A supposedly serious blog post about information security, in which the author unconsciously reveals his jealousy over men who have more hair than him

by | Oct 14, 2011 | Data Protection, Data Security, FOI, Oliver Letwin

Once upon a time, MPs made a huge fuss about the risks to Parliamentary privilege of FOI, and the possibility that people could make FOI requests and obtain copies of correspondence from constituents. Under the noble leadership of the quad-bike riding David Maclean, they made an attempt to exclude Parliament from FOI’s scope altogether – not to hide expenses, just to protect constituents’ correspondence.

And you may now turn off your sarcasm filter. According to the Public Whip website www.publicwhip.org.uk/, we cannot know Oliver Letwin’s views on this matter, as he was absent from all the votes. However, his apparently laissez-faire attitude to correspondence in general, as reported by the Daily Mirror and other gleeful newspapers suggests that he may not have been that exercised by it: see the Mirror for more http://tinyurl.com/65vwf3r, including excellent photos of Mr Letwin dumping official letters in bins on his early morning walks.

Mr Letwin is usually good value for money – he has a Bertie Wooster-ish quality, a silly ass accidentally let loose in the establishment. There was the time he went into hiding after claiming that the Conservatives would cut £20 billion from the public budget (one can only hope he spent his time sheltering in the equivalent of the Drones Club). There was the wonderful moment when his house was burgled when a chap knocked on his door early in the morning, and he just let him in (http://tinyurl.com/67577tq). And, like his fellow Cabinet Office minister Francis Maude, he has fascinating hair (Maude could just fit into P.G. Wodehouse, but he would be a smooth-talking cad with a smoking jacket).

What annoyed me about the typically daft nature of the Letwin letters incident (bingate? parkgate? sillyassgate?) was the Cabinet Office statement that no sensitive information was included. Instead of an admission that a bin in a public park is no place for any form of official correspondence, and one of Letwin’s engagingly frank apologies (which I assume we’ll get at some point), they imply that this is not a serious issue. We don’t know how serious it is, but there is a strong possibility that the Data Protection Act has been breached.

Ministers and MPs sometimes froth with outrage at the flaws of others, and treat themselves slightly differently. Admittedly, Letwin himself is more cerebral and not prone to soundbites, but the people I work with – councils, housing bodies, NHS trusts, NDPBs, companies – are the kinds of organisations whose slips, mistakes and foibles are occasionally blown wildly out of proportion by politicians. So when someone at the centre gets it wrong, they should say so immediately. This is a straightforward breach of proper records management, good quality data protection, and common sense, unless it did not happen.

There were all sorts of questions I had after reading the Cabinet Office’s bland statement, so I decided to end on an FOI request to the Cabinet Office. Whether there is any point in asking such questions is a legitimate question – perhaps we should write this off as another example of Mr Letwin’s idiosyncratic style – but I know that if one of my clients had a gaffe like this, they’d get FOIs ten to the dozen. So this is mine.

  • has Mr Letwin disposed of correspondence containing personal data about other people?
  • Did the correspondence relate to his constituency role, his Cabinet Office role, or both?
  • what kind of details were included (e.g. names and addresses, email addresses, information about personal circumstances or complaints)?
  • Has either Mr Letwin (in his capacity as an MP) or the Cabinet Office (as a data controller) informed the Information Commissioner of these incidents, on the basis that there is a possibility that the Seventh Data Protection principle has been breached, as it relates to security?
  • Has Mr Letwin received any data protection training in his capacity as a Cabinet Office minister?
  • Is any such training now planned?
  • When the statement provided by the Cabinet Office was released, claiming that the information disposed of was ‘not sensitive’, had the person making the statement considered the Data Protection implications of disposing of correspondence in bins in public parks?
  • Does the Cabinet Office have a policy or procedure about the appropriate disposal of paper records?