Access to school pupil personal data by third parties is changing

The Department for Education in England and Wales [DfE] has lost control of who can access our children’s identifiable school records by giving individual and sensitive personal data out to a range of third parties, since government changed policy in 2012. It looks now like they’re panicking how to fix it.

Applicants wanting children’s personal identifiable and/or sensitive data now need to first apply for the lowest level criminal record check, DBS, in the access process, to the National Pupil Database.

Schools Week wrote about it and asked for comment on the change [1] (as discussed by Owen in his blog [2] and our tweets).

At first glance, it sound like a great idea, but what real difference will this make to who can receive 8 million school pupils’ data?

Yes, you did read that right.

The National Pupil Database gives away the personal data of eight million children, aged 2-19. Gives it away outside its own protection,  because users get sent raw data, to their own desks.[3]

It would be good to know people receiving your child’s data hadn’t ever been cautioned or convicted about something related to children in their past, right?

Unfortunately, this DBS check won’t tell the the Department for Education (DfE) that – because it’s the the basic £25 DBS check [4], not full version.

So this change seems less about keeping children’s personal data safe than being seen to do something. Anything. Anything but the thing that needs done. Which is to keep the data secure.

Why is this not a brilliant solution? 

Moving towards the principle of keeping the data more secure is right, but in practice, the DBS check is only useful if it would make data safe by stopping people receiving data and the risks associated with data misuse. So how will this DBS check achieve this? It’s not designed for people who handle data. It’s designed for people working with children.

There is plenty of evidence available of data inappropriately used for commercial purposes often in the news, and often through inappropriate storage and sharing of data as well as malicious breaches. I am not aware, and refer to this paper [5], of risks realised through malicious data misuse of data for academic purposes in safe settings. Though mistakes do happen through inappropriate processes, and through human error and misjudgement.

However it is not necessary to have a background check for its own sake. It is necessary to know that any users handle children’s data securely and appropriately, and with transparent oversight. There is no suggestion at all that people at TalkTalk are abusing data, but their customers’ data were not secure and those data held in trust are now being misused.

That risk is the harm that is likely to affect a high number of individuals if bulk personal data are not securely managed. Measures to make it so must be proportionate to that risk. [6]

Coming back to what this will mean for individual applicants and its purpose: Basic Disclosure contains only convictions considered unspent under The Rehabilitation of Offenders Act 1974. [7]

The absence of a criminal record does not mean data are securely stored or appropriately used by the recipient.

The absence of a criminal record does not mean data will not be forwarded to another undisclosed recipient and there be a way for the DfE to ever know it happened.

The absence of a criminal record showing up on the basic DBS check does not even prove that the person has no previous conviction related to misuse of people or of data. And anything you might consider ‘relevant’ to children for example, may have expired.

DBS_box copy

So for these reasons, I disagree that the decision to have a basic DBS check is worthwhile.  Why? Because it’s effectively meaningless and doesn’t solve the problem which is this:

Anyone can apply for 8m children’s personal data, and as long as they meet some purposes and application criteria, they get sent sensitive and identifiable children’s data to their own setting. And they do. [8]

Anyone the 2009 designed legislation has defined as a prescribed person or researcher, has come to mean journalists for example. Like BBC Newsnight, or Fleet Street papers. Is it right journalists can access my children’s data, but as pupils and parents we cannot, and we’re not even informed? Clearly not.

It would be foolish to be reassured by this DBS check. The DfE is kidding themselves if they think this is a workable or useful solution.

This step is simply a tick box and it won’t stop the DfE regularly giving away the records of eight million children’s individual level and sensitive data.

What problem is this trying to solve and how will it achieve it?

Before panicking to implement a change DfE should first answer:

  • who will administer and store potentially sensitive records of criminal convictions, even if unrelated to data?
  • what implications does this have for other government departments handling individual personal data?
  • why are 8m children’s personal and sensitive data given away ‘into the wild’ beyond DfE oversight in the first place?

Until the DfE properly controls the individual personal data flowing out from NPD, from multiple locations, in raw form, and its governance, it makes little material difference whether the named user is shown to have, or not have a previous criminal record. [9] Because the DfE has no idea if they are they only person who uses it.

The last line from DfE in the article is interesting: “it is entirely right that we we continue to make sure that those who have access to it have undergone the necessary background checks.”

Continue from not doing it before? Tantamount to a denial of change, to avoid scrutiny of the past and status quo? They have no idea who has “access” to our children’s data today after they have released it, except on paper and trust, as there’s no audit process.[10]

If this is an indicator of the transparency and type of wording the DfE wants to use to communicate to schools, parents and pupils I am concerned. Instead we need to see full transparency, assessment of privacy impact and a public consultation of coordinated changes.

Further, if I were an applicant, I’d be concerned that DfE is currently handling sensitive pupil data poorly, and wants to collect more of mine.

In summary: because of change in Government policy in 2012 and the way in which it is carried out in practice, the Department for Education in England and Wales [DfE] has lost control of who can access our 8m children’s identifiable school records. Our children deserve proper control of their personal data and proper communication about who can access that and why.

Discovering through FOI [11] the sensitivity level and volume of identifiable data access journalists are being given, shocked me. Discovering that schools and parents have no idea about it, did not.

This is what must change.

 

*********

If you have questions or concerns about the National Pupil Database or your own experience, or your child’s data used in schools, please feel free to get in touch, and let’s see if we can make this better to use our data well, with informed public support and public engagement.

