UK: Freedom of Information and Blogging: A Potentially Dangerous Mix?

The Freedom of Information Act 2000 ("FOIA") gives people access to information held by public authorities which in many instances they could not previously access. Blogging gives people a publishing power they did not previously have. From commercial and legal perspectives, their combination may make for a potentially dangerous mix. Blogs which at least track Freedom of Information Act requests, such as the "UK FOIA Requests" blog (http://www.spy.org.uk/foia/), are already springing up and, going by the US experience, it would come as little surprise to find bloggers posting copies of documents obtained under FOIA to their blogs. In the fervour surrounding both the Act's coming into force and blogging's power to the people, it may be easy to lose sight of the fact that existing copyright and other legal protections have not fallen away. This article notes some of the risks facing originators of sensitive information supplied to public authorities and bloggers who obtain and choose to publish it.

FOIA came fully into force on 1 January 2005. Any person requesting information from a public authority now has a statutory right to be informed whether the information is held (the so-called duty to confirm or deny) and, if it is held, to have the information communicated to him or her, unless one of the Act’s many exemptions to disclosure applies. Last year the Department for Constitutional Affairs was estimating that 100,000 or so public authorities would be subject to the Act. Requests can be made by individuals, companies, non-UK citizens and even people living abroad. Information is defined broadly to mean information recorded in any form.

We can expect FOIA to be used by, among others, journalists, consumers, animal rights activists, companies and political parties. There is little limit on the types of information that will be requested. Exemptions may apply to prevent the disclosure of certain information, but in many instances that will not stop the requests being made because there are likely to be finely balanced questions as to whether, in the case of the qualified exemptions to disclosure, the public interest in retention is trumped by the public interest in disclosure. And even in the case of the absolute exemption for confidential information, it might be argued that there is such an overwhelming public interest in disclosure that the common law public interest defence to an action for breach of confidence would apply to defeat the application of that exemption. Moreover, some requestors may use FOIA for strategic or political reasons, even if they expect their requests to be refused. They may choose to publicise the fact that they have made requests, which in itself may put pressure on either the public authorities concerned or companies whose commercially sensitive information held by those authorities is the subject of requests.

One obvious consequence of FOIA is the potential release of confidential or otherwise commercially sensitive information. We know from overseas experience that freedom of information legislation is commonly used not only by companies trying to obtain information on their competitors but also by potential claimants to court proceedings. They may endeavour to get their hands on case-relevant documentation from public authorities, either for actions against the authorities themselves or for actions against corporate defendants who have been obliged to file sensitive information with those authorities. This prospect raises a number of practical issues which companies who stand to be affected by FOIA will want to consider. Those issues include taking steps to protect confidential documents and ensuring that, as a minimum, consultation takes place before any release.

Beyond these immediate practical issues, there is a potentially greater practical issue which is raised by the coincidentally timed explosion of blogging and webfeed technology. Without getting into the detail, a blog is simply a type of website which anyone with rudimentary computer skills and an internet connection can set up. Adding new content to a blog is, more or less, child's play.

Significantly so far as the distribution of content is concerned, most blogging applications also automatically create webfeeds. Webfeeds come in various flavours but the most common reference one sees is to RSS feeds. They are simply electronic files residing on a server which can be read from, among other things, a programme called a news aggregator or news reader. When a blog or other website with an automated webfeed is updated, so is the webfeed, which enables anyone subscribing to the feed to learn of the updates through their aggregator/reader, automatically, without checking the site itself. The significance of webfeeds is that they enable automatic, extremely fast and potentially global distribution and syndication of content posted to the internet.

One can immediately see how a blog could be used to publish, to the world at large, commercially sensitive information obtained under FOIA, with potentially significant economic or other consequences for the originator of the information. The important thing for both bloggers and originators to understand, however, is that the release of information under FOIA does not necessarily make that information fair game to be used in any way the recipient sees fit. This is something which print media, online media and many seasoned web administrators will appreciate but which grassroots bloggers may well not.

In many instances there will be little or no impediment to a recipient reproducing governmental information or commenting on (as opposed to directly copying) other information obtained under FOIA on his or her blog. But there are at least two things a would-be blogger cannot do or may not be able to do without the risk of legal action.

The first thing a blogger should not do is reproduce and post to a blog copies of documents obtained under FOIA which are subject to third party copyright. Posting a PDF copy of an obtained document to a blog may be the easiest way of sharing the information but if that document is subject to copyright then the acts of copying and posting without the originator's consent will in all likelihood constitute infringement. Although a public authority's copying of such documents for the purpose of complying with an information request does not constitute copyright infringement, the statutory provision which protects the public authority does not protect the recipient.

The second thing a blogger should not do, at least not before considering certain legal questions, is post FOIA-obtained documents or relevant portions of them which are defamatory of a person or company. Again, although a public authority's release of such documents under FOIA does not expose the authority to an action for defamation (unless the documents were released with malice), the authority's statutory protection does not apply to the recipient. Questions of separate defences to an action for defamation may arise, but that's a separate issue.

Originators of copyright material supplied to public authorities can take steps to minimise the risk of copying and posting to blogs (or other websites) by marking their documents with copyright notices, not because such notices are required to preserve copyright but because many people do not understand copyright laws and may innocently break them. Originators can also ask the relevant public authorities to inform recipients that the documents are subject to copyright. In cases where an originator knows the identity of requestors, those requestors could be directly notified that the documents sought are subject to copyright.

Similarly, if a person or company is aware that a public authority holds defamatory material which might be disclosed under FOIA, the public authority can be informed that that person or company considers the material to be defamatory, be asked to consult that person or company before releasing it, and even be asked to inform recipients that that person or company considers the material to be defamatory. And again, if the identity of particular recipients is known, they could be contacted directly.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.