Trouble by the seaside

Actually I had always quite liked the rubber-faced Education Secretary

I fear I have become the first victim of a phenomenon that may become known as a “reverse Gove”.

I’ve coined the term myself in homage to legendary Sun editor Kelvin MacKenzie, who managed to get the term “reverse ferret” into common parlance.

His phrase was used when his paper would suddenly turn a full 180 degrees and praise the individual or policy it had hitherto been viciously attacking.

Why am I the victim of a “reverse Gove”? It all stems from an allegedly obscene nursery rhyme about the seaside town of Hastings. The ditty was e-mailed by the town’s police chief Mark Ling from his force mobile. When the story emerged I put in a request saying I’d like to see the rhyme.

First Sussex Police turned me down on the basis that the information was exempt under S.40. I appealed saying how could it be personal, seeing as it was at the centre of a disciplinary hearing, and that it was sent on a e-mail system that specifically warns people the content can be released under FoI legislation.

Well I’ve waited a long time for the appeal ruling to come back and this week, not long after the guidance on Gove, I got my response.

Sussex Police said that they had been incorrect to claim that it was exempt under S.40, but they were still not releasing it to me because it was “personal communication”.

The response from Sussex Police says:

It is my assertion that the rhyme was a personal written communication between a Sussex Police employee and a member of the public and therefore not official information covered by the act.  We are therefore not required to consider disclosure.

In making this decision I have considered that whilst you are correct in stating that we have policies informing staff that private communications made on the organisations equipment can be monitored, Sussex Police nonetheless actively allows its staff to use work equipment for their own use.  This includes the sending of email, making personal calls or sending SMS messages.  To support this we have a process to allow staff who have provided phones to pay for personal calls and texts made.

Whilst the rhyme itself may have been deemed as inappropriate to have been sent by a member of Sussex Police, it was not an official communication but was a personal communication outside of the provisions of the FOI act.

As an aside we find ourselves in a difficult position in that a misconduct hearing conducted under the provisions of the Police Regulations has ruled that it was inappropriate for the information to have been ‘published’ by a member of our organisation (albeit privately) and therefore to release it under FOI to the general public would be exacerbating the wrongdoing.

So it would appear that although Gove and his cronies have been rapped for sending official communications on personal systems, I’m being denied what is claimed to be the exact opposite: personal information sent through an official communications system.

Now, as you might suspect, I don’t agree. If this had been a request for his shopping list or what time he was meeting friends then I’d accept the proposition.

But this is significantly different. It is a communication that was allegedly derogatory in nature about the very town that he had the responsibility of policing. If it contained racist language, is that not a relevant cause for concern about the way racist crimes might be investigated?

Sussex Police considered it so seriously that Mr Ling was the subject of a disciplinary hearing. Indeed after the hearing the force’s Assistant Chief Constable said: “The officer failed to uphold the values the public and the force expect of all our people and disciplinary action has been taken against him.”

I’ll be appealing the decision to the ICO and would be grateful for any advice. Here is a link to one of the articles that came out at the time, and here is one after the disciplinary hearing was concluded.

I’m also linking to FoIMan’s excellent blog which has a spicy debate with the inappropriately named Captain Sensible over the Gove e-mail business.

PS. I do have some sympathy for Mr Ling. I spent six depressing months living in Hastings at journalism school (yes I did go to one) learning mainly shorthand. A quick internet search  came up with this description of the town from a band who had to play a gig there.

Hastings. There is very little you can say about Hastings. It is low rent, full of kids and all those kids are drunk with kids of their own. Need I say more.

Even when Foyle was in Hastings the place was a crime hotspot.

How Low Can You Go? Part II.

That crowbar looks far too shiny

The topic of when simple statistical data becomes personal data has always been a topic that has caused a great deal of head scratching.

If I ask how many people in East Sussex are obese nobody would consider that to be personal data and subject to a S.40 exemption. However, if you were to ask how many adult males living at my address were obese and the answer was to be one – you’d have violated my privacy, breached the Data Protection Act and ridden rough shod across S.40. Anyhow, just for the record, I’d like to state that I’m just slightly overweight!

But nobody has really said how and when that numerical data becomes personal data. The topic has come before the Tribunal and the Commissioner before and the issue has still not really been resolved (I’ve put a series of links at the end to judgements which have focused on this point).

