Dear Land Registry,

Background to this request:

1. The LR informed me that it was not subject to FOIA.

For the avoidance of doubt, this is information about the Freedom of Information Act.

https://ico.org.uk/for-organisations/gui...

Outcome:

The LR accepted that it was subject to FOIA and apologised.

:::

2. The Land Registry than put my personal information four times on the WDTK site on the internet.

NB WDTK removed my personal information.

Outcome: The Land Registry apologised - twice

Please therefore read this explanation before disclosing my personal information again on the internet:

Personal data means data which relate to a living individual who can be identified –
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual.

For the avoidance of doubt this is information about the Data Protection Act

https://ico.org.uk/for-organisations/gui...

::::

3. The Land Registry failed in its duty to apply Section 16 help and assistance to my request. And continued to try and link a request to my personal circumstances ( Nb Wrongly - by ascribing my request to my present personal address from reading my SAR).

Section 16 in practice
13. A public authority’s duty to provide advice and assistance is extensive and will apply to both prospective and actual applicants for information. 

14. The purpose of section 16 is to ensure that a public authority communicates with an applicant to find out what information they want and how they can obtain it. 

15. It is not a way for a public authority to establish a motive for the request. A public authority should be prepared to explain why it is asking for more information to avoid giving the impression that it is enquiring into the reasons behind the request. Paragraph nine of the code stresses the importance of this:
‘Authorities should be aware that the aim of providing assistance is to clarify the nature of the information sought, not to determine the aims or motivation of the applicant. Care should be taken not to give the applicant the impression that he or she is obliged to disclose the nature of his or her interest or that he or she will be treated differently if he or she does’.

https://ico.org.uk/media/1624140/duty-to...

As the Land Registry had already attempted to answer the request by putting my personal information onto the Internet, it had clearly failed NOT to link this request to my personal circumstance.

https://www.whatdotheyknow.com/request/l...

::::

The request:

1. From my Subject Access Request I read that the Land Registry has been profiling me - even though my Twitter name is not the same as jtoakley.

In addition, the data opinion is wrong, as I have not raised a 'personal case' with the Land Registry on Twitter.
:::

This is the profiling from my SAR , and you will note that it has been distributed to several Land Registry employees.....

Dear all

I thought it may be useful to keep you informed about a customer posting negative comments about us on Twitter.

Her Twitter handle is xxxxx.

( NB which is not the same as jtoakley)

Having done some digging based on some of her posts, I am fairly certain this is 'jtoakley'. I believe she is one of the customers who has been given a final response by Land Registry.

I responded to her initial post to explain that we do not discuss individual matters or concerns on social media, and that she should contact us through the normal channels if she wished to raise any issue. Since then I have ignored her further posts on Twitter.

I have attached a word document with her recent posts about Land Registry for your reference.

:::

The Land Registry will be aware of the FOIAct means that the request is considered to be 'requester blind'.

'This principle was endorsed by the Information Tribunal in S v Information Commissioner and the General Register Office (EA2006/0030, 9 May 2007) when it stated;
‘We wish to emphasise at this point that the Freedom of Information Act is applicant and motive blind. A disclosure under FOIA, is a disclosure to the public [ie the world at large].

In dealing with a Freedom of Information request there is no provision for the public authority to look at from whom the application has come, the merits of the application or the purpose for which it is to be used.’ (Para 80) '

https://ico.org.uk/media/1043418/conside...

A .Why is the Land Registry collecting personal internet data on members of the public that make WDTK requests by 'digging' as stated?

You will note that the employee linked my name to a suspected 'handle'. How far does this digging go?
The internet, or beyond?

Does the Land Registry regularly 'dig' for other similar names or handles that appear in the internet? Which might, or might not be - WDTK requesters?

And what is its purpose for spending public money and employee time to do so?

And if the Land Registry is profiling WDTK requesters, or, indeed requesters who make any other form of FOIA requests, does it inform requesters that their data is being collected from the internet, or other sources?

And does it give requesters the chance to correct any incorrect assumptions made by Land Registry employees when collecting data, which is then held as data on Land Registry records?

