Thread by @fascinatorfun

I know the @ICOnews now has the UKIP database after a prolonged period of appeals.

So I have an additional piece of the jigsaw to add to the Matthew Richardson advice and it’s timing.

@carolecadwalla

https://twitter.com/carolecadwalla/status/1156115388255674369

2/ On 11th November 2015 Richardson, who is a barrister, & had been UKIP’s General Secretary, so likely to have been involved in the writing of legal policy documents relating to data protection, expressed unease to Julian Wheatland about “what line to take” about data origin

3/. SCL/CA wanted clarification that the data they already had accessed & processed (received in October 2019 ) from Kaiser’s original evidence)had been passed to them legally

She said that the data arrived in SCL London in the form of processing towers, not copied hard drives!

4/By 20th November 2015 SCL/CA had received a copy of a legal advice from Matthew Richardson and Coppell laying out what the passing of the data from UKIP to SCL the months before was in accordance with the UKIP Data Protection Policy and, in particular, their Privacy Policy.

5/. The contention was that this was available to those people who entered their website thus giving consent for their data to be used in accordance to thesepolicies available on the website at the time they signed in.

6/. Of course many people would have signed up to their website many years before.

So when was the Privacy Policy referred to in this legal advice (date: 17/11/15)from this barrister who had also been UKIP’s General Secretary, put up for all who enter the site?
Rather material

7/. This is a link to the legal advice from Richardson and Coppell provided by Kaiser to the @CommonsCMS in her evidence last year.

parliament.uk/documents/comm…

8/. When I followed the links in the advice through last year I could see the UKIP Privacy Policy.

BUT when I went through web archive to see what version of the Privacy Policy was up on their website at the time the database was transferred to CA/SCL and processed?

None.

9/. I had to move forward to February 2016 before I could find any archived UKIP Privacy Policy.

Long after it had been passed on and processes by SCL/CA.

Maybe After Ian Warren had provided the Labour Voter profiles and datasets.

web.archive.org/web/2016020605…

10/. Don’t forget that the chances are that a good proportion of the people on that database that was handed over to SCL/CA in October 2015 for processing and repurposing will have been on that database for years.

ALL before the Privacy Policy seemingly appeared on the website

11/. This is not simply about data breaches

What was the ex General Sec of UKIP doing referring to a Privacy Policy that was not on the website. After all. It is a very basic thing to do when providing legal advice to double check what the public could actually see, by looking

12/. This could explain why Richardson felt rather uneasy about SCL/CA disclosing the origins of the data they had already received and processed.

And what “plan” resulted from the meeting between him and Andy Wigmore on 12/11/2015.

13/. For completeness this is a link to the new release (30/7/2019) of documents from Brittany Kaiser

parliament.uk/documents/comm…

*its* dammit. That apostrophe!

14/ it also makes one wonder what data were given to the Universities if Essex (Whiteley) and Kent (Goodwin) and also Texas and Essex (Clarke) and what permissions were sought and given at the various stages in the project. (From Kaiser’s new doc release)

19/. Richardson’s CV posted on his Chambers’ website makes interesting reading.

Expert in Cyber Crime and Data Protection

https://twitter.com/fascinatorfun/status/1156150177541120000?s=21

Sorry. That should have been 15/

16/. I am sure that I read that whilst he was a student (? Engineering) at Oxford or Cambridge that he created software for a University based student “mini Facebook” called CommonRoom or CommonSpace.

Letter sold it for c £1 million.

17/. Here is a reminder of the pivotal rôle Richardson has played in acting as a bridge between Bannon, Kassam, Farage and Breitbart.

Richardson knew Bannon before Bannon got the idea of a London Breitbart.

spectator.co.uk/2015/06/the-tr…

*later*

9.1. I realise I have left some steps out of my explanation here. Please shift to Tweets 18 onwards.

That Privacy Policy was there.

What was not was the Data Protection Policy that governs how your data will be processed & used.
That link only appears AFTER Dec 2015 on 6/2/16

If you scroll to the bottom of the page in the PRIVACY POLICY it is only on Feb 2016 that at the bottom of the page (in purple) it gives you a link to the Data Protection Policy.

To make sure records are complete here is the PRIVACY policy now with link on 6/2/2016

In 8th October 2015 (so soon before UKIP provided the data towers to SCL/CA) there was NO link to the Data Protection Policy.

Nor was there in DECEMBER 2015.
That was AFTER Richardson and Coppel had written their advice

So by 11/11/2015 the data had been passed and worked on

From the latest Kaiser documents the exchange of emails suggest they were agreeing post hoc what the policy might be.

Once you get to Feb 2016 there IS a link to a Data Protection Policy.

It says it was created & approved on 6th November 2015 but was not in the web archive

So those were tweets 18/19 & 20.

Sorry.

But it is also possible to look at the properties on the document creation and it looks to me as if those were not approved by the board until the end of November 2015. Still not on the website for the public to see until after December.

22/. The PROPERTIES that can be seen from the archived docs suggest that the doc was created on 24/11/2015 on an Apple Mac using Word.

And modified on 7/12/2015.
That fits with its absence from web archive on 7/12/2015.

23/. So that is :- After the data has already been transferred.

After the data has been processed.

After the post hoc advice dated 17/11/2015 and after the Leave EU platform event that succeeded it.

24/ Thank you to @BurtClan4 for the nudge.

It is more than a year since we first spotted this issue but I was waiting a) for the ICO case to conclude to actually get the database -

b) thus more evidence forthcoming on who knew what and when.

October 2015

(Thanks @RoyMotteram . I think I might have to redo this thread!)