Feeds

Does Gove’s webmail policy breach Data Protection Act too?

FOI-fudging foolery might've been the least of Mrs Blurt's boo-boos

Beginner's guide to SSL certificates

Does the use of Gmail or Hotmail by a Minister's Private Office (in order to evade Freedom of Information (FOI) obligations) also lead to breaches in the Data Protection Act? Well, I can see how this could be the case.

The press has raised this issue only in the context of FOI. Yesterday's Sunday Times, for example, noted that the allegations facing Michael Gove and his special adviser, Dominic Cummings, were that by using personal email accounts, they were assuming that any requested information could not be held by a public authority and therefore not subject to a FOI regime.

A spokesman for the Department for Education (DfE) has told the press that "The Cabinet Office is clear that private email accounts do not fall within the FOI Act and are not searchable by civil servants. Neither the Secretary of State nor special advisers have been asked to disclose emails sent from private accounts".

The DfE spokesman then added: "The Permanent Secretary is satisfied that ministers and special advisers act within the law." Despite this, the Information Commissioner has entered the fray and has said that private account emails discussing Government business could be subject to FOI requests.

Whether these emails are, or are not, subject to FOIA will no doubt be resolved in the near future. However, what I am certain about is that all these emails contain some personal data (even if the personal data is limited to email addresses) and these emails are regulated by the Data Protection Act.

Mr Gove, the Sunday Times reports, uses the username of “Mrs Blurt” in his emails. However, suppose the advisor (Dominic Cummings perhaps using the name of “Mr Blurt”) sends an email to “Mrs Blurt” or vice-versa. Now further suppose that email says the following: “Can we talk to the Whips to make sure that Joe Bloggs MP does not get on the Standing Committee that is scrutinising the Education Bill?”. (This kind of exclusion happens as MPs are usually selected for Committees by the Whips on the basis the less troublesome they are, the easier it is for Government business to get through).

Perhaps another email might go: “I have just had a meeting from Head Teacher X who publicly asked some very awkward questions about our education reforms. Just in case there are ‘future complications’ , I recommend that this head teacher’s school should not be in the first wave of schools that get compulsory Academy status?”.

Could these be the sort of emails that a special advisor could send to a Minister – especially if they think the FOI regime does not apply? Well I think this is distinctly possible.

First data protection question: are these emails personal data? I think we can say: “obviously yes”. There are four data subjects: Mr Gove, Dominic Cummings (i.e. “Mr and Mrs Blurt”) and the MP or Head Teacher X. Who is the data controller? Well if it is not the Department for Education (remember, the claim is that the emails are exempt from FOIA) then it has to be Mr Gove and possibly Mr Cummings as well.

Does the personal data fall into the domestic purpose exemption in Section 36 of the DPA? Well, if there are emails that have the content described above, I suggest that this exemption is inapplicable. Do the emails impact on the MP and Head Teacher mentioned in them, so much so that they should be informed about the processing purpose via the fair processing rules? Well, I can’t see an exemption from this obligation.

Michael Gove, as an MP, has a register entry that describes his constituency casework for the purpose of “the carrying out of casework on behalf of individual constituents”. Any “personal emails” about an MP or head teacher as postulated above have nothing to do with this purpose as the data subjects are not constituents. Dominic Cummings, as of today, is not registered at all.

So we have one, possibly two data controllers, likely to be processing personal data in breach of the data protection principles:- one for an unregistered purpose and the other just, plain simple unregistered. Not only could we have FOI evasion but we are also likely to have DP evasion in addition. This means that Mr Gove has gone one better than Tony Blair: Mr Blair only disapproves of FOI.

So if the Information Commissioner finds resistance to his FOI enforcement powers, perhaps he should put his data protection hat on. After all, I think the data protection arguments are sound and failure to comply with the Commissioner's data protection powers can be a criminal offence (unlike with FOIA).

This story originally appeared at HAWKTALK, the blog of Amberhawk Training Ltd.

Choosing a cloud hosting partner with confidence

More from The Register

next story
NSA mass spying reform KILLED by US Senators
Democrats needed just TWO more votes to keep alive bill reining in some surveillance
Bada-Bing! Mozilla flips Firefox to YAHOO! for search
Microsoft system will be the default for browser in US until 2020
Google bags OBSCENELY LARGE Times Square ad space for New Year's
Choc Factory pays millions for whacking new digital screen
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Getting ahead of the compliance curve
Learn about new services that make it easy to discover and manage certificates across the enterprise and how to get ahead of the compliance curve.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.