back to article Data watchdog fines Brit council £120k for identifying 943 owners of vacant property

A London borough has been slapped with a £120,000 fine from the data protection watchdog after unlawfully identifying 943 owners of vacant property in a Freedom of Information (FoI) response. The Information Commissioner fined the Royal Borough of Kensington and Chelsea for breaching the Data Protection Act, after it …

  1. Anonymous Coward
    Anonymous Coward

    Recycling money?

    I always wonder what the real impact of a public body fining another public body is. Isn't this just recycling taxpayer money? If the council has to fork this out of their annual budgets, doesn't this just punish those that pay local council tax since this gets passed onto them or cut out of their slice of the pie? maybe I've misunderstood the logic here...

    1. Anonymous Coward
      Anonymous Coward

      Re: Recycling money?

      Yes but those poor politicians in central government need all the money they can get to pay off the DUP.

    2. macjules

      Re: Recycling money?

      1) It is always Other People's Money, even when it is Council Tax-payers money being transferred to income tax-funded state bureaucracies.

      2) The ICO recently demonstrated with the Cambridge Analytica fiasco that with with a route map, GPS trackers and 5 satellite positioning they could still not find their posterior with both hands. Therefore the only way that RBKC could be fined is if they reported themselves, which they duly did.

    3. gnarlymarley

      Re: Recycling money?

      ....If the council has to fork this out of their annual budgets, doesn't this just punish those that pay local council tax since this gets passed onto them....

      When you stop and think about it business just do this same exact thing. They are basically tax collectors and pass any taxes onto their customers. I mean, where do they get the money to pay the added costs? Just like the money will come from the citizens that pay local tax, business do the same.

    4. Loyal Commenter Silver badge

      Re: Recycling money?

      If the council has to fork this out of their annual budgets, doesn't this just punish those that pay local council tax since this gets passed onto them or cut out of their slice of the pie?

      My understanding is that the London Borough of Kensington and Chelsea is sitting on a fair pile of cash, presumably due to the wealth of a number of its residents.

  2. Adrian 4

    No, the fine is paid out of the pockets of the guilty council officials.

    I wish.

    1. Anonymous Coward
      Anonymous Coward

      "No, the fine is paid out of the pockets of the guilty council officials."

      But is that 'guilty' person the one who clicked the button, the person who decided proper training wasn't cost effective or necessary, the person who decided security didn't need a person or team specifically focused on it, or...or...or...?

      1. Adrian 4

        Re: "No, the fine is paid out of the pockets of the guilty council officials."

        void passthebuck(me) {

        if (someone.pay > me.pay)

        passthebuck(someone)

        }

        1. Yet Another Anonymous coward Silver badge

          Re: "No, the fine is paid out of the pockets of the guilty council officials."

          Decide that you would need to write a secure app to retrieve this data securely

          App would have to be written to NATO security level double-plus-top-ultra-secret and be approved by MI5, GCHQ, MMB and the Dennis the Menace Fan Club

          Point out that this would cost "One Million Dollars"

          Refuse the FOI request on the grounds that it would be too expensive to comply

          Repeat for any and all future FOI requests

        2. TimMaher Silver badge

          Re: "No, the fine is paid out of the pockets of the guilty council officials."

          That will cause a stack overflow in quite a lot of organisations.

          Wrap it in while loop that trawls through the management hierarchy, evaluating the outcome as true/false before finally laying the blame?

          Just sayin’.

        3. jh27

          Re: "No, the fine is paid out of the pockets of the guilty council officials."

          I think you got your > and < confused.

    2. Anonymous Coward
      Anonymous Coward

      I am shocked !!

      we need a Captain Louis Renault icon !!!

  3. tiggity Silver badge

    Excel

    Thts the problem with people getting too spreadsheet obsessed.

    Export your data in a simple text format and this type of data breach woill be spotted (assuming basic competence)

    1. Sykowasp

      Re: Excel

      Does Excel have an "Export only directly visible data in this view" option, or similar?

