Head in the Sandbox

The Information Commissioner’s Office recently held a workshop about their proposed Regulatory Sandbox. The idea of the sandbox is that organisations can come to the ICO with new proposals in order to test out their lawfulness in a safe environment. The hoped-for outcome is that products and services that are at the same time innovative and compliant will emerge.

There is no mention of a sandbox process in the GDPR or the DPA 2018. There is a formal mechanism for controllers to consult the ICO about new ideas that carry high risk (prior consultation) but the circumstances where that happens are prescribed. It’s more about managing risk than getting headlines. Unlike Data Protection Impact Assessments, prior consultation or certification, the design and operation of the sandbox is entirely within the ICO’s control. It is important to know who is having an influence its development, especially as the sandbox approach is not without risk.

Although Mrs Denham is not above eye-catching enforcement when it suits her, the ICO is often risk averse, and has shown little appetite for challenging business models. For example, the UK’s vibrant data broking market – which is fundamentally opaque and therefore unlawful – has rarely been challenged by Wilmslow, especially not the bigger players. They often get treated as stakeholders. The sandbox could make this worse – big organisations will come with their money-making wheezes, and it’s hard to imagine that ICO staff will want to tell them that they can’t do what they want. The sandbox could leave the ICO implicated, having approved or not prevented dodgy practices to avoid the awkwardness of saying no.

Even if you disagree with me about these risks, it’s surely a good thing that the ICO is transparent about who is having an influence on the process. So I made an FOI request to the ICO, requesting the names and companies or organisations of those who attended the meeting. As is tradition, they replied on the 20th working day to refuse to tell me. According to Wilmslow, disclosure of the attendees’ identities is exempt for four different reasons. Transparency will prejudice the ICO’s ability to carry out its regulatory functions, disclosure of the names of the attendees is a breach of data protection, revealing the names of the organisations will cause them commercial damage, and finally, the information was supplied with an expectation of confidentiality, and so disclosure will breach that duty.

These claims are outrageous. DPIAs and prior disclosure exist, underpinned both by the law and by European Data Protection Board guidance. Despite the obvious benefits of developing a formal GDPR certification process (both allowing controllers to have their processing assessed, and the creation of a new industry at a time when the UK needs all the economic activity it can get), the ICO’s position on certification is supremely arrogant: “The ICO has no plans to accredit certification bodies or carry out certification at this time“. A process set out in detail in the GDPR is shunned, with the ICO choosing instead to spend huge amounts of time and money on a pet project which has no legal basis. Certification could spread expertise across the UK; the sandbox will inevitably be limited to preferred stakeholders. If they’re hiding the identities of those who show up to the workshop, it’s hard to imagine that the actual process will be any more transparent.

The ICO’s arguments about commercial prejudice under S43 of FOI are amateurish: “To disclose that a company has sent delegates to the event may in itself indicate to the wider sector and therefore potential competitors that they are in development of, or in the planning stages of a new innovative product which involves personal data“. A vital principle of FOI is that when using a prejudice-based exemption, you need to show cause and effect. Disclosure will or will be likely to lead to the harm described. How on earth could a company lose money, or become less competitive, purely because it was revealed that they attended an ICO event (which is what using S43 means)?

The ICO’s personal data and confidentiality arguments are equally weak – everyone who attended the meeting would know the identities of everyone else, and all were acting in an official or commercial capacity. This was not a secret or private meeting about a specific project; anyone with an interest was able to apply to attend. Revealing their attendance is not unfair, and there is plainly a legitimate interest in knowing who the ICO is talking to about a project into which the office is putting significant resources, and which will have an impact on products or services that may affect millions of people. The determination to hide this basic information and avoid scrutiny of the sandbox process undermines the credibility of the project itself, and makes the ICO’s claim to be an effective defender of public sector transparency ever more hypocritical.