********

References:
[1] National Pupil Database: How to apply: https://www.gov.uk/guidance/national-pupil-database-apply-for-a-data-extract

[2]Blogpost: http://mapgubbins.tumblr.com/post/132538209345/no-more-fast-track-access-to-the-national-pupil

[3] Which third parties have received data since 2012 (Tier 1 and 2 identifiable, individual and/or sensitive): release register https://www.gov.uk/government/publications/ national-pupil-database-requests-received

[4] The Basic statement content http://www.disclosurescotland.co.uk/disclosureinformation/index.htm

[5] Effective Researcher management: 2009 T. Desai (London School of Economics) and F. Ritchie (Office for National Statistics), United Kingdom http://www.unece.org/fileadmin/DAM/stats/documents/ece/ces/ge.46/2009/wp.15.e.pdf

[6] TalkTalk is not the only recent significant data breach of public trust. An online pharmacy that sold details of more than 20,000 customers to marketing companies has been fined £130,000 https://ico.org.uk/action-weve-taken/enforcement/pharmacy2u-ltd/

[7] Guidance on rehabilitation of Offenders Act 1974 https://www.gov.uk/government/uploads/system/uploads/
attachment_data/file/299916/rehabilitation-of-offenders-guidance.pdf

[8] the August 2014 NPD application from BBC Newsnight https://www.whatdotheyknow.com/request/293030/response/723407/attach/10/BBC%20Newsnight.pdf

[9] CPS Guidelines for offences involving children https://www.sentencingcouncil.org.uk/wp-content/uploads/Final_Sexual_Offences_Definitive_Guideline_content_web1.pdf
indecent_images_of_children/

[10] FOI request https://www.whatdotheyknow.com/request/pupil_data_application_approvals#outgoing-482241

[11] #saveFOI – I found out exactly how many requests had been fast tracked and not scrutinised by the data panel via a Freedom of Information Request, as well as which fields journalists were getting access to. The importance of public access to this kind of information is a reason to stand up for FOI  http://www.pressgazette.co.uk/press-gazette-launches-petition-stop-charges-foi-requests-which-would-be-tax-journalism

 

Act now: Stand up and speak out for your rights to finding out the facts #saveFOI

The Freedom of Information Act has enabled me to stand up for my children’s rights. It really matters to me. And we might lose it.

For every member of the public, who has ever or who has never used their rights under the Freedom of Information Act laws, the government consultation on changing them that closes today is worth caring about. If you haven’t yet had your say, go and take action here >> now.  If it is all you have time for before the end of today, you can sign 38 degrees petition or write an email to your MP.

Or by the end of today you can reply to the call for evidence. There is further guidance on the Campaign For Freedom of Information’s website. 38 Degrees have also got this plain English version.

Please do. Now. It closes today, on November 20th.

If you need convinced why it matters to me and it should to you, read on.

What will happen

If the proposed changes come to pass, information about public accountability will be lost. Political engagement will not be open to all equally. It will promote an unfair society in which individuals are not only prevented from taking part in full public life, but prevented from understanding decisions made about them or that affect them. Campaign groups will be constrained from standing up for human rights by cost.  The press will be restrained in what they can ask.

MySociety has a brilliant summary.  Michael Sheen spoke up calling it “nothing short of a full frontal attack” on the principles of democratic government. And Tom Watson spoke of three serious instances where facts would have stayed hidden, were it not for access made using the law of Freedom of Information:

1. death rates in cardiac patient care
2. cases when the police use Tasers on children
3. the existence of cracks in the nuclear power station at Hinckley

Why does FOI matter to me personally? In Education.

Because it’s enabled me to start a conversation to get the Department for Education to start to improve their handling of our 8 million children’s personal and sensitive data they hold in the National Pupil Database for England and Wales. Through FOI I asked for unpublished facts how many releases of identifiable personal data of school pupils have been fast-tracked at the Department of Education without panel oversight. And to see the panel terms of reference which are still not on their website.

The request: whatdotheykknow.com
The outcome:
National Pupil Database FOI case study summary here.

I’m now coordinating calls for changes on behalf of the 8m children whose records they hold and parents across the country.

******

Why does FOI matter to me personally? In Health.

Because Freedom of Information law has enabled public transparency of decision making and accountability of the care.data programme board decision making that was kept secret for over a year. NHS England refused to publish them. Their internal review declined appeal. The Information Commissioner’s Office upheld it.

The current protection afforded to the internal deliberations of public bodies are sufficient given section 35 and 36 exemptions. In fact my case study, while highlighting that NHS England refused to release information, also shows that only a handful of genuine redactions were necessary, using Section 36 to keep them hidden, when the minutes were finally released.

In October 2014 I simply wanted to see the meeting minutes form part of the public record of care.data planning. I wanted to see the cost-benefit business case and scrutinise it against the benefits case that the public were told of at every public engagement event I had been to.  When at every turn the public is told how little money the NHS can afford to spend I wanted scrutiny of what the programme would cost at national and local levels. It was in the public interest to better inform public debate about the merits of the national programme. And I strongly believe that it is in the public interest to be informed and fully understand the intention and programme that demands the use of sensitive personal data.

The request: whatdotheyknow.com
The outcome: care.data FOI case study summary here.

Others could use this information I hoped, to ask the right questions about missing meeting minutes and transparency, and for everyone to question why there was no cost-benefit business plan at all in private; while the public kept being told of the benefits.  And it shows that data collection is further set to expand, without public debate.

