Category Archives: Uncategorized

Who exactly is a newspaper targeting with its petition, and is it gathering personal data fairly?

The Northumberland Gazette, in a no doubt well-intentioned campaign, is urging its readers to petition the Information Commissioner (IC)

to do more to stop robocalls

“Robocalls” being

unwanted, automated, recorded calls, which are a blight in [sic] people’s lives

There are a couple of problems with this. Firstly, as Tim Turner pointed out, the IC cannot increase his own powers: that is a matter for Parliament, and, indeed, he would, er, be exceeding his powers if the IC increased his own powers. Christopher Graham (or, rather, the role he fills) is a creature of statute, not a superhero. Moreover, the IC has himself been lobbying for Parliament to increase his powers to deal adequately with contraventions of the Privacy and Electronic Communications (EC Directive) Regulations 2003 . If the newspaper wants the IC to have greater powers it should certainly assist the IC in seeking them, but I think it should do so with better information, and by encouraging people to lobby their MP, rather than by submitting their details into a google doc.

In my experience people often end up on spammers’, and “robocallers'”, lists, because they submit their personal details to meaningless and unclear websites. Privacy notices, where given, are a pain to read, but if fine properly, they should tell you who is collecting the data, and for what purposes, and what your rights are.

In fact, failure to provide such information when gathering personal data is likely to constitute a contravention of the first data protection principle in the Data Protection Act 1998 (DPA). It’s notable, and ironic, that the Northumberland Gazette seems to provide no privacy notice whatsoever in connection with its petition. One hopes that those submitting a form don’t end up on more spammers’ lists, and find themselves complaining to the IC about an apparent breach by the newspaper of their rights under the first DPA principle.

Chapter 2 of Part 1 of The Protection of Freedom Act 2012 was commenced on 1 September this year, to little publicity. It contains quite radical provisions regarding use of children’s biometric information.

(…One for the no doubt thousands of younger readers of this blog…)

Hey kids – want to annoy your teachers and your parents while at the same time asserting your rights to autonomous decisions about your privacy? Then put down your tamagotchis, or whatever it is you play with these days, and have a look at Chapter 2 of Part 1 of The Protection of Freedoms Act 2012 (POFA). Bear in mind (as I know you will, as you guzzle your ginger beer) that, by virtue of The Protection of Freedoms Act 2012 (Commencement No. 9) Order 2013, sections 26, 27 and 28 of POFA are now in effect.

And note that, if your school processes your biometric information (for instance, if you have to provide your fingerprints in order to register, or to access libraries (to read the latest Enid Blyton, no doubt) or get school meals) then (after September 1 this year) the school has to have informed your parents that it is going to do this (or continue to do this). If your parents object, then the school has to stop (and almost certainly give you an alternative way of registering/accessing the library/getting school meals etc). The school

must ensure that a child’s biometric information is not processed unless—

(a)at least one parent of the child consents to the information being processed, and

(b)no parent of the child has withdrawn his or her consent, or otherwise objected, to the information being processed….

The relevant authority must ensure that reasonable alternative means are available by which the child may do, or be subject to, anything which the child would have been able to do, or be subject to, had the child’s biometric information been processed.

But also note (here’s the totally rad bit) that, even if your parents are OK with it, you have the right to object, and if you do, that trumps what your parents, and your school, think. Cool eh?

if, at any time, the child—

(a)refuses to participate in, or continue to participate in, anything that involves the processing of the child’s biometric information, or

(b)otherwise objects to the processing of that information,

the relevant authority must ensure that the information is not processed, irrespective of any consent given by a parent of the child

Now, kids, you will have your own views, and some of you may approve of administrative systems which rely on the gathering, use and retention of personal information. You may think that the potential time- and costs-saving benefits are the most important factors at play. But some of you might well object, on perfectly reasonable grounds. You might be worried about what might happen if, for instance, this information fell into the wrong hands, or was simply kept too long, and was misused to your detriment. You might even object in principle to this sort of private information being used in this sort of way, when there are less intrusive methods available.

