Surveillance: Citizens and the State - Constitution Committee Contents

Examination of Witness (Questions 881-899)

Professor Janice Morphet

18 JUNE 2008

  Q881  Chairman: Professor Morphet, can I welcome you most warmly to the Committee. Thank you for coming. We are not being televised this morning but we are being recorded so could I ask you, please, to formally identify yourself for the record.

  Professor Morphet: I am Janice Morphet.

  Q882  Chairman: Would you like to make a short opening statement?

  Professor Morphet: It may help the Committee to hear a word about my experience before we start. I have been employed in local and central government for nearly 40 years—40 years next year—and during that time I have worked for a variety of local authorities—county, district, London borough. I have been chief executive of a small unitary authority, Rutland, and during the period between 2000 and 2005 I was a local government adviser in what is now CLG, working in e-government and working on local government modernisation. By profession I am a town planner.

  Q883  Chairman: Could I begin by asking whether you think that the modernisation of local government needs a large expansion in the amount of personal data that is collected and shared between departments? If you do, should this be done on a need-to-know basis and a judgement about proportionality, or do you think collections of data should be widely available to many service departments?

  Professor Morphet: I think the modernisation of local government has been about using what is collected better and more efficiently, so I am not sure that I would support the view that it entails an increase in the use of data collection. Perhaps I could illustrate that in a particular way. One of the main responsibilities of a local authority is to provide people with benefits through their arrangements with the DWP, and that information at the moment is collected separately by different departments inside the local authority. If you look at a modernised local government perspective, what you clearly see is that many citizens are not actually receiving their full entitlements. There are just over 50 different kinds of financial benefit that a citizen could be entitled to, and work that we undertook when I was in CLG demonstrated that 80 per cent of the information required for those applications for benefit was the same. The current system would be that a citizen would have to fill in as many forms for these benefits as they thought they were entitled to, but a modernised local government approach would suggest that you collect the information once and, with the citizen's consent, you see if they are entitled to other benefits. That is the first thing to say. I am not sure if the Committee is aware of something called the "T" scheme, "T" meaning trust.

  Q884  Chairman: Please expand.

  Professor Morphet: There is a system called the "T" scheme, which is owned by the Cabinet Office, although run independently but certainly linked with them, and what this does is identify perhaps seven levels of risk in terms of their relationship to particular transactions. Most local authorities only get to about level three. If I could illustrate what the levels mean and go on from there, for example, a level zero would be a citizen being issued a library book. There is a very little risk in the loss of a library book. Yes, there is a cost but it is a very low risk. Nevertheless, you have to identify yourself to the local authority before you are permitted to take out a book. Going up the scale, obviously, registering for a service, you might need to provide more information about your identity and that is verified by the local authority. That may be level two. I am just trying to think what might be a level two service. If you are seeking maybe to have a taxi licence, you might argue that that is the middle level. For the upper level, where the risk is highest and where the personal information you have to provide, which is proportionate to the risk of fraud, say, or misuse of public resource, then clearly that is level three. So it goes on to higher levels, which local authorities do not use. The purpose of these levels is to identify clearly for each transaction in local authorities, and indeed in central government, what kind of risk is proportionate and related to each of these transactions, what kind of information needs to be collected, and what kind of staff training and data handling processes go with this. Local authorities are using this approach, which I think is quite cautious, quite responsible, in terms of their use of information. At the upper level, level three, local authorities are of course governed by the DWP's verification framework. Again, I am not sure if that is something you are aware of. Local authorities are inspected regularly by the DWP in terms of their application of the verification framework. For example, if you live in London and you want to get a parking permit to park your car outside your house, you have to demonstrate to the local authority before you receive that permit that you are indeed a resident and indeed that you own the car. There are two proofs that you have to show. However, for a renewal you only have to confirm that that information is still correct, whereas if you were going back for a financial benefit, where the risk of fraud is higher, you have to show the documents ab initio. I hope that explains the kind of system that exists.

  Q885  Chairman: Can I just go on and ask whether you think the safeguards against the loss or misuse of personal data by local authorities are adequately developed?

  Professor Morphet: The framework which I have outlined to you is used and in force and inspected regularly. I think there are adequate safeguards for those approaches. Clearly, if you look at breaches and information loss in local authorities, I do not think we have had the same kind of issues that perhaps there have been in other public bodies. I think the concern from a local authority's point of view is very much about whether a citizen is being disadvantaged if information is not shared. I am not arguing that information should automatically be shared, but I think there is also a concern that the citizen might be losing out in terms of entitlement and often the citizen does think that the information is shared within the local authority—that is a commonly understood public perception—but it is not and authorities do keep that information separate unless there is a very specific approach and agreement from the citizen to share it.

