Category Archives: rants

Redaction Whoopsies

I was prompted by a judgment published last week to write about redaction errors. Before I tell you why, let me just explain the term redaction – lawyers will be familiar with it but it’s one of those words that is not always familiar to those in other walks of life.

Interestingly, I’ve discovered a surprising variation in definitions of redaction online, but for our purposes, redaction is the process of removing those bits of information which need to remain confidential when preparing a document for disclosure or publication. It differs from anonymisation or editing because pseudonyms aren’t used, and the text isn’t written but a place marker is left so that the reader can see something has been removed. Sometimes a short description of what has gone is inserted in [brackets] to help the reader make sense of what is left.

The Information Commissioner’s Office describes it like this :

Redaction is the separation of disclosable from nondisclosable information by blocking out individual words, sentences or paragraphs or the removal of whole pages or sections prior to the release of the document. 

 

So, on to the subject of redaction whoopsies. The judgment that set me off is London Borough of Lambeth v AM (Judgment No. 2) [2021] EWHC 186 (QB) – not a case in the family court, but a case arising from child protection documents held by a local authority, which were released to a data subject following a data protection subject access request. That case was about the local authority’s frantic attempts to sort things out after the data subject managed (a parent) managed to undo the redaction and identify that it was his own family members who had made child protection referrals about his children. Whoopsy.

In summary, the judgment tells us this is what happened :

Lambeth attempted to redact any details that would reveal HJ’s identity. It did so electronically without realising that anyone reasonably proficient in the use of Adobe would be able to defeat the redaction and restore the original text. AM did so and used the documents obtained from Lambeth to write a letter before action accusing HJ of malicious defamation, breach of confidence and harassment.

Upon discovering that AM had been able to circumvent the redaction of the file, Lambeth issued this claim seeking injunctive relief to protect the alleged confidentiality of its file and orders requiring him to destroy all copies of the unredacted information.

In the circumstances, I can understand why the local authority in question might have felt it needed to take action – and the court accepted their arguments that the material was confidential, that he knew he should not have breached that confidentiality by removing the redaction, or by keeping an un-redacted copy and using it to threaten legal action against his family members – and an injunction was made (presumably requiring him to destroy copies, although the judgment does not specify). But what I wondered immediately on seeing the judgment was :

  • Why did they send him documents that still contained the confidential information waiting to be found in the first place?

and

  • Have they reported themselves to the Information Commissioner’s Office?

Ultimately, AM (the data subject who got around the redaction) could not have done what he did if the LA had done proper redaction in the first place – and nor would Lambeth have been in the awkward and expensive position of having to fund protracted litigation in the Queen’s Bench Division of the High Court. Think about it :the hard copy equivalent of what is described is sending a printed copy of the disclosure but putting a post it note marked ‘don’t read this bit’ over every reference to confidential information. Not really the sort of data processing that the ICO is terribly fond of.

In this case the data breach seems to have poured fuel on a family feud, probably prompting some rather upset communication from those families members who had held the expectation their identities would be protected. That is bad enough, but in other cases it might jeopardise a placement or put a child or parent at direct risk of harm. I know this because I too have had cases (a number of them) where someone’s failure to properly redact has only been spotted after circulation. Fortunately none of my cases have involved actual harm but I’ve seen a few scenarios which were a bit too close for comfort.

Until a few years ago redaction was carried out with tipex or a black marker pen, and disclosure was delivered in the form of photocopied hard copy documents. Then the problem was the lettering still being visible through the marker or the tipex. Now, you don’t get that, but there are equivalent problems with digital files, with their version histories, and optical character recognition and searchability. Most disclosure exists digitally, is redacted digitally and is served digitally rather than in hard copy.

I have a pretty good idea what happened in the Lambeth case because it’s happened in mine. The judgment doesn’t go into much detail because the purpose of the case was to fix the problem not investigate how it arose, so we only have a pretty slender description. But from the description given, this doesn’t sound to me like a member of the public performing some high level IT wizardry to undo properly redacted redactions, in ways that Lambeth could never have foreseen. It sounds to me like someone doing what any competent person can do with Adobe (a standard and readily accessible piece of software) if the redactions have not been properly done in the first place. I know this because it has been me on occasion who has ACCIDENTALLY discovered that someone at a LA has purported to redact but in fact has just stuck a black box over some text, without removing the text beneath. I discovered it when a keyword search resulted in multiple hits on a confidential name, a name that could be located behind the black ‘redaction’ boxes – but which could be dragged out from behind the black box (or the box deleted) to reveal the purportedly redacted text.

