Saturday, 12 March 2022 – I Didn’t Ask You to Break the Law

Laing O’Rourke is the developer for the new Olympia Exhibition Centre in Hammersmith, so big that it has its own train and tube stations.  This is one of the biggest redevelopments in the history of the borough on a scale of impact on the local area as Westfield Shopping Centre and the A4 “Westway” overpass.  Construction on the main part of the development, including building the new Central Hall (known as “Phase B” of the development) started in September.

Despite the submission of the planning application in 2018 and the S106 agreement being signed nearly two years earlier in October 2019, the Employment and Skills Delivery Plan, a precondition of starting construction, was only agreed (with me) in July despite Phase A starting in early 2021.  One of the delays in coming to an agreement was that LO’R didn’t want to commit to actions in a plan to train and employ local residents even though they had committed to training and employing them in the S106 agreement.  Another reason was because the original Rhino for LO’R, a weirdly reasonable person given her role, said that LO’R didn’t record the ethnicity of its employees or that of its subcontractors despite agreeing to targets to employ residents from a minority ethnic background; a group hugely underrepresented in the construction labour force as found and condemned in the Government’s Farmer Report.

Needless to say, anyone with reasonable self-awareness is not suited to being a Rhino and she has left and been replaced.  The new Rhino (actual job title: Social Value Advisor), whose relationship with reason is frosty, emailed the first quarterly report (in a set Excel template) to me on 25 February, seven weeks after the latest report was due and nearly eight months after the delivery plan was agreed and after which LO’R should have been monitoring and managing its delivery as it committed to do as an obligation in its planning application.  In the email, she wrote:

“Hi Paul,

“Hope you’ve had a nice week.  See attached employment and skills report.  Please note that the ‘Achieved to date (number)’ cells are locked so I have inserted a note on each cell with the number of Local labour, Paid work placements, Unpaid work placements.  The number in the cell is incorrect so please use the notes.

“Looking forward to hearing from you.”

 

Like with Berkeley Group’s, her report didn’t include names and postcodes of the local residents LO’R is claiming to have trained and employed; without evidence or without any details I might be able to verify.  I replied:

“Hi [Rhino],

“It’s locked because you have to put the details in as evidence: names and postcodes, or it is literally not counted towards your S106 obligations.”

 

Her non-sequitur reply came on the following Monday, 28 February:

“Hi Paul,

“Hope you had a nice weekend.  Once you’ve had a chance to review the report it would be good to meet to discuss.”

Maybe she just ignored my reply or dismissed it, but I chose to understand that she didn’t understand it.  I replied:

“Hi [Rhino],

“Yes, it would be good to meet to discuss progress from this report.

“However, what I mean in my email below is that the report has not been completed which is why the jobs didn’t count in the report as you said.

“Can you include the evidence requirements needed for the report including the names and postcodes of the residents so that I can verify them and then I can arrange a review meeting to discuss it?”

 

Like S106, Laing O’Rourke has been around for a long time, a company brand well known to most because of their ubiquitous presence in our public realm, constantly demolishing or building something big everywhere.  They have done this reporting before many times and constantly.  Nevertheless, she feigned ignorance; presumably Laing O’Rourke’s whom she represents.  But maybe she’s feigning her own personal ignorance too and I should be honoured to have been chosen by her to cure her as her life coach even though I never offered, and I have no idea why she chose me, to be her (or possibly Laing O’Rourke’s) adviser:

“Hi Paul,

“Please advise as to why full names and full postcodes are required as I am cautious of GDPR [data protection legislation].”

 

I replied, characteristically now, bluntly:

“Hi [Rhino],

"It’s because I need to verify evidence that the Local Planning Authority’s (LPA’s) obligated contributions are being received which is one of our statutory requirements as an LPA, and because you specifically agreed to do so when you agreed the S106 agreement.”

 

On the following Friday, 4 March, she seemed on the surface grateful for my consultation and accepted my wisdom:

“Afternoon Paul,

“Thanks for your response.  There will be a delay in amending the report as names and full postcodes have not been obtained.  I am in conversations with Laing O’Rourke’s legal team to understand how we can suitably retrieve this.

"The process may take some time so please advise if you would like to meet in the meantime to discuss progress.”

 

NO I DON’T WANT TO MEET! We’ve already met and I therefore already know that you see your role as spreading misinformation and “Good News Stories” as part of LO’R’s repertoire of advertising their “corporate social responsibility”.  I don’t want to waste an hour of my life listening to your propaganda which, rather than to satisfy LO’R’s S106 obligations, you have been employed to spread like manure, just because you now have nothing better to do while you wait for legal advice on evidence I know you send to other London planning authorities, of which you have a legal agreement to provide and of which we have a legal requirement to verify!  When you send me data that tells me what progress you have genuinely and wholly made on your delivery plan, then I would like to have a meeting to discuss your plan’s progress (or lack thereof).  In the meantime, either send me a clear, unambiguous and verifiable report as set out in my template or leave me alone!  However, I replied more calmly:

“Hi [Rhino],

“Thanks for the update.  I’ll wait until we have something to review and discuss, thanks.”

 

I may be waiting a long time.  On 7 March, I received an email from L’OR’s Senior Legal Counsel addressed to me and the Rhino:

“Hi [Rhino] and Paul,

“I have now had an opportunity to consider the monitoring report and the information requested therein.  I note in particular that LOR is being asked to provide identifiable personal data, including both special category and criminal conviction data. To my knowledge, we have never been asked to provide identifiable personal data in this way by any other Council.  We have instead been able, and indeed encouraged, to employ more privacy-friendly ways of sharing personal data through the use of anonymisation and pseudonymisation – and one of the main reasons other Councils have encouraged us to adopt such an approach is because they do not want to become ‘joint controllers’ of the personal data they receive due to the increased regulatory obligations and resulting legal and financial risks.