  Q886  Chairman: Can I ask if you think that the increasing use of information and communication technologies by local authorities presents dangers to individual privacy, or do you think the technologies are designed or could be designed in ways that safeguard privacy?

  Professor Morphet: I think the ICT systems that are used by local authorities have really replicated the kinds of systems that we had with paper systems, which I think have these safeguards, because information is not shared. It is held very tightly within the authority and access, say, for example to personal data in social services or children's services now is very tightly controlled. When I was a chief executive, we had an extremely difficult case concerning a family and child protection issues, and certainly I was never allowed to see the case files because they were confidential, and I think those practices are very much steeped in local authority working. I can only speak in terms of local authorities for that, but certainly I have never felt—in fact, I think the danger is almost in the other direction, that people are very frightened of sharing any information and, as we have seen, sadly, with child protection cases, and distressing cases recently, that inability to share and that cultural concern about sharing information has obviously put children at risk. So I think that my view of local authorities would be very much a culture of not sharing information unless there is a very specific code and framework for doing so.

  Q887  Lord Peston: My question follows on more or less from everything you have just said. Could we first of all clarify what one should have in mind when we are talking about data sharing? It seems to me there are several possibilities. One is talking about data sharing within an authority, and then there is data sharing between an authority and something else, and the word "sharing" can either mean you having access to my data or you and me and exchanging data. Could you enlighten us on whether they are all important?

  Professor Morphet: I think the three examples you have given are used in different ways. For example, when I was running a local authority, in our Housing Benefit service we did not give housing advice directly; we subcontracted that to the Citizens Advice Bureau, and obviously the staff who then may have needed access to some personal information related to the individual to give that advice had to go through the same kind of training and be subject to the same kind of controls as if they were our own staff. There was no reduction in that standard because another agency was undertaking it for us, and that indeed would be the case. I have had out-sourced services, say, for benefits and the staff who work for Capita or other big companies are subject to the same kinds of standards as your own staff and have to be trained and inspected in the same way. So that is in terms of personal data. If you are thinking about data matching, which is when you are comparing large bundles of information between local authorities, only recently have we been able to look at data matching in any significant way because of IT systems being better. That is primarily used now in terms of fraud, because what is very clear is that those who perpetrate benefit fraud are mainly two types. One is an individual who will just try to commit fraud but there are very organised large-scale frauds going on, and they tend to operate within regions over a large number of authorities. Up to now it has been quite difficult to catch them. You can obviously catch them within a local authority but data matching is helping that, and if you look at the Information Commissioner's advice, certainly he has covered quite clearly the issue about data matching, which I think covers that point satisfactorily.

  Q888  Lord Peston: All of this was leading up to the point that we used the expression in our question whether local authorities receive sufficient guidance on this, but really we ought to be asking do individuals officials receive sufficient guidance? What is your view? If I can add another bit on that, one often refers to the need to know, but in a way, you do not know whether you need to know until you have tested it by getting the information in the first place.

  Professor Morphet: Yes. There are two sorts of examples to think about. I have been primarily talking about benefit cases, where people have to divulge financial information. The training systems for that are very rigorous and they are inspected very closely. The need to know comes into play when you are doing casework around an individual, around a child, say, a child protection issue. There is quite a lot of distrust between organisations, in my experience anyway, at a formal level about sharing information. However, informally some of those conversations go on around a child because of concerns. When I was a chief executive, which is now ten years ago, we introduced social workers into secondary and primary schools because we had concerns. It is now becoming more common practice to have social work practitioners, certainly in large schools, and now associated with primary schools, and if that can go on, trust can be built and sharing information around the child is a more natural event. There are risks; on the other hand, the risks of not taking action are also very great, and I think that ability to take that judgement as a professional is something that is part of your daily tasks.

  Q889  Lord Peston: Your view is it has to be done on an individual basis; in other words, if an authority were to say "Our principle in this authority is a presumption not to share" and another authority would take the view "Our presumption is you should share." That is your starting point. Where would you be on that?

