Does my briefing look big in this?

On his blog, David Higgerson, the journalist and Digital Publishing director for Trinity Mirror, reports an interesting case from Hackney Council. Rebecca Helmsley made an FOI request to the Council via What Do They Know about the death of a person in a children’s home in the 1980s. During the process, Hackney accidentally appended the wrong document to an email, so instead of providing a proper FOI response, they send Helmsley a short research report into her interests and activities. Hackney apologised and explained that they gather information about FOI applicants’ “research interests” so that they can provide “additional context to an FOI response, hopefully adding to its intrinsic value“.

The definition of personal data is always under debate. The waters have been muddied for ten years by the Durant Case, which found that for data to be covered by the Data Protection Act, it had to be ‘biographically significant‘. This allowed some organisations to take a robust approach to DP, especially when responding to subject access requests. We don’t have to give them this, it’s not biographically significant. I have personally never done this and have little time for anyone who has.

*Harry Hill sideways glance to camera*

Even if you don’t think that a person’s research interests, websites they visit and FOI requests they make are biographically significant, the Durant judgement has been largely and sensibly set aside by the Edem judgement this year, which says that biographical significance is a test only applicable in borderline cases. Post-Edem, the Hackney data is definitely personal data because it identifies a person and distinguishes them from other applicants. I actually think that the level of detail in Hackney’s briefing on Helmsley is biographically significant anyway, but even if it’s not, the briefing was created after the law on this matter was clarified. It’s personal data.

Data Protection’s first principle requires at least three things to justify processing data – the use of personal data must be lawful, fair and according to a set of conditions. For the sake of brevity, I’m going to assume that profiling the research interests of an applicant is lawful because of the methods Hackney say they use to do it (i.e. they used publicly available sources, meaning no breach of privacy or confidentiality was involved).

Fairness can mean a number of things but it always means telling the applicant that their data is being processed unless there is an exemption. The ICO also allows for a measure of ‘reasonable expectations’, where if a data processor is doing something obvious in context, fair processing is not required. There remains a vigourous debate about whether it is reasonable for a public body to share the names of FOI applicants outside the FOI team / officer / person who does FOI alongside eight other things. I think it’s healthier for an organisation’s FOI person to keep applicants’ identities secret from their colleagues unless they fear the request is vexatious etc, but I don’t think it’s a breach of DP and reasonable expectations may possibly apply. But your identity and your research interests are two different things. I am certain that Hackney (and any other organisation that researches its FOI applicants) should inform the applicants that they are doing it.

The third element of the puzzle is the condition, which is fundamentally the question of whether the processing is actually allowed. If you have consent, a contractual obligation, a legal obligation or a legal power, or the need to protect the data subject’s vital interests (any of them), you can use the data. Without that, the Council has to fall back on legitimate interests, a condition which requires them to establish that it is “necessary” for them to create the briefing, that they have a legitimate purpose for doing so, and that doing so does not cause unwarranted harm to the applicant’s interests. Knowing who your applicant is and why they’re asking is, in my view, legitimate. As long as the applicant gets the information they have requested (and any refusal they receive is the same that anyone else would receive), I see no unwarranted harm. However, is it necessary?

I’ll leave that hanging in the air because frankly, it isn’t my problem. If an FOI public authority think that this kind of thing is necessary, that’s for them to decide. But I have no hesitation in saying that personal data is being processed, the Data Protection Act applies, and the least that any organisation that profiles its applicants (even if only their research interests) needs to do is inform those applicants that they are doing so. There is no exemption. If you want to know whether Helmsley reasonably expected this to happen, scroll to the end of her request on What Do They Know.

The worst thing about the perception of DP is the way in which people feel that, once it applies, the use of personal data is forbidden. It is not. The use of personal data is simply regulated by common sense principles, the most common sense of all being that the use of data in secret should be the exception. Hackney say that they are creating these briefings to provide a better service. Good for them. As Higgerson points out, some organisations are more concerned with the PR fallout of an FOI disclosure. I am not ashamed to say that as an FOI officer, I would often tell the PR team (who, of course, outnumbered me) about disclosures to the press and others. They never tried to influence what we disclosed, and they had a job to do. Even if this kind of thing is done purely for the purposes of news management, I am not arguing that the DPA prevents that. I am simply convinced that an organisation that wants to research its FOI applicants has to be transparent about the fact that they are doing so.

Comments

  1. I wonder about Mr Higgerson’s employer’s take on openness and transparency.

    http://wirralinittogether.wordpress.com/2014/04/25/wirral-council-leaders-register-of-gifts-and-hospitality-looks-suspect/

  2. Is there anybody who you don’t suspect of something?

    • Yes. Plenty. But those I do suspect usually warrant and deserve it.

      • How many of your suspicions have been proven independently (i.e. independent of you)?

      • Ha. I’m a Joe public blogger, not a multi-millionaire, untouched by the antics of Chris Grayling sadly.

        Here’s one example I’ll put to you which probably won’t constitute “proof”. You could say my suspicions about English councils’ liberal use of compromise agreements used to gag those in dispute and protect reputations received some validation and seem to be borne out here…

        http://www.telegraph.co.uk/news/9967901/14m-bill-for-gagging-axed-public-officials.html

        The later involvement of the NAO and some subsequent hearings in Parliament then added further weight to those suspicions.

        I’m avoiding any use of the word “proven”.

        Incidentally, the “bill” as they like to term it would dwarf the £14 million stated in the article.

        Will this do?