Since then the programme has been postoned again and work is in progress on improved public engagement to enable public and professional confidence.

What has Freedom of Information achieved?

One of the most memorable results of Freedom of Information was the MPs expenses scandal. Who knows how much this Freedom of Information Request saved the taxpayers in immeasurable amounts of future spending on duck houses since MPs have been required to publish expenses since 2010? Four MPs were jailed for false accounting. Peers were expelled. Second homes and what appeared to the public as silly spending on sundries were revealed. Mr. Cameron apologized in 2009, saying he was “appalled” by the expenses. The majority of MPs had done nothing illegal but the Freedom of Information request enabled the start of a process of increased transparency to the public which showed where activities, while permitted by law, were simply unethical or unreasonable.

Historical record

Information published under the Freedom of Information Act can help to ensure that important records of decision-making processes are retained as part of the historic background to government.

Increased trust

The right information at the right time helps make better decisions, make spending more transparent and makes policies and practices more trustworthy.

Access to official information can also improve public confidence where public sector bodies are seen as being open. In a 2011 survey carried out on behalf of the Information Commissioner’s Office, 81% of public bodies questioned agreed that the Act had increased the public’s trust in their organisation.

A key argument made by the commission is that those in public office need private space for decision making. The Information Commissioner’s Office countered this in their submission to the consultation saying,

“there is a distinction between a need for a private space, depending on the circumstances and a desire for secrecy across a broad area of public sector activity. It was the latter tendency that FOIA was intended to correct.”

So how much more “private space” do public servants need?

Holding back information

When information that are judged should not be released in the public interest, there are already exemptions that can be applied to prevent disclosure of information under the Freedom of Information Act. [1]

The exemptions include:

  • if the information can easily be accessed by other means – e.g. the internet or published documents
  • if the information is personal information
  • if the information is provided in confidence (but only if legally enforceable)
  • when there is a legal reason not to disclose
  • if the information is about national security, defence, the economy, law enforcement, formulation of Government policy, health and safety, communications with Her Majesty or other royalty, international relations, intended for future publication and commercial interests. (All exemptions in this group must be tested to see if disclosure is in the public interest.)

In addition to these exemptions, organisations can withhold information if it will take more than two-and-a-half days to provide it, or they cannot identify what information is needed (although they have to work with the requester to clarify what is being requested).

They can also withhold information if they decide the request is vexatious.

Does it cost us too much to administer?

Some people who are supportive of these changes say they are concerned about costs in answering requests but have perhaps not considered the savings in exceptional cases (like the Expenses Scandal outcome). And as mySociety has reported [2], money spent responding to Freedom of Information requests also needs to be considered fairly in the context of wider public spending. In 2012 it was reported that Staffordshire County Council had spent £38,000 in a year responding to Freedom of Information requests. The then Director of mySociety, Tom Steinberg, commented:

“From this I can see that oversight by citizens and journalists cost only £38,000 from a yearly total budget of £1.3bn. I think it is fantastic that Staffordshire County Council can provide such information for only 0.002 per cent of its operating budget.”

Why does the government want to make itself less transparent? Even the Information Commissioner’s office has replied to the consultation to say that the Commissioner does not consider that significant changes to the core principles of the legislation are needed. This is a good law, that gives the public rights in our favour and transparency into how we are governed and tax money spent.

How will the value of FOI be measured of what would be lost if the changes are made?

What can you do?

The call for evidence is here and there is further guidance on the Campaign For Freedom of Information’s website. 38 Degrees have also put together this super-easy Plain English version.

To have your say in the consultation closing on November 20th go online.

Or simply call or write to your MP.  Today. This really matters.


References:

[1] Requests can be refused https://ico.org.uk/for-organisations/guide-to-freedom-of-information/refusing-a-request/

[2] MySociety opposes restrictions https://www.mysociety.org/2015/11/11/voices-from-whatdotheyknow-why-we-oppose-foi-act-restrictions/

[3] National Pupil Database FOI case study summary here

[4] My care.data programme board FOI case study summary here

The last steps to safety: helping refugees in transit to Germany. Stories from border town volunteers.

As European leaders meet for the sixth time this year to talk about what to do about refugees, people on the ground are getting stuff done.

Freilassing Hilft, a collaboration of volunteers founded through four friends and a Facebook group eight weeks ago, feeds 1500 different people every day, who pass through the small border town in Germany.

We’re expecting another 700 more this evening,” Rolf said, volunteering with the separate and long-established charity Caritas at Salzburg’s main station on the other side of the border.

Two “special” trains arrive daily from the south, from Vienna.

Individual men, women and children have become a package – ‘ die Flüchtlinge‘ – refugees – who arrive en masse. From the platforms they are escorted by police and young military service soldiers to segregated areas in the fluorescent lit station concourse.

There they wait.  Standing in an orderly narrow queue between cold aluminum crowd control barriers near the exit at the back of the station.

Chatting and relaxed at both ends of the line, a dozen heavily armed police supervise passing these people on. Dark navy uniforms stand out against the reflective white flooring. Big boots and bigger guns don’t seem a very friendly way to greet up to 1500 people a day who have left behind violence and conflict, with only the possessions they can carry; each with a small rucksack, some with small children.  The children look as mine would after travelling; a little fraught, bewildered and awake in harsh neon at night, when they should be asleep. Most but not all, clinging to a trusted parent. And no crying.

