Tag: Audit Commission Act 1998

EXCLUSIVE: Wirral Council admit disclosure of NI numbers, dates of birth & names of nearly 200 staff was a mistake

EXCLUSIVE: Wirral Council admit disclosure of NI numbers, dates of birth & names of nearly 200 staff was a mistake

EXCLUSIVE: Wirral Council admit disclosure of NI numbers, dates of birth & names of nearly 200 staff was a mistake

                                                                          

Surjit Tour (left) at a recent meeting of Wirral Council's Standards and Constitutional Oversight Committee
Surjit Tour (left) at a recent meeting of Wirral Council’s Standards and Constitutional Oversight Committee

The background to this story is that last year Wirral Council accidentally divulged to me around two hundred people’s names, dates of birth, national insurance numbers, job titles and whether they were in the Merseyside Pension Fund (that Wirral Council administers) or not.

This is my response to Wirral Council (and ICO on this matter).

Dear Surjit Tour, Caroline Flint (ICO) and others,

Thank you Mr. Tour for your letter of 28th April 2015 (your reference ST/CG) and the email from ICO’s Caroline Flint dated 30th April 2015 (ICO case reference number RFA0568370). As both communications cover the same topic I am writing this joint response in reply.

I will deal first with an error in the response in the email from ICO. The first sentence in that email states “Thank you for raising your concern with us about Wirral Metropolitan Borough Council’s (Wirral MBC’s) handling of your personal data.”

None of the personal data that this matter relates to is about myself.

Moving to Mr. Tour’s letter of the 28th April 2015, paragraph 2 correctly states that I requested “eight lengthy contracts/leases” (one of which is the PFI contract with Wirral Schools Services Limited that this matter relates to).

Although not implicitly stated, it is implied that I was provided with eight lengthy contracts/leases and that this request “did impose a considerable strain on the officers”.

However four were not provided (the BAM Nuttall contract came into effect during the 2014/15 financial year, the development agreement (dated 9/1/2008) and bond (dated 6/10/2008) with Pochin Land and Development Limited (relating to the Birkenhead ASDA Compulsory Purchase Order) was refused and so was Wirral Council’s agreement with Neptune Developments with regards to the Birkenhead Masterplan proposals).

Two leases were provided (I would estimate each at being around 200 pages long). Two contracts were also provided (including the PFI contract) which are each around 500-1000 pages long. In the case of one of the leases (the New Brighton Marine Point lease) two entire copies of the lease were provided (when I only asked for one). As one of the two copies provided of that lease has a Land Registry official copy stamp on it (so presumably the copying was done by Land Registry) I would respectfully point out that the “considerable strain on the officers” referred to in your letter in making a second copy of that lease (then providing a second copy of that lease to myself with the Land Registry copy) was unnecessary.

In the last sentence of your letter you refer to Regulation 9 of the Accounts and Audit (England) Regulations 2011 which requires the documents to be made available for public inspection twenty working days before the date appointed by the auditor for local government electors to exercise their rights to either ask questions or make an objection.

For the 2013/14 audit, this date was the 18th August 2014. Therefore in order to comply with the regulations the documents should have been made available in the twenty working days leading up to the 18th August 2014 (which was the 21st July 2014 to the 15th August 2014).

As specified in your letter the PFI contract was available for inspection by myself on the 12th September 2014 (a month later than the timescale in the legislation you refer to). The copy of the PFI contract I was given on the 12th September 2014 was incomplete and it was the following month before I received the missing pages of the contract (which was after the accounts for that year had been closed by the auditor).

There were similar problems with the member expense forms as those given to me in September 2014 were also incomplete (or related to the wrong financial year) with the rest given to me in October 2014.

Therefore as the information was provided a month (or in some cases two months) later than the legislation specified I dispute your assertion that “The difficulties were compounded by the short timescales permitted by Regulation 9 of the Accounts and Audit (England) 2011 to produce the documents you had requested that related to the accounts of the Council”.

Had the documents been open for inspection and I had received copies prior to the 18th August 2014 (in compliance with the regulation you refer to) I would agree with you, however they were not.

Moving to the points made in page three of your letter, I was unaware (until I read your letter) of the existing right of inspection to admission agreements under schedule 2 Part 3 paragraph 11 of the Local Government Pension Scheme Regulations 2013.

I refer you to one of the admission agreements in the PFI contract specifically Schedule 19, Part 3, page 4/5 of the PFI Contract:

“3 (i) The Administering Authority shall from the date referred to in paragraph (ii) of this clause admit to participate in the benefits of the Scheme every employee of the Transferee Admission Body –

(a) whose name appears in the List annexed to this Agreement where he is identified as being a member of the Scheme by virtue of being an employee of the Administering Authority (hereinafter referred to as “the List”) or

(b) whom, by notice in writing given to the Administering Authority, the Transferee Admission Body may from time to time nominate provided that any person so nominated must be eligible to become a member of the Scheme.”

The Administering Authority referred to is Wirral Council. Therefore the list of names, dates of birth, job descriptions, NI numbers is of former Wirral Council staff whose employer was changed from Wirral Council to that of the PFI contractor.

You state in the second paragraph on page 3 “The amount of any such deficit would be determined by such factors as salary and age of the employee”. However the list does not include salary details of employees. Therefore as this information does not form part of the admission agreement or annexed list I dispute your statement that “That information would therefore be relevant to any assessment of the financial risk to the Council brought about by the PFI Contract.”