  Professor Morphet: I am talking now about individuals, who can have quite complicated lives. A child might live with its mother during the week and stay with its father in another authority at the weekend, and there might be concerns that need to be shared across the border. I would be on the side that, if there were concerns, they should be shared, but obviously in an appropriate manner. Depending on the scale of concern, I think it would be very important to do so, and particularly in urban areas, where local authority boundaries do not necessarily represent the patterns of movement and where people live, I think it is extraordinarily important that that is managed in a very proactive way, appropriately and to the case.

  Q890  Lord Smith of Clifton: Might I ask: you were talking about contracting out to the Citizens Advice Bureau on Housing Benefit, and there are two things here. First of all, the Citizens Advice Bureau is taken generally to be advocates, yet they are exercising an agency function, so there is a real conflict of interest. Secondly, with contracting out to outside agencies, there must be a degree of control loss in terms of training. There are plenty of theoretical articles about the degree of control loss the more you contract out, and there clearly needs to be rigorous training. I am sure it is on paper but who does the compliance on this?

  Professor Morphet: On the point about the CAB, I take entirely the point that you make about a conflict of interests, but a number of agencies like the CAB now actually compete for this kind of work. There is a point of debate there, but that is the contract that we had.

  Q891  Lord Smith of Clifton: Forgive me, you are just re-articulating the dilemma, not offering us any solutions.

  Professor Morphet: I was just going to go on to say that thinking about the training side and how that is enforced, clearly, for many out-sourced contracts the actual out-sourced employees still sit within the local authority buildings and offices, so actually, the training and compliance happens in the same way as it would if they were in-house. Now each local authority has a risk and compliance officer as a requirement. Internal auditors also do systematic checks. DWP inspectors come on a regular and unannounced basis and, if there is any difficulty, they come back, having given you things to improve. Those agencies now use mystery shopping and other techniques to assess these things. They have IT compliance auditors as well, so now a local authority will have an IT compliance audit, which is precisely looking at the processes for handling data in terms of data quality, whether it is correct when it is inputted. We have all heard of people who have had problems because there have been mistakes. It also looks at the rigour of the internal systems and whether or not they can be breached by people from outside. I am not being glib about it. I think within a local authority it is such a systematic environment—and it is hard to convey that to you, I understand but that is the way it works. Perhaps it is hard to explain but it does happen every day.

  Q892  Lord Smith of Clifton: I am happier with your answers on training but coming back to this conflict of interest by co-opting essentially the voluntary sector as agents of the state at a cheaper rate, and I think this is widespread, and not just the CAB and Housing Benefit, and so on, when we talk about citizens' trust in government, I must say if I thought in respect of my Housing Benefit they were not acting as advocates but were more concerned with renewing their contract with the local authority and did not want to cause too much trouble, this does not enhance my trust in the whole process.

  Professor Morphet: I think that is a good point and I am not disagreeing with that at all. We did not have a contract with the CAB to actually issue Housing Benefit but they were giving housing advice on homelessness, finding people accommodation and that kind of advice. Nevertheless, even if you are establishing homelessness, you still have to establish the financial and personal circumstances of an individual. So I do understand the point that you are making and I do not know whether CAB still have that contract. This was ten years ago and the contract was extant between 1996 and 2000. Perhaps that has now changed.

  Lord Smith of Clifton: I doubt it. Thank you.

  Q893  Lord Morris of Aberavon: I think Lord Smith has covered largely what I wanted to ask. The CAB, for whose help I was very grateful as a constituency Member of Parliament, are a voluntary organisation. I am encouraged by what you say about training but how do you know that they train to the same standard as a local government employee?

  Professor Morphet: Because they would be trained by the local authority or by the DWP in the same way, and their compliance would have to be subject to the same audit as the local authority. So if you have a contractor undertaking work for you, the local authority has the same obligations as if they had their own staff doing it. Those obligations do not reduce. So, in a sense, if a third party is doing the work for you, the obligation on you is greater to make sure the compliance is there.

  Q894  Lord Lyell of Markyate: You were talking about multi-agency partnerships, and I was just trying to think of a circumstance. I am now going to mention a dodgy kind of character who may have more or less dodgy characters around him, probably less dodgy; somebody who is being chased by the child support agency, not paying their ex-wife, who may also possibly be applying for a waste disposal licence, or not applying for a waste disposal licence; may have come up on CCTV cameras as fly tipping; may be working on the black market, which is wife says he is doing to the CSA, whether he is or is not; may be claiming benefit or not, and the wife maybe claiming Housing Benefit, to which she may be entitled because she is being looked at. Those are about six different agencies. To what extent in practice are they actually sharing information today, in your knowledge?

