Written evidence A3 (PHO40)
Re: PACAC Call for Evidence: PHSO annual scrutiny 2020-21 (Submission ref: XEL725639)
I write in relation to the committee’s scrutiny of the PHSO, whose annual call for evidence over the above year was closed on 29/10/21.
Having already provided the committee with my submission prior to this deadline, on 28/10/21, I anticipate you will, by now, be assimilating the information you have received. In my case, I supplied a file of 31 pages, in specific relation to the committee’s second point of scrutiny, namely:
The time taken for the PHSO to respond to correspondence, including Subject Access Requests and Freedom of Information requests.
Given the timing of the deadline and the reluctance of the PHSO to correspond by this deadline, I now wish to inform the PHSO of an update. This follows the most recent communication I have received from the PHSO, subsequent to the closure of the PACAC deadline. I trust you will take this into consideration as the information (albeit redacted) is relevant to communication deficiencies.
1. With respect to my SAR dated 28/9/21: On 29/10/21, I received a disclosure from the PHSO, comprising 2 files. On examination of these 2 files, it was clear to me that key personal data that should have been provided to me was in fact absent. As such I sent an email on 2/11/21 as follows:
Sent: 02 November 2021 14:25
To: 'InformationRights' <Informationrights@ombudsman.org.uk>
Cc: 'DPO@Ombudsman.org.uk' <DPO@Ombudsman.org.uk>
Subject: RE: The Parliamentary and Health Service Ombudsman - Your information request
Thank you very much for the disclosure you provided, as per the email below. I have managed to gain access to the 2 files you attached as per your separate email enclosing the password.
Please can you confirm that you have sent everything held on this case in relation to my personal data. On 29/10/21 I received 2 files with details shown below:
1. Emails – C-xxxxxxx.pdf of size 338kb comprising 20 pages
2. Docs – C-xxxxxxx. Pdf of size 8Mb comprising 201 pages.
I look forward to receiving your confirmation by the end of tomorrow, the next working day, thank you.
The following day I received an email response as shown below:
From: InformationRights <Informationrights@ombudsman.org.uk>
Sent: 03 November 2021 16:00
Subject: The Parliamentary and Health Service Ombudsman - Your information request
We have received notification that you have sent us an email by Proofpoint Essentials. We are unable to read the email. Please can you re-send the email in a different format for us to be able to view this as it is showing as quarantined.
Freedom of Information & Data Protection Team
Parliamentary and Health Service Ombudsman
On 3/11/21, I resent the email from 2 different email addresses. Having not received any response, on 8/11/21, I spoke on the telephone to the PHSO reception desk who explained that it was impossible for me to speak to the Information Rights team. They suggested I resend the emails again and by 11/11/21, if I had still not received any response, then I should send a hard copy letter in the post. I was just about to do so when, earlier today (11/11/21), I finally received a response as shown below:
Thank you for resending the email.
I can confirm that you have been provided your file in full. The only document which we did remove was a template letter which xxxxx xxxxx used to send as an email to your MP xxxxx xxxxxxxxx. The letter was incomplete, and the contents can be seen in the email xxxxx sent your MP on 10 August 2020.
I wish to point out that the above confirmation triggers a very serious revelation that 180 pages of evidence are completely absent from my case file. This is referenced on page 4 of my PACAC file:
Further to the email I sent a few moments ago, please find attached, the file (6) Bundle 2 of 180 pages. For the fresh case sent in 22/7/20.
Please confirm receipt of both emails at your earliest convenience.
As you aware from my correspondence, although I raised my case on 22/7/20, even when I asked for confirmation of receipt of all my evidence again on 1/8/20, and again on 26/3/21, I still received no response confirming all the evidence had been received. I now realise I did not enclose the 3-page letter in my evidence of submission and so I have attached this to the end of this document (redacted form in case it is published).
This absence of evidence causes me grave concern and distress. It proves that my complaint was never even read, otherwise the missing 180 pages of evidence would have been immediate. More disturbingly, however, is the fact that, had the PHSO bothered to inform me that 180 pages of evidence had gone missing, I could have resent another copy to them and they could then have done a proper investigation. As such, this now exposes them as an organisation who doesn’t even bother to check the evidence it receives let alone read the complaint - which obviously makes reference to it! As such, this proves the PHSO are unfit for purpose, at least in respect of my case.
