Red tape

Dark times on the Wirral, as confidential memos about web filtering fly around, suggesting skullduggery on the corridors of Council power. The headlines are remarkable: “Confidential memo tells shocked Wirral councillors their emails are being read by town hall bosses“, which would be quite a thing if it was true. Following the receipt of offensive emails about Hillsborough, the Chief Executive of Wirral Council suggested that the Council could filter the emails out so that councillors would not receive them. The opposition members worked themselves up into a lather, with one, Councillor Chris Blakeley, declaring: “I think it is outrageous that the council should determine which emails we should receive”. Another, Councillor Lesley Rennie opined “My colleagues and I are absolutely appalled that there could have even been a suggestion that emails from the public could be considered for filtering“.

At the risk of starting another barney in the comments, I don’t think the Council was suggesting anything inappropriate. Whatever you think of Wirral Council (feel free not to tell me), I think it’s likely that the Council was simply offering to block offensive emails, rather than making decisions about which emails Councillors receive. The Chief Executive stated that he had received complaints about the emails, so clearly felt that some kind of response was required. As feelings across Merseyside are still understandably raw over Hillsborough, even if the Council response was inelegant, I can see why the offer was made.

However, the Councillors’ reaction and some of the comments on the Wirral Globe’s story (the commenter ‘2040TIM’ sounds like he knows what he’s talking about), raise an interesting question that I suspect many councils and most councillors have not considered. If you are not a Data Protection nerd or a dedicated council watcher, look away now.

Councillors wear up to three hats in the normal course of their activities. As participants in Council Committees and decision-making, they are part of the Council. For Data Protection purposes, they are covered by the Council’s DP notification and any incident or breach involving them would be the Council’s problem. Hat number 2 comes with membership of a political party. They may sometimes receive personal data from their party for campaigning purposes. In this scenario, the party is responsible for Data Protection. The strangest hat is the one they wear as constituency representatives. Here, neither the council nor the party is responsible. The Councillor is a Data Controller in their own right.

Much of the controversy about Councillors and Data Protection revolves around the technical issue of notification (still often called ‘registration’, despite that term belonging to the 1984 Act), and in particular who pays for it. Some councillors notify, some don’t. One Wirral blogger was told by a councillor that notification was ‘a load of tosh‘, which is an odd way for an elected representative to describe a legal requirement. Some councils pay for all of their councillor’s notifications, some don’t. However, despite the fact that numerous councillors across the UK remain without a notification, and despite the fact that the ICO has prosecuted estate agents, bar owners, solicitors and hairdressers for non-notification, no councillor in the UK has ever been prosecuted for non-notification.

The reason for this is probably that by prosecuting an errant elected member, the ICO would be crossing Eric Pickles, the Secretary of State for Communities and Local Government and an opponent of the ‘red tape’ that member notification represents. In 2011, Pickles told Conservative Home that notification for members was a ‘tax on volunteering’. In 2013, he proposed amending the DPA to exempt parish and town councillors from notification altogether (which is a good idea) and allowing councils to make a single payment for all Councillors’ notifications, which is unnecessary given that since the middle of the last decade, the ICO has accepted notification forms for all of a council’s members in one go with a single payment. I know this, because I used to do the notifications for my council’s members.

But this is all a red herring. Notification is an administrative tick-box. Under the 1984 Act, if you processed data electronically, you were covered by the Act and you had to register. If you didn’t process data electronically, you didn’t have to register and you didn’t have to comply. Under the 1998 Act, you have to comply regardless of whether you notify. If you’re exempt from notification, you still have to comply with all other aspects of the 1998 Act. If you refuse to notify, you’re committing an offence, but you still have to comply with all other aspects of the 1998 Act.

Just before Christmas, another Northern Council – Craven Council in the Yorkshire Dales – had a councillor / Data Protection controversy. The Council proposed rolling out iPads to its elected members as part of an upgrade to its IT security. Some councillors objected, and one Independent member was reported as offering “to sign up as his own data handler“, in other words, he was offering to notify as a data controller in order to avoid having the iPad. And so we come to the punchline. The Councillor was already a Data Controller whether he liked it or not. All councillors have to ensure that they are compliant with the DPA for the areas not covered by the Council or their party. Notification – and who pays the £35 – is just about the least significant aspect of this process.

For one thing, Councillors are Data Controllers for any equipment, any email account, any electronic system that they use to communicate with their constituents. The Council is their Data Processor in this context. Buried deep in the back of the Data Protection Act are surprisingly specific requirements for the relationship between a Data Controller and Data Processor – there must be a contract made or evidenced in writing, security guarantees given by the processor (the Council) to the Controller (the Councillor), and a reasonable check that the contract is being complied with. In other words, if the Wirral Councillors up in arms about what may or not be happening to their emails have not obtained a written contract from Wirral, ensuring that Wirral will act only on their instructions when handling their constituency correspondence, the Councillors are in breach of the Data Protection Act. The Council – as a data processor – is not.