And you might want to consider that, if sufficient of your classmates object, under what is an admirable and rather radical statutory scheme which gives priority to the wishes of children, then the whole purpose of having this sort of system (convenience and cost benefits for the school) might fall away.

In what little spare time I have I perform the role of Secretary of NADPO – the National Association of Data Protection and Freedom of Information Officers. NADPO holds its annual conference in London on 22 November. The call to members has gone out, and also to members of the Data Protection Forum, with whom we have informal reciprocal arrangements.  Now, for the first time, we have decided to make any spare places publicly available.

The line-up is as impressive as ever (if not more so): we have Jonathan Bamford, from the Information Commissioner’s Office, the BBC’s Martin Rosenbaum , Dr Ian Brown, from the Oxford Internet Institute, David Allen Green, author of the highly regarded Jack of Kent blog, and legal commentator for The Financial Times, S A Mathieson, senior analyst for EHI Intelligence and a freelance journalist and Antonis Patrikios, Director at Field Fisher Waterhouse’s Privacy and Information team. We also have the Law Commission, who will be talking about, and seeking attendees’ views on, their scoping project on Data Sharing between public bodies.

Spare places, if any are available, will be offered to those who express interest on a first-come-first-served basis, at a ridiculous bargain rate of £50.

The conference takes place at Field Fisher Waterhouse’s offices in Vine Street, EC3N.

If you’re interested in attending feel free to contact me using the form on this page.

It’s always hard when those you admire let you down (Van Morrison duetting with Cliff Richard*, Godfather 3, Larkin’s letters) and I preface what follows with an assertion that I think Citizens Advice Bureaux (CABs) are a force for good, and one that takes on even more importance as the government butchers the legal aid system. However, when those you admire do let you down, it is important not to shrink from criticism.

Last week reports emerged of what appeared to be a very serious incident of inadvertent exposure of large amounts of potentially highly sensitive data of clients of Newcastle Citizens Advice Bureau. I think the Northern Echo were the first traditional news source to break the story (after @FOIMonkey had announced the unfortunate discovery on twitter). Other outlets soon picked this up, including the BBC. What had apparently happened, said the BBC, was

About 1,300 files containing names, addresses, debt history and criminal records were accidentally made available on the internet.

This is no small matter for an organisation which requires, and indeed prides itself on, total confidentiality between it and its clients.

The Chief Executive of Newcastle CAB had reassuring words:

Shona Alexander, chief executive of the branch, said:

This isolated incident at Newcastle CAB is being thoroughly investigated…I’d like to reassure people that, because we take data protection extremely seriously, they can speak to us in total confidence. All Newcastle CAB staff and volunteers are fully trained in information assurance.

(Although, as Tim Turner pointed out, this bore some resemblance to a platitudinous quote given by Greater Manchester Police when they had contravened the Data Protection Act 1998, and as @FOIMonkey suggested, “isolated incident” is an odd way to describe the apparent long-term inadvertent disclosure of 1300 files in 16gb of client data cached by Google.)

However, it was reassuring to know that this compromised data had been identified, and would be removed, with the assistance of Google. Google are, I understand, generally happy to assist with removal, although each one (and there were hundreds here) normally requires a separate request and takedown is effected normally within twenty-four hours (there is also a process whereby site owners can ask that cached copies of entire directories/sites are removed). @FOIMonkey even had the decency and public-spiritedness to get Google to take many down herself, in what was I am sure a time-consuming task of no direct benefit to her.

But this morning (24 September), when I checked twitter, I noticed that @FOIMonkey had tweeted yesterday

Concerned that 5 days after the Newcastle CAB data breach came to light, the information is still online. Please sort them out @ICOnews

She went on to show that more than 11,000 files had still not been removed, pointing out that “it could all have been removed by now”.

