Why Am I Having to Mark Their Homework?

The burden shouldn’t be on the public to keep explaining the difference between a policy and evidence that the policy was followed.

Over the past few weeks, I’ve spent a considerable amount of time doing something I really shouldn’t have to do: checking the work of professionals employed by public authorities to administer Freedom of Information requests. Not because I disagree with their answers, or because I’m determined to find fault, but because some of those answers simply don’t address the questions being asked. Worse still, I’ve found myself having to point out errors in the application of the very legislation these organisations are legally obliged to follow.

It’s becoming bloody tiring, and it raises a question that goes well beyond my own correspondence. Why should an ordinary member of the public have to continually check whether a public authority is doing its job properly?

On 21 August, I submitted Freedom of Information requests to police forces across the country concerning their use of facial recognition technology. The central issue was straightforward. Police forces assure the public that biometric information collected during live facial recognition deployments is deleted in accordance with their published policies. I wanted to know what recorded evidence exists to demonstrate that those deletions actually take place.

The requests covered deletion-confirmation records, audit findings, technical assurance, retention exceptions and the involvement of third-party suppliers. I specifically excluded personal information, operational intelligence, security credentials and technical details that could expose vulnerabilities. In other words, I wasn’t asking for anything that would compromise an investigation or undermine the technology. I was asking for evidence that the safeguards used to justify its deployment are actually working.

That distinction is central to this entire investigation. A document explaining what should happen is not necessarily evidence that it did happen. A policy promising deletion is not a deletion record, just as a policy requiring an audit is not evidence that an audit took place or that its findings were satisfactory. These are hardly revolutionary concepts.

When a website becomes the answer to everything

Nottinghamshire Police provides a particularly interesting example of the difficulties I’ve encountered. On 17 September, the force responded to my request by relying on Section 21 of the Freedom of Information Act, which provides an exemption where the requested information is already reasonably accessible by other means. In practical terms, Nottinghamshire directed me to its website.

I have absolutely no objection to this approach when it genuinely answers the question. If the evidence I’m asking for is already available in a published document, there’s no reason for the police to send me another copy. Simply identify the document, point me towards the relevant section and I’ll happily read it. The problem arises when the material being offered is merely related to the subject rather than containing the information actually requested.

I challenged Nottinghamshire’s response on 17 September. Five days later, the force withdrew it, explicitly describing its previous response as erroneous. It subsequently considered Section 31, relating to law enforcement, and extended its deadline while undertaking a public-interest assessment. After further correspondence about the basis for that extension, the force eventually issued its revised response on 16 October.

And what did that revised response contain? Another reliance on Section 21 for five of my six questions, directing me back to essentially the same facial recognition information. After withdrawing its original response, considering a different exemption and taking additional time, Nottinghamshire had effectively returned to its starting position. The letter offered no explanation of why the original Section 21 decision, which it had withdrawn as erroneous, was now considered appropriate.

So I downloaded all seven documents available through the link and examined them against the original questions. The material included policies, Appropriate Policy Documents, a Data Protection Impact Assessment, legal guidance and a register of deployments. Some of it was genuinely useful, and the force separately confirmed zero recorded incidents in response to one section of my request. That was a proper answer, and I acknowledged it.

However, the published documents did not provide the specific records demonstrating that post-deployment deletion had been completed. They described audit functionality without supplying the requested audit findings, and outlined deletion procedures without providing the technical assurance requested concerning the recovery of deleted biometric information. The force’s own Live Facial Recognition Policy also expressly excludes Retrospective and Operator Initiated Facial Recognition, despite the linked material being relied upon to answer questions about those technologies.

The deployment register itself makes the distinction especially important. It records more than 100,000 faces seen across two operations in Nottingham city centre. That figure does not necessarily represent 100,000 different people, but it demonstrates the scale of the processing involved. The register tells us when and where the operations took place, how many faces were seen and how many alerts were generated. What it doesn’t provide is recorded confirmation that the subsequent deletion requirements were completed.

After examining these documents, I found myself writing to Nottinghamshire again, explaining precisely which questions remained unanswered and asking the force to identify where the missing information could supposedly be found. In effect, I was marking their homework for the second time.

Meanwhile, at British Transport Police…

British Transport Police has adopted a different approach, although the outcome has been similarly frustrating. My request was submitted on 21 August, and on 20 September BTP informed me that it needed additional time to consider the public-interest test associated with Section 31. It provided a revised response date of 16 October.

I asked the force to explain which parts of my request engaged the exemption, what law-enforcement interests might be prejudiced and how disclosure of the requested information could cause that prejudice. On 21 September, BTP identified Sections 31(1)(a) and (b), referring broadly to possible prejudice to operational or tactical capability. It was an explanation of the general concern, although it didn’t fully address the individual questions I had raised.

Then 16 October arrived. Rather than receiving a substantive response, I received another extension notice, this time moving the deadline to 13 November. The explanation was that BTP had still not reached a decision about where the balance of the public interest lay. That was substantially the same explanation offered in September. There was no identification of exceptional circumstances explaining why the additional time already granted had proved insufficient, or why another four weeks was now necessary.