It goes further. Councillors should clearly inform their constituents about the way in which their data is used. They should respond to subject access requests. The Wirral Councillors are upset about what they believe is happening to their Wirral.gov.uk email addresses, but many Councillors use Hotmail or Yahoo mail for constituency business, or at the very least have all of their Council emails auto-forwarded to an outside account. This carries both security risks that might breach the 7th DP principle, but also raises the spectre of the 8th Principle, which governs how to transfer information outside the European Economic Area (many web-based email providers use servers outside Europe).

Many senior Council officers and IT and DP specialists will weep at the thought, and I can think of one or two who will give me a smack for bringing it up. But Councils cannot dictate to their Councillors. It is clearly logical for Councillors to use systems and kit provided to them by the Council, but ultimately, they are responsible for a big slice of the data that they use as part of their work and it’s their decision. The Council is a processor, a service provider. Sticking with the robust corporate system is a reasonable idea, but they can work outside of it and if they do, Councillors are wholly responsible for what happens. In the meantime, any Councillor planning to kick up a fuss about emails or iPads or anything else should remember that if something goes wrong, the Council has a get-out-of-jail-free card for non-Council business. Perhaps they should be more shocked about that.

Bad planning

A couple of weeks ago, the journalist Heather Brooke tweeted the following in respect of myself and another person:

Really, you two are starting to sound a little like trolls. Do I lurk on your feed & make continuous snide remarks? No

She doesn’t quite call me a snide, lurking troll but we’re close. If “innocent face”  is enough to get Lord MacAlpine going, then associating me with trolls (example: Frank Zimmerman, the man who threatened Louise Mensch and her kids ) is surely murky territory. Could I argue that Brooke’s comments tend to lower me in the estimation of right-thinking members of society generally or would be likely to affect a person adversely in the estimation of reasonable people generally? Brooke is the hero of the MPs expenses case, the respected journalist and authority on FOI, the esteemed tutor of the next generation of journalists. I am just a tawdry freelancing consultant. Isn’t it possible that people might well give her comments credence because of her status as a respectable public figure?

So can I sue her for libel?

Of course not, it wasn’t libel. Brooke has a low opinion of me and these weekly mentions on my blog will probably only make it worse, but she is entitled to say I’m a troll. She can say worse things and has every right to. She said it’s a shame I’m not a journalist, so maybe she already has. Brooke expressed a negative opinion about the fact that I fired critical responses to some of her tweets in quick succession. The question of whether I was simply disagreeing with her (my version) or deliberately misunderstanding her point (her version) depends on your perspective – you’re obviously free to see it her way, and given our respective respectability, you probably will. I don’t agree with her accusation, but my objection doesn’t make it libel. She didn’t accuse me of training the BNP, teaching people in how to breach the DPA and get away with it, or bribing officials to get training contracts. I haven’t done these things, and I would sue anyone who said that I did. Free speech protects our legitimate opinions even if they offend other people. However, it shouldn’t allow us to say anything, especially if anything is an unfounded accusation of a crime.

All this is by way of introduction to a doubtless unwelcome and unpopular contribution to the depressing resolution of the libel battle between the redoubtable blogger Jacqui Thompson and Mark James, Chief Executive of Carmarthenshire Council . Doubtless I will be accused of backing Team Goliath for not simply foaming at the mouth in outrage, but I cannot say my reaction is the same as most of the comments I have seen.

Much of the background to the case is like a riposte to my own defences of public sector workers. The idea that councils might fund or back libel actions for their staff in any circumstances is a disgrace. Public money is for public services, and if an officer is libelled and cannot afford to defend their reputation, they must blame our legal system or cruel fate. If Carmarthenshire’s Chief Executive accepted public funds to defend his personal reputation – even though this might have been entirely legal – he should pay the money back, as he can afford his own defence.

Moreover, all senior council officers must have a thick skin. I once dealt with a senior officer who did not want his salary disclosed because of fears his children would be bullied in the playground. He earned more than £100,000 per annum, and he was talking bollocks. Every front-line officer gets abuse from time to time and they just plough on, letting it wash over them. If you are not prepared to be called crap, incompetent, idiotic, stupid, moronic, selfish, or cowardly, whether it’s fair or unfair, you are not fit for management in local (or central) government, the Police, NHS, Fire or the rest of the public sector. Suck it up; it’s part of the job.