Please therefore provide the LR policy on profiling requesters ( the data which applies to the 'digging' stated) .

B. Who does this collected information on potential WDTK requesters go to? And for what purpose? Please provide the work instructions to Land Registry employees for researching the internet and any other sources to undergo this work.

C. I am informed that the Land Registry has a consistent pattern of releasing personal information - in response to WDTK requests:

Because one apology to me wasn't enough to stop yet more personal information being released onto WDTK, what steps has the Land Registry taken to ensure that personal data of WDTK requesters is not released into its site in the future?

Since my personal data was released four times, I would like the internal correspondence showing that the Land Registry recognised its initial mistake and the duplicated mistake with the employee/s concerned.

Please therefore provide Land Registry general data held on responding to WDTK requests - without releasing personal data onto the Internet.

Plus specific data showing that the Land Registry has attempted to correct the actions of employee/s who have released personal data on any public platform. Any data held which instructs employee/s not to repeat the action of disclosing personal data on the internet .....and explaining why they were wrong to do so.

NB (To comply with DPA, the personal data of the Land Registry employee/s concerned in placing personal data on any public platform to be redacted).

:::

Criteria and scope of request:

Request Title/summary within scope.
I am writing to make an open government request for all the 
information to which I am entitled under the Freedom of Information 
Act 2000.
Please send me recorded information, which includes information 
held on computers, in emails and in printed or handwritten 
documents as well as images, video and audio recordings.
If this request is too wide or unclear, and you require a 
clarification, I would be grateful if you could contact me as I 
understand that under the Act, you are required to advise and 
assist requesters.(Section 16 / Regulation 9).
If my request is denied in whole or in part, I ask that you justify 
all deletions by reference to specific exemptions of the act. I 
will also expect you to release all non-exempt material. I reserve 
the right to appeal your decision to withhold any information or to 
charge excessive fees.
If any of this information is already in the public domain, please 
can you direct me to it, with page references and URLs if 
necessary.
Please confirm or deny whether the requested information is held ( section (Section 1(1)(a) and consider whether information should be provided under section 1(1)(b), or whether it is subject to an exemption in Part II of the Act. 
If the release of any of this information is prohibited on the 
grounds of breach of confidence, I ask that you supply me with 
copies of the confidentiality agreement and remind you that 
information should not be treated as confidential if such an 
agreement has not been signed.
I would like the above information to be provided to me as 
electronic copies, via WDTK. The information should be immediately 
readable - and, as a freedom of Information request,  not put in a PDF or any closed form, which some readers may not be able to access.
I understand that you are required to respond to my request within 
the 20 working days after you receive this letter. I would be 
grateful if you could confirm in writing that you have received 
this request.


::::::::


Please consider  the ICO's Decision on the provision original documents on file, rather than newly written letters of response.
https://ico.org.uk/media/action-weve-tak...
This request does not require a letter, drafted by the External Affairs department, or any other written input by reputational defence employees, and purporting to be the response to a FOIA request.

Yours faithfully,

[Name Removed]

Dear Land Registry,

Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of Land Registry's handling of my FOI request 'Putting personal data on the internet and profiling ('digging' for WDTK requester's personal information)'.

Thank you for your response but this request is on the LR social media procedures.

Or 'digging for information', as the Land Registry terms it in-house.

Therefore snce the LR openly flouted the DPA four times, I wrote the background to the request to ensure the Land Registry understands that it must not put personal information in its response to this FOIA request on WDTK.

......Mainly to prevent it doing so for a fifth time.

::::::

Review

Dear [Name Removed]
 
Thank you for your email dated 25 October which contains a mixture of questions and requests for information under the Freedom of Information 
Act 2000 (FOIA).
 
FOIA does not require us to provide explanations or justify our practices and procedures.

Response - Quite so. But thank you I already am aware of this.

Please re-read the request. This an FOIA request for practices and procedures - which are already on LR file.

ICO guidance on requests:

https://ico.org.uk/media/for-organisatio...

It is a WDTK request is clearly marked as such and is not a 'letter' asking for justification, or 'explanation'.