One teen is wandering on her own, looking a little lost, drowning in a turquoise terry towelling  dressing gown that’s too big. I wonder what her story is.

Along the ‘safety’ barricade, white vested volunteers weave back and forth holding out plastic bags of cheese sandwiches and drinks. “Hold them up high,” says Rolf waving 500ml water bottles in the air in his blue, disposable-gloved hands. “If they want them they’ll reach out and take them, you don’t need to say anything.”

There is calm and quiet. There are no words. Tense and tired looking faces nod respectfully to volunteers in appreciation of support. And still they wait for the special buses laid on to bring them across the Austrian-German border, to the small town of Freilassing, seven kilometres away. They will soon be in Germany.

Refugees can only cross the border on these supervised buses. Refugees aren’t allowed on the regular trains from Salzburg any more at all.

Special buses get driven discretely between Salzburg and Freilassing, often in the dark. The town of 16,000 inhabitants has been the checkpoint entry for numbers equivalent to about a tenth of its own population every day since the end of August.

From Freilassing special trains are onwardly coordinated by the Bundesbahn to take the refugees to a scattering of cities across the country. The refugees don’t get told where they are going. That’s deliberate,  said local volunteer, eighteen year-old Jana on the platform in Germany the next morning. She’s the deputy leader of the volunteer group Freilassing Hilft, an organisation founded through four friends’ collaboration in a Facebook group just 8 weeks ago, to give refugees support in transit.

“Some people have specific places they want to reach”, she explained. “They may have family members who they know are in Hamburg for example, and only want to get sent there. It could be upsetting to find they’re being sent somewhere else.”

Berlin, Magdeburg, they’ve been widely distributed, but few helpers know exactly where either.

While most refugees transfer directly from the Austrian buses to German train after registration checks and getting lunch bags from local volunteers, if a train isn’t due straight away they are bussed less than mile away to the Sägewerkstraße centre where they will stay no longer than 24 hours.

Those people who have not yet been registered by police – under tarpaulin awnings on the station platform, or on the bridge the Saarlachbrucke crossing point thirty at a time – go through the registration process at the centre.

In the dry and protected space the men, women and children get some respite, from the weather at least. Donations of winter clothes and shoes are distributed by Caritas volunteers and Freilassing Hilft to those who need them. Medics and professional volunteers can care for health needs. So close to their destination, it can be tense.

Sixty-four year old Kunnikunde joined the Caritas volunteer group in October. A group staffed mainly by pensioners since the students have returned to their studies. She helps distribute the donated clothing inside the former furniture showroom. “Helping them, seeing them smile, afterwards when it is over it is a great feeling, like running a marathon”, she said.

It’s not the same for everyone who works inside though. For the professionals who have been helping for longer, this intensive support is taking its toll. “I see dark faces in my dreams,” one told me. “I can’t forget them.” He sighed, clapped me on the shoulder, as if giving me some sign of solidarity in spirit. I wondered what support he needs and feels able to take, as he gives to others. He pulled on blue plastic gloves each with a professional snap, and went back inside.

The vast building is shut to other outsiders. It has no windows. Security teams patrol the barrier lines, marked off with tape and supported by local police. Whether it’s more to keep people from getting out or others getting in, I’m not sure.

It is not overstatement to say this is the biggest humanitarian disaster Europe has seen since the Second World War and Germany seventy years on, is again redistributing people fleeing war and its effects. As a border town, people in Freilassing have had plenty of experience.

Local feeling is mixed, says Jana. “We have three shifts,” she explained. “All together in the last five weeks we had probably 450 volunteers come and help us. And we get on well with the other organisations. We all work well together, the relationship with the police is very pleasant. But we certainly need to watch that the [public] mood doesn’t change.”

Since I met her two weeks ago, that number has rocketed to over two thousand individuals helping out, some coming to help from miles away.

Their organised management of community spirit is exemplary. They’ve channelled local people wanting to help, into actual donations and distribution of food and drink. An empty concrete floored shell of a shop-under-renovation is their base opposite the station to accept regular donations of thousands of apples, bananas, cereal bars, water, and sandwiches. Volunteers take shifts in the unheated room and bag up packed lunches for distribution to refugees arriving off  the buses. The group has borrowed a handful of supermarket trolleys to take supplies across the road.

Today’s “wish list” on Facebook:

– men’s winter shoes sizes 6+
– Bananas
– White rolls
– Still mineral water 0,5l
– children’s drinks 0,2l
– drawing things
– Babyshoes sizes 19-22
– Baby milk and bottles

“This shift is simply packing the lunch bags for a couple of hours, and we get lots of people if we put out a call,”  Jana explained when I asked how they get hold of what they need. “We can say, we need bananas, and after two hours we have sixteen crates of fruit and then people come along saying, but you have loads, you’re hoarding it. Other times we have nothing and need to use cash donations to buy everything ourselves. Last week we had to go twice a day to the supermarket, but we can’t go to Aldi anymore and just buy up all their stock. We need to pre-order and what we need can change in a matter of minutes. It’s hard to plan with.”

It’s an impressive set up by students who decided they could not simply stand by and do nothing. As we chat two more volunteers come along to register for shifts and Margret, a local mother of three, drops in a huge crate of apples from her orchard.

“What else can we do?” she asks. “You can’t just leave these people with nothing. Unless they felt forced to, they wouldn’t leave. There are families, and young children who are scared, and alone, and they need our help.”

One recent good news story Jana told me, had everyone in tears.