      "Pivot Tables are Bad for FoI Requests" is the lesson learned here.

      1. John McCallum

        Re: Excel

        One could always mash that key marked PRINT SCREEN

      2. katrinab Silver badge

        Re: Excel

        There is an export to pdf option. It isn't completely foolproof as you can get hidden text in pdf files, but it would be an improvement.

        1. GruntyMcPugh Silver badge

          Re: Excel

          @katrinab

          You still have to be careful with .pdf, there was a case recently where a .pdf had been sent out under a FOIA that contained redacted information, and there are free tools to undo that to make it visible again.

          1. katrinab Silver badge

            Re: Excel

            Well yes. Those free tools are the copy function in Acrobat, and the paste function in another program, eg Word, which isn't free, but most people have it anyway. Then change the background colour of the text to white, and the text colour to black.

    2. pɹɐʍoɔ snoɯʎuouɐ

      Re: Excel

      "assuming basic competence"

      and there's the big problem.... council workers and basic competence are mutually exclusive !!

      1. Grikath

        Re: Excel

        "and there's the big problem.... council workers and basic competence are mutually exclusive !!"

        Not always.. In municipal-related projects I've had to distribute many a pivot table, and the first thing you do is LOCK THE DAMNED THING. It's also why you learn Access if you got to work with Office. Same queries, less embarrassment.

        However Manglement doesn't like that, as it locks them out of....reviewing.. your work for answers they do not like. So Safe Practice gets beaten out of subordinates and below. Your average slob may have provided the table, but you can be sure it was not locked or otherwise sanitised until Manglement and Public Embarassment got through with it and sent it out as-is.

    3. Anonymous Coward
      Anonymous Coward

      Re: Excel

      Or use something like R or Python for data analysis, slicing and dicing etc. Problem is always a lack of knowledge.

  4. Herring`

    This seems to happen all the time. "Paste as values" - it's not hard to learn. Either than or save as PDF. The latter would also stop councils sending out Word documents with "Track Changes" on.

    Maybe I should start running a course for councils "how to stop your employees leaking". Compared with £120K, it would be cheap.

  5. trevorde Silver badge

    Alternative solution

    1) take a photo of the screen with a (film) camera

    2) develop file

    3) print out image

    4) scan printed image into computer

    5) email scanned image to journo

    Have I missed any steps?

    1. John G Imrie

      Re: Alternative solution

      4.5 remove url of porn site from photo

    2. david 136

      Re: Alternative solution

      You forgot

      * FAX to self

      * Copy to microfiche, then print

      * Copy 4000 times

      * Send to monastery for transcription by copyist monks.

      * Translate to ancient language for transmission in the oral tradition

      * Rely on a stone in a museum to translate back to English

      (Order of steps may be varied)

  6. Shadow Systems

    I apologize for being ignorant in this...

    But aren't property owner records already public records? As in publicly available from the council planning office (at the bottom of the stairs, leopard, etc) that can be had by anyone whom cares to visit & request said data?

    If the ownership records of those properties is public, then what difference does it make if the council included that data in a FOIA request for related data? If it's also publicly available data then all it did was save the FOIA requesters an extra request, and the council more money responding to the additional FOIA requests, by including the data in the first FOIA request.

    Like if you make a request to know whom owns the vehicle with plate $XYZ123 & the department of motor vehicles sends you not only the owner's name, but address as well. Both the name & address are publicly available, you can always do a reverse look up online or merely dial the operator & ask, so the department providing that data isn't violating any "private data" rules - it's all publicly available.

    So please excuse my ignorance of why this is evidently a bad thing, instead explain why it was supposed to be bad so that I might learn.

    Thank you. =-)

    1. A K Stiles

      Re: I apologize for being ignorant in this...

      I think you can get the name (and possibly contact address) of the owner of a property from the land registry (for a nominal fee), but that doesn't tell you whether the property is occupied. The council will know this from the council tax record for the property (single occupant pays less than multiple people occupying, zero occupants pays less again I believe), but that isn't a matter of public record.