The most eye-catching element of the case is still troubling. Public meetings should be public places. Any restriction on filming, recording, tweeting or reporting of proceedings held in public by any person for any reason is an affront to democracy. I would include the courts in this (with necessary protections for witnesses and victims). No part of the UK, and no UK institution no matter how large or small should seek to restrict access to public proceedings, no matter what the circumstances. Any organisation that attempts to restrict coverage of public meetings – whether by professional journalists or by amateur bloggers – must be prevented from doing so. Any amount of blather from Eric Pickles disguises the fact that he has done nothing formal to protect those wanting to film or report council and other similar proceedings.

And finally, calling the police because a person is filming a public meeting and refusing to stop is ridiculous. From a purely tactical perspective in the Carmarthenshire case, it was disastrous. The people who called the police have forever ensured that this case will always be the innocent ‘armchair auditor’ against the overweening, something-to-hide establishment. Mark James won his case, but in the court of public opinion, he and his council will forever be associated with the image of an ordinary taxpayer being led away simply for wanting to report the truth, and they deserve nothing else for their poor judgement in making that image happen.

But free speech is not dead. The arrest of Jacqui Thompson for filming a public meeting is a free speech issue, and I entirely agree with her stand on that. However, this libel case was launched by Thompson and not the council. Ultimately it is about accusations of corruption versus claims of intimidation. If you haven’t read the full judgement and are going off the headlines, you should read it objectively now before you pontificate (I didn’t and I deleted tweets as a result). If you really can’t bear it, this detailed story in the Western Mail (HT: @NewsatTwm on Twitter) is very strong.

The daft arrest isn’t the decisive issue. Thompson sued Mark James, the Chief Executive, because he published a letter accusing her and her family of conducting a campaign of harassment and intimidation against council officers. James counter-sued for comments that Thompson made on her blog about perjury, dishonesty and corruption. If Thompson could justify her allegations of corruption, the comments on her blog and her actions in the Council chamber would be vindicated, and James’ comments about the campaign would probably be libellous. However, without anything concrete to back up the corruption claims, the position is reversed. If Thompson made serious and repeated accusations without evidence, she has libelled James and potentially others. No matter how outrageous the arrest was, it does not prove that anyone is guilty of corruption, or justify statements that cannot be verified. Thompson’s libel action against James is not made one tiny bit stronger by the unfairness of her arrest, and it was not an opportunity for her to be recompensed for the unfairness of that arrest. No amount of capsule sermonising from Nick Cohen changes this.

Even the sympathetic Broken Barnet coverage of the case acknowledged that Thompson “has perhaps made errors of judgement in some of the comments made in some of her posts” . But isn’t it more than that? In 2006, Thompson accused James and a planning officer of corruption and was sued by the latter for libel. She lost, and had to retract her comments and apologise in court – paragraphs 6 and 7 of the judgment – as well as agreeing to pay £7500 in costs (costs she later argued should be borne by the Council, a suggestion that I think is outrageous). Thompson made no attempt to prove that any of her allegations of corruption were true and defended herself solely on “honest comment”. Every decision and comment I have found on this defence include a variation on this quote: the comment “must explicitly or implicitly indicate, at least in general terms, the facts on which it is based”. You cannot accuse someone of corruption without something concrete to back it up.

So consider paragraph 299 from the current judgement:

Mrs Thompson did not, when sued by Mr Bowen, attempt to prove that the allegation of corruption she made against him was true. She has never attempted to prove in court that Mr Bowen was corrupt. A defamatory publication for which there is no defence is unlawful. She accepts that she cannot prove that. She accepted during the trial that the HMCS letter bearing the Council’s stamps does not prove that the Council made any payment in respect of Mr Bowen’s libel action, and does not prove that he or Mr James, or anyone else lied or committed perjury.

At this point, I’m out. I can’t support Thompson if this is true. Corruption isn’t just a label you apply to those who you disagree with. Even if the corruption seems painfully obvious to you through experience of beating your head against a brick wall of bureaucratic numbskullery, impenetrable decisions, and people who just seem to have it in for you. Even with all that, corruption is not a loose or metaphorical word. Accusing someone of corruption is accusing them of a crime – taking or accepting bribes, committing acts of misconduct in public office, or perpetrating fraud. This is corruption. Unhappy FOI and Data Protection applicants, bloggers, letter writers and Local Government Ombudsman complainants throw around words like corruption and conspiracy as if all they need to justify their use is a deeply held conviction. Whatever the outcome of Jacqui Thompson’s libel case had been, flinging these words around is an abuse of free speech at best. The outcome of the case shows that the courts agree.