Worst of all, if disclosure of the attendees’ identity was the calamity for commercial sensitivity and personal data that the ICO claims it to be, there should be an immediate and thorough investigation of how the information I requested came to be revealed on the ICO’s website and twitter account. The entire event was recorded and a promotional video was released. Several attendees (whose names and companies I cannot be given because of confidentiality, data protection and commercial prejudice) are identified and interviewed on camera, while there are numerous shots of other attendees who are clearly identifiable. Either the ICO has betrayed the confidentiality and personal data rights of these people, putting their companies at direct commercial risk, or their FOI response is a cack-handed attempt to avoid legitimate scrutiny. Either way, I strongly recommend that the left hand and the right hand in Wilmslow make some rudimentary attempts to get to know one another.

Long ago, I was one of a number of online commentators described by the ICO’s comms people as a ‘driver of negative sentiment’. More recently, one of Denham’s more dedicated apologists accused me of being one of the regulator’s “adversaries”. I’m not a fan of the ICO, and I never have been. But this stinks. The determination to throw every conceivable exemption at a simple request to know who the ICO is talking to suggests that the office is afraid of scrutiny, afraid of having to justify what they’re doing and how they’re doing it. The incompetence of refusing to give me information that is on display on their website and Twitter account shows contempt for their obligations as an FOI regulator. The ICO has its head in the sand; as we drift out of the European mainstream into a lonely future on the fringes, their secrecy and incompetence should be matters of concern for anyone who cares about Data Protection.

Bad Policy

On July 19th 2018, Linda McKee made a simple (but admirably polite) FOI request to the Information Commissioner’s Office. McKee asked for a copy of the ICO’s special categories policy document, a requirement of the Data Protection Act 2018 when processing special categories data in certain circumstances. The DPA was passed in early May 2018, but the requirement for special categories policies had been known since the DP Bill was published in September 2017. Policy documents were not required under the previous DP regime, and having run training courses on both the Bill and the Act, I can confirm that many people in the sector were keen to see real life examples of a policy document. McKee’s request made a lot of sense.

On 17 August (maintaining the ICO’s flawless record of replying to FOIs at the last minute), Wilmslow responded. They confirmed that a policy document was held, but as there was a clear intention to publish the policy document in the future, they refused to disclose it. This seemed a bit daft to me; Section 22 of FOI is designed to protect the organisation from early publication of information. The revelation of the ICO’s special categories policy would hardly cause ripples throughout the sector. Staff would not have been diverted from their normal jobs to deal with the torrent of press attention its release would provoke. They should have coughed it up and moved on.

McKee asked for an internal review, and at this point, the Commissioner headed determinedly the wrong way. There is no fixed time limit for an internal review, which is a flaw in the legislation but nevertheless not something that the organisation should exploit, and the ICO dragged it out for MONTHS. I have to be honest, I didn’t really pay attention, aside from using the ICO’s inability to release a relatively simple document as a gag on my DPA courses. Towards the end of 2018, I checked back in on McKee’s woes, to see an interesting suggestion on the What Do They Know thread. It seemed that when the ICO replied in August, the policy hadn’t actually been finalised.

I couldn’t quite believe this, so over Christmas, I made an FOI request to clear the matter up. I asked whether the policy was held in a final approved form when the ICO replied to McKee in August, for any recorded information about whether the ICO should actually have replied that the policy was not held (because it was not finished), and for a summary of why the ICO refused the request.

And here, a brief interlude to consider a section of the FOI Act that has tantalised FOI experts for years without resolution. Section 77 makes it a criminal offence for the organisation to alter, deface, block, erase, destroy or conceal any record held by it with a view to frustrate its disclosure. So if I am working for a public authority and I pretend that a record isn’t held in order to prevent an FOI punter from receiving it, I have committed an offence. If the organisation conspires in this, the organisation can itself be prosecuted by the Commissioner.

