Original URL: https://www.theregister.com/2010/11/09/is_contactpoint_database_illegal/

Did UK.gov break the law with its child database?

Whitehall promises answers on specs of binned ContactPoint

By Jane Fae

Posted in Legal, 9th November 2010 11:50 GMT

Analysis Did the Department of Education (DoE) – or Children, Schools and Families (DCSF), as it was then known – knowingly break the law in its establishment of the ContactPoint database?

The instant answer is: we don’t know. However, a history of excuses, delay and avoidance of awkward questions is starting to mount up. If the department has nothing to hide, it is certainly acting as if it has.

Meanwhile, in a bizarre new development, the DoE contacted us to say that its previous refusal to reveal what data it had been planning to collect had been a mistake. In fact, the information coded as “commercially sensitive” was not after all commercially sensitive – and they are now free to release it to us.

The ContactPoint database was first mooted in 2004 as a response to failures in the social care system – most notoriously in the case of Victoria Climbié.

There, the fact that various case workers dealing with Victoria’s family failed to share their knowledge was considered to have contributed to the child’s eventual terrible death. As a result, the government determined that it would set up a database enabling any and every person likely to be called upon to look out for a child’s welfare to access current dealings with that child at the touch of a button.

That was the original vision: wide-ranging information about all children, available to all. It did not long survive public criticism, with fears that too much information on such a base would be a massive risk to child welfare in its own right. A slow but insistent whittling back of the categories of person allowed access to the base began.

Thus, from a base that would enable care workers and police to share information about children at risk, it dwindled to little more than a glorified interdepartmental telephone directory, linking the contact details of individuals who had had dealings with any particular child through a central online database. It would not even be available to all police or all care workers, being operated instead through a series of gatekeepers.

This, in turn, led to a number of arguments as to the numbers likely to have access to the database – and one of the first signs that the DCSF preferred to keep its good works hidden rather than see them exposed to the light of day. In 2008, following work by the Register looking at the categories that the government claimed would have access to the base, we suggested publically that far from the low figure trumpeted – of near 300,000 – the end result was likely to be closer to 1 million.

This was vigorously denied – but our story led, eventually, to a statement being sneaked out in the last days of the 2007/8 parliament to the effect that the numbers would be closer to 400,000 - or 25 per cent higher than originally announced.

However, the possible law-breaking lies in a rather different area. Instead of simply passing a law enabling the Secretary of State to set up a database for purposes of child protection, the Children Act 2004, refined by regulations published in 2007, went into mind-boggling detail as to what the Department might do. Section 12 of that Act reads rather more like a management data specification than UK legislation. It states that the Department may collect information such as the name, address, gender and date of birth, an identifying number and contact details of any person with parental responsibility.

Crucially, by including so much detail, it raises the possibility that collecting information not on this list is likely to be unlawful.

The categories of information included in that list are not many, nor are they difficult to capture. The largest cost, according to suppliers of systems of this kind, was likely to be around the ETL processes necessary for scraping contact details from a dozen or more different governmental systems in order to feed data into the ContactPoint base.

Nonetheless, the cost, widely publicised as £224m, looked well out of kilter with what was being proposed, and we began to wonder if the DCSF hadn’t actually exceeded its brief, and that it was not, in fact, collecting rather more than the legislation allowed.

An official statement from the DoE recently revealed: "The final total cost of setting up ContactPoint has not yet been determined but it will be less than the budget provision of £224m. The set-up costs cover the design, build and test of the system; however, the cost of coding and other individual elements of the work can not be separately identified."

No comment, until now

However, back in 2008 we started asking questions about what data was being captured. In fact, we were more specific than that, asking for a list of what data was being held in the system – minus any meta-data details that could impinge on the system security.

Back came the response: no way. Releasing such details would be a risk to security. In vain we countered that we couldn’t see how it would be. The DCSF were immovable.

Fast-forward to this year and news that ContactPoint is to be scrapped and its data deleted for ever. This time we bunged in an FOI request, asking much the same question.

It took time. First we received the excuse, so frequently used by government departments, that it needed more time to answer. Though we can’t quite understand why, since after about two months, the shiny new Department of Education came back with another “no”. This time, the excuse was ever so slightly different: "The release of the information requested in this case could prejudice the system supplier’s commercial and financial interests as the design principles embodied in this information could be replicated by competitors. This information, if disclosed, could damage the system supplier’s business reputation and their customers’ confidence."

In addition: "Disclosure could also weaken the system supplier’s position in a competitive environment by revealing market-sensitive information or intellectual property information which could be useful to their competitors."

Oh, and data security as well. The department stated: "Releasing the data specification would not, on its own, present a direct threat to the security of the system. However it would, if made available to someone with the relevant IT knowledge intent on attacking the system, give them valuable information on how to most effectively probe for any security weaknesses."

We are appealing that one. We have also lobbed in a second FOI request. This time, we are asking not for the data spec but the logical spec used as brief for the base. Surely, we reasoned, that could not be commercially sensitive. We were still waiting until just a few days ago.

Twice we had been gently rebuffed with the suggestion that since it all happened under a previous administration, the department can’t see why anyone would care anymore. Would that apply to criminal acts committed by ourselves, we wondered? Er, of course not.

Two weeks ago, we asked again for an explanation of department's reluctance to answer simple questions on this issue. It looks like we might be getting a few answers this time (on the logical spec issue).

We also put it to the DoE directly that we believed it might have been acting unlawfully and asked for it to respond.

Then, on Friday, a reply – from a committee tasked to review its original decision not to release information. They tell us: “During the review it came to light that protective markings included on some of the information had been included in error. These markings had indicated that the information was commercially sensitive. It has now been confirmed that this is not the case.”

Ooops!

Still no sight of the information requested – we must now let them have a snail mail address for them to release documents to. When we receive it, we will carry out our own review. Did the DoE stick to the letter of the law? We have no idea – but we will let you know. ®