However, the latest judgement from the offices of the Information Commissioner [Ref: FS50161581] relates to the Greater Manchester Police (GMP). It received a request wanting to know the number of burglaries that took place in Honeysuckle Close and Tunshill Road.

To my mind the key point in this question was the number of houses in each street. In Tunshill Road there are 83 but in Honeysuckle Close there are just 13.

GMP refused to release the data saying it was subject to S.31 (law enforcement) as well as S.40 (personal information).

The S.31 argument was quickly dispensed with by the Commissioner despite some interesting arguments by GMP which included the fact that disclosure of the information might lead to more burglaries as criminals would expect the stolen property to be replaced with new goods courtesy of the insurance companies.

But the S.31 plea from GMP was rejected by the Commissioner who said “this would not present a real and significant impact on the ability of the police to prevent crime and to apprehend offenders”.

On to S.40 and the Commissioner admitted the number of properties and the number of burglaries were small in number but added “I am not persuaded that, taken together, they would allow for the identification of any individual.”

The Commissioner touches on the subject of “crime maps”, a new politically-driven idea that will allow people to look up on the internet to see what sort of crimes have been committed and where. However, he says that just because a police force picks a certain parameters for the reporting of each crime type the Commissioner, when considering individual Freedom of Information requests, does not have to be bound by the police approach.

As it would appear that 13 is considered a number not too low to allow a S.40 exemption to be applied. The key question is when does the number become too low (see my earlier post on this topic ‘How Low Can You Go?’) and would the level change if we were talking about more sensitive personal detail.

To test drive this ruling I’m asking on whatdotheyknow how many burglaries have taken place each year in Connaught Square, Westminster, to see if the arrival of the Blairs after he left No.10 and the associated police presence had any effect on the number of house raids [link].

Other judgements:

Common Service Agency v Scottish Information Commissioner [2008] UKHL 47, link

Department of Health v Information Commissioner & Pro-Life Alliance [EA/2008/0074], link

Sussex Police v Information Commissioner [EA/2009/0013], link

How low can you go?

At some point you can get no lower.....

Freedom of Information officers often come up against the problem of when and if statistical data can be seen on specific occasions to be a breach of S.40 (Personal Information).

Most commonly this problem has been seen in tables of data – often about medical conditions – where the public authority will put a dash “-“ in any cell where the value is less than five.

The Department of Health (DoH) regularly uses this technique when providing tables showing the number of women who have had multiple abortions.

You will see from this Abortion data table that there are a handful of under-18 girls who are on their third abortion or more – yet the DoH refuses to give us the exact figure.

In Scotland there was a long-running dispute over whether low cell values in a table of the prevalence of childhood cancer, could lead to those children being identified.

I have to say that I still have difficulty with the concept and certainly do not accept that any cell value under 5 or ten automatically has to be anonymised. In the abortion table example how would knowing that six women aged under 18 had their third abortion that year led to their identity being exposed?

The key to these questions, in my opinion, is the total pool from which the information is drawn. So in the abortion data case your pool of identifiable candidates is all the women aged under 18 in the whole country.

But this vexed problem of low cell values has taken a different turn in the case of Beresford Lane in the Sussex village of Plumpton Green.

A company that wants to put together data for prospective house buyers asked the local police force for data about anti-social behaviour in the lane for a six month period.

Sussex Police refused to either confirm or deny (NCND) it held any such information as it claimed that to state it held such information could lead to the identity of either the victim or the culprit. This use of S.40 was rejected by the Commissioner and has now also been thrown out by the Tribunal.

But the key element in this case was in essence the “total pool”/“cell value” which in this case was the number of people who lived in the lane  against the number of anti-social behaviour complaints in that lane.

The Tribunal came to the following conclusion: “The Appellant says that if it confirms or denies that it holds the requested information, that could lead to the identification of either those who have made complaints about ASB, or those about whom such complaints have been made. Clearly, if it does lead to such identification, that would amount to disclosure of personal data. The question is - would it lead to such identification?