Back to my request to the ICO. They replied (once again, remarkably close to the 20 day deadline), and told me two interesting things. First, in answer to my question about whether the policy was held in a final approved form: “The policy was not held in final approved form“. Second, any recorded information about whether any data held constituted the requested information, or whether the ICO should in fact responded that the information was not held: “We do not hold recorded information. As you will be aware the Freedom of Information Act only covers recorded information held by a public authority. However, it may help you to know that there was a verbal discussion in regard to the response to this Freedom of Information request.” So, there was a verbal discussion that people plainly remember, and the ICO thinks it might help me to know this, without even a squeak about what the discussion was about. Thanks, Wilmslow, consider me unenlightened.

I believe that the ICO’s response to McKee’s request is untrue. The correct answer to her request is ‘no information held’, with advice and assistance that the data was in draft. Section 22 applies where the requested information exists but the organisation intends to publish it unchanged in the future; the ICO’s policy wasn’t complete. Look at what McKee asked for all those months ago: she asked for “your Policy designed to show compliance with Schedule 1, Part 4 of DPA 2018“. An incomplete, unapproved policy plainly does not answer the request, and the ICO should have confirmed that. The use of the exemption was a dishonest dodge to avoid admitting the truth.

If the ICO had a policy and pretended that they did not, under Section 77 it would have been a criminal offence for them to conceal its existence once it had been requested. As it happens, the ICO did the opposite – pretending that the information existed and refusing to give it out because it would be published in the future, rather than admitting that several months after the DPA was passed, the policy was not complete. Whoever decided that this was the right approach should think long and hard about a transparency regulator taking such a cynical attitude to legislation they are supposed to uphold and protect.

While QE2 tries to grab the headlines, demanding that FOI be extended to cover new organisations, her own house is far from being in order. The lack of FOI enforcement against recalcitrant and secretive government departments is an ongoing stain on the ICO’s reputation, while the lazy cynicism and lack of frankness over the office’s own activities suggests that the ICO can talk the talk, but walking the walk is beyond them. Regular readers of this blog are probably inured to my lack of faith in House Wycliffe, but for all Denham’s chasing of headlines, day to day experience of how the ICO carries out the most mundane of its functions suggests carelessness and disarray. Rather than trumpeting the press releases about extending FOI to charities and commercial bodies, more people should ask whether the ICO is capable of doing even those tasks it already has.

Regulating the FOIA into obscurity?

This is a guest post from the redoubtable John Slater, whose tireless efforts to hold DWP to account are a lesson in how FOI should be used. John has had real success in wrestling information out of a stubborn and secretive system, but the post describes the hurdles in the way of the applicant, and the shameful way in which the ICO makes things worse. It’s not a quick read but there’s a lot to say. I think anyone with an interest in how the benefits system operates, or how healthy the FOI system is at the moment should give it the time it deserves. I’m very grateful to John for writing it and letting me host it.

I suspect that most people reading this have experience of submitting a request for information (“RFI”) under the FOIA and all the frustrations that can come with it. Some people may have complained to the office of the Information Commissioner (“ICO”) while others may have just given up when their RFI was refused. I suspect that a smaller number of people, who had the time, appealed ICO decisions to the First-Tier and Upper Tribunals.

Via my involvement with the FOIA I have been dealing with the ICO for approximately 6 years. My interaction has ranged from normal FOIA complaints through to appeals to the First-Tier and Upper Tribunals.

Setting aside the minor issues one typically experiences with any large organization I have to say that my experience of dealing with the ICO has been very positive. Even when a decision notice (“DN”) went against me I could understand why and how that decision was reached. In respect of appeals to the First-Tier and Upper Tribunals I have nothing but praise for the people involved, even when I was appealing an ICO decision.

However, approximately 18 months ago things started to change for the worse. The time taken to respond to complaints seems to be inexorably increasing and the quality of the case work is deteriorating. I’ll use 3 of my current complaints to illustrate the problems that I and others are experiencing on a regular basis.

