informationrightsandwrongs

The ICO has “fined” Sony £250k for its Playstation Network breach.

My swiftly-grabbed breakfast coffee yesterday morning was interrupted by an emailed press release from the Information Commissioner’s Office (ICO) informing us that a civil Monetary Penalty Notice (MPN) in the sum of £250,000 had been served on Sony Computer Entertainment Europe Limited by the ICO. It was such an important case it was celebrated by a rare foray into video by the ICO’s David Smith. This was the outcome of investigations into a data security breach in April 2011 which had, in the ICO’s words, the effect of

compromising the personal information of millions of customers, including their names, addresses, email addresses, dates of birth and account passwords. Customers’ payment card details were also at risk

An MPN is served under section 55A of the Data Protection Act 1998. One can be served where the ICO determines that there has been a serious contravention of the Act, of a kind of a kind likely to cause substantial damage or substantial distress, and the data controller knew or ought to have known that there was a risk a contravention of this type would occur, but failed to take reasonable steps to prevent it.

There is a right of appeal against both the MPN itself, and the amount, to the First-tier Tribunal (FTT). Rather to my initial surprise Sony swiftly announced they were lodging an appeal. I had noticed that there were very large parts of the ICO’s formal MPN document that were blacked out. See

and

Even figures such as the estimated worldwide number (in millions) of PS Network users were redacted. I had a suspicion that some sort of negotiation might have taken place between the ICO and Sony, whereby the former would willingly redact everything the latter asked for, if the latter accepted their punishment. The announcement that they would appeal showed how I should be wary of my suspicious nature*.

Sony say

the ICO recognises Sony was the victim of “a focused and determined criminal attack,” that “there is no evidence that encrypted payment card details were accessed,” and that “personal data is unlikely to have been used for fraudulent purposes” following the attack on the PlayStation Network.

This seems to miss the point that section 55A does not require the ICO to determine that harm has occurred, only that the contravention was likely to cause substantial damage – or distress. As the ICO points out, thousands of people had their personal details (names, address, dates of birth and account password)s were compromised. The risk of identity theft existed, and, as the ICO points out, continues to exist. However, a question does arise as to how serious the breach was.

Last week the FTT handed down judgment in an unsuccessful appeal of a previous MPN served on Central London Community Healthcare NHS Trust (for a detailed analysis of that case, see Robin Hopkins’ piece on the Panopticon blog) . As a result of this we now know a bit more both about the ICO’s procedures in serving MPNs and the FTT’s likely approach to any further appeal. We know (paragraphs 37 and 38) that the FTT will conduct in effect a de novo hearing of the facts, and permit itself, where appropriate, to substitute its own view for the ICO’s, but that it will be likely to afford a degree of deference to the ICO’s views, given his expertise in DPA matters. We know (paragraph 39) that the FTT could increase the amount of the MPN. We also know that £250,000 marks the border between what the ICO sees as a “very serious” type of breach and the “most serious” type. One suspects Sony will be asking the FTT to consider whether this breach, which potentially affected a huge number of people, but which did not involve sensitive personal data, was as serious as the ICO treated it.

Personally, I think it was – the sheer numbers, and fact that this data is still out there, perhaps being sold and traded to crooks and spammers, make it so. Although the FTT could take a different view, Sony could well be living in the land of make believe.

One final point. Some have suggested that the ICO has traditionally been unwilling to take on the large private sector organisations when it comes to data protection enforcement. The suspicion has been that he is reluctant to risk lengthy and costly challenges. With this action, the ICO gives (at least a little bit of) lie to that. It would be a real shame if a lengthy and costly challenge ensues. We don’t want the ICO to whisper “I told you so”, do we?

*Actually, my suspicious nature makes me wonder if they will ultimately pursue the appeal. Although it will cost them nothing, this isn’t about cost, but reputation, and do Sony really want to risk another day of bad headlines about their data security, in the event that they lose the appeal?

UPDATE: 12 July

The First-tier Tribunal listings show that Sony withdrew their appeal on 8 July. We don’t know the reason why, but I wonder if I was right after all?

Has an NHS Trust tried wrongly to prevent publication of information under FOI? Or are they just perhaps (naively) internally exploring the options?

Brace yourselves. Hold on to your china. I have a shocking announcement to make: NOT ALL PUBLIC AUTHORITY STAFF FULLY UNDERSTAND FOI!

In fact, some of them don’t even like it – check out some of the submissions made to the Justice Committee when it was conducting its post-legislative scrutiny of the Freedom of Information Act 2000 (FOIA).

Even worse than those who don’t understand it and say so, are those who don’t understand it but think they do. All practitioners have been faced with the person who announces loudly and wrongly which exemption should be claimed, and won’t accept they’re wrong, because “that’s what we always used to say when I worked at [former employer]”.

These observations are prompted by a twitter exchange, and subsequent Telegraph article yesterday, regarding the accidental disclosure of internal emails by NHS Newcastle-upon-Tyne, in which staff there discuss how to respond to an FOI request. The article reports how the staff considered whether they had to disclose a strategy report, and that the following comments were made

The planned preventative maintenance is all my own work for which I can express intellectual rights…

The…strategy is commercially sensitive and subject to executive approval…Can we say that our Strategy is commercially sensitive and refuse to disclose?

