Showing posts with label data protection. Show all posts
Showing posts with label data protection. Show all posts

Thursday, 25 April 2013

The Fine Art of Colouring In

When you ask for information under FOI, sometimes details have to be held back. What's reasonable, and how should it be done?


On 5 February this year, a requester called Nick Wintour wrote to the Police Service of Northern Ireland, via the What Do They Know website. He wanted to know the cost of the winning tender for a promotional video the service had commissioned, along with a breakdown of the costs and a copy of the tender document.

Their response was provided almost a month late, on 15 April. The video, he was told, cost £11,370 but the details could not be provided for reasons of commercial interest; and he was given, as requested, a copy of the tender document.

It was 50 pages long.

Most of the pages were blacked out - 39 pages in their entirety.

It's quite frustrating to receive a response like this. But is it justified? And how do you do it?

Marker Time

There are two kinds of FOI enquiries which take up a lot of time. One is where an exemption has to be claimed, which requires analysis, argument and careful judgement. That's often hard work, but it's usually interesting.

But there are other enquiries where most of the information is provided, but some needs to be withheld. And that means one thing.

It's chunky black marker time.

Redacting bits of information from a document is laborious and time consuming. It usually involves reading through the paperwork very carefully and obscuring details, usually with a black marker - what my counterparts in the University of Edinburgh used to call 'colouring in'.

It takes ages, after a while the words swim confusingly in front of your eyes, and if you're sitting in a small room, you will find yourself getting high from the marker fumes (some people see this as one of the perks of the job; I couldn't possibly comment).

Getting it right, in these circumstances, is difficult. And yet, it's also essential.

Traps for the unwary


(If you're an FOI requester, sorry about this bit, it's for FOI practitioners and it won't help you - the section you want comes next)

First up, have a big supply of black chunky markers and discard each one the moment it begins to give out: your marking needs to be black, not gray.

Second, don't send the requester a scan of the document: the light from a scanner can often reveal the underlying text. You may end up giving away more than you intended. Photocopy the marked document, and send a scan of the copy.

Thirdly, even blanked out details can be useful. If you're blanking out the names of Professor Hu and Professor Csikszentmihalyi in a document, it won't be too difficult for the requester to figure out who Professor XX is. Try and randomise your blanking.

Fourthly, don't use correction fluid (Tippex, Snopake etc). This can be scraped away to show what's underneath.

Finally, if you want to redact details from an electronic document, do it properly. Don't just put a layer of black boxes on pages of a PDF. Use proper redaction software (such as Adobe Acrobat) and if you have a Word Document with comments turned on, print it to PDF and send this.

What not to redact

Bearing in mind the tediousness of redaction, it's not surprising that FOI officers err on the side of caution - it's easier to blank a whole page than individual words, and there's less chance of missing something. You don't have much time to make decisions, so your process is likely to follow a simple rule: if in doubt, blank it out.

For this reason, if you think the information in your document has been wrongly redacted, don't hesitate to request a review or repeal.

Many organizations prefer to withhold complete documents rather than produce a redacted one, but very often most of the document can be provided with just some withheld. But what can you reasonably expect to be withheld?

The video contract mentioned above is a good example, and it's actually been properly done - each page is marked with the relevant exemption to show why it was withheld. This is good practice - often you get pages blacked out without reasons given.

In the contract, some redactions are very justifiable. It includes details on the personnel, their backgrounds and experience. Unless the company are using an Oscar-winning director, or inexperienced interns, there's no reason for you to have their personal details. It's not important. (Personal data is one of the most redacted items. Since most FOI officers also work in data protection, they're particularly cautious about this. In the case of animal research, withholding a person's name may protect them from injury.)

Secondly, information about the company's pricing is probably correctly withheld: it's specialist information of use to competitors and suppliers.

Not so clear is why the company's methodology is secret: making a video is a fairly straightforward process and there's not a great deal of room for different methods. Besides, the results would be plainly seen in the end product. I think someone's been overcautious here.

One particularly bad example of redaction happened to Irish journalist Gerard Cunningham (@faduda on Twitter). He asked for data on the government's Jobbridge scheme which allows companies to take on unpaid interns in receipt of social welfare benefits. The relevant department replied, but refused to disclose the company ID numbers - they said this would allow someone to log on and access the company data. He didn't mind, but he wanted to be able to match companies to jobs they were offering. He suggested they use a simple algorithm to replace the real number with a new one. They refused, saying they were not required to create new information. But of course this isn't creating information, it's obscuring it, in exactly the way you do with a black marker.

If you get a redacted document in response to an enquiry, it's difficult to avoid the feeling that the small amount of information blacked out is exactly the vital information you need. Sometimes it is - but sometimes even though it isn't, it just stares at you, taunting you. The chances are that it's been correctly withheld. But you should certainly been given reasons for the redaction and you should be prepared to challenge any you feel are not justified.