Case 1 – Universal Credit Programme Board Information Packs

In July 2017 I asked the DWP for the 3 most recent packs of information that were given to the Universal Credit (“UC”) Programme Board members at each monthly meeting. Given how controversial UC is and the history of the DWP being less than honest about it, this seemed to be a good route to try to find out what the senior people responsible for UC actually know and what they are doing about it.

For those not familiar with programme management terminology the programme board consists of senior people who are accountable and responsible for the UC programme, defining the direction of the programme and establishing frameworks to achieve its objectives. So apart from Neil Couling (senior responsible owner) and the secretary of state they are about as senior as it gets. The membership of the programme board can be found here:

https://www.whatdotheyknow.com/request/419990/response/1090823/attach/html/2/3044%20IR%20516%20IR%20604%20reply.pdf.html

Unsurprisingly the DWP refused my RFI on 16 August 2017 citing S.36. However it explained that it needed an extension to carry out the public interest test (“PIT”). On 14 September 2017 the DWP did exactly the same thing. This is a tactic that the DWP uses regularly and often issues monthly PIT extensions until the ICO becomes involved.

I complained to the ICO on 14 September 2017. On 22 November a DN was issued giving the DWP 35 calendar days to issue its response. On 3 January 2018 the DWP finally confirmed that it was engaging S.36 and that the public interest did not favour disclosure (I’ve yet to see a public interest test from the DWP that does favour disclosure). I submitted a revised complaint to the ICO on 9 January 2018 challenging S.36 and the public interest decision.

Despite the 5 month delay by the DWP the ICO bizarrely told me that I still had to exhaust the DWP internal review procedure before my complaint could be investigated. I had submitted 4 internal review requests (“IRR”) during the 5 months that the DWP treated the FOIA with such contempt. I know from previous experience that the DWP would use the same PIT ‘trick’ to delay answering my IRR. I explained this to the ICO and asserted that it has the authority to proceed without me having to submit another IRR. On 30 January the ICO accepted my complaint. I know about this from experience but I assume most people would have followed the ICO instruction and been stuck in another loop of 5 months until the DWP was told to issue its response to the IRR.

On 26 April my case was assigned to a case officer, just 3 months short of a year since I submitted my request to the DWP. Despite the DWP clearly citing S.36 the ICO allowed the DWP to get away with numerous delaying tactics and nothing happened for many months. Despite chasing the ICO on a number of occasions there appeared to be no progress. My patience ran out in October 2018 and I complained to the ICO about this and two other cases. On the face of it this appeared to have got things moving.

However, on 18 October 2018 I was told by the ICO that an information notice had been served on the DWP to obtain copies of the information I had requested. The DWP has 30 days to respond to these notices.

Whilst I’m not surprised by this (in fact I even suggested this was the case in my complaint) I struggle to understand how any organisation can investigate a complaint for almost 6 months without having a copy of the requested information. I can only hope that the DN I have been seeking for so long will appear at some point in 2018!

The delay has been so long that I have actually submitted another request for more current programme board packs. At the time of writing the DWP hasn’t provided a response within 20 days so that’s another complaint that I need to send to the ICO!

Case 2 – Aggregation of various RFIs

Between 4 February and 23 April 2018 the DWP aggregated 9 of my requests for information claiming that they were for the “same or similar” information. Well, what it actually said was:

We consider each of the seven requests to be of a similar nature as they all relate to either decision making or performance delivery of disability assessments on behalf of the Department for Work and Pensions.  In particular, all of the requests would be allocated to the same team for response as it falls within their specialised area. 

Under Section 12 of the FOI Act the Department is not therefore obliged to comply with your request and we will not be processing it further.