:::::

 
LR - However to address the questions in your email:

:::

My Response:

Please note:
My request is for de-personalised DATA on file at the time of the request.
That is what an FOIA request is.

Help and assistance:
An accurate and easy way to identify a question is that they have question marks (?) at the end of them.

::::

 
Land Registry does not profile its customers on Twitter. If key terms are uses on a Twitter post, for example “Land Registry” we will be alerted to this.

My Response :
Thank you - but that is an 'explanation', not file data.
And you have already stated above that you do not give explanations in response to FOIA requests..

::::
 
You made a SAR and we provided information that we held and this included the internal email relating to your posting on Twitter. There is nothing untoward in this. It is you who is posting on Twitter and making references to Land Registry.

My Response:

You state:

'Your posting?'
'It is you who is posting on Twitter and making references to Land Registry'.

---

Once again, the LR is personalising this request with an accusation that I have made Twitter post/s .

Help and assistance :
My name is jtoakley.
My name was NOT on the Tweets logged in my SAR.

However, since you have confidently made the accusation, I await the Twitter-provided IP address linked to me, as the Twitter poster - as proof of your accusations.

Help and assistance :
As you will know, even then an IP address is not a guarantee of the identity of the poster.

:::

The reason for the request:
Therefore I requested your policy on profiling, since the LR must have some guidance on 'guessing' who posters are on the internet.

Then adding social media posts - not attributed to them by name - and so technically anonymous, on the personal files of anyone corresponding with the Land Registry.

In addition, when a name is present on social media, a J Smith might be confused with any other JSmith.
It is legitimate to request to know how Land Registry procedures and processes averted inaccuracy.

Help and assistance :
That is the difference between profiling - and collecting accurate, attributable data.

::::

And therefore this request was on that basis....

'Please therefore provide the LR policy on profiling requesters ( the data which applies to the 'digging' stated)' .

My Response :

This clearly is not a question. ( NB no question mark).

It is a FOIA request for the LR policy on collecting information anonymous, or otherwise ( and personal data) from the internet - and subsequent attributing it to Land Registry correspondents.

1. Without advising the public that information is being collected about them.
2. And without giving them the chance to refute any guesswork LR in- house accusations left on file.
::::

 
FOIA requests relate to identifiable requests for information only. Your 
actual FOIA request therefore only appears to be the following as 
extracted from your email:

My Response - 'appears' ? 'Actual?'

This is clearly stated to be the WDTK request - helpfully using the Land Registry's own terminology - which is ' digging' for information.

The Request

 
Please therefore provide the LR policy on profiling requesters ( the data which applies to the 'digging' stated) .

My response- I cannot see that it has any other 'appearance' than the obvious one.

Help and assistance :
You may like to note that an FOIA does not have to make a single sentence request. The requester may attempt to clarify it - to assist the production of an accurate response from the responder.
In this case the added information was to stop the Land Registry from adding my personal data to the WDTK response - for the fifth time.

::::
 
Our response:
 
We do not hold this information. We do not profile requestors.

My Response:

Help and assistance :
Please read the above on the difference between profiling and collecting attributable information.

:::
 
Information on our social media policy can be found on our website at 
GOV.UK using the following link:
 
[1]https://www.gov.uk/government/organisati....
 
Please provide the work instructions to Land Registry employees for 
researching the internet and any other sources to undergo this work.
 
Our response:
 
Please see the above link to social media use and also the Code of 
Practice at the following link.
 
[2]https://www.gov.uk/government/publicatio....

My Response:

Thank you for the links.

However it 'appears' that the information does not cover attributing unnamed profiled data to Land Registry files by 'digging'.

:::
 
Request:

Since my personal data was released four times, I would like the internal correspondence showing that the Land Registry recognised its initial mistake and the duplicated mistake with the employee/s concerned.
 
Our response:
 
Please see attached, redacted, correspondence.

My Response: It appears to be missing. Please provide.

::

Please also see information already supplied with your SAR.

My Response:

Thank you for your advice. But as stated, I have already read it.