I don’t want to be all preachy here. There is and will always be human error when redacting large volumes of documents with repeated references to confidential names and addresses – one often slips through – and that can only be minimised by good processes involving checking and double checking – but what happened in this case (or at any rate what seems to have happened) is of a different nature. It has a high potential for harm and yet is so easily avoidable – and if used properly is pretty foolproof.

There is a proper Redaction function on Adobe DC Pro (other software is available but it’s a good example and pretty standard). Adobe DC Pro costs 12 quid a month. It substitutes text for a black box – it does not merely superimpose it. I cannot understand why any local authority does not do this as standard. I have had twitter exchanges with some (diligent and knowledgeable) local authority lawyers this week telling me how LA bureaucracy means that this is all impossible because of budgets and silos and procurement and lack of software … well, blah, blah. I get, and am familiar with that sort of infuriating impossibility loop (far too familiar) – but really? Most local authorities need and have some form of pdf software for bundling purposes (though a few still seem to be in the 20th century), so it is difficult to see how they can be unable to ensure that a redaction tool is available and used. Someone needs to sit the Director of Childrens’ Services or Head of Finance and Silos (or whoever) in those local authorities down, and tell them how much the ICO might fine them, how much it might cost to pay damages to the adoptive family or domestic abuse victim that has to move house, as a result of this sort of elementary data breach. Quite apart from the human cost to families the cost to a LA who causes such an issue by failing to redact properly is going to be substantially more than twelve piddling quid a month.

What my twitter exchanges did establish (in combination with my own experience) is that this is not a one off in one local authority. I strongly suspect that these sort of errors are probably more commonplace than can be justified, but that many are caught in the nick of time, or go unnoticed by the recipients of the information. It’s really quite alarming.

My experience suggests that it isn’t always lack of software though – sometimes it is just people not knowing how to work it. I had one case where a social worker had decided to be helpful by doing their own redaction rather than running it through legal (or whichever department is nominated to do it in the LA). That too can and should be pretty easily sorted, through process review or training.

Someone will probably accuse me of writing a sort of terrorists cookbook for those trying to breach confidentiality – well, respectfully they can naff off – this stuff is so basic that any fule can do it. All the more reason for great care by those with primary responsibility for looking after and processing this sensitive data. The buck really stops with them. If you don’t hand the nosey parkers and the dangerous stalkers of this world the information in the first place, they won’t be able to access it and do bad things with it.

The potential for the manipulation of pdfs is not a new or unknown phenomenon and by now LAs (and the rest of us) should be on top of our game. The ICO has a whole massive guide on how to disclose information safely here. I would have thought it was key reading for any local authority department responsible for subject access requests or disclosure of papers in the context of litigation, and that it ought to have informed any LA data policy and data risk assessment. It has a whole section on ineffective redaction and the dangers of using black highlighters that leave text beneath. It also links to a Redaction toolkit which has been available for almost a decade. So nobody can tell me that this is something novel or surprising. Any Local Authority with a robust data protection policy and risk assessment should have the necessary staffing, software and processes to be able to redact sensitive information about vulnerable children and families without redaction whoopsies.

Not my area…

Money lawyers may dismiss what follows as the deranged ramblings of a mere children lawyer, who rightly gave up money work as ‘too hard’ – but hear me out…

I spent a large chunk of last week listening to – and live tweeting – the conjoined domestic abuse appeals heard by the Court of Appeal on Tues-Thurs. Now this is not the first time I’ve thought about the implications of domestic abuse across the broader spectrum of Family Court work and beyond my little niche, but it has given rise to some musings about where we are at in terms of their impact on financial remedy specifically. These are not fully thought through proposals or anything, just some queries I’m throwing out for discussion. I think we maybe need to ask ourselves some questions, though I don’t profess to have all the answers. It’s been a while since I’ve done financial remedy work, and I may be out of touch.

So, things like PD3AA on vulnerable witnesses ostensibly applies to all types of family proceedings where there is a vulnerable witness, though I’m not sure how often it is deployed in such cases, in particular how often it is utilised in cases where there is a background of domestic abuse (alleged or proved), perhaps beyond the occasional screen.

PD12J however, the detailed guidance on dealing with domestic abuse – sits under Part 12 of the rules and, as such, applies only to Children proceedings.

It’s easy to forget that domestic abuse can hold relevance for two primary reasons in proceedings :

  • because of its impact on participation and best evidence
  • because it may be relevant to the substantive decision e.g. in children cases it means there is a risk to be managed

The first basis is clearly relevant in any sort of family proceedings. Where there are children there will likely have been some consideration of the issues in the context of the children case, something will have been committed to writing, perhaps there will be findings. But in many cases that is not the case – either the children are adult or there are none. How then does the court address, or even become aware of those issues, particularly where many participants in proceedings will be in person? As far as I’m aware there is no equivalent process to the C1A where a participant is asked at the point of issue whether or not there is a background of domestic abuse – meaning that the ‘red flags’ about the need to deploy PD3AA may not go up for the judge. The only place someone might deposit such matters is in the ‘conduct’ box on Form E.