This seems to suggest that the DWP believes the requested information is the same or similar because they relate to activities it carries out and the teams that do them. This is a crude attempt to rely on the discredited concept of ‘overarching themes’ that was attempted in Benson v IC and the Governing Body of Buckinghamshire New University (EA20110016).  At [29] the Tribunal stated:

Whilst the Tribunal understood the Commissioner’s analysis the Tribunal felt that it was not compelling and relied on concepts that were not actually within the legislation – e.g. ‘overarching theme’. The Tribunal felt that any consequent uncertainty should, on balance, be resolved in the Appellant’s favour.

On 30 March I submitted a complaint to the ICO. My complaint involves 9 requests and deals with an important area of the FOIA, where there is very little precedent. A reasonable person might conclude that the ICO would be keen to act swiftly. On 27 April 2018 my complaint was assigned to a case officer so things were looking good. It is now coming towards the end of October and I have not had a single piece of correspondence from the ICO.

The requests that have been aggregated cover management information about how the DWP runs large controversial contracts that assess the eligibility for employment support allowance and personal independence payment (“PIP”). A previous RFI uncovered numerous problems with the quality of medical reports being produced for PIP assessments. This might explain why the DWP is so keen not to let me have the current information but not why there has been no progress by the ICO.

Case 3 – Datasets & Type of Data Held for Various Benefits About Claimants

On 26 February 2018 I asked the DWP to disclose the datasets and type of data it holds about various social security benefits. I am not asking for the actual data just the type of data and the “groups” or “sets” of data that it holds.

On 17 April 2018 the DWP refused my request citing S.31 (it eventually confirmed it meant section 31(1)(a))  and  S.24. After a further IRR the DWP reconfirmed its position and I complained to the ICO on 15 July. Some 3 months later on 11 October I was finally told that my case had been assigned to a case officer. Does this now mean I wait for a further 6 months before anything actually happens?

Conclusion

I know the ICO is very busy, partially due to the new Data Protection legislation, but the problems that I and others are experiencing can’t just be explained by “being busy”. Based on my previous experience of dealing with them I also don’t believe it is the fault of the case officers. These problems are due to serious organisational failings within the ICO. There doesn’t seem to be the type of business processes / workflow that one would expect to see in an organisation of this size. The line management oversight of case officers appears to be absent. Based on my own experience it seems to be that the line managers focus solely on protecting case officers while actually making matters worse for them as their workloads probably grow faster than they can cope with.

The ICO should have a small set of metrics about how it is dealing with cases. Surely line managers should be looking at cases where nothing has actually happened for 6 months and do something about it? The idea of management by exception has been around for a long time and yet I’m left with the impression that there are no exceptions set within the ICO and senior management have no impartial way of knowing what is actually going on at the case level.

People might wonder why this matters and that in these times of constrained budgets we should expect cases to take longer. I can’t accept this as one of the key drivers for the FOIA is that we get a chance to hold public authorities to account for their actions. For that to happen we need access to information while it is still relatively current.

It is generally known that there are certain large government departments that have very poor history in respect of FOIA. If someone requests information that these departments suspect will be embarrassing they will deliberately play the system to delay disclosure. From personal experience it’s all far too easy to do:

  1. Ignore the request completely until the ICO tells the department to respond (3+ months).
  2. Use the public interest test with impunity to introduce a 5 to 6 month delay before the requester can complain to the ICO about the exemption cited.
  3. 3 months before a case officer is assigned.
  4. At least 3 to 6 months before a DN is issued.

Total possible delay = 14 to 18 months.

The department can then appeal the DN to the First-Tier Tribunal (“FTT”), even if there is little chance of success. I’ve had 2 cases recently that have been appealed and then withdrawn just before the FTT hearing was due to take place. This added another 6 month delay let alone the cost to the public purse. If the DWP had actually gone through with the appeals and lost then that delay would probably be closer to 9 to 12 months.

This means that “playing the system” allows disreputable government departments to delay disclosure of embarrassing information by at least 2 years. Any media interest in the information can then be met with the claim that it is now ‘historical’ and things are better now.