If accused of a crime, you are innocent until proven guilty. Evidence is weighed and sifted, and an objective decision made by a court. Journalists and bloggers can play a vital role in digging up evidence of crimes, in bringing them to public attention, and forcing the hand of the police and the CPS, but ultimately, it is the courts and not the commentators who make the decision of guilt. Without evidence, your strongest conviction is worth nothing and if you cannot keep it to yourself, you risk the wrong end of a libel suit. And now we see what that’s like.

Local newspaper journalism is dying; like most people, I believe that the internet including many enthusiastic bloggers will end up replacing it entirely. But Thompson Vs James must not be misrepresented as a threat to this. In her statement on the case, Thompson said this: “I believe this judgement has dire consequences for others who publicly scrutinise and criticise their local authority, including the press”.  I completely disagree with her. Nobody should feel that this case prevents them from scrutinising, criticising, mocking, or commenting on public affairs in the strongest possible terms. Get out there. Show why the decisions are shoddy, find the links between politicians and dodgy business, seek out the fraudsters, the hucksters and the bigots where they exist and show them for what they are.

But – and it’s a big but – do not accuse someone of criminal activity without something concrete. I don’t want to live in a society where allegations of criminality are made without being substantiated – that’s not free speech, it’s a witch-hunt. Nothing about this case puts the decision-makers and politicians in Carmarthenshire County Council in anything but a dire light, but I’m not paranoid enough to believe that Thompson was stitched up by the Establishment. She made accusations she couldn’t ultimately substantiate – even if they were true, she couldn’t prove it to the satisfaction of a judge. If she appeals and proves her claims to be true, refuting the idea that her campaign was illegitimate, I’ll be in a long queue to congratulate her. But she cannot win her appeal on the basis that the daft arrest was daft, or illiberal, or wrong. It was all of those things, but two wrongs do not make a right.

And if you want to call me an arsehole (guilty), a vile corporate stooge, a council apologist, a scumbag enemy of free speech, a self-hating blogger or even a wannabe journalist (not guilty), the comments section is below.

Cambridge in Thermal Image Sex Shocker

Important privacy news reaches us, hot from the virtual presses of Cambridge-news.co.uk:  http://tinyurl.com/3vbjlgz . The council is sponsoring a plan for surveyors to tour the Cambridge area, using thermal imaging cameras to take pictures of houses. Those that are revealed to have poor insulation will be asked if they want a visit from experts who will assist them in improving the situation, and as part of the process, homeowners will be shown the thermal image of their property.
Some people will resent the idea of the council touring the streets, taking day-glo photos of residents’ homes. They could conceivably record images that may embarrass or annoy. However, Councillor Sarah Brown, an elected member who lacks nothing in imagination, has wider fears. Should amorous residents of the area be engaged in passionate relations, emitting copious body heat near the windows, their activities will be recorded.
Councillor Brown is concerned at the potential problems should the participants not be man and wife. The scheduled visit of the home insulation police could rapidly degenerate into the revelation of extra-marital affairs. You can just picture the scene: “Marjorie, what were you doing in the garage with those three men?” Or perhaps “Colin, can you explain why you are silhouetted in the front bedroom with a Rhinoceros?” OK, Councillor Brown didn’t come up with anything that specific, but I’m only following her lead.
The website has one of those wonderful news headlines at which the Daily Express is so adept: “Will thermal images catch love cheats?”. Erm, no. The company running the scheme are clear-cut in demolishing this idea, stating that the sensors cannot see through glass, and if a person was visible, they would appear only as a blur. Perhaps influenced by this, the rest of the website’s coverage is balanced and fair, concentrating on reporting the opposing views of the debate’s participants. Any hack worth their salt would at least have embellished the thermal image illustration on the story with a mocked-up image of saturnalian goings-on in the lounge. They don’t even make anything of the fact that the Council’s principal scientific officer is a Mr Dicks.
Nevertheless, despite the fact that there appears to be no real privacy worry at all, I think Councillor Brown deserves points for creativity. The average councillor tends to just find some fly-tipping or dodgy paving, and then gets themselves photographed in front of it looking cross. But no, here we have sex, invasions of privacy, domestic turmoil, and even the possibility that incriminating pictures will be sent to the wrong address and thus the infidelity broadcast to the neighbourhood in an array of strange colours. If you’re going to make a mountain out of a molehill, this is how to do it in style. So, 10/10 for technique.
My only other observation is that the story does contain the popular nugget, cited by the council in its defence, that lots of other local authorities have already signed up. In my experience, this might simply mean that they’re all wrong. But nevertheless, one can hope that if Councillor Brown’s concerns are shared in other places, they are offered a more firm reassurance than this somewhat equivocal quote from the Councillor with lead responsibility for housing: “I can’t offer you a 100 per cent guarantee but I’m reasonably confident and data protection is something I care about, and I’m reasonably confident we should be OK
So that’s OK then.