I wonder if our culture of trying to avoid the blame game in money work might be impacting on this : what do I mean? Well, in financial remedy proceedings the court is directed by statute not to consider ‘conduct’ unless it would be ‘inequitable’ to disregard it (s25 Matrimonial Causes Act 1973). That means that judges are very reluctant to hear about allegations of domestic abuse, because they are generally not going to affect the outcome. Even where conduct is initially raised, judges are often at pains to explain this bit of the law to litigants, explaining that bad behaviour within relationships is sadly commonplace and the decision is not likely to depend on such issues. And if these issues aren’t going to affect the outcome there is of course no incentive for them to be set out in writing (indeed there is a positive discouragement or prohibition on doing so) , in order to alert the judge to the potential participation implications – or the substantive relevance of the alleged behaviour.

On top of that is the long running – and entirely sensible – campaign to remove fault from the divorce stage of proceedings more generally (ultimately successful).

But what if domestic abuse is relevant not just to participation (though that is important in itself), but to the substantive matters?

  • What if there has been financial control? What if other forms of control are now being expressed through the proceedings instead?
  • What if the control is continuing through the proceedings, unnoticed by the court, through persistent non-disclosure or vexatious but apparently reasonable requests for further information or by ramping up legal costs that a perpetrator knows the victim can ill afford until she is left acting in person, ground down and demoralised?
  • What if the control and abuse has eroded the victim’s self confidence, negatively impacted her capacity to support herself independently through an impact on her career?
  • What if the impact on the child(ren) means that there is justification in the victim staying at home, reducing hours or taking a less challenging role, to enable them to support the childrens’ wellbeing, therapy, recovery rather than maximising earning potential?
  • What if the behaviour has had such an enduring impact on the victim, even if non-physical in its form, that it would be unfair to ignore it?
  • What if there is a particular pressing need for the shape of any order to be crafted so that it ensures financial separation from the perpetrator so that the abuse through financial control can end?

One might say that my asking these questions is in tension with the no fault ethos. I don’t think it is. Firstly, it is important to distinguish between bad behaviour (which most relationships do involve at one time or another, in different guises and to differing degrees) and abusive behaviour which has a relevant impact on participation or financial matters. But secondly, a re-focusing upon relevance through impact was a recurrent theme in the domestic abuse appeals last week, and it seems to me that there is probably room for more thought about how we square the presumptive bar on the consideration of ‘conduct’ generally with the need to obtain sufficient information about allegations of abusive behaviour to properly inform the court both in terms of case management and possibly outcome. I suppose what I’m asking is : how does a judge know whether its inequitable to disregard conduct in the form of domestic abuse if the process squashes any mention or exploration of it systemically? And how easy would it be for a victim of such abuse to be heard on such issues? (particularly given all the pressures such victims will often be under, both financial and otherwise, and often without legal representation).

I suspect that at present the procedural framework for financial remedy proceedings may render judges oblivious to much of what may be going on under the surface. Particularly if the Court of Appeal adopts some of the arguments made last week about the Article 6 duties of proactive enquiry and case management around potential abuse (including in circumstances where not all victims are even aware that what they have gone through is abuse), then as a matter of principle those duties ought probably to extend to other types of proceedings – even where there is no relevant child of the family to consider under s25.

It might be that my worries about domestic abuse not being properly picked up and handled in the financial remedy sphere are unfair and unfounded. But in the context of so much evidence emerging of how we don’t always get it right in the children sphere even where it’s obviously pretty central, and knowing that there are similar personnel and all the same pressures on resources, I think it’s a valid question to be asking, even if the answer that comes is ultimately reassuring.

It’s also not Just about a fair procedure. As in the children sphere we do need to ask ourselves some searching questions about attitude. Think about Moor J’s remarks in MAP v MFP about a wife who sought an add back in respect of funds spent by her husband on cocaine and prostitutes – well, he said ‘since this was part of H’s flawed character and a spouse must take their partner as they find them, this could not be said to be wanton either & would not be added back’.

Now you can argue about whether to see the Husband’s behaviour in that case as an affliction or as merely evidence of him being a bit of a sh*t, but imagine if that approach were applied to a case of domestic abuse. A cynic might say it amounts to little more than the court shrugging its shoulders and saying ‘well, you should choose your husband’s more carefully love’. I would say that whilst domestic abuse may be a character flaw, it is still abuse, and the court should where relevant factor in the impact of it on the proceedings and the fair financial resolution. Not by way of punishment for bad behaviour, but in recognition of impact.

