Tim,

Thanks for the email. Here is the central question.

 

Does the trust need to inform a data subject that they have read their public blog or their public statements?

 

I would suggest that no, they do not. 

 

Issues that emerge if they do are the following. When does the organisation have to provide this FPN? When an officer reads a blog? When the officer reads the blog and sends it, or material from it, to another officer?  The question is when is the *organisation* aware of the information. When it is officially collecting personal data from the web? Is it only when they extract the material from the site or is it when anyone from the organisation visits the site? Does the existing FPN that might exist on the organisation’s website or its notification with the ICO apply to those cases?  What this would suggest is that anytime an officer in an organisation visits a blog they need to issue a FPN. (Does any organisation know regularly what sites its officers visited on a daily or hourly basis and for what purpose? They might be able to find that out after the fact.)

 

I would suggest that in this case an FPN, for reading the blog, is not needed is for the following reasons.

1.    Following Jay’s discussion of FPN on p.263 where she says “The reasoning is not completely clear [the argument that the MPs had not been told about disclosure of expenses so it would be in breach of the FPN requirements to disclose the information] but it appears that they accepted that because the MPs were aware of the disclosure of some information under the Publication Scheme adopted by the Commons the further disclosure was not regarded as another purpose. They also placed reliance on the fact that the obligation on the data controller to provide the information is not absolute but is only to “ensure so far as practicable” that the information is provided or made available.”

 

I would suggest that the nature of writing a public blog and publishing it about a case would indicate that the author would have the reasonable expectation that the other party mentioned in the public statements would read those statements. Thus, it should not be a surprise that the organisation would become aware of and read the blog.  The intent is to make their case in the public domain about the organisation and its behaviour. As a result, the organisation is going to receive attention by the public. It will have to act on the basis of what was written, whether it has read the blog or not.

 

2.    I would suggest that as far as practicable applies in the case we are discussing. I would be surprised if the ICO expected FPN notices each time a blog was read or was forwarded within an organisation as it would not be reasonably practicable to provide that notification each time an officer within an organisation read a blog.

 

3.    I would suggest that the ongoing relationship further reduces the need for a FPN for the blog being read and the response by the organisation, to read it, monitor it, and circulate cuttings from it, fits within the management of the ongoing relationship, which the author was aware of as part of the ongoing relationship. If I understand your logic, it would suggest that an additional FPN is needed even though the organisation is already processing and dealing with the author in an ongoing relationship. I would suggest that a FPN might be needed if the blog that was being read had nothing to do with the organisation as that would be stretching the view that it is within the expectations of the data subject. However, this is still uncertain because the comments are in the public domain. This would suggest that anytime an officer read any blog they would need to issue a FPN to the author of the blog.

 

4.    Following Jay again, p. 265, she does point out that the ICO’s guidance does distinguish between actively communicating a notice and making it readily available. “On the wording of the Act, as long as the data subject has the information made readily available to him and is not misled or deceived, then there is no obligation of active communication. On the other hand the data controller has an overriding obligation to act fairly and there may be cases where fairness requires an active communication.”

I would suggest that in this case, the FPN notice of the organisation would likely cover the fact that they will collect personal data to manage the complaints. I think the organisation has already provided the necessary ingredients for a FPN by their ongoing relationship with the author. I would suggest that the collection and processing has been fair. We may dislike it, but that does not make it unfair.

They know the data controller.

They know their representative.

They know the purpose for which the personal data is collected. Their personal data is collected to manage their ongoing case/ complaint /legal issues.

 

I am not sure what more would be expected.

 

You will recall that the ICO did mention that it read some FOI/ DP blogs and did circulate the cuttings within the ICO. Did they issue a FPN at the time for that particular collection? I do not recall seeing one. (I do not believe that my blog would qualify nor would I expect my comments on this list to reach that status).

 

On the defamation issue, I would not suggest that organisations use their media teams as defamation detectors. I was pointing out that the staff would have a reasonable expectation that the organisation would take steps to protect them, as employees, from defamation as well as potential threats that can emerge on the web. I would think this requirement is heightened now that we have social media. The flip side of the individual holding the organisation to account is that the organisation has to take steps to protect it staff. One would note that the Solicitors from Hell was a harbinger of what was to come. I would image that in the wake of Haringey and Rotherham organisations will need to be aware of the potential that their social workers could be subject to online campaigns of abuse.

 

I would suggest that a public sector organisation is not able to sue for defamation, but its individual officers can. http://www.brodies.com/node/1844 The level of serious harm, this case involving a housing provider, has to be pretty high. http://www.nabarro.com/insight/alerts/2014/august/defamation-act-2013-what-is-serious-harm/

 

As I said previously, all of this is moot until such time as the ICO receives and actions a complaint or the court receives and actions a complaint.

 

If one does occur, I will be interested in the outcome.

 

Best,

Lawrence