The police helped an asylum seeking Syrian husband in the north of Germany to go south again and reach Freilassing when he heard his wife had managed to escape the war zone one year after he had. Police had escorted him to the Sägewerkstraße, the building now known by the name of its street; enormous open plan furniture warehouse space donated by a local landowner as a staging post for the refugees’ journey. Meeting his wife after a year and two tortuous journeys apart was an emotional experience for them both, as well as all the Caritas charity and Red Cross staff involved. The asylum seeking couple were able to leave together and returned to his new home in the north. A rare good news story. Not all refugees find family or complete the journey safely with family they set out with. Not all refugees are from Syria, and some have traveled for up to two years before this last step to what they hope will be safety.

At the Austrian-German border police now check the ordinary vehicles passing through and ask for papers, a return of the border controls that had been removed in the Schengen agreement. A recent change which taxi driver Andreas is starting to feel has become too much of a burden on residents.

“For our children, or our children’s children, what is the future going to look like? We’ve got our own problems. Poverty, housing the elderly, and there never seems to be money to fix it. But suddenly for refugees, the money’s there.”

That Saturday saw two demonstrations.

One crowd called for support of the border towns, such as Freilassing, just as for the organisations and supporters who are engaging themselves in the work with the refugees. The Caritas Director Pralat Hans Lindenberger said that the refugees also needed to be shared fairly across the German states, as quickly and fairly as possible.

In the counter demonstration many of the attendees were brought in from different parts of Germany, says Jana, with few locals from far right and recognised Nazi organisations.

Supporters are however still signing up to help. While the number of refugees seeking asylum usually falls in winter as seas become more dangerous, this shows no sign of change yet despite or because of the reportedly cut rate crossings offered by the human traffickers.

Others are getting involved to help but to the volunteers it seems ad hoc. This Telekom portal launched today offering multi-lingual support. Long term volunteers will welcome the support tools for the refugees and their own staff.

Helpers and organisations are all calling for central government support.

In the short term, as winter snows may arrive soon, broader cooperation of nation states at government level in funding and manpower is needed in a consistent collaborative approach, as embodied by the Freilassing organisations in the microcosm of the Austrian-German border.

“Basically”, says the Red Cross volunteer, “all our leaders need to lead. Not only ours.”

Everyone is calling for greater leadership from not only the German government and more from Austria, but a collaboration including the UK. When I said I’m from the UK, they laughed. Since Germany takes the same number a day in this small town, as we might in two months time, I’m not surprised.

Austrian ‘support’ is also felt to be cursory, simply passing people on to Germany. No one knows how long goodwill in Freilassing can last. But volunteer numbers still say, ‘refugees welcome.’

Winter has begun. Although more support has been announced it is as yet unclear to the volunteers what it will offer where.

Unless there is safe passage to travel, and shelter at the point of arrival and all along ‘the route of Hope’ from Greece to Germany, the volunteers in Freilassing won’t help as many people as they do today, including the hundreds of unaccompanied children.

In the Alpine cold, many of them will simply never reach the border at all.

This UK response is not enough, not in this Parliament or even next year.

As political leaders prepare to meet in Malta to discuss measures to stem the flow of migrants and refugees from Africa to Europe,  I think of Rolf’s words, “you don’t need to say anything.”  But we do.

We need to speak up, so they hear a million voices of migrants. Speak up so that our leaders know they have the support of many people who want a more positive proactive approach in our population, but are not as vocal as the anti-immigration crowds. Speak up for the children who are still to set sail.

Any further border control agreements must put respect for human rights at their heart, not put more barriers in the way of people migrating or those getting on with grassroots practical support. Leaders must enable refugee routes to safety, and condemn those placing these people in more harm.

These people are survivors. They have not walked there, seen loved ones drown, given up all they know, for the joy of voluntourism. People in Germany laughed at our government’s commitment to take our share of people. It’s the only laugh I’ve heard recently in relation to refugee support.

As Kunnikunde said,“We have big hearts, but our generosity cannot go on forever. We all need to do this together.”

*****
*****

If you want to help make a difference and support refugees through volunteers at the organisation Freilassing Hilft (Freilassing Helps) you can make a regular or one-off donation. This enables them to buy stock according to need and in line with what donors have already provided.

Donations care of the charity:
Verein Europäischer Zwillings- und Mehrlingsfamilien e. V.
Account: VR RB Oberbayern Südost
IBAN: DE 787 109 000 000 002 310 45
BIC: GENODEF1BGL
Purpose: “FreilassingHilft”
The purpose is important so that “FreilassingHilft” gets the donation.

For a receipt of your donation, email: [email protected]. More information: see their Facebook group.

OR consider the Red Cross or the long established local Caritas.

Thank you.

justice payment

Foto credit and story supported by Freilassing Hilft

Counting war stories, making remembrance meaningful.

Let’s not make remembrance futile by making the depth of a bow a measure of respect. Measuring deaths in war and war’s wider effects well, should get more emphasis to make a difference for better lives.

Neil Halloran’s data visualisation [1] on war since WWII is really worth a watch. Perhaps it will leave you both horrified and hopeful. He says; “If watching the news doesn’t make us feel hopeful about where we are heading, watching the numbers might.”

Hopeful despite how awful war is today, and how much we ignore, or are ignorant of, because we are in a time of relatively few in-war deaths*. Relative compared with WW1 for example.

The First World War claimed more than 10.5 million battle deaths.