We could refer to [other information] which is in the public domain…It would at least make us look slightly helpful

The Trust clearly did not want this exchange disclosed, because after inadvertently doing so, they tried to use an email recall function, which as we all know, hardly ever works. I don’t blame them – this sort of exchange hardly reflects well on the FOI knowledge of and intentions of, certain staff. If it happened in my organisation I’d toddle on down to their office with a rolled-up copy of ICO guidance and bang them on the head with it (or maybe just suggest they have some training).

However, this sort of exchange goes on daily, in hundreds of public authorities, as hard-working, possibly naive staff grapple with complex FOI requests. They’ll mull things over, discuss options, make ridiculous suggestions, until, ultimately – one hopes – an FOI officer pulls it all together and arrives at a reasoned, fair and lawful decision about disclosure.

Of course that doesn’t always happen, and not all organisations have the bulwark of an honest, good FOI officer in place, but disclosure of internal discussions about potential exemptions, before any final decision on disclosure has been arrived at, does not point towards a potential criminal offence, as some were suggesting on twitter, and it doesn’t really make for a good story.

How data security is like a car park. Sort of.

Last Friday I parked in my usual car park. I entered it past the signs informing me of the terms for parking there, and the penalties for breaching them. After parking I walked past the signs reminding me in big letters “HAVE YOU PAID AND DISPLAYED?”, and went in to work.

But when I returned later that day I had a ticket on my windscreen – a penalty charge notice – imposed for failing to display a ticket. I still don’t know how I managed to do this. Every other time I have parked, and bought a ticket, and placed it in the same place on the dashboard. But something went wrong this time.

Ever one to draw a clumsy analogy for the sake of a blog post, it got me thinking about data security. We all know how to avoid enforcement action by the Information Commissioner’s Officer (ICO): train your staff, have good policies and procedures and check regularly they’re being complied with. Then, if something goes wrong, the ICO will determine that there was nothing more as an organisation you could do to prevent the incident, and you are not in breach of the Data Protection Act. (Of course it’s a bit more complicated than that. But not much).

However watertight your policies are though, and however often and loudly you remind people about them, mistakes happen. As Einstein is reported to have said “Two things are infinite: the universe and human stupidity; and I’m not sure about the universe.” All you can do is mitigate the risks, and mitigate them sufficiently to satisfy those who regulate you. Thus, the ICO will (should) not impose a Monetary Penalty Notice if you had taken all the data security precautions you reasonably could have taken but one person made a stupid mistake leading to a data breach.

And, because the car park has clear and fair terms and conditions, I won’t challenge the lawfulness of imposing a penalty charge notice just because one stupid individual failed to check that his stupid car had a stupid $%*&ing ticket on the stupid dashboard last Friday morning.

How the Campaign for Freedom of Information was integral to the original enactment of the Freedom of Information Act, and continues to lead on the subject. Support it.

In the mid-1990s my understanding of the concept of Freedom of Information was limited to two points: first, that it was heavily pushed by an organisation called the Campaign for Freedom of Information, and its director, Maurice Frankel and late Chairman, James Cornford and second, that FOI was, surely, unarguably a Good Thing.

In the heady months after Labour’s 1997 election victory it was easy simply to assume that the manifesto commitment to introducing a Freedom of Information Bill would be honoured. While those with more than a passing interest in the subject noted over the following months, with concern, a major retreat from David Clark‘s White Paper Your Right to Know, the Freedom of Information Act 2000, as passed, was still a piece of progressive legislation, very much to be welcomed.

It is interesting, then, to read, in Jack Straw’s recently published, and sometimes rather mean-spirited memoirs, potentially just how little is owed to those who are now seen as the key figures in that Labour administration, and how much is owed to the Campaign for Freedom of Information. Straw describes how the manifesto commitment resulted in a White Paper to parts of which he and Tony Blair were fundamentally opposed:

Tony himself was by now getting extremely worried about the eccentric FOI policy to which his government, in a trance, had seemingly committed itself

and how

I had half a thought that the best thing might to be bin the whole bill, or kick it into the long grass with a Royal Commission

But ranked against him were “all the enthusiasts for FOI-max, ably briefed by the indefatigable Maurice Frankel”.

(Straw effectively, by his account, found himself fighting his own bill. His victory, as he sees it, was to ensure that a power for ministers ultimately to veto disclosure was included. The unsavoury picture painted is of an over-eager administration – committed by its manifesto – unwillingly enacting a progressive law, but ham-stringing it in the process. And of course, we have since had several instances where that ministerial veto has been exercised (twice by Straw himself),, most recently and worringly to prevent disclosure of lobbying correspondence by the Prince of Wales, despite an extraordinarily thorough ruling in favour of disclosure in the Upper Tribunal.)

But this blog post is not about Jack Straw, now sniping from the opposition back benches, and not about the illiberal ministerial veto. It is about what a debt we all have to the Campaign for Freedom of Information, which has continued to argue for a more robust FOI Act, while defending it against threats of diminution. Regarding the latter, it is difficult to over-emphasise the significance of a late submission by the Campaign to the Justice Committee’s post-legislative scrutiny of the Act, which demolished many of the more specious arguments made by those criticising the Act. (Let us hope that the Committee’s welcome final report is accepted by the government, and that those of us who defend the Act can breathe easily, for a time at least.)

I have no personal interest in the Campaign (although I should perhaps declare that Maurice once gifted me a very-well-used-but-broken La Pavoni espresso machine) but it needs celebrating, and cherishing, and supporting (funding will always be an issue with an organisation like this). Everyone who uses and champions FOI should recognise this.