Friday, 7 December 2012

Information Roundup #3

Information Roundup #3

A roundup of recent FOI and data protection stories in the Republic of Ireland

Syrian wins appeal over failure to secure citizenship
It must now be 'unusual' for the reasons behind the decision-making of public bodies not to be provided, according to the Supreme Court. This is the outcome of a process in which a Syrian lawer, refused Irish citizenship, challenged the failure of the relevant Minister to disclose the reasons for doing so. FOI requests disclosed new documents but the Minister's reasoning was withheld; the Supreme Court, however, decided that this was unfair because it gave him no basis on which to challenge the decision.

Could Leveson affect Press Freedom in Ireland? 
Seamus Dooley, Irish Secretary of the NUJ asks if the Leveson suggestion that data collected by journalists might have to be disclosed could lead to a conflict with the Irish Supreme Court ruling that protection of sources is a constitutional right.

As part of the budget process, the Minister for Public Expenditure and Reform has confirmed that new Freedom of Information legislation is planned as one of a series of measures that include whistleblowing reform and legislation to bring greater transparency to lobbying activity.


Wednesday, 28 November 2012

Ordinary People

One person who has started using Freedom of Information legislation in Northern Ireland to get answers to some issues which concern him is Simon Whittaker, an IT security consultant.

As a regular public transport user, he says, "I see things which aggravate me about the way our publicly funded transport network is run". Observing the difficulties of the Code4Pizza.com project in trying to digitise and publicise timetable information for Translink, which runs the province's public transport network, he formed the opinion that "Translink was quite a closed shop and wasn't really interested in sharing information which it holds". (Note: this may change with the requirements to publish datasets in the Protection of Freedom legislation)

Concerned about security of data in the company's mLink application, which allows users to buy tickets on their mobile phone, he wrote about this in his blog, since it appeared that credit / debit card data was being sent unencrypted. He felt it showed very little thought had been paid to the security of users' data. This now seems to have been resolved.

In March, he wrote to them using What Do They Know.com, asking for details of their internal and external communications relating to security issues. They refused, citing commercial interests (Section 43). I would not expect all this information to be disclosed, since it might (a) reveal commercial secrets of a software supplier, and (b) might reveal a security gap which could be exploited by criminals (this would involve a different exemption). However, knowing that they have taken the issue seriously and have made positive efforts to respond is clearly in the public interest and they really should have provided some of what he requested, with appropriate redactions. He did not pursue it at the time because of other priorities.

On 21 September, he wrote once again through What Do They Know, asking for details of the cost of providing wifi services on the Network. This time he got the information he was looking for: it showed a total setup cost of over £700,000 and annual running costs of a quarter of a million pounds, with the majority going to fitting out the train system; new trains will include wifi as standard. This was picked up within a couple of weeks by a BBC report.

A further enquiry at the beginning of November asked for details of the research which had taken place to assess the likely availability and speed of the service, and to see the Service Level Agreement which had been entered into with the contract. The first part of his question received an answer, but the latter was withheld, once again using the Section 43 exemption. He has asked them to look again at this.

I believe he has good grounds for an appeal, to the Information Commissioner if necessary, though he is hoping to avoid this. "I'm also aware that this costs public money to do and would not undertake this lightly," he told me. Section 43 allows for information to be withheld if its release would damage the commercial interests of the public authority or an outside body. But there needs to be evidence that real harm would occur; examples would be disclosure of sensitive price information or trade secrets. A service level agreement, on the other hand, is exactly the kind of thing FOI is designed for - it allows the public to know that services offer value for money by ensuring that suppliers are penalised for not keeping their commitments. I can't see how a reputable company (or public authority) could suffer commercial losses through the disclosure of such information.

Simon's case is a good example of how FOI is changing the way we do things: as an everyday service user with specialist knowledge, he is exactly the kind of person who can add value to the work of public authorities by asking pertinent questions. Translink's responses have been prompt and helpful but show a wariness of disclosing information on their commercial transactions: not only should this be public data, it ought to help their work to have the public aware and able to comment on how this relationship is managed.

It's also a good example of how the Republic has fallen behind on the use of FOI: in the south, Simon would by now have forked out €45 for the information, with much bigger costs should he have to go to the Information Commissioner for help. "It was interesting," he says, "that it took me as an individual to ask these questions as opposed to them being asked by any reporters or audit offices". With reports that the Northern Ireland Executive wants to be allowed to charge for requests, this is an important point and one Simon feels strongly about: "In my view this makes a nonsense of the FOI act by ensuring that only the wealthy, companies and journalists have access to the information which makes our country run."

Monday, 26 November 2012

On the records

Two recent cases in the Republic about Freedom of Information and the Abuse of power

A Stroke Too Far?

In the Republic, Minister of Health James Reilly is in trouble - and Freedom of Information has a major part to play.

In July this year, working with Minister of State for Primary Care (a junior ministry) Róisín Shortall, the Department of Health produced a list of 20 primary care sites for development, a list weighted in favour of particularly deprived areas of the country. On 16 July, it was announced that this list, approved by the Minister of Health, was to be published; by now there were 33 potential locations on the list. When the list was published, it had grown to 35. There were two significant additions: Swords and Balbriggan, neither particularly deprived - and both in the Minister's constituency.