::::::
 
Please therefore provide Land Registry general data held on responding to WDTK requests -  without releasing personal data onto the Internet.
 
Our response:
 
Please see attached internal staff guidance on WDTK requests.
 
Plus specific data showing that the Land Registry has attempted to correct the actions of employee/s who have released personal data on any public platform. Any data held which instructs employee/s not to repeat the action of disclosing personal data on the internet .and explaining why they were wrong to do so.
 
Our response:
 
Please see redacted correspondence referred to above.

My Response:

Thank you but it doesn't seem to be attached.
Please provide.

::::

 
A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.whatdotheyknow.com/request/p...

Yours faithfully,

[Name Removed]

Dear Petty, Roger,

Please note the terms which you can hold personal data.

Clearly your review will provide the LR's instructions to employees ( held as data) on in collecting and processing personal data on members of the public which, (as LR terms it ) has been stated as 'dug up' from the internet.

::::
To help and assist the LR's review of this request:-

This is the ICO's advice:

In brief – what does the Data Protection Act say about handling personal data fairly and lawfully?

The Data Protection Act says that:

Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless –

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

This is the first data protection principle. In practice, it means that you must:

have legitimate grounds for collecting and using the personal data

::::

* NB the LR is stating that it is collecting unattributable Tweets from the internet( digging' is 'collecting data' and therefore it has the right to add this personal data to personal records.
The LR will have data on file explaining its 'legitimate aims' to staff on internet 'digging'.
Therefore this instructive Data will form part of the Land Registry response to this request.

::::

ICO advice continued-
not use the data in ways that have unjustified adverse effects on the individuals concerned;
be transparent about how you intend to use the data, and give individuals appropriate privacy notices when collecting their personal data;

::::
* NB The Land Registry response should contain the procedure for informing members if the public that the Land Registry is collecting their data from the internet.

handle people’s personal data only in ways they would reasonably expect;

::::

*Nb I would not reasonably expect the Land Registry to be collecting unattributable data from the internet and adding it to my file.

Since the Land Registry has been specific in the response above and stated it has collected my personal data, what is the reason that it would try to collect my personal data since ....the ICO states that :
::::

ICO advice continued-

make sure you do not do anything unlawful with the data.
::::
* NB since it us illegal to collect data without informing a member of the public that the LR is 'digging' (Land Registry !s term) for information about them, recording it secretly and not allowing that member of the public to correct it. It is just justifiable to ask for the data which advises Land Registry emplyees of the steps that they must take to comply with the Act.
:::

ICO advice continued-

In more detail…

What are the “conditions for processing”?
What does fair processing mean?
Is it possible to use or disclose personal data for a new purpose?
Is it ever acceptable to disclose personal data to other organisations for them to use for their own purposes?
What about disclosures that are in the best interests of the individual concerned?
What about “privacy notices”?
What is meant by “lawful”?
What are the “conditions for processing”?

The conditions set out in Schedules 2 and 3 to the Data Protection Act are known as the “conditions for processing”. Organisations processing personal data need to be able to satisfy one or more of these conditions. This will not, on its own, guarantee that the processing is fair and lawful – fairness and lawfulness must still be looked at separately.

The conditions for processing are more exacting when sensitive personal data is involved, such as information about an individual’s health or criminal record.

For further information, please read about the section of this guide on the conditions for processing, which contains an explanation of what they mean in practice.

What does fair processing mean?

Processing personal data must above all else be fair, as well as satisfying the relevant conditions for processing. “Processing” broadly means collecting, using, disclosing, retaining or disposing of personal data, and if any aspect of processing is unfair, there will be a breach of the first data protection principle – even if you can show that you have met one or more of the conditions for processing.

Fairness generally requires you to be transparent – clear and open with individuals about how their information will be used.

Transparency is always important, but especially so in situations where individuals have a choice about whether they wish to enter into a relationship with you.

If individuals know at the outset what their information will be used for, they will be able to make an informed decision about whether to enter into a relationship, or perhaps to try to renegotiate the terms of that relationship.

Assessing whether information is being processed fairly depends partly on how it is obtained. In particular, if anyone is deceived or misled when the information is obtained, then this is unlikely to be fair.