I might also point out that the admission agreement refers to a bond or indemnity with an insurer (Schedule 18 Parts 3 pages 14-17) to cover this sort of situation which reduces the risk of such liabilities falling on Wirral Council. Unfortunately the name of the insurer is not provided on the copy of the contract I have but the admission agreement states this insurance is to a limit of £67,000 (for that admission agreement which is one of three in the contract).

As I am publishing this response to ICO and Mr. Tour, I am also publishing the email from ICO that it refers to and the letter from Mr. Tour.

I have made a determination as data controller (see s.32 of the Data Protection Act 1998) that having regard to the special importance of the public interest in freedom of expression, the fact that I’m publishing my response (which could lead to confusion unless the email from ICO and letter from Wirral Council is also published at the same time), ICO’s view that Wirral Council breached the Data Protection Act 1998 as well as other reasons, that it is in the public interest for these documents to be published.

Finally, although I appreciate your point about whether s.34 of the Data Protection Act 1998 applies to the list is a matter for Wirral Council and ICO to come to a view on, at the very least there appears (from my perspective) to have been maladministration on the part of Wirral Council.

Providing documents requested during the audit outside the timescales you referred to in your letter and indeed in some cases after the accounts were closed prevented me from exercising my right to object to the auditor or to ask questions of the auditor before the accounts were closed at the end of September 2014.

As you are Monitoring Officer for Wirral Council, I draw your attention to section 5A of the Local Government and Housing Act 1989 and the duty of a Monitoring Officer to write a report (circulated to all councillors, the Chief Executive and the Chief Financial Officer) and for this report to be considered at a future Cabinet meeting within a set time period if there has either been a contravention of any enactment or rule of law by the authority or maladministration. I therefore await your response as to whether you will be writing such a report.

Yours sincerely,

John Brace

=======================================================================

from: casework@ico.org.uk
to: john.brace@gmail.com
date: 30 April 2015 at 15:42
subject: Data Protection Concern: RFA0568370[Ref. RFA0568370]

30 April 2015

Case Reference Number RFA0568370

Dear Mr Brace

Thank you for raising your concern with us about Wirral Metropolitan Borough Council’s (Wirral MBC’s) handling of your personal data.

We want to know how organisations are doing when they are handling information rights issues. We also want to improve the way they deal with the personal information they are responsible for. Reporting your concerns to us will help us do that.

Our role is not to investigate or adjudicate on individual concerns but we will consider whether there is an opportunity to improve the practice of the organisations we regulate. We do this by taking an overview of all concerns that are raised about an organisation with a view to improving their compliance with the Data Protection Act 1998 (DPA).

From the information provided to us it does appear that Wirral Council has breached the DPA as it has acknowledged disclosing third party data in error. Wirral MBC has stated they have recovered the information disclosed inappropriately. They have also specified that requests made under the Audit Act in the future should not include any personal information which would enable particular individuals to be identified unless the requester can demonstrate that the disclosure is in the public interest to the extent that it should override the individual’s right to privacy.

It is now Wirral Metropolitan Borough Council’s responsibility to explain to us how it intends to improve its information rights practices in relation to reducing the possibility of such inappropriate disclosures in the future. Although we do not intend to write to you again, we will keep the concerns raised on file. This will help us over time to build up a picture of Wirral MBC’s information rights practices.

Thank you for bringing this matter to our attention.

If you are dissatisfied with the service you have received, or would like to provide us with feedback of any kind, please let me know. Further information can also be found on our website by following the following link https://ico.org.uk/concerns/complaints-and-compliments-about-us/complain-about-us/

Yours sincerely

Caroline Flint
Case Officer
01625 545 258

The ICO’s mission is to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

If you are not the intended recipient of this email (and any attachment), please inform the sender by return email and destroy all copies. Unauthorised access, use, disclosure, storage or copying is not permitted.
Communication by internet email is not secure as messages can be intercepted and read by someone else. Therefore we strongly advise you not to email any information, which if disclosed to unrelated third parties would be likely to cause you distress. If you have an enquiry of this nature please provide a postal address to allow us to communicate with you in a more secure way. If you want us to respond by email you must realise that there can be no guarantee of privacy.
Any email including its content may be monitored and used by the Information Commissioner’s Office for reasons of security and for monitoring internal compliance with the office policy on staff use. Email monitoring or blocking software may also be used. Please be aware that you have a responsibility to ensure that any email you write or forward is within the bounds of the law.
The Information Commissioner’s Office cannot guarantee that this message or any attachment is virus free or has not been intercepted and amended. You should perform your own virus checks.

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Tel: 0303 123 1113 Fax: 01625 524 510 Web: www.ico.org.uk

=======================================================================

Department of Transformation
 and Resources
Joe Blott
Strategic Director for Transformation
and Resources
Town Hall, Brighton Street
Wallasey, Wirral
Merseyside, CH44 8ED
DX 708630 Seacombe
Website: www.wirral.gov.uk

date 28 April 2015

to John Brace
Jenmaleo
134 Boundary Road
Bidston
Wirral
CH43 7PH
my ref ST/CG
service Legal and Member Services
tel 0151 691 8569
fax 0151 691 8482
email surjittour@wirral.gov.uk

Dear Mr Brace

DISCLOSURE OF PERSONAL INFORMATION IN ADMISSION AGREEMENT FORMING PART OF THE COUNCIL’S PFI CONTRACT

I refer to your letter of 19 January and to our subsequent meeting which culminated in your return of the personal information which was inadvertently disclosed to you when a copy of the PFI Contract was provided to you on 12 September 2014.

