Freedom of Information request

[Garacesh]

I will simply come up with a different way of submitting the request

Yes, please do.

Except this time, make it compliant with the FOIA.

 

And I would suggest that you consider requesting less information so that 1) You don't have the administrative overhead you're so keen to avoid and 2) It doesn't break the £450/18-hour limit.

[DGardiner]

that's not the point of the Act.

 

neither is outsourcing the collation of the data - ask for the data you want to know, we will cough it up if we are able and return it in the format our tools allow us.

[sparkeh]

I know they're scratching around for excuses to refuse my request because they don't want to do it

This is reaching the point of absurdity. They don't need excuses the request was invalid.

I will simply come up with a different way of submitting the request

Brilliant! Please do. That's what people have been asking for. Make it compliant and you'll get your data. Its simple.

[bmaloney]

Brilliant! Please do. That's what people have been asking for. Make it compliant and you'll get your data. Its simple.

 

No I won't, I did say that and I explained what Kent were doing, but maybe you didn't read that. Schools are being deliberately awkward, assisted by the Local Authorities, they are concocting reasons not to provide the data. This is not the purpose of the Act.

[sparkeh]

No I won't, I did say that and I explained what Kent were doing, but maybe you didn't read that. Schools are being deliberately awkward, assisted by the Local Authorities, they are concocting reasons not to provide the data. This is not the purpose of the Act.

But you could at least ensure that the schools who are not being obstructive (your words) and following advice from ICO can reply. Right?

[CC359]

Feeling like you don't have the time to complete it is not a defence. I know they're scratching around for excuses to refuse my request because they don't want to do it, but that's shortsighted. I will simply come up with a different way of submitting the request and they'll be back where they started. The school's in Kent are a prime example, those in Barnet are another. The FOIA doesn't disappear because you make life difficult for the requester, that's not the point of the Act.

 

Requests that are deemed "unfounded and excessive" can be denied. The problem is that these guidelines are all considered on a case-by-case basis and people will have different opinions on the definitions. A̶s̶ ̶f̶a̶r̶ ̶a̶s̶ ̶I̶ ̶k̶n̶o̶w̶ ̶s̶o̶m̶e̶t̶h̶i̶n̶g̶ ̶t̶h̶a̶t̶ ̶t̶a̶k̶e̶s̶ ̶l̶o̶n̶g̶e̶r̶ ̶t̶h̶a̶n̶ ̶1̶8̶ ̶h̶r̶s̶ ̶a̶l̶l̶o̶w̶s̶ ̶t̶h̶e̶ ̶£̶2̶5̶ ̶p̶e̶r̶ ̶h̶o̶u̶r̶ ̶c̶h̶a̶r̶g̶e̶,̶ ̶s̶o̶ ̶i̶f̶ ̶a̶ ̶s̶c̶h̶o̶o̶l̶ ̶f̶i̶l̶l̶i̶n̶g̶ ̶o̶u̶t̶ ̶y̶o̶u̶r̶ ̶f̶o̶r̶m̶ ̶t̶a̶k̶e̶s̶ ̶2̶5̶ ̶h̶r̶s̶ ̶t̶o̶ ̶d̶o̶ ̶s̶o̶ ̶a̶n̶d̶ ̶r̶e̶q̶u̶e̶s̶t̶s̶ ̶y̶o̶u̶ ̶t̶o̶ ̶p̶a̶y̶ ̶t̶h̶e̶ ̶f̶e̶e̶,̶ ̶w̶o̶u̶l̶d̶ ̶y̶o̶u̶ ̶b̶e̶ ̶w̶i̶l̶l̶i̶n̶g̶ ̶t̶o̶ ̶d̶o̶ ̶s̶o̶?̶ I suspect your first reaction to that is that it shouldn't take longer than 18 hours and you question the competency of the school. You might also feel like they took so long in order to spite you. We can't know.

 

If you come up with a different way of submitting the request however, I see that as progress. They've given you feedback, you've listened and acted accordingly, and they may feel much more amicable towards you. Win-win all around. If you still feel like certain LAs and schools are being needlessly difficult after you've made an effort to accommodate them, then you should report it to the ICO.

 

I personally don't have issues with the form you provided and will be happy to fill it out if given the green light by the ICO, and if the admin staff have misplaced the email in the lapsed time since we received it, then I will contact you to re-send it. But I haven't been impressed with the tone and condescending attitude you've used on these forums. If I were in your shoes, where a FOI request I sent out ended up creating so much discord, I would have publicly collected and acknowledged feedback to show that I am receptive and listening, even if I disagree with the feedback given. There isn't a need for things to have become as aggressive as they seem to have done.