In part this post was triggered by me reading  some guidance offered by a lawyer and others in a newspaper advice column, which suggested that conduct was something that might be relevant in the case. I queried whether that would really be something that would be run – or perhaps that was likely to be helpful to run – but then began to wonder whether it was really right that we squash these noises about domestic abuse because of our culture of avoiding conduct and blame. From the replies I got I know I’m not the only lawyer who is being pulled in two directions by these issues, but I’d be really interested to know whether these are topics of active re-appraisal amongst financial remedy specialists?

I shall now retreat to my bunker and await a general drubbing for sticking my oar in to a field I know nowt about…

New Year’s Eve – No Pressure

It doesn’t do to think too much on New Year’s Eve. As I have recalled too late. Only yesterday I was pondering lighthearted easy wins for my new year’s resolution – eat less biscuits, do a doodle a day, dry January… but before I knew it I was wallowing in a soup of regret, with bits of last week’s turkey floating by like forlorn icebergs.

………WARNING : If you don’t want to wallow in my self-indulgent soup, turn away now and proceed with your Hogmanay booze fest…….

The truth is, in the Covid era we have set ourselves small, bitesize daily targets : survive today, walk the dog, take whatever work is available because it needs doing and you never know what might happen next month, eat less biscuits tomorrow, actually – eat more biscuits because life is too short… to my surprise I’ve maintained my tweet diary of lockdown for 292 days so far, because it’s given me a sense of rhythm, of perspective – of comfort even. Much like the soothing powers of a well managed to do list – it can give an illusion of control and of order, and of the productive passing of time. I didn’t plan it that way, but it has become a comforting habit.

The focus for many of us this year has been on the small things, and it’s perhaps only now that I’ve looked up and remembered the bigger arc. The diary feels a little more like groundhog day every time I make an entry. Treading water. We don’t even feel any further forward in the arc of this wretched disease.

We have become habituated to blaming Covid for all our failures, and missed deadlines and goals in 2020. Our worlds and our focus have shrunk. Indeed I have found it all too easy to avoid thinking about the one, modest, professional target I set myself at the start of 2020, until the year is about to close shut, with that goal not even approached. Covid isn’t really an excuse. I just didn’t do it. I can say I didn’t have the opportunity due to covid, but… Ah well. There is always next year. But I said that last year and the year before…The truth is there is a bit of me that is ambitious. Not for status or more income. It’s more a craving for feedback, something there is precious little of in this job. Am I doing ok? Could I do better? Would anybody even tell me if I was awful at it? A thank you from a client is rare (though lovely when it comes), and often our clients are (frankly) not the best judge of our skills, any more than the outcome of the case is a reflection of our talent or lack of it. I was already in the dumps when I sat down to complete my CPD record for 2020 but I felt worse for doing it – damn the template writers for incorporating emotionally hazardous questions about what my goals for 2021 should be. Truth is I don’t know what they are at all. In the bigger bigger picture of course professional triumphs and job satisfaction pale into insignificance against the life and death backdrop that covid brings, but I suppose I’m realising that all of this stuff somehow matters at the same time. And I don’t think I’m ever going to be ready to take a deep breath and treat it as ‘just a job’. I love it and I want to be the best I can at doing it. When you have spent the best part of a year talking to heads on a screen the opportunity for human feedback is even more slender. I miss my work friends.

So yes, New Year’s Eve has taken me by surprise a little. It has shaken me from my comfortable reverie of repetition and remote working. I have crocheted 279 hexagons towards my covid blanket in 2020. It has kept me sane, but will it sustain me through 2021? Truthfully, I think my broader wellbeing will demand more than the satisfaction of completing a blanket – wellbeing is about more than managing the day to day pressures of too much work, and work of an unpleasant nature – overall life satisfaction is a part of it too. I need to find some way to revitalise my professional confidence and enthusiasm, whilst also surviving the day to day and retaining the renewed appreciation of the little things, and the people in my life, that covid has brought me.

So. Here are my goals. I’m not going to call them resolutions, for I’m not truly resolved – I might break them. They are aspirational, suck it and see plans for starting out on a new year. Goodness only knows, making fixed plans for anything seems foolhardy these days :

  • do a doodle every day – post it in the twitter diary, however bad it is.
  • revive my professional life (working on how – the big unanswered goal for 2021)
  • keep safe, hug my family more (the ones I’m allowed to hug)
  • be kinder – at work, at home and on twitter
  • do dry January, ban biscuits, run more regularly
  • finish the bloody blanket

I wish you all a Happy New Year, and a safe and contented 2021.