The dangers of email mail-merge
A long time ago I rather rashly made an FOIA request for website usage data from every principal local authority in the UK. Things got a bit fuzzy in Northern Ireland owing to their local government reorganisation but in general most people handed over the information. Sometimes incredibly swiftly (take a bow Cardiff), sometimes with a bit of nagging (I’ll spare your blushes).
Two councils refused my request on the grounds that they don’t hold the data. Being the suspicious type I investigated their home pages. One of them did not appear to be running any tracking script which (though eccentric) seemed to be in line with their response. The other was running the Google Analytics tracking script. I pointed this out and following a brief email exchange my request was rejected[changed from reviewed which was a typo] and this had been upheld by an internal review.
So I referred the matter to the ico.
The ico investigates
I have to say the investigating officer was a remarkably nice and helpful man, despite my erratic phone answering and the comparative nerdiness of my request. After some discussions and contemplation the ICO issued a decision notice in which, you will not be surprised to learn, my appeal was upheld.
The decision notice has been published. They’ve taken my name out, which is nice, and you can read the decision notice in a PDF.
So apart from crowing at my (let’s face it: pretty minor) victory why else am I here?
Well though I always thought the council was wrong I could kind of see where they were coming from and so I think aspects of the ICO decision notice are helpful to note.
Things to note
The ico decided:
17. Having considered the above, it is evident that Google Analytics holds the usage data because the council has previously instructed it to do so (i.e. by actively placing a tracking script within the code of its webpages). Whilst the council has explained that it no longer needs this usage data for any business reason, it is clear that Google Analytics continues to collate and store the usage data because it has not received instruction from the council not to (i.e. through the removal of the tracking script). On this basis, the Commissioner has concluded that the raw usage data is held on behalf of the council by Google Analytics.
The Council also pointed out that they would need to run a report to answer the question which would be the creation of new data: something they are not obliged to do. The ico has given them quite a lot to consider on this point but concludes:
22. Having considered the above, it would appear to the Commissioner that running a report on the electronically held raw usage data would result in a statistical summary. It would also appear that it may be reasonably practicable for the council to provide such a summary, due to it having both the Google Analytics tool and council officers with the necessary skill to use it. On this basis the Commissioner would be likely to conclude that the provision of a summary based on the raw usage data would not represent the creation of new information.
So. If you collect the data, you hold the data. If someone asks you for a statistical summary of the data you hold that is (within limits) covered.
(I haven’t actually received the data yet mind).