 

 

Edit: Crossing out mis-information

Edited March 21, 2018 by CC359

[bmaloney]

A theoretical question: would you be happy for the school to publish the answer on their website, and then email you to say they're on the website?

Are you saying they should send me a link in an email and expect me to click on it? What if my policy prevents me doing that, have they actually provided me with the information? How can I be sure their website is free of viruses and malware?

 

Incidentally Somerset County Council, who are at the centre of the ICO appeal as that's where Dulverton Junior School are, have a disclaimer on their emails which says:

 

"Whilst we take reasonable steps to try to identify any software viruses, any attachments to this email may nevertheless contain viruses which our anti -virus software has failed to identify. You should therefore carry out your own anti-virus checks before opening any documents. Somerset County Council will not accept any liability for damage caused by computer viruses emanating from any attachment or other document supplied with this email."

 

So if they send you and attachment it's you're problem if it's got a virus in it. I guarantee schools will refuse a FOI request which comes as an attachment to an email.

[DGardiner]

No I won't, I did say that and I explained what Kent were doing, but maybe you didn't read that. Schools are being deliberately awkward, assisted by the Local Authorities, they are concocting reasons not to provide the data. This is not the purpose of the Act.

 

or it costs the schools too much to collate the information for what you have asked no MIS will spit this out by default, someone is going to have to spend ALOT of time working this data out of the system and making sure its clean of any personally identifiable information.

 

youve asked for too much data that wont just spit out of the MIS systems and thus people have deemed it too expensive to collate, each settings facilities are different what may take one data manager who knows sims like the back of their hand half an hour to throw together may take some office admin person hours or days to put together manually.

[enjay]

As far as I know something that takes longer than 18 hrs allows the £25 per hour charge, so if a school filling out your form takes 25 hrs to do so and requests you to pay the fee, would you be willing to do so?

 

You've misunderstood that. Schools can't charge for that £450 but they can refuse to respond on the grounds of it costing that much.

[CC359]

You've misunderstood that. Schools can't charge for that £450 but they can refuse to respond on the grounds of it costing that much.

 

I see, thanks for clarifying An up to £10 charge was allowed under the DPA to cover postage/printing costs, if I'm right? So under GDPR there is no charge allowed to be made whatsoever?

[bmaloney]

or it costs the schools too much to collate the information for what you have asked no MIS will spit this out by default, someone is going to have to spend ALOT of time working this data out of the system and making sure its clean of any personally identifiable information.

 

youve asked for too much data that wont just spit out of the MIS systems and thus people have deemed it too expensive to collate, each settings facilities are different what may take one data manager who knows sims like the back of their hand half an hour to throw together may take some office admin person hours or days to put together manually.

 

You're not listening, so I'll repeat. The schools initially refuse on the grounds the request is not valid. When I ask for an internal review they say "we didn't refuse, we simply asked for a valid email address." then they refuse on the grounds of cost with an identical template showing the calculation why it's too expensive, with the number of pupils inserted and the time to access each pupil's record adjusted to ensure the total time is just over the 18 hour appropriate amount. It's obvious when you see them one after another, as I did.

 

One school even mistakenly sent me the empty template which their LA had been circulating with the instructions on what to put where left in. You can see the workings when you get enough examples, the schools are going to the LA asking if they have to provide the data and the LA is coming up with excuses why not. I'm not impressed, that's not what the FOIA is for.

[enjay]

I see, thanks for clarifying An up to £10 charge was allowed under the DPA to cover postage/printing costs, if I'm right? So under GDPR there is no charge allowed to be made whatsoever?

 

Again, more confusion. DPA and GDPR aren't factors here, this is the FOIA. You can still charge £10 for printing and postage costs but as this (and most) responses are sent electronically, there's no charge.

[bmaloney]

But you could at least ensure that the schools who are not being obstructive (your words) and following advice from ICO can reply. Right?

 

Nobody is stopping them replying, except perhaps their ISP who may block by default and require white-listing. The ICO say publicly it's up to the public authority whether they click on the link or not, but schools are saying the ICO tells them not to click on the link. I think the ICO are afraid it'll cause them more work when schools leak data inadvertently by clicking on links in emails, but they're leaking data by sending their responses to FOIA request by email.

[DJ-1701]

Are you saying they should send me a link in an email and expect me to click on it? What if my policy prevents me doing that, have they actually provided me with the information? How can I be sure their website is free of viruses and malware?

 

Quite a difference, in that case you would be getting a reply from a domain you already e-mailed, so an expected source, with data held on that domain.

[Edutech98]

The ICO say publicly it's up to the public authority whether they click on the link or not, but schools are saying the ICO tells them not to click on the link.

 

No they don't. The only publicly available information we have from the ICO is saying they support the schools decision that they shouldn't have to click on a unknown URL link due to the security concerns that this brings.

 

There published advice is that public authorities need to put organsational and technical measures in place to protect their data which is what schools are trying to do.

 

You seem to have an issue with making things up as you go along!

[bmaloney]

Quite a difference, in that case you would be getting a reply from a domain you already e-mailed, so an expected source, with data held on that domain.

 

Not necessarily the domain of the website is not always the same as the domain of the email. Not only that, but sending an email is not the same as visiting a site, as you keep telling me. I've no guarantee the site is safe, why should I visit it? Am I supposed to think that because it's a school their website is free of malware and viruses? I'm being told on this forum that schools don't have resource to implement proper virus scanning for themselves, how can they possibly ensure their website is free of viruses?

 

As I've already shown Somerset County Council doesn't guarantee their attachments are virus free, if they can't do it with all their resources how can a primary school?

 

Cuts both ways, we either come up with a way of doing business on the internet (an air break machine) or we lock ourselves away in our silos and hope the nasty wolf stays away from the door. Wannacry was not spread by email.

[elsiegee40]

Fortunately this is not a court of law.

 

The ICO made a decision that is legally binding unless and until overturned by the Appeal Panel.

 

As I said before, there is little point debating what ifs until the Appeal Panel decision is announced.

 

Until then schools may validly stand by the ICO decision.

[tg12]

As I've already shown Somerset County Council doesn't guarantee their attachments are virus free, if they can't do it with all their resources how can a primary school?

 

That statement is there for much the same reason all food packaging says “May contain traces of nuts”. Even though there’s very little chance of it, it’s there to cover themselves should the improbable happen. Nothing is 100% certain.

[Katy]

That statement is there for much the same reason all food packaging says “May contain traces of nuts”. Even though there’s very little chance of it, it’s there to cover themselves should the improbable happen. Nothing is 100% certain.

 

That, and nobody can guarantee something as virus free, even with all the antivirus in the world, with zero day exploits existing.

[djrscally]

I'm gonna chip in again and say: there's no way this request legitimately takes longer than the 18 hour time limit. If you can't dump everything requested out of the MIS in way way WAY less than that you either need training for your staff or a new MIS. So, if I were getting responses from schools saying they had to manually check each individual record I think I would be pretty annoyed too.

 

The technival invalidity of this request not withstanding I think it's pretty crummy for an LA to be organising a refusal on those grounds.

[minimoo]

If the information is already published online you direct the requester to the answer via a link. You are not refusing to answer the request. You are simply not rewriting the answer.

 

And in that context, an pre-filled form/template from a requestor isn't necessarily manageable as a request mechanism

[minimoo]

And surely - one solution to this is for schools to start publishing their current staff count / gender split of staff on their website - some of the the request would then contain information that was already publicly available, and those bits of the request would be done to the requestor to look up themselves. After all - surely the purpose of the FOI was to encourage public bodies to make information publically available for ALL - and schools making more data available would be a good outcome. Edited March 21, 2018 by minimoo

[mavhc]

Are you saying they should send me a link in an email and expect me to click on it? What if my policy prevents me doing that, have they actually provided me with the information? How can I be sure their website is free of viruses and malware?

 

You can't, but the FIOA allows for that, plus it's better for everyone else on the planet, the data is now public, easy to build a bot to scan all school websites. Maybe you could use a guest network, probably easier to set up on a home network. Do you have a tablet or something you could wipe 20000 times?

 

Only accept plain text emails, problem solved. Auto bounce all html emails with a message to explain why.

 

Attachments can be in plain text too.

[elsiegee40]

And surely - one solution to this is for schools to start publishing their current staff count / gender split of staff on their website - some of the the request would then contain information that was already publicly available, and those bits of the request would be done to the requestor to look up themselves. After all - surely the purpose of the FOI was to encourage public bodies to make information publically available for ALL - and schools making more data available would be a good outcome.

 

Those big enough to have to comply with the equal pay directive will be doing this.

[Katy]

Those big enough to have to comply with the equal pay directive will be doing this.

We do this as our trust is HUGE, although it's not a "number of female staff" etc, it's a staff list where you would have to count up and total for each gender yourself. Not that it matters for this as FOIA doesn't apply for us (Independent).