You will recall that in a written request dated 25 July 2014 you had exercised your right under Section 15 of the Audit Commission Act 1998 (“ACA”) to inspect and receive copies of over 300 invoices, eight lengthy contracts/leases and all member expense forms for 2013 and 2014. These documents related to the Council’s accounts for 2013/14.

The request for those documents did impose a considerable strain on the officers who were required to locate and copy those contracts after redacting commercially sensitive and personal information from those documents in accordance with the requirements of the Data Protection Act 1998 and Article 8 of the European Convention on Human Rights. Article 8, as you may know, requires a public authority to show respect for a persons private life and not to interfere with that right except as is in accordance with the law and is necessary (amongst other things) in the interests of the economic wellbeing of the country or for the protection of the rights and freedoms of others.

I should emphasise that the non-redaction of the personal pension information was not intentional. The information was overlooked amongst the thousands of pages of the documentation which you had requested under Section 15 of the ACA. The difficulties were compounded by the short timescales permitted by Regulation 9 of

www.wirral.gov.uk (LGC logo) Awards 2015 Winner Most Improved Council

the Accounts and Audit (England) 2011 to produce the documents you had requested that related to the accounts of the Council also by the sickness absence of one of the Council’s officers who was dealing with your request.

I have looked carefully into the legal consequences of the inadvertent disclosure of the personal information in the PFI Contract and have indeed taken Counsel’s advice on the matter. My conclusions are set out below.

Section 34 of the Data Protection Act 1998 contains an exemption from the requirement to comply with the non-disclosure provisions of the Act if any personal data consists of information which the Data Controller is obliged to make available to the public under any enactment.

The non-disclosure provisions are defined in Section 27 of the same Act and include the first data protection principle which requires Data Controllers to process personal data both fairly and lawfully.

If however the processing is necessary for compliance with any legal obligation to which the Data Controller is subject, then the requirement to process personal data fairly and lawfully does not apply.

The applicable legal obligation is Section 15 of the ACA which gives a right to any local government elector to inspect all contracts relating to the accounts which are to be audited. There is an exception for information which can identify a particular employee of the Council and also for personal information outside that description ie non-employees of the Council if the information enables a particular individual or individuals “to be identified and the Council’s Auditor considers that it should not be inspected or disclosed”.

In the particular circumstances of the PFI Contract the Auditor had not been requested to authorise non-disclosure. The volume of the documents running into several thousands of pages which you had requested rendered it simply impracticable within the short timescales to seek the Auditor’s opinion on whether the personal information should be disclosed. You must remember the context in which the personal information in the PFI Contract was inadvertently disclosed. It was one of many documents that had to be sifted for personal information and commercially sensitive information.

That however does not end the matter since there is a Judgment of the Court of Appeal in the case of Veolia ES Nottinghamshire Limited v Nottinghamshire County Council and Others 2010 EWCA CIV 1214 which decided that Section 15 of the ACA must be interpreted in a manner which is to ensure compliance by the Council with the rights conferred on individuals by the Human Rights Act 1998 and in particular the right to a private life contained in Article 8 of the European Convention on Human Rights to which I refer above.

The advice I have received is that Section 15 of the ACA should be interpreted in such a way that the Auditor’s prior consent to non-disclosure is not required where it would be impracticable to obtain that consent eg because of the volume of documents required to be submitted to him in the short period of time allowed by the Legislation for production of contracts which relate to the Council’s accounts.
It does not of course follow that the Council’s duty not to interfere with Article 8 Rights of the individuals named in the Admission Agreement of the PFI Contract automatically overrides your right as a local government elector to see that information if it formed part of the contract which you were entitled to inspect.

2
There is a public interest that is to be considered which is that the local government elector or indeed a member of the public should normally enjoy full disclosure of information which is relevant to the Council’s true financial position and which would enable them possibly to detect any wrong doing by the Council or its employees.

In this regard I would draw your attention to Schedule 2 Part 3 paragraph 11 of the Local Government Pension Scheme Regulations 2013 which imposes an obligation on the Council to make a copy of an Admission Agreement available for public inspection at its offices. Details of the employees of the PFI Contractor who had been transferred to the contractors employment from the Council under the Transfer of Undertakings (Protection of Employment) Regulations are relevant to an assessment of the Council’s financial position. Under the Local Government Pension Scheme Regulations 2013 if a contractor were to default in his obligations to make pension contributions in respect of those employees or were to become insolvent, the Council would have to meet any deficit in the Pension Fund that arose as a result. The amount of any such deficit would be determined by such factors as salary and age of the employee. That information would therefore be relevant to any assessment of the financial risk to the Council brought about by the PFI Contract.

Furthermore such employees of the PFI contractor are only entitled to remain in the Local Government Pension Scheme if they continue to be employed in connection with the provision of the services comprised in the PFI Contract. Members of the public would need to know the identities of the contractors employees who were admitted to the Pension Scheme under the Admission Agreement in order to check whether they were continuing to work on the PFI Contract and therefore still entitled to remain in the Local Government Pension Scheme with the attendant financial risk to the Council and thereby council tax payers if the PFI contractor were to default in payment of pension contributions or become insolvent.