2. As far as the FOI request is concerned, to date I have still received no response. I have reminded them, again, (today by email) of their obligation to comply with Section 10 of FOIA (2000).
I look forward to your acknowledgement of receipt of this letter of 5 pages. I will expose the PHSO.
26th March 2021
Parliamentary and Health Service Ombudsman.
Re: Case Cxxxxxxx (ICO)
Dear Ms .
Thank you for your email dated 25/3/21 in relation to your initial understanding of my prospective PHSO complaint case against the ICO. As this case is evidently very large by virtue of the extensive documentation, and the distinct possibility (following your earlier comments) that some information may have got lost in transit, I would hope you could please confirm that you are in full receipt of all supporting documentation to date, prior to your assignment to the case. This includes exclusively:
(a) My 2 emails (with respectively 1 and 7 attachments), each dated 22/7/20.
(b) My email dated 1/8/20, requesting a confirmation of receipt for the information described in (a).
(c) My email dated 4/12/20 expressing my concerns against the ICO caseworker (XX), requesting that all future PHSO correspondence on this matter is addressed by someone independent (since XX has been working on a related XXXX case that is about to give rise to a different potential complaint against her). I would respectively suggest that XX’s line manager is also not independent and that this matter should be discussed on the basis of pure objective evidence (not assumptions), through an entirely separate team within the ICO that is totally independent of XX.
(d) My email dated 7/12/20 expressing my concerns following auto notification from the PHSO, that my email (c) had been “deleted without being read”.
(e) My email and attachment of one page, sent on 26/1/21, evidencing that the XXXX sent my appeal docs to XXX in December 2018, rather than June 2018 (as protocol dictates), prior to my opportunity to raise a comprehensive appeal with the XXXX against the complaint against XXXX. The XXXX had already closed the appeal in October 2018. This specific aspect of the case is very serious and triggers a public interest matter.
(f) My emails dated 12/3/21 and 23/3/21 expressing concern in relation to the apparent lack of any progress since the initial checks had been completed on 10/8/20.
As such, I would appreciate please your confirmation of possession of all the above, and of all the associated information I have sent the PHSO to date. At the early stages of your investigation, I would hope you could please address point (c) above.
I take issue with the third paragraph of your letter in which you state “the ICO are the final authority on data matters outside of the courts”. In actual fact, it may come as a surprise, that it is very frequently the case that ICO assessments (based only on ICO opinion) only go so far, beyond which the ICO generally refer the SAR complainant to the courts. The ICO frequently accept, “Our decision will not affect your ability to enforce your rights through the courts” and furthermore:
“If you are seeking personal redress or compensation for the way an organisation has dealt with your personal information, you will need to pursue this independently through the courts or with an industry's own ombudsman or regulatory body”.
Just like any other Government organisation, the ICO is (in itself) not immune from prosecution in respect of data protection Rights, nor from (any associated) professional negligence and/or allegations of misconduct. The final authority on all data protection matters always rests with the courts, not the ICO. Indeed, it is convenient at this point to draw your attention to recent adverse publicity surrounding the ICO at https://informationrightsandwrongs.com/2020/09/12/if-ico-wont-regulate-the-law-it-must-reboot-itself/
The article’s conclusion is that “the ICO is failing to perform its basic tasks of regulation and enforcement”.
In a nutshell, this has been exemplified by my case, as I join the growing list of other disgruntled people who are trying desperately to seek natural justice and hold the ICO to account for their misconduct. If any company is in breach of the regulations (let alone the ones they are supposed to oversee for goodness’ sake), then such matters must be taken seriously, to retain public trust and confidence.
In terms of legislation, DPA (2018) makes provision for complaints and orders to be progressed through the ICO, or respectively and alternatively, through the courts. Sections 165 and 166 are relevant to the former, whilst Sections 167 through to 169 are relevant to the latter.