In the size of those numbers, it is easy to lose sight of the individual in war. An exhibition I visited earlier this year in Brighton, managed to restore that, through thirteen intimate stories, at the exhibition: War Stories, Voices From The First World War.

In two low lit rooms visitors were invited to share in the wartime experiences of 13 men, women and children: to see through the eyes of an Indian soldier wounded on the Western Front and cared for in the Royal Pavilion hospital, a Brighton & Hove Albion footballer on the front line, or the gardener imprisoned for his pacifist belief. Echoes of haunting stories of people from the past, backed by Barber’s Adagio for Strings playing softly over the sound system.

Personal letters, diaries, art, photography, clothing, film and memorabilia evoked the love, fear, loss and longing that touched the lives of millions of people.

Lives and deaths that we most often today see simply as data, lost in numbers. The exhibition successfully rediscovered small individual stories from the big data.

“Names, names, forever only names. May you be remembered always, not just as soldiers, but as fragile human beings.”

Visitors could add their own story or message like this one, to the collective exhibition too, by creating a message written on a luggage tag, and tying it to an iron cut out tree.

The majority of messages were from children.

“For my dearest Grandad Private Frederick George Hughes, of the Staffordshire Regiment,” started one.

Some comments were critical and reminded me how personal sacrifice can be remembered down the generations, and how our remembering of the big picture is often selective, and politicised.

“In memory of my Indian ancestors who died in WW1 and WW2, I have not forgotten, like the English history books and politicians have.”

In the same way, what has been criticised today has been highly selective and politicised.

Today, some seem preoccupied with looking at Cameron’s photoshopped poppy or the angle of Corbyn’s bow, at the special Centotaph memorial service rather than  thinking about the reasons we stop to ‘remember’ at all.

We have too little broad public understanding of the ordinary, the now, and the continuing impact of war; or on fixing its effects on the living people in our communities, and those where others live.

We have too little broad public understanding  of the refugee crisis as a side effect of war. The poem ‘For the Fallen’ seems as appropriate for these civilian casualties as servicemen and women:

“They shall grow not old, as we that are left grow old:
Age shall not weary them, nor the years condemn.
At the going down of the sun and in the morning,
We will remember them.” [2]

One line even more fitting than most for those who drown on their route of hope: ‘They sleep beyond England’s foam.’

It can be hard to remember these people as individuals in the mass images we see on the media. We know of some better than others.

In the mass numbers in the refugee crisis it appears the media don’t always use accurate numbers. We cannot reliably know how many refugees are dying or are looking for somewhere, anywhere, safe to go. Measuring and reporting these people accurately [3] matters not only in providing the right services in the right places, but this organisation that admits its own numbers are wrong (double-counting the same people making multiple border crossings) [4] is being given huge amounts of money. We must understand how many people are really being helped though these funds, measure what is done, and what more they need.

We measure another side effect of war badly at home in the UK, those who are often forgotten, the ex-service men and women living on our streets. Homelessness is hard to measure and compare when the government basis of measurement keeps moving. “The bottom line is that we can no longer rely on these figures to show national trends.” [5]

We should be better at measuring these effects of war on society. If we measure situations well, it can help make policy and practical changes more effective, and the support offered, more useful.

We also need to be better at talking about war and its effects. Despite our world class systems in the UK, able to pick up details of all of our internet use, we seem unable to have a collective conversation of our role in wars elsewhere in the world in a transparent fashion. Or accurately measure the effects of action we take in other countries including those that may be unintentional.

Let’s make remembrance count for something. Real remembering means learning lessons. It means getting things done, for living people. It means not only remembering people that died, but why they died: to protect our homes, our loved ones and our freedoms.

*****

References:

[1] Neil Halloran’s data visualisation on war since WWII  http://www.fallen.io/ww2/  – note: *relative is discussed in his visualisation and how he uses in-war and civilian deaths is discussed in more detail.
[2] Laurence Binyon wrote ‘For the Fallen’ first printed in The Times on 21 September 1914
[3] UN refugee numbers http://data.unhcr.org/mediterranean/regional.php
[4] How the EU miscounts migrants http://theconversation.com/seeing-double-how-the-eu-miscounts-migrants-arriving-at-its-borders-49242
[5] http://www.crisis.org.uk/data/files/publications/Homelessness_Monitor_England_2015_final_web.pdf

image source: I walk Cornwall

 

Parliament’s talking about Talk Talk and Big Data, like some parents talk about sex. Too little, too late.

Parliament’s talking about Talk Talk and Big Data, like some parents talk about sex ed. They should be discussing prevention and personal data protection for all our personal data, not just one company, after the event.

Everyone’s been talking about TalkTalk and for all the wrong reasons. Data loss and a 15-year-old combined with a reportedly reckless response to data protection, compounded by lack of care.

As Rory Cellan-Jones wrote [1] rebuilding its reputation with customers and security analysts is going to be a lengthy job.

In Parliament Chi Onwarah, Shadow Minister for Culture & the Digital Economy, summed up in her question, asking the Minister to acknowledge “that all the innovation has come from the criminals while the Government sit on their hands, leaving it to businesses and consumers to suffer the consequences?”  [Hansard 2]

MPs were concerned for the 4 million* customers’ loss of name, date of birth, email, and other sensitive data, and called for an inquiry. [It may now be fewer*.] [3] The SciTech committee got involved too.

I hope this means Parliament will talk about TalkTalk not as the problem to be solved, but as one case study in a review of contemporary policy and practices in personal data handling.