If therefore that personal information had been drawn to my attention l would have had to weigh in the balance the public interest in disclosing information relating to the Council’s financial position and the identity of employees who were only entitled to remain in the Pension Scheme whilst they remain employed on the PFI Contract, against the invasion of those members privacy if their identities, dates of birth, and national insurance numbers were made known to you.

I have to say that if I had been called upon to make that decision I would have redacted the personal information and not disclosed it to you unless you had been able to satisfy me that you required that information in circumstances which related to those aspects of the public interest to which l have referred above.

It is evident from the contents of your letter of 19 January and our subsequent meeting that you yourself do not believe that the public interest in disclosure of the identities of the members of the Pension Scheme in the PFI Contract was more potent than the respect which the Council is required to show for their privacy under Article 8. Your reasons for seeking disclosure of the PFI Contract had nothing to do with your concern over the Council’s financial exposure to potential deficits of PFI contractors in the Local Government Pension Scheme or to any concerns that the PFI employees who had been allowed to retain membership of the Local Government Pension Scheme were abusing that Scheme by retaining their membership when they were no longer working on the PFI Contract. You have acted responsibly by returning that personal information to me because you recognise that it did not serve the purpose you had in inspecting the PFI Contract in relation to the Council’s accounts for 2013/2014.

3

In future I propose to ensure that future requests to inspect documents under the ACA should not include any personal information which would enable the identity of particular individuals to be ascertained unless you (or any person wishing to inspect the accounts) can demonstrate that the disclosure of that information is in the public interest to the extent that it should override the individuals right to privacy.

Finally I should add that as from 1 April 2015 Section 15 of the Audit Commission Act 1998 has been replaced by Section 26 of the Local Audit and Accountability Act 2014. Under that Act there is no longer a requirement for the Council to seek the prior consent of the Auditor before withholding any personal information in the documents relating to the Council’s accounts which a local government elector is entitled to inspect. It is a recognition by Parliament that the prior involvement of the Auditor is not workable having regard to the short timescale for inspection of the documents and the often voluminous nature of those documents. There are however transitional provisions which mean that the 1998 Act will continue to apply to the inspection of accounts for the year 2014/15.

I am sending a copy of this letter to the Information Commissioner so that he is made fully aware of the Council’s investigation into your complaint and the complicated legal framework within which the Council has to work particularly when it is confronted by a request from the public to inspect a large volume of documents.

Yours sincerely and signed on behalf of
Surjit Tour
Head of Legal and Member Services

(signature of Jane Corrin)

Jane Corrin
Information and Central Service Manager
Transformation and Resources

If you click on any of the buttons below, you’ll be doing me a favour by sharing this article with other people.

Was there no available public transport when Wirral Council councillors took taxis?

Was there no available public transport when Wirral Council councillors took taxis?

Was there no available public transport when Wirral Council councillors took taxis?

                                                  

Hackney carriage by Ed g2s
Hackney carriage by Ed g2s

Hackney carriage by ed g2s • talk – Own work. Licensed under CC BY-SA 3.0 via Wikimedia Commons.

The question I will be asking at tonight’s Council meeting to Councillor Adrian Jones is to do with a blog post I wrote back on the 26th January headlined “INCREDIBLE: £2,877.35 spent by Wirral Council last year in previously hidden payments on taxis for Labour councillors!”.

It led to Row as Wirral Labour councillors rack up nearly £3,000 expense claims for taxis by Emma Rigby in the Wirral Globe, a Granty’s Inferno column headlined GRANTY’S INFERNO: Taxi-happy Wirral councillors are taking us all for a ride and someone writing a letter in to the Wirral Globe Not ‘horrified’ by Wirral councillors’ taxi fare bill.

Below is the text of my question to Councillor Adrian Jones (the Cabinet Member for Support Services):

“Each year Wirral Council is required to publish annual totals of what councillors have claimed in travel expenses. Due to contracts with various taxi firms invoicing Wirral Council directly thousands of pounds of expenses weren’t included in the list for 2013/14.

The Members Allowance Scheme states that the use of taxis (or councillors’ own cars) for attending meetings is only permitted where public transport is either not available, or the journey by public transport would be likely to result in unreasonable delay.

For the taxi journeys made by councillors not included in the annual published lists for 2013/14 and those made since can you confirm:

(a) each journey was taken where there is no available public transport (or taking public transport would lead to unreasonable delay) and if not will councillors involved be refunding Wirral Council and

(b) what changes will be made so that the expenses for such journeys made in 2014/15 will be included next time the annual lists are published?”

Since the MP expenses scandal a number of years ago, there is much more transparency now over MP’s expenses. If I wanted to I could go on a website and search for my MP’s taxi expenses.

For example by looking at that website I can tell you that my MP Frank Field travelled by taxi on the 10th October 2014 from Rock Ferry to Conway Park station costing £6. I doubt there’ll ever be that level of openness and transparency for expense claims by councillors, but during the audit last summer I exercised my right to request (see s.15 of the Audit Commission Act 1998)the documentation providing amounts, what transport they used, mileage et cetera for travel expenses for councillors during the 2013/14 financial year.

A lot of paperwork was provided (which I published on this blog), but the detail about taxi journeys by Labour councillors revealed through a Freedom of Information Act request here was not (and this is only the annual totals and not at the detail of each journey).

