Mark Hynes, LBWF Director of Governance and Law, receives a second successive rebuke from the Information Commissioner’s Office: what’s going on?
As a previous post has revealed, though LBWF’s Director of Governance and Law, Mark Hynes, doubles as the council’s Data Protection Officer, his understanding of how information on individuals should be handled on occasion is completely at odds with the experts of the Information Commissioner’s Office (ICO).
Some recent correspondence provides a further illustration of Mr. Hynes’ embarrassing divergence from the legal mainstream.
The letter reproduced below from an ICO case officer to Mr. Hynes concerns a complaint that the redoubtable Waltham Forest Echo journalist, Michelle Edwards, has made about how LBWF handled two inquiries of hers submitted under the Freedom of Information Act (FOIA).
The point in contention is Ms. Edwards belief that she has the right under the existing legislation to submit her requests, and also receive answers, on paper, rather than via any electronic medium; and LBWF’s response that its preferred option for communication is ‘the online FOIA portal offered by the Council’, and if Ms. Edwards wishes to be considered an ‘exception’, then she should submit ‘medical evidence’ in mitigation.
What the letter explains is the case officer’s adjudication, and it doesn’t make pretty reading for Mr. Hynes.
On the ‘paper versus portal’ question, the case officer rules firmly in Ms. Edwards’ favour:
‘Section 11 of the FOIA and Regulation 6 of the EIR [Environmental Information Regulations] are clear that requestors may, within reason, specify the form and the format of the information they wish to be provided. Whilst this does not confer an absolute duty on public authorities to provide the requested information in the format requested, it does mean that “reasonable” requests should be complied with’.
And regarding the possible submission of ‘medical evidence’, the decision goes the same way:
‘I would strongly advise the Council to cease asking requestors if there is any medical necessity to their form and format preferences. As the relevant consideration is the “reasonableness” of the preference, such requests for sensitive personal data are disproportionate. I would also remind the Council of its obligations under the GDPR and Data Protection Act 2018 in regard to Special Category data (which would include medical data)’.
How can it be that Mr. Hynes, twice in a few months, has found himself so comprehensively upbraided?
The issues themselves are not arcane. Indeed, to anyone familiar with the legislation, LBWF’s arguments and actions in this case are almost amateurish in their reasoning, as if composed by an ill-informed and rather petulant novice.
What’s gone wrong?
Some of the explanation is the fact that Mr. Hynes has become extremely thinly spread.
At LBWF, he is not only Director of Governance and Law and Data Protection Officer, as already noted, but also Returning Officer.
In addition, he heads up a new organisation called Eastern Legal Partnership, essentially the LBWF legal department, which aims to provide cut-price advice and services to ‘other public sector organisations such as other borough councils, housing associations, NHS, schools and academies and others’.
And on top of all that, during his time at LBWF, he has always held various outside executive positions, including directorships at Solace in Business Ltd. (terminated in September 2017), The Society of Local Authority Chief Executives and Senior Managers (Solace Group) Ltd. (current), and PRNH Ltd. (current).
That is a substantial workload, and there are indications it is proving too much. In his Companies House listing for Solace in Business, he is mistakenly described as a ‘Local Government Chief Executive’, something that he really should have spotted and corrected. If the same source is checked for PRHN Ltd, which appears to be a small family company, it reveals the following:
And, finally, there appears to be an emergent issue about postal votes in the recent general election, with the East London and West Essex Guardian reporting that an ‘administrative error’ at LBWF led to the very late delivery of forms to as many as 1,470 residents, something that the Electoral Commission no doubt will be unhappy about.
Needless to say, none of these infelicities in themselves are hanging offences, but cumulatively they are nevertheless striking, and suggest that Mr. Hynes is finding himself under pressure.
The lesson to be learnt is obvious. LBWF employs Mr. Hynes, and determines his duties. It now needs to step in and ensure that he is not overworking himself, and in particular that, as Data Protection Officer, he has more time to familiarise himself with ICO expectations.