Government spends money in data protection work in the [4] “National Cyber Security Programme”. [NCSP] What is the measurable outcome – particularly for TalkTalk customers and public confidence – from its £860M budget?  If you look at the breakdown of those sums, with little going towards data protection and security compared with the Home Office and Defence, we should ask if government is spending our money in an appropriately balanced way on the different threats it perceives. Keith Vaz suggested British companies that lose £34 billion every year to cybercrime. Perhaps this question will come into the inquiry.

This all comes after things have gone wrong.  Again [5]. An organisation we trusted has abused that trust by not looking after data with the stringency that customers should be able to expect in the 21st century, and reportedly not making preventative changes, apparent a year ago. Will there be consequences this time?

The government now saying it is talking about data protection and consequences, is like saying they’re talking sex education with teens, but only giving out condoms to the boys.

It could be too little too late. And they want above all to avoid talking about their own practices. Let’s change that.

Will this mean a review to end risky behaviour, bring in change, and be wiser in future?

If MPs explore what the NCSP does, then we the public, should learn more about what government’s expectations of commercial companies is in regards modern practices.

In addition, any MPs’ inquiry should address government’s own role in its own handling of the public’s personal data. Will members of government act in a responsible manner or simply tell others how to do so?

Public discussion around both commercial and state use of our personal data, should mean genuine public engagement. It should involve a discussion of consent where necessary for purposes  beyond those we expect or have explained when we submit our data, and there needs to be a change in risky behaviour in terms of physical storage and release practices, or all the talk, is wasted.

Some say TalkTalk’s  practices mean they have broken their contract along with consumer trust. Government departments should also be asking whether their data handling would constitute a breach of the public’s trust and reasonable expectations.

Mr Vaizey should apply his same logic to government handling data as he does to commercial handling. He said he is open to suggestions for improvement. [6]

Let’s not just talk about TalkTalk.

    • Let’s Talk Consequences: organisations taking risk seriously and meaningful consequences if not [7]
    • Let’s Talk Education: the education of the public on personal data use by others and rights and responsibilities we have [8]
    • Let’s Talk Parliament’s Policies and Practices: about its own complementary lack of data  understanding in government and understand what good practice is in physical storage, good governance and transparent oversight
    • Let’s Talk Public Trust: and the question whether government can be trusted with public data it already has and whether its current handling makes it trustworthy to take more [9]

Vaizey said of the ICO now in his own department: “The Government take the UK’s cyber-security extremely seriously and we will continue to do everything in our power to protect organisations and individuals from attacks.”

“I will certainly meet the Information Commissioner to look at what further changes may be needed in the light of this data breach. [..] It has extensive powers to take action and, indeed, to levy significant fines. “

So what about consequences when data are used in ways the public would consider a loss, and not through an attack or a breach, but government policy? [10]

Let’s Talk Parliament’s Policies and Practices

Commercial companies are not alone in screwing up the use and processing [11] management of our personal data. The civil service under current policy seems perfectly capable of doing by itself. [12]

Government data policy has not kept up with 21st century practices and to me seems to work in the dark, as Chi Onwarah said,

‘illuminated by occasional flashes of incompetence.’

This incompetence can risk harm to people’s lives, to business and to public confidence.

And once given, trust would be undermined by changing the purposes or scope of use for which it was given, for example as care.data plans to do after the pilot. A most risky idea.

Trust in these systems, whether commercial or state, is crucial. Yet reviews which highlight this, and make suggestions to support trust such as ‘data should never be (and currently is never) released with personal identifiers‘ in The Shakespeare Review have been ignored by government.

Where our personal data are not used well in government departments by the department themselves, they seem content to date to rely on public ignorance to get away with current shoddy practices.

Practices such as not knowing who all your customers are, because they pass data on to others. Practices, such as giving individual level identifiable personal data to third parties without informing the public, or asking for consent. Practices, such as never auditing or measuring any benefit of giving away others personal data.

“It is very important that all businesses, particularly those handling significant amounts of sensitive customer data, have robust procedures in place to protect those data and to inform customers when there may have been a data breach.” Ed Vaizey, Oct 26th, HOC

If government departments prove to be unfit to handle the personal data we submit in trust to the state today, would we be right to trust them with even more?

While the government is busy wagging fingers at commercial data use poor practices, the care.data debacle is evidence that not all its MPs or civil service understand how data are used in commercial business or through government departments.

MPs calling for commercial companies to sharpen up their data protection must understand how commercial use of data often piggy-backs the public use of our personal data, or others getting access to it via government for purposes that were unintended.

Let’s Talk Education

If the public is to understand how personal data are to be kept securely with commercial organisations, why should they not equally ask to understand how the state secures their personal data? Educating the public could lead to better engagement with research, better understanding of how we can use digital services and a better educated society as a whole. It seems common sense.

At a recent public event [13],  I asked civil servants talking about big upcoming data plans they announced, linking school data with more further education and employment data, I asked how they planned to involve the people whose data they would use. There was no public engagement to mention. Why not? Inexcusable in this climate.

Public engagement is a matter of trust and developing understanding in a relationship. Organisations must get this right.[14]

If government is discussing risky practices by commercial companies, they also need to look closer to home and fix what is broken in government data handling where it exposes us to risk through loss of control of our personal data.

The National Pupil Database for example, stores and onwardly shares identifiable individual sensitive data of at least 8m children’s records from age 2 -19. That’s twice as big as the TalkTalk loss was first thought to be.