It’s only if information was provided on the level of detail of each journey that the question about whether there was no available public transport could be answered. I’m sure Wirral Council should have this information from the invoices from the taxi firms. When this part of the passenger transport contract was put out to tender this year lot 4 was described as follows:

“LOT4 – This contract is for ad hoc journeys by taxi to allow Wirral Councillors to travel to various venues across Wirral.

This contract will allow Wirral Councillors to travel around Wirral on official Council business. The times will vary and may include evening and weekends.”

I look forward to hearing Councillor Jones’ answer this evening!

If you click on any of these buttons below, you’ll be doing me a favour by sharing this article with other people. Thanks:

What was my reply when Wirral Council's "Ministry of Truth" asked for 2 invoices on this blog to be erased?

What was my reply when Wirral Council’s “Ministry of Truth” asked for 2 invoices on this blog to be erased?

What was my reply when Wirral Council’s “Ministry of Truth” asked for 2 invoices on this blog to be erased?

Jenmaleo,
134 Boundary Road
Bidston
CH43 7PH
18th January 2015
by email to surjittour@wirral.gov.uk
CC: joeblott@wirral.gov.uk

Mr. Surjit Tour
Head of Legal and Member Services and Monitoring Officer
Department of Transformation and Resources
Wirral Metropolitan Borough Council
Town Hall
Brighton Street
Wallasey
Wirral
CH44 8ED

Dear Mr. Tour,

Thank you for your email of 15th January 2015 sent at 16:38 with the subject “Blog posting of invoices” which is attached for reference at appendix A. You also attached to your email ICO guidance to s.32 of the Data Protection Act 1998 titled “Social networking and online forums – when does the DPA apply?” which can be read on ICO’s website at https://ico.org.uk/media/for-organisations/documents/1600/social-networking-and-online-forums-dpa-guidance.pdf .

Please class this as a formal response to the issues you have raised in it. I have no problem with you sending a copy of this response to Dr Gareth Vincenti.

You refer in your opening paragraph to section 15 of the Audit Commission Act 1998 (in its amended form as it was later amended by s.160 of the Local Government and Public Involvement in Health Act 2007). This is attached in full for reference at appendix B.

You state “You were provided with copies of certain invoices in compliance with Section 15 (a) of the 1998 Act, which entitles you to make copies of all or any part of the accounts and those other documents.”

The issue of copying of documents (as you can read for yourself in appendix B which is a copy of the legislation) is dealt with by the Audit Commission Act 1998 section 15(1)(b), as section 15(1)(a) deals with a right to inspect documents, not to copy documents. Therefore this sentence in your email should read Section 15(1)(b), not Section 15(a).

You go on to state “In redacting certain parts of those invoices, the Council relied on Section 15 (3A) of the Audit Commission Act 1998, as amended, which relates to personal information.”

If you read s.15(3A) of the Audit Commission Act 1998, as amended (attached as appendix B) you will find the definition of personal information in s.3A is “(3A) Information is personal information if–

(a) it identifies a particular individual or enables a particular individual to be identified; and
(b) the auditor considers that it should not be inspected or disclosed.”

It is important to note that the way the legislation is phrased it is not down to Wirral Council to make the ultimate decision as to whether information that may or may not fall within the definition of personal information as defined by section 3A should or shouldn’t be inspected or disclosed, but that decision is to be made by Wirral Council’s auditor who is for the financial year in question (2013-14) was Grant Thornton UK LLP.

It has not been determined yet whether Wirral Council asked its auditor Grant Thornton UK whether any of the information on the invoice in question should not be inspected or disclosed and if so what Grant Thornton UK LLP’s decision on this matter was.

Appendix C is a communication to Wirral Council’s external auditor in an attempt to clarify whether this took place.

On the 19th January 2015 I received a reply from Wirral Council audit Grant Thornton UK LLP. As you may or may not be aware the current engagement lead at Grant Thornton UK LLP is different to the engagement lead at Grant Thornton UK LLP for the 2013/14 audit. I can confirm that Grant Thornton UK LLP however are making enquiries and will respond as soon as they can.

If there has been an oversight and Wirral Council did not ask its external auditor to make a determination in relation to the many redactions it made to the hundreds of invoices I inspected and received copies of, I would hope that that arrangements could be made to inspect and copy the information I was incorrectly denied access to inspect and receive copies of last year.

You state later in your email:

“The Council considers that it may be necessary to report this matter to the Information Commissioner’s Office and Dr Vincenti may wish to take his own action in connection with your disclosing his personal data “

I will deal with the two interrelated matters raised here in relation to what you refer to as “personal data” of Dr Vincenti’s.

His surname “VINCENTI” is mentioned at the top of the invoice. Not redacted on the copy invoice supplied by Wirral Council is the phrase “Invoicing by Midex Pro for Dr Vincenti”. It is also stated that “cheques are to made payable to Dr. Vincenti”. Two addresses are also used on the invoice to send cheques to, one is a document exchange “DX 720874 Northallerton”, the sort code of 54-10-41 (which relates to a specific branch of a bank) is provided on the invoice for BACS payments and an email address of garethvincenti@btinternet.com is also given.