This matters because the Information Commissioner’s guidance says that extensions to consider the public-interest test should ordinarily bring the total handling time to no more than 40 working days. Longer periods are possible, but should be exceptional and fully justifiable. BTP’s latest proposed deadline takes the handling of my request to almost 60 working days.

The legislation allows reasonable additional time for the public-interest test; it does not provide an unlimited opportunity to keep moving deadlines without justification. I therefore wrote back asking what exceptional circumstances necessitated the further extension, why the assessment remained incomplete, and why information unaffected by Section 31 had not already been disclosed.

Once again, I found myself having to explain the regulatory expectations to people whose professional responsibilities include administering these requests. I appreciate that some Freedom of Information requests are complex. Consultation may be necessary, specialist advice may be required and genuinely sensitive information deserves careful consideration. I have no difficulty accepting any of that. What I find difficult to accept is a further month-long delay accompanied by little more than a statement that the authority still hasn’t finished considering the matter.

There is a difference between exercising a legitimate legal provision and providing a meaningful explanation for why its continued use is necessary.

Legal obligations are not optional extras

The Freedom of Information Act 2000 establishes statutory duties. It isn’t a collection of administrative suggestions that public authorities can interpret casually or follow when convenient. Section 21 has a legitimate purpose, as does Section 31, and the provisions allowing additional time to consider the public interest exist for good reasons. My objection isn’t to their use. It’s to having to repeatedly check whether they are being used correctly.

Nottinghamshire provided another revealing example. Its September refusal cited Section 17(5) as the provision requiring a refusal notice when relying upon Section 21. However, Section 17(5) concerns refusals under Sections 12 and 14. The relevant refusal-notice provision for a Section 21 exemption is Section 17(1). I identified this error in my internal review request. When Nottinghamshire issued its revised response almost a month later, the same incorrect reference appeared again.

Imagine a solicitor citing the wrong statutory provision in formal correspondence, having the error pointed out, and then repeating it in a subsequent letter. Would that inspire confidence in the care being taken over the matter? Would it be unreasonable to ask whether the rest of the legal reasoning had received sufficient attention?

I don’t expect perfection from anyone, and I’m perfectly capable of making mistakes myself. The important difference is what happens when those mistakes are identified. Correcting them should be a basic part of professional accountability, particularly where the correspondence concerns someone’s statutory rights.

There is also a wider cost to all of this. Every inadequate response requires further correspondence, additional review and potentially an escalation to the Information Commissioner. That consumes the requester’s time, the authority’s resources and ultimately public money. A properly considered answer at the outset would surely be preferable for everyone involved.

Which brings me to the question that has increasingly occupied my thoughts throughout this investigation: what happens to people who don’t have the time or inclination to challenge these responses? An individual receives an official letter containing references to legislation and directing them towards a collection of published documents. Alternatively, they receive a notification explaining that their request has been delayed because a legal exemption is being considered. The correspondence looks authoritative, so they assume the organisation knows what it is doing and accept the explanation.

How often does that happen? I don’t know, and I’m not going to invent an answer. But after spending weeks examining responses, checking legal provisions and comparing published documents with the information requested, I think it is a perfectly legitimate question to ask.

Public accountability becomes considerably less meaningful if exercising a statutory right requires the requester to become an unpaid quality-control department. The burden of demonstrating that a request has been handled correctly should not routinely fall upon the person making it.

This matters particularly when the subject is facial recognition technology. Police forces are increasingly able to process images of large numbers of people simply going about their ordinary business in public spaces. The safeguards surrounding that processing are therefore fundamental to public confidence. If deletion, retention and auditing arrangements are important enough to feature prominently in policies and privacy documentation, they should also be capable of meaningful scrutiny.

I’m not suggesting that Nottinghamshire Police, British Transport Police or any other force is unlawfully retaining biometric data. The evidence examined so far does not establish that. The question is whether the recorded evidence exists to demonstrate that the safeguards operate as described, and whether public authorities are properly addressing requests to examine it.

If the records exist and can lawfully be disclosed, provide them. If a legitimate exemption applies, explain it properly. If the information isn’t held, say so. And if an exceptional delay is necessary, explain the circumstances rather than simply issuing another date. None of those expectations strikes me as particularly demanding.

The purpose of Seen. Not Processed. has always been to examine the evidence rather than ask the public to accept assurances at face value. That means acknowledging proper answers just as readily as identifying inadequate ones. I am entirely willing to be corrected when the evidence demonstrates that I am wrong, and I expect the same standard from the organisations responding to my requests.

I will continue asking questions, examining the answers and challenging decisions where the evidence justifies it. But I remain convinced that something is wrong when ordinary members of the public are repeatedly required to explain the basic distinction between a policy and proof that the policy has been followed.

I really shouldn’t have to keep marking their homework. Especially on a Saturday evening, when there’s a perfectly good pub I could be sitting in.

Trust requires evidence.

Seen. Not Processed.