A good example of this is the Project Assessment Review Reports (“PARs”) for the Universal Credit programme. I asked the DWP for these in April 2016 (see URL below):

https://www.whatdotheyknow.com/request/universal_credit_programme_proje#comment-82746

Using the delaying tactics described above and making the ICO issue an information notice to compel the DWP to release the PARs to them, they weren’t disclosed until March 2018. That’s a 2 year delay.

The ICO needs to sort out the internal delays that these government departments seem to be relying on. They also need to make sure there are meaningful consequences for public authorities that “play the system”. Writing strongly worded DNs telling public authorities off for abusing the system is meaningless. The ICO was highly critical of the DWP in its DN for the PARs case. A link to the DN is given below and the criticisms start at [62].

https://ico.org.uk/media/action-weve-taken/decision-notices/2017/2014762/fs50640285.pdf

The criticism has had absolutely no impact on the DWP.  It still regularly doesn’t reply in time and still produces “boilerplate” responses that have little bearing on the case in question.

As a result of the new GDPR and Facebook the Information Commissioner regularly seems to be in the media and was recently named as the most influential person in data-driven business in the updated DataIQ 100 list. I hear talk of the Commissioner being able to issue huge fines for data breaches and serving enforcement notices on organisations that are not complying with the FOIA.

The original white paper “your right to know” stated at [1.1]:

Unnecessary secrecy in Government leads to arrogance in government and defective decision-making. The perception of excess secrecy has become a corrosive influence in the decline of public confidence. Moreover, the climate of public opinion has changed; people expect much greater openness and accountability from government than they used to.”

If public authorities continue to be allowed to easily introduce delays of 2 years before disclosure then the regulator of the FOIA is failing in her role.  Before the FOIA we only had the thirty-year rule (now moving to the twenty-year rule) controlling when information was released to the public.

I suggest that we are rapidly approaching the situation where by default we have the “two-year rule” for information government departments do not want released. Unless the Commissioner does something about it that will slowly increase to the “three-year rule” and then the “four-year rule”. From my perspective its time the Commissioner stopped boasting about all the powers she has and started using them.

Checks and balances

A while ago, I was asked by a prospective client to provide a criminal records check before getting a big piece of work. Given that I wouldn’t be handling any personal data or getting access to children or other vulnerable people, it seemed like overkill. The awkward part of me wanted to suggest that the requirement was close to being an enforced subject access request, which would be a criminal breach of Data Protection law. Enforced subject access requests occur where a person is obliged to provide a data controller with the result of a subject access request for criminal records in return for employment or a service.

Then I looked at the number of days’ work they were offering and the pragmatic part of me kicked in. I don’t have a criminal record, so I applied for and sent them a disclosure certificate saying so. It occurred to me that if I tried to make an issue of principle out of it, it might look like I had something to hide. I imagine it’s a terrible situation to be in if you have got a record and are trying to move on, but to be selfish, I don’t and it seemed odd to create the impression that I might have. And I wanted the work.

Last week, a prosecution by the Information Commissioner against the insurance company Hiscox for the enforced subject access offence collapsed. A customer, Irfan Hussain, was attempting to claim on a £30,000 watch he had lost, and Hiscox wanted to see his criminal record before paying out. He refused, and complained to the ICO. The case collapsed when the unlucky horologist was too unwell to give evidence.

I can’t help thinking that this was an odd choice for a prosecution. Even if Hiscox tried to force their customer to provide his information, was this unreasonable? He had already stated that he had no criminal record (according to the FT), so all Hiscox were apparently asking him to do was prove that what he had said was true in the light of his claim. The means by which they proposed to do it might technically have been an enforced subject access request, but there’s surely a difference between something technically being an offence and it being worth mounting a prosecution on it. The provisions contain a public interest defence, and Hiscox’s public comments after the trial suggest that this was their strategy. I suspect it might have worked. Especially as this seems to be the ICO’s first attempt at an enforced subject access case, was this really the best place to start?

