by | Apr 16, 2013 | Data Protection, FOI, ICO, Richard Thomas | 4 comments

The Information Commissioner’s attempt to replace the previous “gold standard” FOI complaints handling with something slightly less rigorous was a good idea. I think the delays of Richard Thomas’s era were shameful, as regular readers of this blog will know (how are you both?). However, Graham flattered his predecessor. What was on offer was bronze – variable, timorous decisions made after fossilised delay – so the challenge was not simply to cut the backlog, but to make consistently good decisions as well. The fact that Graham’s regime now offers increasingly mediocre decisions delivered relatively quickly means that we’ve swapped bronze for the stuff they wrap a Kinder Surprise in.

You might think that this is merely show-off hyperbole. Hopefully you’ve been reading this blog long enough to know that I don’t care what you think, but even so, the objective observer doesn’t have to look far to find evidence of decisions rolling off the production line bearing the hallmark of baloney. Take this one, highlighted by the estimable Jon Baines on his blog. A Chief Inspector working for Sussex Police apparently sent some inadvisable messages from his work Blackberry, including a nursery rhyme about a disabled child. Oh, my aching sides.

Matthew Davis duly dispatched an FOI request to the force, which maintained that they didn’t hold the information in question, as it had been sent in a personal capacity. As long as the information was not being used by the force for any formal or official purpose, this would be true, but as Davis’ request was prompted by the fact that Sussex were reportedly investigating the issue, this claim was wrong, as the decision notes. So far so good. Regardless of the sender’s original intentions or expectations, once information is being processed for an official purpose, it’s up for grabs. Another candid copper came a-cropper* when expressing regret over her inability to make progress with her CPD because someone hadn’t died. As the force pointed out, whatever she expected, the information had to be disclosed.

In my opinion, the decision nosedives by accepting the argument that the message is the Chief Inspector’s personal data. My opinion is clearly ill-informed, as I am basing it on what the Sun said. However, if we take the significant risk of accepting what they say at face value, the requested data is a rude version of the Twelve Days of Christmas without any context. I don’t know the work in question, but it’s presumably on a par with the extended [insert name of town you don’t like] Earthquake Appeal gag that people with boring jobs email to each other (Google’s top result for it at the moment is Barnsley). Even if Chief Inspector Ling was the author of the rhyme, I don’t think you could easily argue that it was his personal data. However, assuming that he wasn’t, I don’t believe that the fact that he forwarded the email to others makes its contents is his personal data.

Consider paragraph 16 from the decision: “The Commissioner notes that the withheld information is information that clearly relates to an individual, the Chief Inspector whose name is readily identifiable via the press. The information was sent from his phone and the information is clearly held by the Sussex Police in a way that clearly relates it to him. Context is important and in this context the Commissioner accepts that the public would learn something about the Chief Inspector if it was disclosed.”

Apart from the fact that he’s almost certainly a tool?

The fact that the Sun has already identified Chief Inspector Ling doesn’t automatically remove the DP considerations, but if the biggest risk is that the data subject might be identified, then frankly, the horse is well on its way to Tesco and the stable door is swinging in the wind. The notice itself identifies Ling by referring to the press coverage. If this was truly Ling’s personal data and the force was concerned about identifying him, Sussex’s only roll of the dice was a prim ‘not confirm / deny’. We’re not saying if an officer did or did not send a rude rhyme to his mates, and even if one did, we’re not saying which one it was. This approach seems illogical in the face of the Sun story, but anything else identifies Ling by confirming that the rhyme is held (or rather, not held because it was personal. If the Sun had it completely wrong and he didn’t send the emails, the lack of a not confirm / deny is outrageous.By rejecting the ‘not held’ line but accepting the personal data argument, the ICO have identified Chief Inspector Ling anyway.

However, I think this premise is flawed on its own terms. The highest UK court precedent for determining what is personal data – the Durant case – is full of contentious and controversial elements, but nevertheless, it provides at least one refinement of the DPA which I always find myself coming back to: focus. What or who is the focus of the rude rhyme about Hastings? Even if Ling wrote it, it seems safe to assume the focus of the rhyme is Hastings and the fine folk who inhabit it. Without any comment that he may have added about the rhyme (whether it’s ‘have you seen this disgraceful slur on the good citizens of Hastings?’ or ‘OMG! LOLZ!?!?!’), it’s just a rhyme. If an individual citizen of Hastings is identified in the rhyme, it could be their personal data, in the way that Katie Price’s disabled son would be the subject of one of Ling’s other alleged missives. But this rhyme is not Ling’s personal data.

Of course, knowing how dreadful the rhyme is might allow the recipient, and the wider public, to draw inferences about Chief Inspector Ling. Indeed, I’ve already decided precisely what kind of a person I think he is based on the allegation about him forwarding a Harvey Price joke. This decision notice already seems to confirm a senior police officer sent jokes that were sufficiently crass that they provoked complaints that led in turn to his suspension. What’s left in terms of personal data to be revealed? That Ling’s version of the Twelve Days Of Christmas is worse than just packed with gags about shellsuits and teenage mums?

As I have already admitted, I have made a series of assumptions, and the ICO – in receipt of all the correspondence – are in a better position to make the decision. But if their own formal decisions make no sense, I think it’s reasonable to speculate. We already know that the silver standard includes such impressive techniques as unattributed copying from Wikipedia, and now comes a definition of personal data with seemingly unlimited elasticity. What next?

* I would like formally to apologise for this horrible doggerel. I am deeply ashamed.