Dr Gareth Vincenti discloses his own email address, along with other contact details such as the address for correspondence on his website here [drvincenti.co.uk/contact.htm (at the time of writing this link worked however Dr Vincenti’s website is down as of 19th March 2015)]] . The document exchange address is published here http://www.expertsearch.co.uk/cgi-bin/find_expert?4052 and also elsewhere online.

Neither the sort code, nor the document exchange reference fall under s.3A as neither identify a particular individual or enable a particular individual to be identified as both would be used by multiple individuals.

You refer in my email to my right to inspect the invoice. Section 34 of the Data Protection Act 1998 deals with information available to the public under inspection by another enactment (in this case s.15 of the Audit Commission Act 1998).

As it is short I will quote it here:

34 Information available to the public by or under enactment.

Personal data are exempt from—
(a) the subject information provisions,
(b) the fourth data protection principle and section 14(1) to (3), and
(c) the non-disclosure provisions, if the data consist of information which the data controller is obliged by or under any enactment other than an enactment contained in the Freedom of Information Act 2000 to make available to the public, whether by publishing it, by making it available for inspection, or otherwise and whether gratuitously or on payment of a fee.

As to the invoice in question, the “personal data” of Dr Vincenti as you put it was available for inspection because of s.15 of the Audit Commission Act 1998, therefore s.34(c) of the Data Protection Act 1998 applies. It has not been established whether the auditor made a determination that any of it fell within the meaning of “personal information” in section 3A. Therefore at this stage, as you have not provided any evidence that the auditor made such a determination it means such “personal data” is exempt from the non-disclosure provisions that you refer to in your email.

You also state in your email that “which additions include the address of an employee/or former employee of the Council which is capable of amounting to personal data and in the context of the invoice capable of amounting to the processing of sensitive personal data.”

The address you refer to was a partial address. Had it been a complete address including house number, it could be argued that it would fall under the definition of personal information (as defined by s.15(4) of the Audit Commission Act 1998 see appendix B) which states that in order to qualify as personal information, the information “relates specifically to a particular individual”.

There are 60 different addresses in Forwood Road and 22 addresses that match that particular postcode. Wirral has a average household population of 2.17 per a household. Therefore the partial address could potentially relate to one of an estimated 48 individuals.

A partial address, without a house number does not therefore “relate specifically to a particular individual” nor does it enable a particular individual who may live at one of these addresses to be identified. It relates to a large group of individuals. Therefore it falls outside the definition of “personal information” as defined by s.4(1)(a) as it is not information that relates specifically to a particular individual.

Section 32 of the Data Protection Act 1998 on journalism, literature and art also applies here. I state my belief as data controller that I believe that having regard in particular to the special importance of the public interest in freedom of expression, publication of both the original invoice, a copy of the invoice with some of the text from the original invoice highlighted in green and this response including appendices to the response is in the public interest.

A very similar complaint to ICO was made in 2011 about a blogger called Derek Dishman who blogs under the nom de plume of “Mr Mustard” by Barnet Council. The exchange between Barnet Council and ICO can be read here https://www.whatdotheyknow.com/request/94886/response/237295/attach/2/R%20IRQ0426076%20ICO%20Barnet%20correspondence%20re%20ENQ0391446.pdf . To summarise ICO disagreed with Barnet Council’s incorrect assertions about this blogger (which seem broadly similar to those made by Wirral Council).

Finally you state “I do not consider that your right to inspect and the right to have copies made of relevant documents, then entitles you to disclose such documents to the public”.

I hope I have outlined (in much detail above) as to why you are incorrect in that assertion. This issue of the purposes to which information obtained by third parties using their rights to inspect and have copies of information held by local councils during the audit has already been dealt with at a previous judicial review case.

I refer you to R (HTV Ltd) v Bristol City Council [2004] 1 WLR 2717 which I have recently read. I quote from Elias J, the High Court Judge in that matter:

“55. The premise here is that the provision requires the information to be used for a limited purpose or purposes. As I have indicated, I accept that Parliament probably did envisage that the information would be primarily in order to enable electors to raise questions with the auditor and ultimately raise objections. But the fact that those who have access to this information extend beyond those who can make such a request, or raise such an objection, shows that it cannot be the only purpose.

56. In any event, there is no express limitation in the statute as to the use to which this information can be put. I see significant practical difficulties as to confining the use of the material once it has been acquired.”

Finally, my last two points are as Wirral Council is the data controller for the complaint made to it by Dr Gareth Vincenti which refers to me, please class this response as a request exercising my right under s.7 of the Data Protection Act 1998 for a copy of Dr Gareth Vincenti’s complaint.

I further point out that due to what is referred to above I am exercising my right under s.10 of the Data Protection Act 1998 and request that Wirral Council confirm it will immediately cease to process further any personal data about myself in relation to the complaint made by Dr Gareth Vincenti or your email for the reasons outlined above as raising this issue in the way it has been is causing distress.

Yours sincerely,

John Brace

 

 

Appendix A (email from Surjit Tour to John Brace dated 15th January 2015)

from:

Tour, Surjit <surjittour@wirral.gov.uk>

to:

john.brace@gmail.com

date:

15 January 2015 at 16:38

subject:

Blog Posting of Invoices

mailed-by:

wirral.gov.uk

Dear Mr Brace,

I refer to your inspection of documents under Section 15 of the Audit Commission Act 1998, in connection with the audit of the Council’s accounts for the financial year ending March 2014. You were provided with copies of certain invoices in compliance with Section 15 (a) of the 1998 Act, which entitles you to make copies of all or any part of the accounts and those other documents. In redacting certain parts of those invoices, the Council relied on Section 15 (3A) of the Audit Commission Act 1998, as amended, which relates to personal information.