After it was disclosed that these locations had been added to the list after it was passed to Reilly's department, Minister of State Shortall - a member of the Labour party, minority partners in the governing coalition - said she found this 'difficult to understand'. Despite support from Labour rank and file, she was not supported and she resigned both the ministry and the Labour whip.

The accusation was made that this was 'stroke politics' - the kind of devious backroom deal that had been typical of Irish politics in the past - especially when it turned out that the site for the proposed Balbriggan centre was owned by a property developer linked to Reilly and his Fine Gael party. The Minister, who had had the list in his possession for a week before publication, explained that the selection of the sites was a complex operation: 'a logistic, logarithmic progression. There is nothing simple about it'.

But emails released under the Freedom of Information Act showed that the two sites in question were added to the list in just two hours, shortly before the list was published.

The opposition has demanded his resignation. In a country that cared about such things, he would have resigned already. But as a close associate of the Taoiseach, Enda Kenny, and as deputy leader of the majority coalition partner, it's unlikely he will go.

'Stroke' politics may be alive and well in Ireland, but at least things which used to be carried out in private have now been exposed publicly. Let's hope the voters take this into account at the next election.

Off the record

Another medical-related story in the Republic: in the continuing saga of Savita Halappanavar's death, her husband has obtained copies of her medical records. A major part of the story was her repeated requests for a termination of her pregnancy, which was refused. But the records, eventually disclosed to her husband's lawyer, make not mention of this. They refer to her requests for a cup of tea and toast, and a blanket - but the termination requests do not appear to have been recorded.

This point led to a fascinating and troubling discussion on the MagicMum website. Commentators repeatedly described the medical records of their pregnancy and delivery as plain wrong: "There were lots of things missing off my notes", "Each time I was in hospital I would cry in agony during the night and request pain relief. Each morning was noted "patient slept well", "My notes were very different from the reality", "totally not true", "a work of fiction masquerading as medical notes", "My notes said I refused to push. I bloody did not."

One contributor pointed out that, in an understaffed wards, mistakes were inevitable: "When notes are being written , there are three things , what the patient thinks happened , what the staff member thinks happened and what actually happened . All of which are different ."

But others pointed out situations where facts seemed to be suppressed or distorted for a reason, especially when touching on the controversial subject of abortion:

"I've had an abortion previously and told the Coombe [Hospital] so. The midwife insisted on recording it as a 'confidential' pregnancy, saying that that was how they record them all, despite the fact that I told her 3 times I didn't mind it being recorded as an abortion."
"I went to two different hospitals over 5 pregnancies. The first of those 5 pregnancies resulted in a termination. That hospital put it down as an abortion on the following pregnancy. I changed hospital and on the next three pregnancies they recorded it as a miscarriage along with my other miscarriages. I told them at each booking in appointment that it was an abortion and they listed them all as miscarriages at 14, 13 and 10 weeks."

 Worryingly, while some contributors had been given easy access to their records, others found it difficult:

"I asked to see them once and the nurse told me I wasn't allowed see them. She went off to check with someone and came back to say I definitely wasn't allowed see them."
"I applied under data protection and was told that as I had a private consultant, the notes were not mine but his property."

"After my first was born, I wrote a complaint in my notes under the delivery records - when I requested my notes a year later, the page was photocopied and my complaint was cropped."

"I browed through and mixed with my notes were the notes of a totally different patient."
This is a really good example of the importance of Freedom of Information legislation available to ordinary people. One way of ensuring that accurate records are kept is to encourage people to check their own records. Falsifying information or playing down uncomfortable realities is an abuse of power - and one that can only be answered by ensuring that everyone has the right to tell their side of the story. It should not take a tragedy like that of Savita Halappanavar to get this message across.

Practice note: the access regime for personal data in the Republic is the opposite of that in Northern Ireland. In the south, personal data is provided for free by public authorities but other requests require a fee paid; in the north, FOI requests are free but Subject Access Requests for personal data require a charge (not always levied).




Tuesday, 20 November 2012

The Global Reach of Ireland's FOI

Because the Republic of Ireland's FOI law just applies within the state, it's easy to forget that it has much wider implications in this globalised world. Here's an example.

An article on the Croation website Help Net Security reports on the conflict between Facebook - an American multinational - and the data protection laws of the European Union. Facebook has complained that the threat of big penalties for breaches of data protection rules will discourage big companies - such as, well, themselves - from investing in Europe.

The article quotes an Austrian-based website called Europe Versus Facebook, which has obtained documents showing Facebook's lobbying activities, through a Freedom of Information request - to Ireland's Data Protection Commissioner.

It shows Facebook arguing against European Data Protection Commissioners cooperating; against 'privacy by default' settings, against the 'right to be forgotten', strong data breach notifications, heavy fines for breaches, and in favour of easier transmission of data outside the EU.

The document includes a briefing for the Minister of Justice and Equality, prepared for a meeting with representatives of Facebook, which notes that 'we must also seek to ensure that the interests and jobs created by stakeholders operating in Ireland are protected'.

Facebook has its European headquarters in Dublin, and is planning a major extension in the city.