      • If you’re avoiding any use of the word ‘proven’, then it’s a ‘no’, isn’t it?

      • My first sentence addresses that nonsense.

      • I’ve always preferred ‘innocent until proven guilty’ to ‘guilty because I think they are’.

      • Me too, the distinction being I don’t liberally slur, grandstand or cast pointless innuendo for effect.

        What’s beyond reasonable doubt here is I’m dealing with an intellect that’s either damaged, traumatised or not quite fully-formed.

      • Insulting the person you disagree with is a good indication of how strong you think your argument is.

        You came to my blog in order to draw attention to the fact that Mr Higgerson’s employer does not print the news about Wirral that you think it should be printing. Either this was a completely random point, or it was an attempt to undermine what he had to say via a form of guilt by association, despite the lack of any proof that Trinity Mirror’s news values are in any way inappropriate. Whether this constitutes a slur, grandstanding or pointless innuendo is something that I think most intellects of whatever kind will be capable of assessing. I have no doubt about Mr Higgerson’s authority to speak on FOI matters, or his integrity in doing so. I doubt you have anything approaching evidence of anything else.

      • If blog posts needed “proof” to be somehow valid or qualifying they’d die tomorrow. Have you ever posted anything you haven’t got “proof” for? Of course you have. You do it every time you put your fingers on the keyboard.

        Anyway, how high are you setting the bar?

        In order that I can qualify for your blog in the future, what standard of “proof” are you demanding?

        o Beyond reasonable doubt (criminal) or;
        o Balance of probablilities (civil)

        Do tell TT.

      • If you expect other people to take you seriously, I think you need something more than strongly held opinion.

        But that’s just my opinion.

  3. Ruth kennedy says:

    There is also the much more minor but still, I think, important Q of whether spending officer time compiling such reports is a good use of increasingly scarce local authority (tax payers’) money!

    • I hadn’t thought of that. It’s a very good point.

    • Thank you for repeating that point, Ruth. As a Hackney Council tax payer myself, I don’t think it is a minor point at all and that’s one of the reasons I alerted David Higgerson to this issue in the first place. Last year the London Borough of Hackney cited Section 12(1) of the FOIA (which allows a public authority to refuse to comply with a request for information where the cost of compliance is estimated to exceed a set limit known as the appropriate limit) as grounds for why it could refuse to comply with a request from Rebecca Helmsley for information. I am curious whether the expenditure to produce these applicant profiles is being met from a general departmental budget or is subtracted from the applicant’s “appropriate limit”?

      I appreciate your observations, Tim, that Hackney has an obligation to inform applicants that personal data is being processed, that the Data Protection Act applies, and the least that any organisation that profiles its applicants (even if only their research interests) needs to do is to inform those applicants that they are doing so. To date, to the best of my knowledge, Hackney Council has failed to do so.

      However, Tim, I would be interested in hearing how you reconcile the ICO’s demand that requests be handled “applicant blind and motive blind” with your argument: “Knowing who your applicant is and why they’re asking is, in my view, legitimate. As long as the applicant gets the information they have requested (and any refusal they receive is the same that anyone else would receive), I see no unwarranted harm.”

      Rebecca Helmsley’s requests may lack some sophistication but I don’t agree with critics (passim) who have accused her of adopting an adversarial position. She is merely one in a long line of frustrated people who have tried and, to date, failed to expose the truth about “Trottergate” within the ranks of Hackney Council and Hackney Labour Party.

  4. Thanks for your comment. I think it’s simplistic to see ‘applicant blind’ as a rule that always applies. A request can be refused because to answer it would go over the cost limit, and that cost limit doesn’t just apply to a single request. It applies to any request received on the same topic from the same person within a period of 60 working days. This is not applicant blind. Moreover, the vexatious provision – routinely and inaccurately described as applying to the request and not the person making it – cannot be applicant blind. If Hackney had received vexatious requests from an applicant before, it would be able to look at who was asking to see whether it fitted into a vexatious pattern. Finally (and I accept that this is controversial), I don’t think it’s illegitimate for the organisation to look at who is asking to try to anticipate what will happen once they disclose, as long as they don’t spin or alter the disclosure itself.

    Aside from costs and vexatious, what must not happen is an applicant getting a different answer because of who they are. That is insupportable, which is why I said above, looking at identity is OK as long as “the applicant gets the information they have requested (and any refusal they receive is the same that anyone else would receive)”. It would be impossible for an organisation to factor in the cost of profiling their applicants in the cost limit. That’s an extra cost that they would have to justify in a different way. Even if I think it’s legitimate (i.e. I don’t think it’s illegal), I don’t think it’s a wise use of resources.

  5. However, my opinion is freely offered and nothing whatsoever depends on how it’s received and the reaction of those receiving it. Unlike yours (and David Higgerson’s (being salaried)) which are coloured at best, contaminated at worst.

    http://wirralinittogether.wordpress.com/2014/03/05/it-pays-well-to-train-councils-in-information-governance-dp-foi-ripa/

    Luckily, being retired, my fortunes won’t be relying upon the good will of basket case organisations squandering public money, unlike some of your ilk.

    • Of course. You are free to keep sharing unproven allegations.

      I would point out that I am a freelance and have no salary but as you’ve already decided that I am contaminated, I guess that makes no difference.

Trackbacks

  1. […] and David has also provided a further piece for the Guardian here. Tim Turner also wrote an interesting piece examining the basis for the profiling under the […]

%d bloggers like this: