Public bodies that use Google Analytics do hold the data collected

The dangers of email mail-merge

A long time ago I rather rashly made an FOIA request for website usage data from every principal local authority in the UK. Things got a bit fuzzy in Northern Ireland owing to their local government reorganisation but in general most people handed over the information. Sometimes incredibly swiftly (take a bow Cardiff), sometimes with a bit of nagging (I’ll spare your blushes).

Two councils refused my request on the grounds that they don’t hold the data. Being the suspicious type I investigated their home pages. One of them did not appear to be running any tracking script which (though eccentric) seemed to be in line with their response. The other was running the Google Analytics tracking script. I pointed this out and following a brief email exchange my request was rejected[changed from reviewed which was a typo] and this had been upheld by an internal review.

So I referred the matter to the ico.

The ico investigates

I have to say the investigating officer was a remarkably nice and helpful man, despite my erratic phone answering and the comparative nerdiness of my request. After some discussions and contemplation the ICO issued a decision notice in which, you will not be surprised to learn, my appeal was upheld.

The decision notice has been published. They’ve taken my name out, which is nice, and you can read the decision notice in a PDF.

So apart from crowing at my (let’s face it: pretty minor) victory why else am I here?

Well though I always thought the council was wrong I could kind of see where they were coming from and so I think aspects of the ICO decision notice are helpful to note.

Things to note

The ico decided:

17. Having considered the above, it is evident that Google Analytics holds the usage data because the council has previously instructed it to do so (i.e. by actively placing a tracking script within the code of its webpages). Whilst the council has explained that it no longer needs this usage data for any business reason, it is clear that Google Analytics continues to collate and store the usage data because it has not received instruction from the council not to (i.e. through the removal of the tracking script). On this basis, the Commissioner has concluded that the raw usage data is held on behalf of the council by Google Analytics.

The Council also pointed out that they would need to run a report to answer the question which would be the creation of new data: something they are not obliged to do. The ico has given them quite a lot to consider on this point but concludes:

22. Having considered the above, it would appear to the Commissioner that running a report on the electronically held raw usage data would result in a statistical summary. It would also appear that it may be reasonably practicable for the council to provide such a summary, due to it having both the Google Analytics tool and council officers with the necessary skill to use it. On this basis the Commissioner would be likely to conclude that the provision of a summary based on the raw usage data would not represent the creation of new information.

So. If you collect the data, you hold the data. If someone asks you for a statistical summary of the data you hold that is (within limits) covered.

(I haven’t actually received the data yet mind).

What should define a Multi Agency Information Cell?

Why the gripping headline?

I’m not sure I’m getting the hang of writing click-bait headlines. But this is a significant question for some people. And some of those people read this blog.

What’s it all about?

Version 2 of the JESIP doctrine has been published for consultation. JESIP is the Joint Emergency Services Interoperability Programme and the JESIP Doctrine lays out how the emergency services should work together around major incidents.

Though JESIP is about the emergency services the doctrine actually affects hundreds more organisations because they (local authorities, heath bodies, utility companies and so on) have a duty to work with the emergency services (and each other) to sort out emergencies.

The original JESIP doctrine was pretty clear and sensible. Version 2 builds on these pragmatic and sensible foundations but adds in a couple of years of learning since the original. You can see the draft JESIP Doctrine here.

Get to the point Ben

Section 5 of the draft doctrine covers Information Assessment and Management. It touches on a range of things that will be of interest to people in my network (like essentially recommending ResilienceDirect as the way you should exchange data).

Section 5.4 issues a “Framework for Information Assessment” which is really saying “let’s be consistent in when talking about how reliable information is”. The question of how you assess the reliability of publicly available information (like reports on social media) is something VOST and Digital Humanitarian groups have some considerable expertise in.

Most exciting is section 5.5 which mandates a Multi-Agency Information Cell. This is a dashed good idea. In fact many people might think it sounds rather like a Virtual Operational Support Team (or VOST). In the current draft though the MAIC does seem a bit inward looking, pooling the geographic data that agencies have.

This sparked a bit of a discussion on Twitter and I said I would fire something up to see if we can get some sort of consensus from the VOST/BlueLight and possible CrisisMapping community.


The consultation is open to anyone to respond. responses have to be sent in a fairly structured way (using an Excel spreadsheet – I’ll park the discussion on the use of open formats for a more appropriate time). So anyone can (and probably should) respond in their own right.


I’d really appreciate the insight of the wider digital and emergencies community specifically on the sections about the Framework for Information Assessment and the Multi-Agency Information Cell. I’ve pulled those sections (and only those sections) into a Google Doc.


Living on the edge of devolution

Picture of a walker on a hill side with a farm in a valley far below and behind

Trains are devolving

Responsibility for the West Midlands rail franchise could be handed to the putative mayor of the West Midlands it has been reported. 

That’s probably a good thing. This devolution idea seems to be likely to hang around for a bit. Politicians based in Birmingham are likely to be more interested in rail services based in Birmingham than the bunch based in London. They may not run it any better but it’ll be a shorter drive to go and shout at them.

I’m not based in London or Birmingham so the whole thing is of largely academic interest to me.

Except actually I use that franchise quite a lot. The West Midlands franchise (currently badged London Midland) provides the (rather slow) rail link between Hereford and Birmingham (and Malvern, Worcester etc). We are, quite literally, the end of the line (or I suppose, the start).

London Midland isn’t the only operator serving Hereford. We travel north to Manchester and south to Cardiff and beyond on Arriva Trains Wales. Responsibility for this Wales and Borders Franchise is being handed over to the Welsh Assembly.

We’re also the end of the line for the occasional Great Western service (not complaining I love my early morning chug through the Cotswolds).

From next year the vast majority of our rail services will be under the control of devolved institutions. That’s exciting. Closer to the people, more accountable, more joined up.

Except, here in Herefordshire we don’t get a vote in either of those institutions. We’re not in Wales nor are we part of the West Midlands Combined Authority.

This might not matter. It’s not like transport planners have been focused on making an effective and efficient service at Hereford station up until now.

But it probably will matter.

The whole point of devolving decision making is that it will make it more responsive to local people. So the West Midlands franchise should be, under devolution, run to be in the best interests of Birmingham and the Black Country. The Wales and Borders franchise should be (despite the name) run to be in the best interests of the Welsh.

If it serves Herefordshire well it will be by accident or because our interests coincide with the interests of the people of Wales or the West Midlands.

I suspect you probably still don’t care. We’re only talking about trains after all.

But let’s think about some of the other issues that are going to be devolved to the West Midlands and are already devolved to Wales: health, social care, road transport, economic infrastructure investment.

In all these cases we’re on the edge. Potentially squeezed between two institutions created with the explicit purpose of not having to worry about the impact of their decisions on us.

What can we do?

As I see it we have three broad options

  1. We can ask to join one of these devolved bodies.

    Joining Wales might be a hard sell in the county (though maybe not, they are our neighbours after all (yes, OK, it would be a hard sell)). It would probably be an even harder sell to the people of Wales. And even then I can see negotiations over the use of the language and the location of “Welcome to England” signs spiralling out of control.

    The West Midlands might be even tougher. We don’t share a land border with the West Midlands county and, let’s face it, no more than 1 in 100 of their citizens could point to Hereford on a map, let alone Leominster.
  2. We can get a devolution settlement of our own.

    We’ve already missed out on some of the juicy deals but I think most Herefordians would have some strong opinions about local priorities for road spending or health. But the independent state of Herefordshire? It’s difficult to see it. Cornwall managed to get an early devolution deal so it’s not unheard of for a single county. But Cornwall has over half a million inhabitants (that’s not far off 3 times our population).

    So a combined authority then? Joining up with Shropshire and Telford? Or maybe with Worcestershire? That worked really well before didn’t it?

    No. No it didn’t.

    Personally I’m quite attracted to the idea of devolution to the Marches (currently configured as Shropshire, Telford and Herefordshire). If Worcestershire joined we’d match the police force boundary. If they can do it maybe politicians can to.But then I grew up in Hereford, lived in Shrewsbury and worked in Ironbridge. My perspective may not be typical.

    At least we could expect more of a focus on improving the A49.

  3. We can say a plague on all your houses and just ignore it.
    This also has its attractions. English devolution may not take. And compared to what we see in Wales it’s really quite limited.

    There are real reasons to be cautious. In 2008 Herefordshire Council merged with the Primary Care Trust (then the thing that made most of the decisions for the NHS in Herefordshire). This was an uncharacteristically innovative thing to happen in what is , to say the least, a small-c conservative county.

    That was unwound in 2013 not because the people of Herefordshire thought it was a bad idea but because the government struck Primary Care Trusts out of existence (as part of fulfilling their election pledge that there would be no top-down reorganisation of the NHS).

    That should create within our leaders locally a healthy scepticism of how much power the folks in London are really going to hand over.

To devolve or not to devolve

I’m not trying to sell one option (except I think joining Wales is probably out) but I do think it’s something we should probably talk about.

Wouldn’t it be great if the people of the county had a say in where the decisions that affect the county were taken.

Is that a foolish hope?

If you want to know more about English devolution this blog post from the LGIU is a good place to start.

Photo credit: Fran heads for the edge by Alastair Campbell used under CC BY-SA 2.0

A Minimum Viable LocalGov Web Analytics Platform

A couple of weeks ago I wrote about what a jolly good idea it would be if we could pull all Council website stats into one place.

As a next step in this journey I’ve set up a minimum viable analytics platform.

It’s very minimum. Out of the 400+local authorities, it features data from 2.

They are

East Sussex, my favourite council in this space, which publishes on a Google account that will give anyone read access to their Google Analytics property

North Yorkshire, which doesn’t publish an account like East Sussex but kindly set one up to allow me to experiment.

So. The first order of business is to pull some data out of their Google Analytics account. I wanted to use the Google Analytics add-on for Google Sheets because it makes life very easy.

Each spreadsheet has to be tied to one Google Account. In this that meant having to create 2 spreadsheets. Luckily I was able create each spreadsheet on Google Drive using the account details I had been given (yes I can see a problem with this too: bear with).

So I created a spreadsheet for each account and used the Add On to run some simple reports. Then I gave myself access to those spreadsheets and copied their contents into a Spreadsheet of my own devising.

And was able to draw a nice graph of sessions per month for each council.

It would be straightforward to add more councils in the same way if they published an account as these two have. I don’t think that’s the solution though.

Creating a Google Account and publishing the password is a really attractive idea but it does enable people to use Google services completely anonymously. They might well want to do that for nefarious reasons. The risk is pretty low whilst only one or two councils does it but the risk would grow significantly if it became standard practice.

This is annoying of course but there we are. What could we do instead?

  • We could encourage councils to run a standard set of reports and publish these. Google Sheets would be a neat way of doing this because the integration is simple and the data can be pulled out in many useful formats.
  • We could set up a series of (that’s not me if it exists) accounts and ask councils to grant us access to their properties. That would save them the trouble of having to schedule reports and we could hand their data back to them nicely
  • We could ask councils to submit annual returns from their websites in a nice simple form
  • We could do all of those and give councils the choice

Going through this process makes me see why the US Government uses its own tracking script for Federal Departments and Websites. From my point of view that would be the most satisfactory approach but 650,000,000 visits a year probably equates to 1.5bn records a year so that’s not a project we’re going to manage successfully as a spare time endeavour.

But I’d really like to hear from others on this.