Freedom of Information request

[mavhc]

Don't click links in emails, especially emails you weren't expecting, they're probably hackers. Standard advice.

 

That's why they use your email account to spam all your friends.

 

You can show that some schools have clicked it, that's not surprising, most people are terrible at security, see every day in the news.

 

Anyway, how goes your plan to work out a good sampling method for future requests?

[bmaloney]

You wish to berate schools for not complying with responsibilities under the FOIA but won’t accept your own. It’s a two way street [emoji3]

What do you mean my own responsibilities? It depends on your definition of an address for correspondence, which has changed since the Act was passed in 2000. For instance we are exchanging written messages (corresponding) on this forum which is a website addressed by a URL. What schools are saying is this is not possible, it can't be an address and we can't correspond on this forum. You have no other address for me, but we are exchanging messages.

 

The same applies to Facebook and Twitter, which weren't invented when the Act was passed, but you can now use them as addresses for correspondence, again URLs. What point are you making? Is our exchange of messages a figment of my imagination?

[sparkeh]

What do you mean my own responsibilities? It depends on your definition of an address for correspondence, which has changed since the Act was passed in 2000. For instance we are exchanging written messages (corresponding) on this forum which is a website addressed by a URL. What schools are saying is this is not possible, it can't be an address and we can't correspond on this forum. You have no other address for me, but we are exchanging messages.

 

The same applies to Facebook and Twitter, which weren't invented when the Act was passed, but you can now use them as addresses for correspondence, again URLs. What point are you making? Is our exchange of messages a figment of my imagination?

 

The point is a very simple one, I have stated a few times and I am certain you understand it very well despite obfuscation. I’ll break it down:

 

1) The FOIA places responsibility on both parties (requester and responder) to a) make a request within the rules of the FOIA and b) to respond to valid FOI requests within the rules.

 

2) An organisation receiving a request can seek advice from the ICO. In this case the ICO has advised that the request is not valid. Now we can go round the houses and fill many pages of this forum about our feelings about this advice but hey, it’s irrelevant. The ICO has taken a position so the debate is fruitless. Its much more constructive to appeal to the ICO if you feel wronged. Or you could amend the request right? I am at a loss to understand why you won’t fulfil your responsibilities yet feel that schools should respond to an invalid request. I am a great believer in the FOIA but also believe that it should be done right, which, according to the ICO, you are not. And when deciding if your request should be responded to, that’s all that really matters.

 

I would genuinely be interested in an proper answer to the points above but am resigned to more obfustication [emoji53]

Edited March 15, 2018 by sparkeh

[bmaloney]

The point is a very simple one, I have stated a few times and I am certain you understand it very well despite obfuscation. I’ll break it down:

 

1) The FOIA places responsibility on both parties (requester and responder) to a) make a request within the rules of the FOIA and b) to respond to valid FOI requests within the rules.

 

2) An organisation receiving a request can seek advice from the ICO. In this case the ICO has advised that the request is not valid. Now we can go round the houses and fill many pages of this forum about our feelings about this advice but hey, it’s irrelevant. The ICO has taken a position so the debate is fruitless. Its much more constructive to appeal to the ICO if you feel wronged. Or you could amend the request right? I am at a loss to understand why you won’t fulfil your responsibilities yet feel that schools should respond to an invalid request. I am a great believer in the FOIA but also believe that it should be done right, which, according to the ICO, you are not. And when deciding if your request should be responded to, that’s all that really matters.

 

I would genuinely be interested in an proper answer to the points above but am resigned to more obfustication [emoji53]

 

Sorry, I have appealed the ICO's decision, to the First Tier Tribunal, as I say the ICO are not the final arbiter. I am awaiting the Tribunal's decision.

 

Now if a school clicks on the link, then decides they don't want to reply and relies on the (false) claim that they won't click on the link, they are being dishonest. It was not the purpose of the FOIA to provide dishonest public authorities with excuses for not responding to requests by saying they are not valid requests.

[djrscally]

You can't and it wasn't. It has be sent out across the teams at the LA to see if anyone has anything to add, responses are then collated, and then the LA responds to the request.

*snip*

 

tl;dr, but yes you absolutely can reject any FoI request regarding your preparations for a zombie apocalypse as being obviously frivolous.

[GrumbleDook]

Sorry, I have appealed the ICO's decision, to the First Tier Tribunal, as I say the ICO are not the final arbiter. I am awaiting the Tribunal's decision.

 

And until a ruling has been given, the ICO’s advice stands.

[elsiegee40]

For those interested the appeal is listed here and was held on 7 March

 

Against this ICO decision

 

The ICO decision makes interesting reading. I await the appeal outcome with interest.

Edited March 16, 2018 by elsiegee40

[synaesthesia]

Someone sounds very much as if they're playing the victim and that everyone not bending over for him is instantly an enemy, so then goes on to waste yet more time, public resource & money by going against the ICO because he's not getting his own way.

The decision looks to be sound, the school appeared to have done the right things in consideration of the proliferation of malware, security breaches, phishing etc. I can't see that @bmaloney stands a chance in appeal.