“The facts before us are notably brief. We have been told that Beresford Lane, Plumpton Green, BN8, is a rural road with approximately 17 residential dwellings. Presumably, many, if not most of the 17 dwellings, will have multiple occupiers which means there are likely to be many more than 17 people living in the area covered by the request. The request covers a period of 6 months. We have no other facts of any significance. On these simple facts, we have great difficulty in seeing how, if the Appellant confirms or denies that it holds information on the number of ASB complaints reported, and the descriptions of any such ASB complained of, in that period and for that location, that would enable a living individual to be identified as having either made a complaint or having been the subject of such a complaint, or indeed to be identified in any other way. The Appellant has simply not demonstrated how that connection could be made.

“The position might be quite different on different facts. For example, if there was a known incident concerning one or more particular dwellings or individuals and if the time period covered by the request was relatively specific to that incident, a confirmation or denial could well lead to an individual being identified. That, however, is not the situation in the present case.”

So it would appear that in this case the Tribunal thinks that to disclose information about a cohort – sadly we don’t have an exactly figure but the number of people who live in 17 houses (34?) – will not breach S.40. But as the Tribunal has said different circumstances and different figures might lead to a different ruling.

The key question is when does that group number get so low that S.40 would be breached. And it appears that the Tribunal has neatly ducked out of answering that question.

The Tribunal ruling can be seen here. Tribunal decision.

Are you free to say nothing?

The Freedom of Information Act has a provision in it to allow public authorities to ‘Neither Confirm Or Deny” (NCOD) it holds the information the applicant asks for.

This is because in some cases merely stating that an authority holds information relevant to a request will disclose too much information even if the data itself can be withheld using one or more of the exemptions.

The Information Commissioner’s Office (ICO) give guidance on the subject (link) in which it provides two examples. Firstly an applicant wanting to know if particular surveillance information was held and, secondly a request to know if troops on active service are equipped with a specific type of weapon.

Some recent examples of the so-called NCOD have been ruled on by the Information Commissioner and they may help FoI officers establish when this can be used.

Ken Bigley

Foreign and Commonwealth Office (FCO) [Ref: 50188323] - In this case the applicant asked for any information the FO held on the identification of a voice that is heard - presumed to be the killer - in the video in which British hostage Kenneth Bigley is beheaded.  The FCO argued that if it did confirm or deny (whichever was appropriate), it would effectively confirm that the Government has (or has not) managed to identify those responsible for Mr Bigley’s death, thereby confirming to those responsible that they may, or may not, be under suspicion. The ICO upheld the FCO’s decision to NCOD the information under S.23 (Security Forces) and S.24 (National Security) of the Act.

The home in Forest Gate London that was raided by terror police.

Cabinet Office [Ref: 50137790]

- The applicant asked for information held that related to a raid on a property in Forest Gate, East London, where two suspected terror suspects were arrested - one was shot but survived - and were later cleared of any involvement with terrorism. The Cabinet Office gave the applicant some information, directed him to a number of websites that also held some information but then refused to confirm or deny if it held any more claiming S.23 (Security Forces) and S.24 (National Security). The applicant said it was ‘absurd and an abuse of the Act’ for the Cabinet Office to refuse to confirm or deny that it held the information when it was obvious that it did, since the raid had been in the public eye and the Prime Minister would not have been able to respond to questions about it had the Cabinet Office held no information. The Commissioner agreed with the applicant and said because it was clear the Cabinet Office held information relating to the matter it should have said as much and then if it didn’t feel able to disclose it should have then applied exemptions to it. The ICO also said that it was not good practice to disclose some information and then NCOD if any other information exists. The Cabinet Office has now been ordered to state if it does hold any more information, and if it does to either disclose it or apply any exemptions it feels are relevant.

Plumpton Green

Sussex Police [Ref: 50205686]

- This was an application made on behalf of AsboData, a commercial company that aims to sell information packs to prospective homeowners. Some of the information it intends to sell is gleaned from public authorities using Freedom of Information Act inquiries. In this case it had asked the police for reports of anti-social behaviour in a particular street in the village of Plumpton Green. The police force refused to confirm or deny if it held such information saying that as there were just 15 homes in the street, the area was too small, and to confirm or deny it had such information would be a breach of S.40 (Personal Information). The ICO did not agree and seemed to suggest that 15 homes was not a group small enough to lead to personal data being disclosed. The ICO ordered the police to confirm if such information was held and if so to either disclose it or place the relevant exemptions on it. The decision has now been appealed by Sussex Police to the Information Tribunal.