Freedom of Information - Considerations for University Management

At VWV, we are seeing increasing numbers of queries about universities' obligations in response to freedom of information requests to disclose datasets and to permit their re-use.

The recent trend seems to be directed at detailed management information. This raises three main considerations for university management:

• in the context of management information, what constitutes a 'dataset'
   
• how to handle releasing and permitting re-use of factual information that may be of doubtful accuracy
   
• to what extent must the dataset be published on, and licensed via, its website

The legislation

In 2013 the Protection of Freedoms Act 2012 (POFA) widened the remit of the Freedom of Information Act 2000 (FOIA) and introduced a requirement for universities to disclose certain datasets. Where requesters previously only had a right to access information, the new rights allow requesters to request data in a re-usable format, and to re-use for commercial processes.

What is a dataset?

The FOIA defines a dataset as a collection of information held in electronic form, where all or most of the information:

• is obtained or recorded for providing the university with information in connection with its services and/or functions
   
• is factual information (meaning it has not been analysed or interpreted and is not an official statistic)
   
• has not been organised, adapted or otherwise materially altered (except for the purpose of forming part of the collection) since it was obtained or recorded

University management may find it useful to employ the following systematic approach when looking at what constitutes a dataset.

Step 1: is it recorded for providing the university with information in connection with the provision of its services and/or functions? These services and functions relate to the purpose of and reasons for the university’s existence and go beyond teaching and research to cover, for example, employment, disciplinary and pastoral functions.

Step 2: is the information factual information? It can sometimes be difficult to decide whether or not particular information is ‘factual’ – see the example below. There is no definition in the FOIA and the Explanatory Note to the statute gives no further guidance. The ICO’s guidance suggests that information that cannot be 'measured or compared in an objective way' will not constitute 'factual information'. Thus, information that is a textual explanation of someone’s opinion would not be ‘factual’ – although the fact that s/he holds that opinion might be, depending on how it is recorded and in what context. If opinion or other text data is capable of identifying living individuals, then the usual provisions of the FOIA in relation to releasing personal data apply, and breach of the Data Protection Act rights of individuals must be avoided.

Step 2a: factual information must not be 'the product of analysis or interpretation other than calculation', suggesting that the information is limited to 'raw' or 'source' data, rather than value-added data.

A further consideration in relation to datasets that contain unverified information is the accuracy of that information. Whilst releasing it may be unavoidable, it is likely that the consequences of re-use of factual information that could be incorrect may be a decisive factor in relation to withholding permission for re-use.

Step 3: has the information been organised, adapted or otherwise materially altered (except for the purpose of forming part of the collection) since it was obtained or recorded? The FOIA suggests that the information ought to be presented in the manner in which it was originally collected.

Steps 2a and 3 have been considered by the ICO and the Information Tribunal. The requester asked for specified reports to be created from a research database held by the university. She argued that the university either had staff with the requisite skills to pull those reports or could engage a suitable expert to do so. In a series of appeals relating to the same matter, the Information Tribunal held that the university was not obliged to analyse its database (ie the request failed 2a) or to create reports that did not exist (ie it also failed 3).

Scenario

A university conducts a course feedback survey for its Economics course to assess course quality and identify any gaps. It collects this information in a database. The database contains the course dates, the date of the feedback, and a tick box exercise showing the likelihood of students recommending the course. All the information contained within the database would be considered to be factual. This would likely mean the database as a whole would constitute a dataset, provided the other criteria are satisfied.

However, if the survey also provided columns for free text comments on, for example the course content, this information would be unlikely to be factual as a significant element of subjectivity would be introduced. The university would then have to assess whether 'most ' of the information in the survey results was factual in order to decide whether or not it was a dataset. If the bulk of the information was in the free text fields, then it is unlikely that this would be a dataset.

Key obligations

Where a dataset is to be disclosed, there are three basic obligations to satisfy:

• Re-use
  The information contained in the dataset, so far as reasonably practicable must be disclosed in a re-usable format. The ICO’s view is that this means the information must be provided in an electronic, machine-readable form which uses open, rather than proprietary standards. So .csv files would be acceptable but Excel spreadsheets would not. Factors to consider concerning whether it is reasonably practicable, according to the ICO, include time, cost and resources.
   
• Licensing
  Any dataset containing copyright material where the authority is the copyright owner must be made available for re-use under a specified licence. It is possible for universities to charge a licence fee but this is limited to ‘a reasonable return on investment'.
  Clearly, what is seen as reasonable will depend on the context, and as yet there has not been any reported case to help understand what will be acceptable. It does raise issues such as whether any diminished ability by the university to generate commercial income from licensing that information may be taken into account.
   
• Publication
  Where a dataset has been provided in response to a FOIA request, the university will also have to consider whether it is obliged to make it available on its website under its FOIA publication scheme.

Best practice

This is a developing area of the law and where there are any questions about whether or not to release, publish and licence a dataset, it will be sensible to obtain up-to-date advice.

One practical tip is worth bearing in mind, given the extent of these obligations: when deciding to collect information and hold it in electronic form, consideration should be given as to whether what is being created will bring it within the definition of an FOIA-able dataset. If so, the consequences of doing so should be considered.

This article was first published in the June 2016 issue of University Business.

For more information, please complete the form below.