Feeds

Undelete those deleted emails, FOIA ruling tells Government

But only if it's not too much trouble...

Designing a Defense for Mobile Applications

'Deleted' Government records needn't necessarily be treated as deleted after all, according to a ruling by the Information Tribunal, which deals with appeals against rulings under the Freedom of Information Act. But don't get too excited - although in theory this means that data that can be undeleted, restored from backups or reconstructed by specialists can still be supplied in response to FOIA requests, in practice the whole show will still collapse when it encounters the haphazard shambles that UK Government backup regimes amount to.

Information Tribunal chairman John Angel indulges in a substantial philosophical digression on the nature of deleted in this recent adjudication, which involved a request to the Royal Mail for personnel data which had been 'deleted'. The Tribunal's conclusion in this case was that the data really had been deleted anyway (so it couldn't be handed over, anyway), but the ruling also tries to nail down the extent to which deleted data can still be counted as "held".

First, the good news: "The Tribunal understands that information which is held electronically and then deleted (and even emptied later from a 'recycle bin' or 'trash can') is still in fact retained in its original form on the computer system until it is subsequently and actually overwritten by other information." In view of this "it may be incumbent on a Public Authority to make attempts to retrieve deleted information. Accordingly the authority should establish whether information is completely eliminated, or merely deleted."

The Tribunal's setting down of this obligation is certainly progress, because it means that authorities subject to FOIA requests can't simply say that, as the data no longer exists on a live system, it doesn't exist, full stop. The Tribunal doesn't philosophise on the extent to which backups are archive data or deleted data (bit of both, depends, right?) but here it doesn't really need to, because for the purposes of the Act it's effectively deeming all backup data as archived until it is completely deleted.

This overturns guidance from both the Information Commissioner and the Department of Constitutional Affairs. The Commissioner has regarded information on backups as not being "held by a public authority for the purposes of FOI", and that "information sent to the back-up server is no longer readily retrievable for business purposes" (ah, but see below...). The DCA, meanwhile, humorously tells us "where it is the intention that data should be permanently deleted, and this is not achieved only because the technology will not permit it, authorities may regard such data as having been permanently deleted."

But you'll have noted the Tribunal said "it may be incumbent..." That "may" is the catch. "If information has been deleted but can be recovered by various technical means, is that information still held by the public authority? The Tribunal finds that the answer to this question will be a matter of fact and degree depending on the circumstances of the individual case... Simple restoration from a 'trash can' or 'recycle bin' folder, or from a back-up tape, should normally be attempted, as the Tribunal considers that such information continues to be held." But beyond that, attempted restoration involving "the use of specialist staff time" would be subject to the cost exemptions in the Act. A local authority can refuse a request if the retrieval cost would be more than £450, while for a Government department the limit is £600.

So if it costs more than a few hundred pounds to undelete the data, you can be legally told to push off anyway. When it talks airily of restoring backups, one suspects that the Tribunal is not entirely in tune with the real world here. Even in a well run network restoration will often be a non-trivial task involving specialist staff (which, actually, it should be), and it seems perfectly feasible that an authority could successfully argue that simple restoration from a backup tape might in some cases exceed the cost limit. The Tribunal also suggests that "the Restore facility in Windows will restore the system to the way it existed on a previous date chosen by the operator" - we presume they've never been foolish enough to try this.

We should note an unpleasant little truth that springs from the Tribunal's conclusions. If there are no coherent groundrules or minimum standards governing public authority retention and archive policies (there aren't), then the worse the IT system is at dealing with retention, archive and backup, the less likely it is to have to respond positively to FOIA requests. There's a pay-off for bad IT strategy; 'I've deleted it' or 'It might be in there somewhere but it'll cost thousands to retrieve it' are deemed valid excuses, rather offences punishable by large fines, so that's all right then, and no, you can't have the information. ®

Using blade systems to cut costs and sharpen efficiencies

More from The Register

next story
BBC goes offline in MASSIVE COCKUP: Stephen Fry partly muzzled
Auntie tight-lipped as major outage rolls on
iPad? More like iFAD: We reveal why Apple ran off to IBM
But never fear fanbois, you're still lapping up iPhones, Macs
Nadella: Apps must run on ALL WINDOWS – PCs, slabs and mobes
Phone egg, meet desktop chicken - your mother
HP, Microsoft prove it again: Big Business doesn't create jobs
SMEs get lip service - what they need is dinner at the Club
ITC: Seagate and LSI can infringe Realtek patents because Realtek isn't in the US
Land of the (get off scot) free, when it's a foreign owner
Samsung threatens to cut ties with supplier over child labour allegations
Vows to uphold 'zero tolerance' policy on underage workers
Dude, you're getting a Dell – with BITCOIN: IT giant slurps cryptocash
1. Buy PC with Bitcoin. 2. Mine more coins. 3. Goto step 1
There's NOTHING on TV in Europe – American video DOMINATES
Even France's mega subsidies don't stop US content onslaught
You! Pirate! Stop pirating, or we shall admonish you politely. Repeatedly, if necessary
And we shall go about telling people you smell. No, not really
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.