Feeds

ICO issues guidelines on #FOI #requests through Twitter, Facebook

I can haz information?

New hybrid storage solutions

The Information Commissioner's Office (ICO) has issued new guidelines for public authorities around how they can respond to freedom of information (FOI) requests made via social media.

The watchdog confirmed that FOI requests made via messages to accounts operated by public bodies on sites such as Twitter or Facebook can trigger those organisations' duties to disclose information under the FOI Act, or its equivalent in Scotland.

The guidelines explain, though, that public bodies do not need to respond to requests for information unless the requesters' real name is clear.

"Where the requester’s username is an obvious pseudonym, or only includes a part of their real name (for example @john3453 or @smith6474) then the request will only be valid if their real name is visible elsewhere on their user profile," the ICO's new guide (24-page/389KB PDF) said.

"However we would urge authorities to remain mindful of the applicant and motive blind principles behind the Act in any case where they are not satisfied as to the requester’s identity but would still be content to disclose the information."

It added: "Where an authority does refuse the request on the grounds that the name is invalid, we would expect it to fulfill its ... duty to provide advice and assistance to those wishing to make a request by advising the requester to resubmit the request using their real name."

Tweet them back, bro

The ICO also explained public bodies' obligations around disclosing information to requesters via the same medium they used in their request, and how those organisations can overcome some of the "technical constraints" that may arise in a social media context.

"If the requester has effectively made the request public by publishing it on a website, as opposed to sending a private message to the authority’s account, then we will consider it within the requester’s reasonable expectations that the authority will also publish its response on the site," the ICO said.

"However, if the authority has any particular reason to believe that it would be inappropriate to publish the information online, then it may wish to respond via a private message to the requester’s account instead. If this facility is not available then it should obtain an alternative contact address from the requester."

It added: "Issues may also arise if technical constraints make it impractical for the authority to provide a response through the site in question. For example, where a request is submitted through Twitter, the limitations on the length of a ‘tweet’ may prevent the authority from providing its full response via that site. Where this is an issue the authority should address the problem by asking the requester to provide an alternative email or postal address where it can send its response. Another possible solution would be for the authority to post the information on its own website and post a link to this from the site."

The guidance also contains advice on how public bodies' responsibilities to disclose information under the FOI regime may be triggered where the requester seeks information that contains keyword terms. It said that requests for documents featuring certain words will generally be valid "because they make a distinction between information that does and does not contain those keywords". However, it said where keywords are common, public bodies may have a right to reject requests that are "unreasonably broad".

"We recognise that there is a possibility a requester may cite a keyword so common that it makes the scope of the request unreasonably broad," the ICO said. "Where this is the case the authority should consider refusing the request ... and contact the requester to ask them to narrow down their request. There might also be circumstances where the framing of a request using a very common keyword may be an indication that the request is vexatious."

Copyright © 2014, Out-Law.com

Out-Law.com is part of international law firm Pinsent Masons.

Security for virtualized datacentres

More from The Register

next story
Found inside ISIS terror chap's laptop: CELINE DION tunes
REPORT: Stash of terrorist material found in Syria Dell box
Show us your Five-Eyes SECRETS says Privacy International
Refusal to disclose GCHQ canteen menus and prices triggers Euro Human Rights Court action
Radio hams can encrypt, in emergencies, says Ofcom
Consultation promises new spectrum and hints at relaxed licence conditions
Heavy VPN users are probably pirates, says BBC
And ISPs should nab 'em on our behalf
Former Bitcoin Foundation chair pleads guilty to money-laundering charge
Charlie Shrem plea deal could still get him five YEARS in chokey
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.