      Knowing how many properties in an area might not be a DPA problem and be in the public interest, but knowing which properties those are and therefore to whom they belong may well be.

      In the UK I believe you have to have a recognisable reason (and possibly be registered?) to be able to request a vehicle owner's details e.g. controlling local parking restrictions, so this isn't considered public information.

    2. ArrZarr Silver badge

      Re: I apologize for being ignorant in this...

      The information is available for request if you have a good reason, just like the registration plate example. It probably also costs per address/registration to get this data. This means that people with the intent to cast a net for fraud of various flavour would have to pay up front.

      The data getting out for free lowers the barrier of entry for the ne'er do well.

      1. GruntyMcPugh Silver badge

        Re: I apologize for being ignorant in this...

        @ArrZarr "It probably also costs per address/registration to get this data."

        I just checked, and yes, you are correct, three quid a pop, so the press getting 943 results for the cost of a FOIA was an absolute bargain. Not that the press could have identified so many vacant houses easily anyway.

    3. Anonymous Coward
      Anonymous Coward

      Re: I apologize for being ignorant in this...

      "But aren't property owner records already public records?"

      ... and how would this differ from contact addresses in wjhis no longer being permitted under GDPR?

      1. Adam 52 Silver badge

        Re: I apologize for being ignorant in this...

        "and how would this differ from contact addresses in wjhis no longer being permitted under GDPR"

        Land registry disclosure is authorised by parliament; Land Registry Act 2002 s66.

        Whereas whois is an agreement between private companies.

    4. Aqua Marina

      Re: I apologize for being ignorant in this...

      The short answer is

      The mass dump of personal data is what is illegal.

      Longer version

      Like you say there is nothing illegal about turning up at your local council office armed with a paper notebook and pen, and asking to see public records then making notes. If however you turned up at the council offices armed with a 1000 page per minute high volume copier, expect not to get through the door.

      At the moment there is a fine line drawn between reasonable access to public records, and massive data collection. I expect things will start to get messy once the GDPR comes into play. Most councils will probably err on the side of caution, until someone has to sue them to get access to public data.

      1. katrinab Silver badge

        Re: I apologize for being ignorant in this...

        You can find out the owner of the property from the Land Registry, at £3 per time. But that isn't necessarily the person responsible for paying Council Tax.

        You can find out the valuation band from the Valuation Office, just put the post code into the website and it tells you the band. But the valuation band is only one factor in determining your tax liability.

        Council Tax records, however, are not available to the public.

      2. cantankerous swineherd

        Re: I apologize for being ignorant in this...

        which law says this?

    5. Insert sadsack pun here

      Re: I apologize for being ignorant in this...

      "Like if you make a request to know whom owns the vehicle with plate $XYZ123 & the department of motor vehicles sends you not only the owner's name, but address as well. Both the name & address are publicly available, you can always do a reverse look up online or merely dial the operator & ask, so the department providing that data isn't violating any "private data" rules - it's all publicly available."

      I assume you are in the US. If so, this is not correct. Access to vehicle registration information is restricted by the Driver's Privacy Protection Act, which states that records may only be disclosed for a number of specified reasons. Those reasons are more numerous than in the UK, for example, but they're not public records (in the sense of "give me a copy and I don't have to explain why"). Access is a privilege, not a right.

    6. My other car WAS an IAV Stryker

      Re: I apologize for being ignorant in this...

      Shadow:

      I had the same core idea as you, and I think that's an American perspective.

      In my county in Southeast Michigan, property records -- owner, tax history, structural info -- are provided via a third-part service hired by most of the municipalities. It is completely free to use, and even wildcard searches can be performed. (I can look up everyone on my street at once!) Similarly, land sale information must be published in a local newspaper, so from day 1 every land owner is known.

      Minnesota has the same laws; I once looked up my parents' address, and remember from long ago seeing land sale records in their hometown paper.

