBA (New Jersey State Bar Association). University, The Netherlands.
2002. Privacy and Electronic Access to Reid,Tyrone. 2010. Crusade Against Secre-
Court Records in New Jersey. Decem- cyPublic Barred from Viewing Finan-
ber 11. cial Disclosures of Elected Officials. Ja-
References 43

maica Gleaner. November 14. http://jama Information: Conflicting Principles or Complementary Rights? Paper present-
d/lead1.html. ed at the 24th International Conference
Scottish Information Commissioner. 2009. of Data Protection and Privacy Commis-
Decision Notice: Decision 115/2007, sioners, Cardiff, Wales, September 911.
Mr. Joseph Millbank and Dundee City
Council. St. Andrews. http://www.its entre/speech_200210911.html. The Times of India. 2010. RTI Helps Poor
cision115-2007.pdf. Diamond Polishers Get Back Cancelled
. 2010. Decision Notice: Decision BPL Cards. August 24. http://timesof
21/2005, Mr. Michael Collie and the
Common Services Agency for the Scot- helps-poor-diamond-polishers-get-back
tish Health Service. St. Andrews. http: -cancelled-BPL-cards/articleshow/6428
// 102.cms.
dedFiles/Decision021-2005.pdf. U.K. Home Office. 1999. Freedom of In-
Sheridan. Gavin. 2010. Department of Arts, formation: Preparation of Draft Legisla-
Sport and Tourism Expenses Database. tion: Background Material. May. Lon-
The Story, March 12. http://thestory.i don. http://www.publications.parliame
atabase/. dm/570/57007.htm.
Slane, Bruce. 2002. Freedom of Information U.K. Ministry of Justice. 2008. Freedom of
and Privacy: Competing Interests with Information Guidance: Exemptions Guid-
Complementary Aims. Paper prepared ance, Section 40-Personal Information.
for the International Symposium on Free- May 14. London.
dom of Information and Privacy, Auck- uk/about/docs/foi-exemption-s40.pdf.
land, New Zealand, March 28. . 2009. Freedom of Information Act
Solove, Daniel J., and Paul Schwartz. 2008. 2000. Fourth Annual Report on the Op-
Information Privacy Law. 3rd ed. New eration of the FOI Act in Central Gov-
York: Aspen Publishers. ernment 2008. June. London. http://w
Stewart, Blair. 2002. Public Register Provi-
sionsAddressing Privacy Issues. Paper on-annual-report-2008.pdf.
prepared for the International Symposium . 2010. Freedom of Information Act
on Freedom of Information and Privacy, 2000. 2009 Annual Statistics on Imple-
Auckland, New Zealand, March 28. mentation in Central Government.
Sunday Times. 2008. Couple Stung by April 29. London. http://www.justice.go
100,000 Secret Loan. December 7. UN (United Nations). 1948. Universal Dec-
/uk/article5299156.ece. laration of Human Rights. New York.
Sunshine Review. 2010. Public Employee
Salary. r/index.shtml.
x.php/Public_employee_salary. UN General Assembly. 1990. Guidelines for
Tang, Raymond. 2002. Data Protection, the Regulation of Computerized Person-
Freedom of Expression and Freedom of al Data Files A/RES/45/95, December
44 The Right to Information and Privacy: Balancing Rights and Managing Conflicts

14. New York. U.S. Department of Justice, Office of Infor-

uments/ga/res/45/a45r095.htm. mation Policy. 2010. Summary of Annu-
UN Human Rights Committee. 1988. Cov- al FOIA Reports for Fiscal Year 2009.
enant on Civil and Political Rights Gen- Washington, DC. http://www.justice.go
eral Comment 16 (Article 17:The Right v/oip/foiapost/2010foiapost18.htm.
to Respect of Privacy, Family, Home and Waters, Nigel. 2002. Privacy Exemptions in
Correspondence, and Protection of Ho- FOI LawsAn Unnecessary Barrier to
nour and Reputation), April 8. http:// Accountability Paper prepared for the International Symposium on Freedom of
mm_16.php. Information and Privacy, Auckland, New
UN Human Rights Council. 2009. Report Zealand, March 28.
of the Special Rapporteur on the Pro- Working Party on the Protection of Individ-
motion and Protection of Human Rights uals with Regard to the Processing of
and Fundamental Freedoms While Coun- Personal Data. 1999. Opinion No. 3/99
teringTerrorism.A/HRC/13/37. Decem- on Public Sector Information and the
ber 28. Protection of Personal Data. May 3.
lish/bodies/hrcouncil/docs/13session/A Brussels, Belgium.
-HRC-13-37.pdf. justice/policies/privacy/docs/wpdocs/1
U.S. Department of Health, Education, and 999/wp20en.pdf.
Welfare. 1973. Records, Computers and World Bank. 2006. Income & Asset Disclo-
the Rights of Citizens: Report of the Sec- sure Requirements for Heads of State
retarys Advisory Committee on Auto- and Governments, World Bank Client
mated Personal Data Systems July, 1973. Countries. Washington, DC. http://site
Washington, DC.
DATACNCL/1973privacy/tocpreface INST/Resources/IncomeAssetDisclosur
members.htm. einWBClientsasofJune62006.pdf.
About the World Bank Institutes Governance Practice
Governance is one of seven priority themes in the World Bank Institutes recently launched renewal strate-
gya strategy that responds to client demand for peer-to-peer learning by grounding WBIs work in the dis-
tillation and dissemination of practitioner experiences. The Institute is committed to building knowledge and
capacity on the how to of governance reforms, with emphasis on supporting and sustaining multistake-
holder engagement in bringing about such reforms.

WBIs Governance Practice works with partners, including networks of country and regional institutions, to
develop and replicate customized learning programs. Its programmatic approach aims at building multistake-
holder coalitions and in creating collaborative platforms and peer networks for knowledge exchange.

For further information:

The World Bank
1818 H Street, NW
Washington, DC 20433
Fax: 202-522-1492

Visit us on the web at:

Photo Credit: (Front Cover)