[Chockster]

It's not 2 years per school, perhaps that wasn't clear? With 20000 schools and say 10 staff each school (I think it's actually a lot more than that, but hey, let's be conservative) you're talking about 200000 staff years each year. If the cost is 2 years, that's 0.001% extra effort. Look at it another way, 10 minutes per school when there's 39 working weeks a year, that's 10 minutes in 900,000 per school? Again 0.001%.

 

Remember this is to comply with the FOIA which is to show that you comply with other laws.

 

Totally clear, thank you. I also fully understand the legal obligations and I'm not addressing the fundamental nature of the request or even your motives for making it, but as GrumbleDook pointed out earlier in the thread, the method you have chosen to use wastes time and money above and beyond the initial gathering and processing of data that could be put to other use, including, dare I say, improvement of their parent record keeping procedures.

[Blue_Cookeh]

I can't say our school would ever reply to such a large FoI request such as this one through somebody else's web form as it is. Either provide an official means of communication (not a 'noreply' address) or don't bother at all. We need to be able to easily file our response away in the format that we sent it to you - a web form does not fulfil this requirement.

 

You could easily have used an Excel or Word template that you had sent out to keep formatting relatively similar across sites which we would have been OK with providing they didn't do anything particularly fancy (which our mail system would block as it is).

[CC359]

The head here initially rejected this request, as did every other head they spoke to, as far as I know. It was certainly large but I was happy to put the time into completing it if necessary. I'm also interested in the result of the appeal.

[minimoo]

You could easily have used an Excel or Word template that you had sent out to keep formatting relatively similar across sites which we would have been OK with providing they didn't do anything particularly fancy (which our mail system would block as it is).

 

Gonna need to jump in here - emails containing random excel/word templates as attachments as FOI are probably more of a risk than a web form.

 

The "solution" here is probably to request that people fill in a text template that can be parsed electronically e..g

 

tell me about X?

------------------

my answer about X is Y

==============

 

I'm thinking ASCII doc / markdown type concept here. Something that could be parsed by a computer (e.g. email response) and store evidence/record for the user sending

[bmaloney]

We need to be able to easily file our response away in the format that we sent it to you - a web form does not fulfil this requirement.

Alt-PrtScn? Besides which schools get an email confirmation with the data they submitted.

You could easily have used an Excel or Word template that you had sent out to keep formatting relatively similar across sites which we would have been OK with providing they didn't do anything particularly fancy (which our mail system would block as it is).

This would be defeated by those who fill it in, print it out, scan it in again as a PDF or image and sent that.

[bmaloney]

Gonna need to jump in here - emails containing random excel/word templates as attachments as FOI are probably more of a risk than a web form.

 

The "solution" here is probably to request that people fill in a text template that can be parsed electronically e..g

 

tell me about X?

------------------

my answer about X is Y

==============

 

I'm thinking ASCII doc / markdown type concept here. Something that could be parsed by a computer (e.g. email response) and store evidence/record for the user sending

 

That assumes the responder doesn't fiddle with the format. Let me tell you they do.

[Blue_Cookeh]

You do realise if you expect schools and other public bodies to expend time and energy responding to your FOI requests, we expect you to put some in too? At the end of the day the fact you fired off the same request to 20,000 establishments isn't our concern! Edited March 16, 2018 by Blue_Cookeh

[bmaloney]

You do realise if you expect schools and other public bodies to expend time and energy responding to your FOI requests, we expect you to put some in too? At the end of the day the fact you fired off the same request to 20,000 establishments isn't our concern!

 

Could you explain what you mean when you say you expect me to put some work in too and why sending a lot of FOI requests out means individual schools can consider it to be not their concern?

[minimoo]

Could you explain what you mean when you say you expect me to put some work in too and why sending a lot of FOI requests out means individual schools can consider it to be not their concern?

 

The concept behind the FOI act is great - it allows individuals to challenge things that they wouldn't otherwise be able to. However in a way unfortunately this also a flaw.

 

I submitted a FOI request a few years ago - for a friend. At the time the purpose of the request was to make a point / get hold of data that might be useful. The outcome of that request was that the public body replied with personal data of individuals by accident (sure, it was only public the 4-5 hours before I saw the response and the then the 20 minutes after that it took for whatdotheyknow to pull the response). That public body told me they were going to investigate the personal data leak - whether they reported it to the ICO etc, I don't know. In that case, my '10 minutes of fun' led to the personal data of 1000 people being leaked onto the internet, and probably someone getting in some form of trouble.

 

Whilst I understand that the case of this request is wider research, there is a 'cost' to the UK for these requests. As a scenario, I could be concerned that your research might not be portrayed accurately, as you might be biased. The easiest way for me to confirm whether this could be an issue would be to issue a FOI request to all the schools email addresses listed on edubase. From my end, that's 10 minutes work sending an email... Correct me if i'm wrong, there is nothing in the FOI act to stop me doing this - and nothing to stop any of the responders on this thread doing the same.

