Bah Humbug

If I was a proper FOI requester, I would await the delivery of each response like an excited child on Christmas Eve, willing the appearance of the day when I will receive my presents. Instead, I am very much the adult embodiment of the child I used to be; I have bursts of enthusiasm that dull to indifference, especially now that my attention has to last over the passage of 20 working days. My FOI request to the Cabinet Office about the correspondence based adventures of Oliver Letwin MP is very much in that category (as an aside, the absence of tweets from @OliverLetwinMP remains a disappointment but I fancy he is merely whetting our appetite for a stonking tweeted SNAFU at some future date).

On the day that the Daily Mirror revealed Letwin’s insouciant approach to office filing and data protection, I fired off an FOI to the Cabinet Office demanding all manner of smoking guns, the outcome of which would allow me to write a stinging blog post of such revelatory and rhetorical brilliance that I would be carried aloft on the metaphorical shoulders of my readership, and given a column in the Guardian or the Financial Times. The days dragged by. I trained many fine folk around the nation, and received yet another rejection for my novel. By the time the Cabinet Office responded, I was on holiday in Morocco, and I didn’t really give a toss: Alan and Lionel be damned, I was trying to find ‘Casablanca Beer’.

Now safely ensconced in the UK with water pouring through the ceiling into my bedroom (to any readers in South Manchester, I can recommend a fine plumber), invoices to send, courses to write, and another publisher to find, I went fickle on my Letwin expose. Part of this is the fact that the 20 working days was distended by a generous 7 extras, by which time I had almost forgotten I had made the request. Part of it was the fact that Letwin had readily signed an ICO undertaking, showing at least some measure of contrition. And of course, in the interim, Vince Cable had decided to outgun Letwin with some DP flouting of his own. But most of all, I lost interest because the high seriousness of my original request was undercut by the ‘meh’ nature of the response.

I asked:

·      has Mr Letwin disposed of correspondence containing personal data about other people?
·      Did the correspondence relate to his constituency role, his Cabinet Office role, or both?
·      what kind of details were included (e.g. names and addresses, email addresses, information about personal circumstances or complaints)? I do not believe that providing a generic description of the data would constitute a breach of the Data Protection Act.
·      Has either Mr Letwin (in his capacity as an MP) or the Cabinet Office (as a data controller) informed the Information Commissioner of these incidents, on the basis that there is a possibility that the Seventh Data Protection principle has been breached, as it relates to security?
·      Has Mr Letwin received any data protection training in his capacity as a Cabinet Office minister?
·      Is any such training now planned?
·      When the statement provided by the Cabinet Office was released, claiming that the information disposed of was ‘not sensitive’, had the person making the statement considered the Data Protection implications of disposing of correspondence in bins in public parks?
·      Does the Cabinet Office have a policy or procedure about the appropriate disposal of paper records?

What I got was this:

The Information Commissioner has considered the matter and his report can be found at http://www.ico.gov.uk.

Enquiries made by the Information Commissioner’s Office (ICO) found that ‘among the documents were letters and emails from…constituents, including personal data such as their names, addresses, telephone numbers and email addresses, although in one instance there was some limited information about an individual’s health problems’. Mr Letwin has signed an undertaking with the ICO whereby he has agreed to dispose of personal data in a secure manner.

Ministers do not receive data protection training. Mr Letwin has been made aware of his responsibilities by the Information Commissioner. Data handling procedures in Government are set out at www.cabinetoffice.gov.uk/resource-library/data-handling-procedures-government. When handling data which contains personal information about identifiable living individuals, the Cabinet Office must ensure that it complies with the provisions of the Data Protection Act 1998. In particular, personal data must not be collected or retained unnecessarily, and appropriate security measures must be taken to protect the information.

I should point out that it is far from clear what information the Cabinet Office holds in relation to what I asked for – it’s possibly that they hold a shedload of emails and other information, but I didn’t get them. They did not provide any meaningful response to the penultimate bullet point in my request. The fact Ministers do not receive data protection training is disgraceful, and the fact that no training is planned, especially given that they knew about Vince when they responded, is shameful. They don’t tell me how to get an internal review, or provide me with any advice or assistance.

But what do I do? This desultory response at least provides me with some useful material for my next training course as the ‘before’ part of a ‘what FOI requests should look like’ exercise. If I complain, the Cabinet Office will either tell me that the original response was just dandy, or they’ll send me an apology in the name of a senior officer, written by a junior one (I was that junior officer once). I could complain to the ICO, adding to a backlog of requests, and in six months to a year, they’ll do something either way that by then, I will not care about at all. And is that a good use of anyone’s time?