I do not consider that your right to inspect and the right to have copies made of relevant documents, then entitles you to disclose such documents to the public nor does it entitle you to alter the Council’s redacted documents, which alteration constitutes processing of data. The Council has received a complaint from Dr Gareth Vincenti concerning a posting made on your blog on 1 December 2014 entitled:

“Do you want to know what 6 redacted legal invoices paid by Wirral Council on employment matters (including one from a consultant psychiatrist) state?

This posting included the copy of an invoice from Dr Vincenti which had been redacted by the Council. You had posted a second copy of the invoice, having altered part of the redactions to include information in green. You state on the blog posting:

“I’ve supplied both the original and a partly redacted copy of this as the original is heavily redacted. My additions are in green”.

I have had regard to the guidance of the Information Commissioner’s Office,“Social networking and online forums – when does the DPA apply?”

I consider that by altering the Council’s redactions to include additions in green, you have potentially processed personal data in breach of the Data Protection Act 1998, which additions include the address of an employee/or former employee of the Council which is capable of amounting to personal data and in the context of the invoice capable of amounting to the processing of sensitive personal data. I do not believe that you are entitled to rely on the exemption contained in section 36 of the Data Protection Act 1998, in that I consider you are using social media for non-domestic purposes. Section 36 contains an exemption for personal data that is processed by an individual for the purposes of their personal, family or household affairs. I am therefore requesting that you remove from your blog both copies of the invoice from Dr Vincenti immediately.

The Council considers that it may be necessary to report this matter to the Information Commissioner’s Office and Dr Vincenti may wish to take his own action in connection with your disclosing his personal data and the address referred to above.

Yours sincerely

Surjit Tour

Head of Legal & Member Services

and Monitoring Officer

Department of Transformation and Resources

Wirral Metropolitan Borough Council

Town Hall

Brighton Street

Wallasey

Wirral

CH44 8ED

Tel: 0151 691 8569

Fax: 0151 691 8482

Email:surjittour@wirral.gov.uk

Visit our website: www.wirral.gov.uk

**********************************************************************

This email and any files transmitted with it are confidential and

intended solely for the use of the individual or entity to whom they

are addressed. If you have received this email in error please notify

the system manager.

This footnote also confirms that this email message has been swept by

MIMEsweeper for the presence of computer viruses.

www.clearswift.com

Appendix B
Section 15 of the Audit Commission Act 1998 (as amended by s.160 of the Local Government and Public Involvement in Health Act 2007)

15 Inspection of documents and questions at audit

(1)At each audit under this Act, other than an audit of accounts of a health service body, any persons interested may—
(a)inspect the accounts to be audited and all books, deeds, contracts, bills, vouchers and receipts relating to them, and
(b)make copies of all or any part of the accounts and those other documents.

(2)At the request of a local government elector for any area to which the accounts relate, the auditor shall give the elector, or any representative of his, an opportunity to question the auditor about the accounts.

(3)Nothing in this section entitles a person—
(a)to inspect so much of any accounts or other document as contains personal information within the meaning of subsection (3A) or (4); or
(b)to require any such information to be disclosed in answer to any question.

(3A) Information is personal information if–

(a) it identifies a particular individual or enables a particular individual to be identified; and
(b) the auditor considers that it should not be inspected or disclosed.

(4) Information is personal information if it is information about a member of the staff of the body whose accounts are being audited which relates specifically to a particular individual and is available to the body for reasons connected with the fact—
(a)that that individual holds or has held an office or employment under that body; or
(b)that payments or other benefits in respect of an office or employment under any other person are or have been made or provided to that individual by that body.

(5)For the purposes of subsection (4)(b), payments made or benefits provided to an individual in respect of an office or employment include any payment made or benefit provided to him in respect of his ceasing to hold the office or employment.

Appendix C – Email to external auditor Grant Thornton

 

from:

John Brace<john.brace@gmail.com>

reply-to:

john.brace@gmail.com

to:

Robin Baker <robin.j.baker@gt.com>

cc:

“Chris Whittingham (Grant Thornton)” <c.whittingham@uk.gt.com>

date:

18 January 2015 at 18:48

subject:

query about whether Grant Thornton gave permission to Wirral Council during the 2013/14 audit for personal information on invoices should not be inspected/disclosed


Dear Robin Baker & Chris Whittingham,

During the 2013/14 audit I exercised my inspection rights to inspect various invoices and receive copies of them for the 2013/14 financial year under s.15 of the Audit Commission Act 1998.

Last Thursday I received an email from Wirral Council that stated “In redacting certain parts of those invoices, the Council relied on Section 15 (3A) of the Audit Commission Act 1998, as amended, which relates to personal information.”

S.15 (3A) of the Audit Commission Act 1998 was amended in 2008 to state:

“(3A)Information is personal information if—

(a) it identifies a particular individual or enables a particular individual to be identified; and

(b) the auditor considers that it should not be inspected or disclosed.”

Could you confirm that as Wirral Council’s auditor at the time whether a determination was made by the auditor that personal information on an invoice for £3,060 from a Dr Gareth Vincenti dated 31st December
2013 was made and if so which elements on the invoice the auditor considered should not be inspected or disclosed?