  Professor Morphet: If you look at that cluster of circumstances, which in some cases would not be unusual, what would happen is that you would probably look at each of those separately to see whether there was any link between them. So if there is an issue about income and means to pay, and that were related to a claim for, say, Housing Benefit on the part of the miscreant, if you like, I think that cluster of activities about means to pay and payment and the wife's circumstances would now be looked at together, or are more likely to be looked at together. If you look at fly tipping and applying for a licence, those two things I think may be looked at together because you would want to check if somebody had been prosecuted for dumping before you issued a licence, no doubt. I am not an expert in that but I am assuming that is one of the checks that you might do. I think those two things come together. If somebody is turned up on CCTV, the only reason why, if they have been shown to be fly tipping, that is an issue for Trading Standards or Environmental Health or the police to take forward appropriately to prosecution if the evidence is there, and if the prosecution goes forward, that is no doubt taken into account when a licence is considered but I am afraid to say I do not know the formal position. What I am saying to you is I do not think those two sets of circumstances, which I have grouped into two, would necessarily be connected—only if the fly tipping or the waste management business was actually providing an income which the individual was citing as a means whereby they could or could not support the child.

  Q895  Lord Lyell of Markyate: You are painting a picture which seems to be a fairly real one of somebody sitting behind a desk, scratching their head about one or two or possibly three of these issues, but in your experience, at the moment the computer from the CSA is not talking to the computer from the fly tipping cameras, et cetera, so that they all link together.

  Professor Morphet: No, I have never seen any evidence of that kind and I could not see any justification for that at all. I could not see why anyone would do that at the moment, or in the future.

  Q896  Lord Lyell of Markyate: But at the moment you do not think it is happening.

  Professor Morphet: Certainly not, no.

  Q897  Lord Rowlands: You may regret mentioning the CAB! In your local authority, if I were a resident, and I came in and said, "Look, I don't want my personal financial information to be handed over to a volunteer from the Citizens Advice Bureau (a) because I know him or her or (b) I expect my local authority to be my local authority", would I be prevented from receiving benefit if I refused consent in that case?

  Professor Morphet: Certainly not. As I say, they were not providing actual casework on benefits. They were advising on homelessness.

  Q898  Lord Rowlands: So the financial side was dealt with entirely by the local authority itself?

  Professor Morphet: Yes. I am just saying that, in order to establish that you are homeless, you have to provide some information about yourself, which you might regard as information that you would want to keep secure. It could actually be information not so much about finance but about domestic violence, for example, and that would be the cause of homelessness, and that is something you would want to keep secure as well. There is always a backstop position, so that if you go into a local authority and you do not want to see the adviser who is allocated to you, you can request another one. The increase in local authority one-stop shops and multiple advisers trained provides a much better opportunity for individuals, a bit like going to a GP surgery; you have a choice but you can sometimes choose to go to one individual if you feel they know your case.

  Q899  Lord Rowlands: Can I just widen the discussion? What we are beginning to find is, with the increasing ability to create bigger and bigger databases, the temptation and the ambition in some cases has been to try to profile people in a variety of ways, to see whether they are going to be more likely to be criminals or more likely to be at risk, et cetera. Have you come across this? What safeguards do you think are necessary to prevent this growing database and this greater profiling, which could end up in discrimination or could just be wrong information or out of date information? The bigger the database, the greater the risk.

  Professor Morphet: I am not particularly aware of any profiling in use at the moment inside a local authority. I suspect what is more likely to happen is that the local authority would be undertaking risk assessments around certain types of individual or certain types of case. Thinking of an older person, the first time they have a fall is generally a trigger point to think that more problems are going to occur and therefore you might review the kind of support that you are giving to that individual. If you think about fraud, if somebody has been found frauding with one financial fraud, I think you would use that as a trigger point for an investigation to see if there are any other frauds, and that has always been the case actually. We might be better at it now because we have the data. I am still working inside local authorities, and I cannot think of any example of profiling that they might use, although now for large fraud cases in benefits that might be the case, a profile of certain circumstances would bring cases to attention for review. I think it would be triggered by the circumstances of the cases.

previous page contents next page

House of Lords home page Parliament home page House of Commons home page search page enquiries index

© Parliamentary copyright 2009