For your information, under FOIA (2000), I recently requested from the ICO: a copy of the specific guidance and/or policy in relation to ‘how to conduct a case review complaint against ICO staff following an expression of dissatisfaction.’ Very disappointingly the ICO failed to disclose anything in the timeframe permitted. Should I receive any documentation, I may well forward that to you, should any such policy come to light. This document may operate as a useful reference tool.
As the ICO caseworker for this case, hopefully being in possession of my 39-page complaint form, you will by now have appreciated that my complaint involves the ICO handling of their assessment against the XXXX. You appear to have grasped the general gist of the complaint. However, there is an error in your understanding of the complaint. I address this below.
Your reference to “full disclosure court order” is incorrect in this context since no court order has been raised (as yet) against the XXXX. The Court order was made against XXX in June 2018 and involved personal data that (I allege) XXX failed to disclose, contrary to the Order, in advance of any opportunity to provide evidence against their sham investigation.
This personal data was required in order for me to raise an appeal with the XXXX (against the findings of the XXX complaint process). The ICO played no part whatsoever in securing the court order. I achieved this result myself, through the courts. I have however, also taken the Information Commissioner to court. I am currently in the process of taking XXX to court again following a more recent ICO decision in my favour, that confirmed XXX breached data protection legislation. This follows from the 2018 order and is relevant to the XXXX appeal.
Essentially, the XXXX failed to send my full appeal documentation to XXX at the appropriate time, (contrary to XXXX regulations), prior to XXX’s input on my representation (as protocol dictates). The XXXX concealed this information from me until after the appeal had already concluded. This breach of process, pre-meditated attempt to conceal my personal data (the evidence), failure to inform me and prevent my Right to rectification, has been pointed out to the ICO but they chose not to engage with that evidence. The consequential effect is that I have been denied the Right to a fair trial (at the appeal stage), as provided by the Human Rights Act (1998) Article 6. I claim, the ICO are equally culpable in effecting this breach to Article 6.
The 3 paragraphs you have stated provide only a broad overview and direction of the nature of the complaint. They do not in any way, describe an accurate representation nor provide for a substitution of the complaint particulars, that are necessarily detailed, extensive, and complex in places. This is to be expected in a complaint of such magnitude.
The ICO were negligent in failing to uphold my DP rights and ignored the fundamental question:
How is it ever possible to raise a comprehensive appeal if I am prevented from ALL access to the EVIDENCE supporting the findings?
The ICO Case Review was not carried out with any integrity or care. The ICO have shown no interest when clearly being mis-informed by the data controller, despite me rising to the challenge of their invitation for me to provide strong factual evidence, which I duly obliged. To turn a blind eye and not engage with that evidence is simply unacceptable. This undermines public confidence in the ICO.
In respect of how I have been affected, page 30 my complaint, references the miscarriage of Justice I have suffered and the consequential breach of a fair trial at the XXXX appeal stage, for which the ICO are part culpable.
In respect of the tendered outcome, the restriction to mere “service improvements” is wholly inadequate. I require an admission that in hindsight, the ICO’s decision was detrimental, having resulted in a breach to both my Data Protection Rights and my Human Rights to a fair XXXX appeal.
The ICO will need to examine their SAR assessment practices as these are clearly not fit for purpose. Their rubber-stamping Case Review process has also been exposed as wholly inadequate. As such, both investigation and Case Review processes will require a fundamental overhaul. The details are provided on pages 33-34 of my complaint documentation.
I do appreciate this case is very complex indeed, for which you have my utmost empathy and understanding. Even I find it difficult returning to it after all this time, trying to piece the story together again. I fully anticipate many questions being raised and I do not expect all the issues to be resolved any time soon, especially with the Covid-19 situation.
Please do not hesitate at any point, should you wish to raise any questions. I would suggest direct email is the best medium for this to take place. I am intending to talk to the media once the restrictions are removed and the appetite for normality resumes.
Finally, just to say at the end of the day, I totally understand about priorities in life, and the work-life balance. The covid-19 situation has taught us all what is important in life and the importance of our families and those around us. I hope this case does not make life any harder for you other than what it is at the moment. I hope we can work through this together and reach a successful conclusion in the interests of natural justice.