Now, in terms of data protection law, I think it is the case that each local CAB functions as a separate data controller, with attendant legal obligations and liabilities, but it seems clear that regional CABs operate under the umbrella of the national organisation, and it seemed to me that this was an issue of general seriousness and importance for the CAB nationally. So I took the time to search out the CAB’s senior press officers, all of whom are on twitter, and asked them for comment, but got no reply.

I then emailed their Press Office, asking for comment, but was merely referred to a statement from last week which (obviously) made no reference to this current issue about apparent failure to remove the data. I pointed this out in reply, and, when I pushed them to say whether they had any further comment, was referred back to the earlier irrelevant statement they had given me earlier.

Meanwhile, I saw that the Assistant Chief Executive of the national CAB was active on twitter, and I asked him for comment. He replied

we take client data protection extremely seriously and working hard with both ICO and Google to resolve this local issue

Which is more like a parroting of the original press release, rather than an answer to the question posed.

It may be that, behind the scenes, frantic efforts are being made and have been made since last Wednesday to remove this data. Maybe Google are being awkward for some reason. I don’t know, but if so, I struggle to understand why we can’t be told this, and why, while we are given bland and unreassuring statements, the only person who publicly seems to be making successful efforts to have the data removed is someone with no obligation to do so, and who alerted the CAB to the problem in the first place.

*Van’s not too bad actually.

All human things/ Of dearest value hang on slender strings*

Ten days or so ago I asked for donations for a charity walk a friend and I were about to do. Normally, in a very English way, we don’t ask for donations for this sort of thing, but just make one ourselves and then feel guilty we haven’t raised more. This time I decided to ask, and was blown away by the response. With direct donations to the Alzheimer’s Society and cash donations we raised close to £550.

And in the beautiful grounds of Hall Barn, once home to Edmund Waller*, last Sunday, we barely exerted ourselves for five whole gentle kilometres. What was very, and rather unexpectedly hard, however, was hearing the stories of other walkers. Dementia affects so many lives in such horrible ways, and this was reflected by the fact that many people who had donated said how they had experienced it in their families.

I said I would run part of it, and I did – all of about three strides. So we didn’t get a picture, but if we had it wouldn’t have been pretty. I will post another picture, sadly from a few years ago, of someone who would have recognised and been truly grateful, as we are, for the kind, kind donations and support for such an important charity.

My mother wore a yellow dress;
Gentle, gently, gentleness.
Come back early or never come.1

I agonised over whether to use my blog to seek sponsors for a charity walk I’m doing, but decided in favour because a) I would hope that making clear that it’s a mere 5k does away with any suggestion I’m showing off, b) I won’t make a habit of it, and c) in itself it’s probably selfish to agonise about blogging to raise a small donation to  worthwhile cause. Forgive my self-flagellation: I do it a lot.

On Sunday 8 September my partner and I are doing the 5k Memory Walk in the lovely grounds of Hall Barn, near Beaconsfield. The Memory Walk

is a series of fundraising walking events taking place across England, Wales and Northern Ireland every September, all raising money to provide vital support to people living with dementia and help our research to find a cure for the future.

I won’t go into great detail about my and my partner’s experience of having someone you love ravaged by dementia, but many have already done so, and many will.

I would be truly appreciative though if you were able to donate using my Just Giving page.

UPDATE: 4 September

Firstly, I want to say thank you to all the wonderful people who have donated to the cause. It sounds trite, but I really am so very touched and appreciative. Even though, thanks to the evil machinations of @lexysumner it looks like I’ll have to run part of the WALK (believe me, if I ran all of it this would be the last blog you’d ever see from me).

Secondly, it has been pointed out to me that donating through Just Giving is not the only option – a couple of donations have been made directly to The Alzheimer’s Society, and doing this means that all the money goes directly to the charity (Just Giving take a 5% cut). I apologise for not realising and mentioning this before. All I would ask is that if anyone makes a donation directly they let me know, so I can let the WALK organisers know.