The business of criminal records checks overall works in mysterious ways. Hiscox are reported to have asked Mr Hussain to make a subject access request to the Criminal Records Office, which is run by the National Police Chief’s Council. This is not the same as applying to the Disclosure and Barring Service or Disclosure Scotland for a certificate or a disclosure, but having been through the process, I have to admit that I am somewhat confused at the difference.

To get my disclosure, I made a written application, proved my identity and then paid a fee to receive a copy of personal data that related to me, or confirmation that no such information was held. The basic check comes through faster than a subject access request (about 2 weeks, although mine came in matter of a few days) but it’s also more expensive (£25). In my case, nothing was held but that’s neither here or there. There is statutory provision for access to this information via the Criminal Records Bureau set out in the Police Act 1997, replaced by the Disclosure and Barring Service in 2006 via the Safeguarding Vulnerable Groups Act 2006. Someone is going to tell me that applying for a certificate is different to applying for subject access, but that raises some questions. If Hiscox had told Mr Hussain to apply for a certificate like I did, it’s exactly the same outcome – a person is obliged by a data controller to obtain information about their criminal history and then cough it up – but if it’s not subject access, no prosecution could be possible.

An individual can obtain a basic check that shows their unspent convictions and cautions, both of which are listed as a relevant record in the DPA section that creates enforced subject access. The ICO’s guidance doesn’t explain the position if a person was forced to ask for a basic check. That check might not give everything that a data controller might want, but it’s full information about a person’s recent criminal history. If obliging someone to ask for a basic check isn’t enforced subject access, it’s a loophole. But if a basic check is essentially a subject access request by another name, it shouldn’t be £25 now, and it should be free after May 25th.

It’s clear that the DBS doesn’t think that forcing an individual to ask for a basic check would be enforced subject access or illegal in some other way because their website says this:

You can’t carry out a basic check as an organisation – you must ask the person to request their own basic DBS check. A basic check shows unspent convictions and cautions.

This implies that asking a person to carry out a basic check when you can’t make an application yourself is acceptable, even though these are very likely to be circumstances where a person can’t meaningfully refuse. There are no warnings about compulsion during the application process via the DBS website. So why is a subject access request to ACRO magic, acceptable only when uncontaminated by duress, but a basic check isn’t? The amount of data disclosed isn’t exactly the same, but the outcome – being forced to disclose your criminal history when it might be unnecessary or excessive to do so – might be identical.

It took a long time (from 1998 to 2015) for enforced subject access to be fully enacted. Now it’s in force, the Hiscox case doesn’t give cause for optimism that anything will change. I have doubts about whether it was a good idea to prosecute Hiscox, but I have heard first hand terrible stories over the years about data being demanded when it should not have been. Having used the system, the way in which criminal records are made available gives me little confidence that such unnecessary and unfair demands for personal data are properly prevented. After the failure of the Hiscox case, even if only because of an ill-timed illness, the ICO needs to go in again and draw a line somewhere.

The Naked Truth

The story of Damian Green’s porn-clogged computer has several facets, with a surprising number of them related to data protection. Whether it was a breach for former Deputy Commissioner Bob Quick to reveal that there was porn on the computer is hard to say for certain – I think Quick has a journalistic defence in revealing hypocrisy given that the Government is current waging a moralistic war on adult websites, but you are welcome to disagree. The fact that Quick has form for revealing information that he shouldn’t have only adds spice to the mix.

The question of why Green’s other accuser Neil Lewis still has his police notebooks raises more serious questions. Did he keep them without authorisation from the Met? If he did, this could be a criminal offence under Data Protection’s Section 55 for which Lewis would be liable. Did the Met Police fail to recover them properly? This would be a serious breach of the seventh data protection principle, for which the Met should expect to answer. In any case, I have to agree with those who say that public servants should respect confidences even after they leave the service. Sensitive material should never be retained by former officers of any organisation. I know my reaction to the story is clouded by the entertaining spectacle of seeing a politician caught with his pants down, or at least, unzipped. The question of how the story came to light needs to be interrogated.