      With required publicizing of such data (name, address, date of closing), I'm not at all concerned what WHOIS says about me. Such privacy fines and laws like GDPR may work for UK and EU but could never fly in the US without a major shift in government at all levels.

    7. Shadow Systems

      To everyone that replied, Thank You.

      I am on "the wrong side of the pond" as you put it, so that may help explain my confusion over how you do things over on your side of it.

      Thank you for explaining how it works over there. I appreciate the education.

      Now come join me at the pub so I can buy you all a round & show my appreciation properly. Just please don't drink me into the poor house, I'll need enough left over to try & swim home. =-D

  7. cantankerous swineherd

    eh? the land registry is open, ownership of properties is public knowledge?

    1. Anonymous Coward
      Anonymous Coward

      That and the land charge registry however the issue here isn't the data it's the data protection aspect. They should not have disclosed the information because it wasn't theirs to give and infringes the data protection of the people contained within it. At least that's how I see it.

    2. John Robson Silver badge

      Ownership is, but the FOI request answer should have been a single number, not a list of properties and their owners.

    3. Just Enough

      It's not just ownership that was revealed. It was combined with occupancy. That is not public knowledge.

  8. Tom 7

    Pivot Table?

    I thought anyone in a council who could use a pivot table was compulsorily outsourced. If you have people in a council that can use pivot tables then they might be able to work out outsourcing is a rip off and they'd have to go!

    1. Loyal Commenter Silver badge

      Re: Pivot Table?

      I thought anyone in a council who could use a pivot table was compulsorily outsourced. If you have people in a council that can use pivot tables then they might be able to work out outsourcing is a rip off and they'd have to go!

      Presumably, this is why they didn't know how to use the pivot table, and, as a result, leaked the data behind it. Not knowing it was there.

  9. Anonymous Coward
    Anonymous Coward

    Backwards Government

    Related to dodgy Government data handling.... In Facebook-land, this is what the Irish government is doing to circumvent its own data regulation:

    https://www.irishtimes.com/business/technology/privacy-rights-it-s-natural-facebook-would-choose-ireland-1.3400531

  10. Teiwaz

    This empty property thing

    Isn't going away.

    It'll be back sooner or later as it really doesn't look as if enough is being done to alleviate the current housing situation, especially in London.

    Should be counted as a wake-up to all those involved.

    However seems a large SEP Field is being visualised by all with the power to act.

    1. Fihart

      Re: This empty property thing @Teiwaz

      Finally a comment about the real issue here -- so many empty properties. And so many people homeless -- or living in crappy, overcrowded, overpriced, rented properties.

      Revealing the extent of underused or unused homes owned by offshore individuals and companies simply as investments deserves a medal, not prosecution.

  11. Stephen Wilkinson

    The FOI team is also likely to be based in the council's legal department and not necessarily that IT savvy.

  12. ICPurvis47
    Holmes

    Slight corrections.

    Shadow Systems said "Like if you make a request to know whom owns the vehicle with plate $XYZ123 & the department of motor vehicles sends you not only the owner's name, but address as well." Not any more, here in the UK. I asked for owner information for an historic vehicle I was restoring back in 1990 and was given chapter and verse, names, addresses, dates of acquisition, MOTs, etc. etc. This January I asked for the same information regarding another vehicle, but was met with a firm refusal, all they are willing to supply me with is the anonymised dates of change of ownership.

    AK Stiles said " The council will know this from the council tax record for the property (single occupant pays less than multiple people occupying, zero occupants pays less again I believe)". Again, not true. Single occupancy attracts a 25% discount on Council tax, but a vacant property is only exempt from CT for a limited time (two years I think). My next door neighbours fell foul of this when their mother died, they left the house empty for a while, intending to do it up and sell it, but after two years they were presented with a bill for double Council tax. The council explained that this was to dissuade owners from leaving property empty and thus reduce the number of families looking for property.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like