 

The only thing that I believe is required is that the entities that receive the FOI requests need to respond - either to tell the requester to go away for one of the exemption criterion or to provide the data requested.

 

Scale that up to a silly level - if the 65 million people that apparently live in the UK did the same as yourself and chose to make a single FOI request to all UK schools for something they care about (fsm/pp/funding/parents/etc/etc) - and a school could respond in 1 second to any given request - it would require a single person working at each school 24/7, 2 years to respond.

[mavhc]

You annoyed yourself by emailing 20000 schools, simple solution: don't do that.

 

Learn statistics, work out what confidence interval you need, email the correct number of schools

[bmaloney]

I submitted a FOI request a few years ago - for a friend. At the time the purpose of the request was to make a point / get hold of data that might be useful. The outcome of that request was that the public body replied with personal data of individuals by accident (sure, it was only public the 4-5 hours before I saw the response and the then the 20 minutes after that it took for whatdotheyknow to pull the response). That public body told me they were going to investigate the personal data leak - whether they reported it to the ICO etc, I don't know. In that case, my '10 minutes of fun' led to the personal data of 1000 people being leaked onto the internet, and probably someone getting in some form of trouble.

'10 minutes of fun' - that would be a misuse of the FOIA in my view.

Whilst I understand that the case of this request is wider research, there is a 'cost' to the UK for these requests. As a scenario, I could be concerned that your research might not be portrayed accurately, as you might be biased. The easiest way for me to confirm whether this could be an issue would be to issue a FOI request to all the schools email addresses listed on edubase. From my end, that's 10 minutes work sending an email... Correct me if i'm wrong, there is nothing in the FOI act to stop me doing this - and nothing to stop any of the responders on this thread doing the same.

True, but then you would get 20,000 responses. What would you do with the responses? If it takes you 1 minute to read each one, that's about 42 days, 8 hour/day. Suddenly it doesn't seem so easy, unless you objective is to waste everyone's time. If you're serious about using the data you would have to have a way of easily collating it, which I have. So it would seem I'm making a serious, purposeful FOI request and not just ignoring the responses and wasting everyone's time. That is a proper use of the FOIA.

[bmaloney]

Learn statistics, work out what confidence interval you need, email the correct number of schools

What if you want to know the specific information about EVERY school? Using a limited sample won't get you the responses from every school.

[Blue_Cookeh]

What if you want to know the specific information about EVERY school? Using a limited sample won't get you the responses from every school.

 

You can't possibly process data from that many schools as an individual - we never received one of your requests (assuming because your data source isn't up to date) so your logic is flawed anyway.

Edited March 18, 2018 by Blue_Cookeh

[synaesthesia]

Imagine all of the data analysis that could have been carried out in the time it's taken to continue whining on these forums.

[GrumbleDook]

You can't possibly process data from that many schools as an individual - we never received one of your requests (assuming because your data source isn't up to date) so your logic is flawed anyway.

 

At the risk of angering the mods by talking stats ...

 

For things like this you cannot sample without having bias, or at least the appearance of bias. You can run targeted surveys because you want a response from a particular demographic or grouping ... but that is different to sampling.

 

When you have an insecure data set to get a full response from you put measures in to at least report failed attempts and failed responses (there is a difference).

 

There is a difference between delivery receipts, read receipts and use of other tools to see if the email has been opened and read. You can, if careful, get a broad idea of whether you are hitting a live mailbox or not, and if you are being ignored.

[bmaloney]

I submitted a FOI request a few years ago - for a friend. At the time the purpose of the request was to make a point / get hold of data that might be useful. The outcome of that request was that the public body replied with personal data of individuals by accident (sure, it was only public the 4-5 hours before I saw the response and the then the 20 minutes after that it took for whatdotheyknow to pull the response). That public body told me they were going to investigate the personal data leak - whether they reported it to the ICO etc, I don't know. In that case, my '10 minutes of fun' led to the personal data of 1000 people being leaked onto the internet, and probably someone getting in some form of trouble.

There is an interesting counterpoint to this. No single school has leaked personal data by using my webform. However they have by sending me emails. I've had two cases I know of, one where a school sent me a query and left in the internal email trail they had been exchanging with the names of some pupils as examples against some of the yes/no answers I had been asking and the other one was a reply to a solicitor who had contacted the school about a child. Apparently the sender's email client had collected my email address as a contact and then auto-completed the wrong email address.

 

You can't paste personal details into a box that requires a number only or a tickbox for a yes/no answer. The form is inherently safer as regards schools making mistakes and leaking personal data. It should be encouraged as a form of responding.

Edited March 18, 2018 by bmaloney

[bmaloney]

You can't possibly process data from that many schools as an individual - we never received one of your requests (assuming because your data source isn't up to date) so your logic is flawed anyway.

Yes you can, you just need it in a database, then you can search and calculate. If you let me know what school you're at I'll check my records. It's pretty concerning that schools are missing emails because they're directed into junk mailboxes. It would be nice if they could recognise an email with the subject "Freedom of Information Request - ..." and actually look at it.