Prevention not protection is what we should champion. Rather than protection after the events,  MPs and public must demand emphasis on prevention measures in our personal data use.

This week sees more debate on how and why the government will legislate to have more powers to capture more data about all the people in the country. But are government policy, process and practices fit to handle our personal data, what they do with it and who they give it to?

Population-wide gathering of data surveillance in any of its many forms is not any less real just because you don’t see it. Children’s health, schools, increases in volume of tax data collection. We don’t discuss enough how these policies can be used every day without the right oversight. MPs are like the conservative parents not comfortable talking to their teens about sleeping with someone. Just because you don’t know, it doesn’t mean they’re not doing it. [15] It just means you don’t want to know because if you find out they’re not doing it safely, you’ll have to do something about it.

And it might be awkward. (Meanwhile in schools real, meaningful PHSE has been left off the curriculum.)

Mr. Vaizey asked in the Commons for suggestions for improvement.

My suggestion is this. How government manages data has many options. But the principle should be simple. Our personal data needs not only protected, but not exposed to unnecessary risk in the first place, by commercial or state bodies. Doing nothing, is not an option.

Let’s Talk about more than TalkTalk

Teens will be teens. If commercial companies can’t manage their systems better to prevent a child successfully hacking it, then it’s not enough to point at criminal behaviour. There is fault to learn from on all sides. In commercial and state uses of personal data.

There is talk of new, and bigger, data sharing plans. [16]

Will the government wait to see  and keep its fingers crossed each month to see if our data are used safely at unsecured settings with some of these unknown partners data might be onwardly shared with, hoping we won’t find out and they won’t need to talk about it, or have a grown up public debate based on public education?

Will it put preventative measures in place appropriate to the sensitivity and volume of the data it is itself responsible for?

Will moving forward with new plans mean safer practices?

If government genuinely wants our administrative data at the heart of digital government fit for the 21st century, it must first understand how all government departments collect and use public data. And it must educate the public in this and commercial data use.

We need a fundamental shift in the way the government respects public opinion and shift towards legal and privacy compliance – both of which are lacking.

Let’s not talk about TalkTalk. Let’s have meaningful grown up debate with genuine engagement. Let’s talk about prevention measures in our data protection. Let’s talk about consent. It’s personal.

******

[1] Questions for TalkTalk: http://www.bbc.co.uk/news/technology-34636308

[2] Hansard: http://www.publications.parliament.uk/pa/cm201516/cmhansrd/cm151026/debtext/151026-0001.htm#15102612000004

[3] TalkTalk update: http://www.talktalkgroup.com/press/press-releases/2015/cyber-attack-update-tuesday-october-30-2015.aspx

[4] The Cyber Security Programme: http://www.civilserviceworld.com/articles/feature/depth-look-national-cyber-security-programme

[5] Paul reviews TalkTalk; https://paul.reviews/value-security-avoid-talktalk/

[6] https://ico.org.uk/for-organisations/guide-to-data-protection/conditions-for-processing/

[7] Let’s talk Consequences: the consequences of current failures to meet customers’ reasonable expectations of acceptable risk, are low compared with elsewhere.  As John Nicolson (East Dunbartonshire) SNP pointed out in the debate, “In the United States, AT&T was fined £17 million for failing to protect customer data. In the United Kingdom, the ICO can only place fines of up to £500,000. For a company that received an annual revenue of nearly £1.8 billion, a fine that small will clearly not be terrifying. The regulation of telecoms must be strengthened to protect consumers.”

[8] Let’s talk education: FOI request revealing a samples of some individual level data released to members of the press: http://www.theyworkforyou.com/debates/?id=2015-10-26b.32.0

The CMA brought out a report in June, on the use of consumer data, the topic should be familiar in parliament, but little engagement has come about as a result. It suggested the benefit:

“will only be realised if consumers continue to provide data and this relies on them being able to trust the firms that collect and use it”, and that “consumers should know when and how their data is being collected and used and be able to decide whether and how to participate. They should have access to information from firms about how they are collecting, storing and using data.”

[9] Let’s Talk Public Trust – are the bodies involved Trustworthy? Government lacks an effective data policy and is resistant to change. Yet it wants to collect ever more personal and individual level for unknown purposes from the majority of 60m people, with an unprecedented PR campaign.  When I heard the words ‘we want a mature debate’ it was reminiscent of HSCIC’s ‘intelligent grown up debate’ requested by Kinglsey Manning, in a speech when he admitted lack of public knowledge was akin to a measure of past success, and effectively they would rather have kept the use of population wide health data ‘below the radar’.

Change: We need change, the old way after all, didn’t work, according to Minister Matt Hancock: “The old model of government has failed, so we will build a new one.” I’d like to see what that new one will look like. Does he mean to expand only data sharing policy, or the powers of the civil service?

[10] National Pupil Database detailed data releases to third parties https://www.whatdotheyknow.com/request/pupil_data_national_pupil_databa

[11] http://adrn.ac.uk/news-events/latest-news/adrn-rssevent

[12] https://jenpersson.com/public-trust-datasharing-nib-caredata-change/

[13] https://www.liberty-human-rights.org.uk/human-rights/privacy/state-surveillance

[14] http://www.computerweekly.com/news/4500256274/Government-will-tackle-barriers-to-sharing-and-linking-data-says-Cabinet-Office-minister-Hancock