RIPA (ref3) - Accessing social media or websites for investigative purposes
Case reference FOI2024/01839
Received 31 October 2024
Published 21 November 2024
Request
Please provide the following information:
(Authorisations With and Without RIPA)
1. Regarding Authorisation and Documentation
o Can you provide the documentation that outlines the council's policy for accessing individuals' social media or websites for investigative purposes, including the criteria for determining whether RIPA authorisation is required?
o How many times in the past five years has the council accessed social media profiles or websites of private individuals, and were these accesses authorised under RIPA or similar legislation?
o What guidelines are in place to prevent repeated, unauthorised access to private or restricted social media accounts or websites, such as those which a member of the public may have restricted or blocked Herefordshire Council access to - and who is responsible for ensuring these guidelines are followed?
2. Regarding Training and Compliance
o What training is provided to council staff on the appropriate handling and use of information obtained from individuals' social media or websites, including understanding when RIPA authorisation is necessary?
o Can you provide details of any internal audits or reviews conducted in the past five years regarding unauthorised visits to individuals’ social media or websites? What were the outcomes?
3. Regarding Notifications and Disclosures
o If unauthorised access to an individual’s social media or website has been identified, what is the procedure for notifying the individual concerned, and is there any record of such notifications in the past five years?
4. Regarding Accountability and Redress
o If an individual requests information about council staff visits to their social media or website, what specific data are provided, including detailed access logs and information on the purpose of each visit?
Response
Please provide the following information:
(Authorisations With and Without RIPA)
1. Regarding Authorisation and Documentation
o Can you provide the documentation that outlines the council's policy for accessing individuals' social media or websites for investigative purposes, including the criteria for determining whether RIPA authorisation is required?
Answer: This information is publically available on the Herefordshire Council website and can be viewed via the following link:
RIPA policy - Council policies, strategies and procedures – Herefordshire Council
As such we consider this information to be exempt under Section 21 of the Freedom of Information Act 2000 because it is reasonably accessible to you via other means. Please take this letter as a refusal notice under S17 of the Act.
o How many times in the past five years has the council accessed social media profiles or websites of private individuals, and were these accesses authorised under RIPA or similar legislation?
Answer: The Service Area have advised this information is not held.
o What guidelines are in place to prevent repeated, unauthorised access to private or restricted social media accounts or websites, such as those which a member of the public may have restricted or blocked Herefordshire Council access to - and who is responsible for ensuring these guidelines are followed?
Answer: The Service Area have advised the Council has a RIPA Policy and provides training. We are not aware of what a restricted social media account or website is. The requester will need to seek their own legal advice regarding guidelines.
2. Regarding Training and Compliance
o What training is provided to council staff on the appropriate handling and use of information obtained from individuals' social media or websites, including understanding when RIPA authorisation is necessary?
Answer: External training is given to relevant staff on the requirements of RIPA and an update on RIPA.
o Can you provide details of any internal audits or reviews conducted in the past five years regarding unauthorised visits to individuals’ social media or websites? What were the outcomes?
Answer: The Service Area have advised this information is not held.
3. Regarding Notifications and Disclosures
o If unauthorised access to an individual’s social media or website has been identified, what is the procedure for notifying the individual concerned, and is there any record of such notifications in the past five years?
Answer: The Service Area have advised it is not clear what is meant by “unauthorised access”. A response to this question is suspended pending further clarification of what is meant by “unauthorised access”.
4. Regarding Accountability and Redress
o If an individual requests information about council staff visits to their social media or website, what specific data are provided, including detailed access logs and information on the purpose of each visit?
Answer: The Service Area have advised, with regards to website visits, the information provided would be the number of visits by staff to the site and the dates and times of each visit. The purpose of the visit will not be recorded by IT systems and logs are not kept for longer than 3 months.
With regards to social media sites, in order to provide access data we would need to know profile ID information and operation of the social media site in question in order to understand the accuracy of the data. Again, the purpose of the visit will not be recorded by IT systems and logs are not kept for longer the 3 months.
Documents
This is Herefordshire Council's response to a freedom of information (FOI) or environmental information regulations (EIR) request.
You can browse our other responses or make a new FOI request.