Could you also confirm as Wirral Council’s auditor at the time whether any determination was made by the auditor about personal information on any of the invoices I requested for the 2013/14 year was made and
if so the particular invoices and particular information that the auditor considered should not be inspected or disclosed?

If the auditor was not asked to make any such a determination could you state this too?

Thanks,

John Brace

If you click on any of these buttons below, you’ll be doing me a favour by sharing this article with other people. Thanks:

Wirral Council reconsiders secrecy over hourly rates for solicitors and barristers and decides to keep them secret

Wirral Council reconsiders secrecy over hourly rates for solicitors and barristers and decides to keep them secret

Wirral Council reconsiders secrecy over hourly rates for solicitors and barristers and decides to keep them secret

                              

Last year I blogged about how Wirral Council had entered into a contract with solicitors and barristers chambers to keep the hourly rates it was being charged “confidential” (and therefore redacted on the invoices and contract I requested to inspect), when I exercised my right under s.15 of the Audit Commission Act 1998 c.18 as part of last year’s audit to inspect various legal invoices Wirral Council had received and the hourly rates included as part of the North West Legal Consortium Collaboration Agreement.

There’s a Management Board for the North West Legal Consortium Collaboration Agreement and a Consortium Contract Manager and last year I asked for their views on the redaction and pointed out that the contract does allow the hourly rates for legal services to be disclosed with the consent of the companies involved. The response I got is detailed in excerpts from two emails below.

Interestingly the contract also specifies in pages 15 and page 16 that if there are any FOI requests relating to these matters that the Consortium Contract Manager must be notified of any FOI requests relating to it (which is probably why Cllr Ian Lewis’ recent FOI request about the fee Wirral Council paid to the barrister Sarah O’Brien took four weeks to answer.

I thought the answer to the question about supplying the legal rates that I received last year from Wirral Council would be interesting to publish here as it runs completely counter to what politicians say in public about the Labour administration being “open and transparent”.

I’ve not included the person who sent these two emails as he’s merely passing on a response he’s received and I don’t want anyone to “shoot the messenger”.

from: @wirral.gov.uk
to: john.brace [at] gmail.com
cc: Financial Services Coordination
date: 30 August 2013 17:04
subject: RE: legal invoices

Hello Mr Brace,

Thank you for your e-mail

…….

Redaction of Evershed’s and Weightman’s invoices

Your request has been forwarded to the Management Board of the NW Legal Consortium which meets next week. We will get back to you once a response is received from the NWLC Management Board on this matter. Depending upon the outcome of this we can then take a view on your subsequent questions.

I am on leave for the next two weeks. If you have any further need to contact us could you please send it to the financial Services coordination e-mail address and copy in my email address. Matters can then be picked up in my absence.

——————————————————————————————————-

from: @wirral.gov.uk
to: john.brace [at] gmail.com
date: 19 September 2013 16:02
subject: RE: legal invoices
mailed-by: wirral.gov.uk

Redaction of Evershed’s and Weightman’s invoices

Your points have been put to the consortium as requested. The response received is contained below.

There was expectation from the bidders that the hourly rates were provided in confidence. The expectation of bidders whilst submitting the hour rates the information would be used only for the purposes of the tenders only.
We believe that disclosure of the hourly rates would be likely to prejudice the commercial interests of the law firms that tendered for the contract. As this exemption relates to the legal firms, the Council sought the views of the firms. In response, the Council was provided with the responses below:

(a) The rates on which our legal services are provided to clients are highly sensitive and often pivotal in whether we win or loose work from a client;
(b) There is a real and significant risk that disclosure of the Rates would enable our competitors to undercut us when the Council puts its legal services out to tender again, and also where we are bidding for other public sector work;
(c) The rates were provided in a highly competitive environment and they remain current. The market in which we operate is highly competitive and – more than ever during the recession – clients have been willing to ‘shop around’ for legal services with hourly rates being a key determining factor as to where to place work. Given the Rates are highly competitive (significantly below even our standard local government rates), it is a real risk that this could lead to clients on less competitive rates taking their work elsewhere or not placing work with us. It is also probable that, if the Rates were disclosed and became more widely known, some of our existing Clients will seek to re-negotiate rates to the level of or close to the Rates which again could lead to a significant financial impact on the law firms. Law firms have not gone unscathed in the recession and many firms have been forced to make redundancies and some have even gone out of business. Disclosure of the Rates could therefore lead to not-only a direct and significant impact on our revenue but also damage to our reputation and to the confidence that our clients have in us;
(d) For the reasons described above, disclosure of rates information for legal services could deter legal services providers who may think twice about whether working for public sector clients in the future. This could lead to a market in which the public sector has a diminished pool of legal services providers to choose from (driving quality down and rates up).

If you wish to pursue this latter matter further you would probably need to take your own legal advice regarding the contract confidentiality versus the Audit Commission Act. The Council has erred on the side of contract confidentiality.

The guidance issued by the Audit Commission regarding inspection rights does state that ‘Your right to inspect the accounts is personal which means the external auditor can not get involved.’ My reading of this would mean that neither Grant Thornton nor the Audit Commission would be able to provide a view on this issue.

I hope that this answers your queries.

If you click on any of the buttons below, you’ll be doing me a favour by sharing this article with other people.