15th November 2019
Case Reference Number…[XXXX]
Dear Mr Hynes
I write to you following a number of complaints received by the ICO from Ms Michelle Edwards, which concern the handling of her Freedom of Information requests to the London Borough of Waltham Forest (“the Council”).
Ms Edwards has brought to our attention the Council’s handling of two particular requests; FOIX364476 and FOI70978012 respectively.
Whilst the Commissioner is not progressing complaints about these two requests to substantive investigations, they present an opportunity for the Commissioner to advise the Council on two areas of compliance with the FOIA and the EIR.
Form & Format
In the 20 September 2019 internal review of request FOI70978012, the Council acknowledges that Ms Edwards specified her preference for a paper-copy of the requested information at the time of her request. The review explains that a copy of the requested information was provided electronically within the 20 working day window, “ostensibly in compliance with the request.”
The Council goes on to offer Ms Edwards the opportunity to provide medical reasons why she cannot use the online FOIA portal offered by the Council, through which responses to requests can be accessed digitally. It writes that it may consider an “exception” on these medical grounds.
In the 25 September 2019 internal review of request FOIX364476, the Council again acknowledges Ms Edwards’ preference for the requested information to be provided in paper format. The Council explains that a refusal notice under Regulation 12(5)(e) of the EIR was issued by email, but goes on to say that “the information” was provided electronically. One reading of this is that some of the requested information was provided to Ms Edwards electronically, notwithstanding the refusal notice. The Council justifies the electronic provision of this information by citing its “endeavours to reduce the carbon footprint”.
Advice
Section 11 of the FOIA and Regulation 6 of the EIR are clear that requestors may, within reason, specify the form and the format of the information they wish to be provided.
Whilst this does not confer an absolute duty on public authorities to provide the requested information in the format requested, it does mean that “reasonable” requests should be complied with.
In both cases – FOI70978012 and FOIX364476 – the Council eventually provided the requested information to Ms Edwards in paper format. On this basis one can infer that the Council considers Ms Edwards’ preferences to be reasonable, but in both cases failed to comply with these preferences in its initial responses to the requests.
I would therefore ask that the Council pays careful attention to reasonable form and format preferences, and that it, in the first instance, provides the requested information in compliance with these preferences.
Lastly, I would strongly advise the Council to cease asking requestors if there is any medical necessity to their form and format preferences. As the relevant consideration is the “reasonableness” of the preference, such requests for sensitive personal data are disproportionate. I would also remind the Council of its obligations under the GDPR and Data Protection Act 2018 in regards to Special Category data (which would include medical data).
Valid requests for information
In the 20 September 2019 internal review of request FOI70978012, the Council writes that, in order to reduce the Council’s carbon footprint, FOIA requests are received and responded to using an online portal. This is repeated in the 25 September 2019 internal review of request FOIX364476.
Advice
All that is required under the FOIA for a request for information to be valid is that the request is in writing, states the name of the requestor and an address for correspondence, and describes the information requested. The EIR relaxes the requirement that a request be made in writing.
Therefore, whilst the Council can express a preference for the manner in which requests are made, it cannot require that requests are made in their preferred format, assuming that these requests otherwise meet the criteria of a valid request. Again, I would strongly advise the Council to cease asking requestors if there is any medical reason why they could not comply with the Council’s preferences for the submission of requests for information.
Lastly, I would emphasise that it is in the Council’s own interests that these concerns are considered. If these concerns are appropriately addressed – within the Council – one would expect to see a resulting decrease in the number of complaints submitted to the ICO.
I trust that this is helpful. Further relevant guidance can be found at the following links:
and
I would welcome any comments or questions you may have by return. A copy of this email will also be sent to you by post.
Yours sincerely
…[XXXX]
Case Officer
Information Commissioner’s Office
…[XXXX]
For information about what we do with personal data see our privacy notice at www.ico.org.uk/privacy-notice