In a world where the Cabinet Secretary badmouths FOI as his parting shot to government (www.guardian.co.uk/politics/2011/nov/23/freedom-of-information-act-government), and a former PM’s chief lieutenant feels entitled to go on Radio 4 and aggressively not understand how FOI works (www.bbc.co.uk/programmes/b006qjfq), to quote Slim Pickens in ‘Blazing Saddles’, I am depressed. Will an internal review make any difference? No. With Sir Gus O’Donnell sending a message to civil servants that FOI is a problem, rather than a natural part of the checks and balances, I don’t see the point of putting them to the trouble. And if I now don’t care so much about Letwin’s adventures in St James’ Park, am I entitled to ask for one? Well, no, so I won’t.

However, the one advantage FOI has over Christmas is that you don’t have to wait all year (unless you’ve made an FOI to a certain organisation if WDTK is any way to judge it), and you don’t have to be good to get presents. I’ve already moved on to the bizarre goings-on involving a former ICO employee getting raided by the cops after badmouthing our alma mater, and the fact that when the ICO meets big international corporations, they keep remarkably scant records. These are both blog posts for another time, so if you’re excited, you’ll simply have to wait to unwrap them.

And yes, as we heathens invented Christmas, we are entitled to enjoy it, and my blogs will be aggressively inflected with a yuletide theme until January. So if you don’t like it, Bah Humbug to you!


A supposedly serious blog post about information security, in which the author unconsciously reveals his jealousy over men who have more hair than him

Once upon a time, MPs made a huge fuss about the risks to Parliamentary privilege of FOI, and the possibility that people could make FOI requests and obtain copies of correspondence from constituents. Under the noble leadership of the quad-bike riding David Maclean, they made an attempt to exclude Parliament from FOI’s scope altogether – not to hide expenses, just to protect constituents’ correspondence.


And you may now turn off your sarcasm filter. According to the Public Whip website www.publicwhip.org.uk/, we cannot know Oliver Letwin’s views on this matter, as he was absent from all the votes. However, his apparently laissez-faire attitude to correspondence in general, as reported by the Daily Mirror and other gleeful newspapers suggests that he may not have been that exercised by it: see the Mirror for more http://tinyurl.com/65vwf3r, including excellent photos of Mr Letwin dumping official letters in bins on his early morning walks.

Mr Letwin is usually good value for money – he has a Bertie Wooster-ish quality, a silly ass accidentally let loose in the establishment. There was the time he went into hiding after claiming that the Conservatives would cut £20 billion from the public budget (one can only hope he spent his time sheltering in the equivalent of the Drones Club). There was the wonderful moment when his house was burgled when a chap knocked on his door early in the morning, and he just let him in (http://tinyurl.com/67577tq). And, like his fellow Cabinet Office minister Francis Maude, he has fascinating hair (Maude could just fit into P.G. Wodehouse, but he would be a smooth-talking cad with a smoking jacket).

What annoyed me about the typically daft nature of the Letwin letters incident (bingate? parkgate? sillyassgate?) was the Cabinet Office statement that no sensitive information was included. Instead of an admission that a bin in a public park is no place for any form of official correspondence, and one of Letwin’s engagingly frank apologies (which I assume we’ll get at some point), they imply that this is not a serious issue. We don’t know how serious it is, but there is a strong possibility that the Data Protection Act has been breached.

Ministers and MPs sometimes froth with outrage at the flaws of others, and treat themselves slightly differently. Admittedly, Letwin himself is more cerebral and not prone to soundbites, but the people I work with – councils, housing bodies, NHS trusts, NDPBs, companies – are the kinds of organisations whose slips, mistakes and foibles are occasionally blown wildly out of proportion by politicians. So when someone at the centre gets it wrong, they should say so immediately. This is a straightforward breach of proper records management, good quality data protection, and common sense, unless it did not happen.

There were all sorts of questions I had after reading the Cabinet Office’s bland statement, so I decided to end on an FOI request to the Cabinet Office. Whether there is any point in asking such questions is a legitimate question – perhaps we should write this off as another example of Mr Letwin’s idiosyncratic style – but I know that if one of my clients had a gaffe like this, they’d get FOIs ten to the dozen. So this is mine.

  • has Mr Letwin disposed of correspondence containing personal data about other people?
  • Did the correspondence relate to his constituency role, his Cabinet Office role, or both?
  • what kind of details were included (e.g. names and addresses, email addresses, information about personal circumstances or complaints)?
  • Has either Mr Letwin (in his capacity as an MP) or the Cabinet Office (as a data controller) informed the Information Commissioner of these incidents, on the basis that there is a possibility that the Seventh Data Protection principle has been breached, as it relates to security?
  • Has Mr Letwin received any data protection training in his capacity as a Cabinet Office minister?
  • Is any such training now planned?
  • When the statement provided by the Cabinet Office was released, claiming that the information disposed of was ‘not sensitive’, had the person making the statement considered the Data Protection implications of disposing of correspondence in bins in public parks?
  • Does the Cabinet Office have a policy or procedure about the appropriate disposal of paper records?