Green’s use of the Shaggy Defence to claim that he knows nothing about the porn begs more questions. If he didn’t download it, this means that someone else did (none of the Tories defending him seem to claim that it doesn’t exist). Part of Green’s outrage when his office was raided in 2008 was the threat to the sanctity of Parliamentary Privilege and the confidentiality due to his constituents. In the light of this, Green needs to explain how it was possible for someone else to download porn onto his computer. The best case scenario for him is that this was the result of malware, rather than someone else being able to log into his computer without his knowledge. Of course, malware infecting an MP’s computer is a story in itself. Regardless of whether this story should be in the public domain, we can’t be expected to ignore it now. As someone who processes highly sensitive data about his constituents (as well as possibly other sensitive information), at some point Green has to explain who had access to his computer and what they were doing downloading porn. Or he has to admit that it was him.

I don’t know what, if anything, Green is guilty of, but his fellow Tory Nadine Dorries’ spectacular contribution on Saturday doesn’t allow for any ambiguity. The MP for Mid Bedfordshire has a habit of deleting tweets when she (or someone else running her account) realises how stupid they make her look, so I have screengrabbed this one and I reproduce it in full here:

My staff log onto my computer on my desk with my login everyday. Including interns on exchange programmes. For the officer on @BBCNews just now to claim that the computer on Greens desk was accessed and therefore it was Green is utterly preposterous !!

UPDATE: There’s more:

All my staff have my login details. A frequent shout when I manage to sit at my desk myself is, ‘what is the password?

ANOTHER UPDATE: Robert Syms MP is at it as well

As a constituency MP, Dorries will be handling sensitive correspondence on a wide variety of matters, and she has publicly confirmed that access to information is open to a wide variety of people, including interns on exchange programmes. To this, there is no defence. The seventh data protection principle states that a data controller must have in place appropriate technical and organisational security measures to prevent “unauthorised or unlawful processing of personal data, and against accidental loss of or destruction of or damage to personal data“. This means a mix of technical measures like passwords and encryption and organisational measures like ensuring that passwords are not shared or written down. Dorries has confirmed she has authorised password sharing in her office – which is bad enough in itself because it means passwords are spoken aloud or written down, greatly increasing the chance of the password being known to someone nefarious. But worse than that, she says specifically that a wide group of people share her login. There is no way of knowing who has accessed what, because even if the intern has done it, it looks like Nadine was the person responsible.

The only way that Dorries has not admitted a clear breach of Data Protection’s security principle is if she (or whoever wrote the tweet) is lying in order to defend Green,  which is quite the stupidest thing I can imagine.

There are several possible breaches here – Quick’s original revelations about Green, Lewis’ retention of his notebooks / the Met’s failure to recover them when he left, Green’s insecure computer equipment and Dorries’ admission of her completely lax security. While Quick and Green’s problems are somewhat murky, Lewis / Met Police and Dorries present much more straightforward issues for the Information Commissioner. Both should be investigated as a matter of urgency.

Given Dorries’ casual admission of the insecure way in which her office operates, a much wider investigation might be required. Elizabeth Denham has put huge resources into investigating the possibility of political use of analytics and big data in an unlawful way, even though it’s hard to imagine anything coming of it. On the other hand, here we have a sitting MP openly admitting that constituents’ data is unsafe – how many more of Dorries’ colleagues operate in a similarly unlawful fashion? I cannot complain to the ICO about these matters, as I am not affected by them. However, the issues are serious, and Wilmslow should step in immediately. A bland press release reminding MPs to process data safely is not good enough; the ICO needs to demonstrate that Data Protection law applies to MPs just as it does to the rest of us.