The Data Protection Act says that information should be treated as being obtained fairly if it is provided by a person who is legally authorised, or required, to provide it.

Example

Personal data will be obtained fairly by the tax authorities if it is obtained from an employer who is under a legal duty to provide details of an employee’s pay, whether or not the employee consents to, or is aware of, this.

However, to assess whether or not personal data is processed fairly, you must consider more generally how it affects the interests of the people concerned – as a group and individually. If the information has been obtained and used fairly in relation to most of the people it relates to but unfairly in relation to one individual, there will be a breach of the first data protection principle.

Personal data may sometimes be used in a manner that causes some detriment to (negatively affects) an individual without this necessarily being unfair. What matters is whether or not such detriment is justified.

Example

Where personal data is collected to assess tax liability or to impose a fine for breaking the speed limit, the information is being used in a way that may cause detriment to the individuals concerned, but the proper use of personal data for these purposes will not be unfair.

Some organisations share personal data with other organisations. For example, charities working in the same field may wish to use or share supporters’ information to allow reciprocal mailings. Some companies even trade in personal data, selling or renting the information. The individuals concerned must still be treated fairly. They should be told that their information may be shared, so they can choose whether or not to enter into a relationship with the organisation sharing it.

Why and how personal data is collected and used will be relevant in assessing fairness. Fairness requires you to:

be open and honest about your identity;
*****+++. tell people how you intend to use any personal data you collect about them (unless this is obvious);
*******+++ usually handle their personal data only in ways they would reasonably expect; and
above all, not use their information in ways that unjustifiably have a negative effect on them.
Is it possible to use or disclose personal data for a new purpose?

*********It depends on whether it would be fair to do so. You should explain why you want to use an individual’s personal data at the outset, based on your intentions at the time you collect it. If over time you devise new ways of using that information, perhaps because of changes in technology, you will be able to use their personal data for the new purpose if it is fair to do so.

When deciding whether you should give any other information in the interests of fairness, you have to take into account the nature of the personal data and what the individuals concerned are likely to expect. For example, if you intend to disclose information to another organisation, fairness requires that you tell the individuals concerned unless they are likely to expect such disclosures. It is also good practice to tell people how they can access the information you hold about them, as this may help them spot inaccuracies or omissions in their records.

When deciding how to draft and communicate a privacy notice, try to put yourself in the position of the people you are collecting information about. Ask yourself:

do they already know who is collecting the information and what it will be used for?
is there anything they would find deceptive, misleading, unexpected or objectionable?
are the consequences of providing the information, or not providing it, clear to them?
We have issued a code of practice on communicating privacy information to individuals – privacy notices, transparency and control. It explains how to draft clear and engaging privacy notices, and the importance of collecting information about people fairly and transparently. Following the good practice recommendations in the code will help organisations comply with the law.

Yours sincerely,

[Name Removed]

Dear Petty, Roger,

Thank you L Malpas

As a lawyer, you are, of course aware that, under copyright, Tweets content belong to the Tweeter, and may not be reproduced without their permission.

I would therefore presume that you have messaged the Tweeter concerneed before copying any Tweets.

Since you have not contacted me, which Tweeter did you contact for permission before adding content-owned Tweets to my file?

::

FYI
Ownership of a Tweets

Twitter respects the intellectual property rights of others and expects users of the Services to do the same. We reserve the right to remove Content alleged to be infringing without prior notice, at our sole discretion, and without liability to you. We will respond to notices of alleged copyright infringement that comply with applicable law and are properly provided to us, as described in our Copyright policy(https://support.twitter.com/articles/15795). If you believe that your Content has been copied in a way that constitutes copyright infringement, please report this by visiting our Copyright reporting form(https://support.twitter.com/forms/dmca) or contacting our designated copyright agent.

::

I will be reporting this to the ICO simply because no organisation should reproduce unidentifued Tweets to a member of the publics files - Without asking their permission for reproduction of their copyrighted material - and not advising them that you are doing so for a stated purpose.

Yours sincerely,

[Name Removed]