“The legal position in connection with the processing of, in particular, special category data and criminal conviction data is complicated because it is generally prohibited.  When a controller, or joint controller, wishes to process special category data or criminal conviction data, it must first find a lawful basis to rely on under Article 6 of the UK GDPR.  An additional condition then needs to be established under Article 9 for the processing of special category data and Article 10 for criminal conviction data.  There are also associated conditions set out in Schedule 1 of the Data Protection Act 2018 that would need to be met. For further information, please refer to the ICO’s [Information Commissioner’s Office] website:

"Special category data: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/special-category-data/#scd2

·      "Criminal conviction data: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/criminal-offence-data/#rules

“The request here is made even more problematic owing to the fact that the monitoring report, as I understand it, extends to LOR’s supply chain and therefore includes data that we do not control.  You should also note that I have spoken the ICO and external council [?] in connection with the monitoring report and they both agree that, on the face of it, we (both LOR and the Council) would need to clear an extremely high threshold to provide and use the data requested.

“In light of the above, it would be useful to understand where exactly it has been determined and/or agreed that LOR must provide identifiable personal data.  The email below would suggest that it has been “specifically agreed” and so having sight of that specific agreement (presumably the S106 Agreement?) might help us all navigate a path through the legal complexity.  It would also be useful to understand why the Council need to verify any personal data we give them and why they will not accept, for example, a unique employee number rather than full name and postcode.

"I hope the above makes sense? Very happy to discuss.”

 

There’s a lot here to digest and, technically, there’s not a lot I disagree with on the face of it.  Not that I’m a lawyer that is qualified to agree or disagree, but just someone applying common sense to the objective of “helping people”.  The spirit of data protection legislation has historically been abused by legal counsel to their clients’ own end, most infamously and horribly as the Soham murders (the clients in this case being Humberside Police whose legal counsel unilaterally determined that sharing identifiable data on Ian Huntley with Cambridgeshire Police was more of a risk to them than Huntley was to young women and girls).  We must question, not the letter of the law, but the conclusions as they apply to specific circumstances that we can get from sober and well-meaning generalisations.

So let’s start at the beginning of his email.  The lawyer puts a lot of emphasis on “special category and criminal conviction data”.  This is a field in the report template but, to paint the full picture, LO’R hasn’t reported “ordinary” identifiable data such as name and postcodes and this is what I’m querying in my emails.  If they want to just report names and postcodes towards their targets to train and employ local residents then, fine, omit special category details.  By invoking the higher threshold for reasons to share data on criminal convictions and other special data such as ethnicity that I never queried, this looks like he is digging for excuses to excuse LO’R from helping our residents, obligations which include having to provide evidence of having done so.  The reason there are additional fields in the report template for these special category data is because either developers, including LO’R, claim they help these categories of residents underrepresented in the construction sector and the labour market more generally such as women, residents from an ethnic minority background and ex-offenders, or they have agreed targets for doing so in their S106 agreements based on this hubris.

He says that, if LO’R and/or presumably the local planning authority “wishes to process special category data or criminal conviction data, it must find a lawful basis to reply on under Article 6 of the UK GDPR.”  The legal basis in the Data Protection Act 2018 is, generally speaking, having a good reason and having the permission of the person of whom you’re sharing data.  We have a good reason: the council and the developer are committed to helping that resident get and keep a job.  That they didn’t seek permission to share those employees’ details of their training and employment is all on LO’R just to fill out the paperwork.  To give an example, a similar scenario might be the employer reporting earnings and tax code to HMRC to pay taxes on PAYE.  No-one questions HR seeking permission to share employees’ details to HMRC, I’m sure much to most employees’ distaste, but similar Government legislation that is S106 is dealt with as if employers have never come across it before.  Imagine what would happen if companies started questioning HMRC why they wanted such sensitive data of their employees, quoting GDPR legislation which doesn’t really relate to what’s being asked and then saying it may take “some time” to get the information because they had never come across this situation before and so never asked their employees for permission to share their data?

Having a reason and permission for asking for criminal conviction status also meets this high standard which “would need to clear an extremely high threshold”.  We’re not asking for what the conviction was, just whether or not they are an ex-offender: yes or no.  This is because developers claim to help ex-offenders and ensure their workforce is more representative of the gender, age and ethnic mix of the local community.  But LO’R doesn’t even collect data on the ethnicity of its employees, never mind try to be more representative and less closet racist.  It seems to me convenient that the industry’s lawyers claim that it is “generally prohibited” to report evidence on efforts to be fairer that the Farmer report made clear that they are not making.

He says that, “We have instead been able, and indeed encouraged, to employ more privacy-friendly ways of sharing personal data through the use of anonymisation and pseudonymisation…”  No they haven’t!  Local planning authorities must and do ask for verifiable and, therefore, identifiable evidence of their residents supported.  It’s telling that he gives no examples and makes no alternative suggestion based on this experience on which he is providing counsel rather than use my, as he claims it to be, flawed Excel template, but just makes this assertion.

The S106 agreement specifically requires LO’R to extend the obligations to their supply chain which they have agreed to do in the S106 agreement.  The argument from planning applicants justifying their proposed development is that the development as a whole creates jobs in the local area.  There is nothing in data protection legislation that prohibits supply chains from reporting this data if LO’R had the processes and agreements in place.  Presumably, he’s still referring to “special category and criminal conviction data” without being very clear about what, precisely, he is referring to.  Again, it is telling when a lawyer, whose profession is so heavily reliant on the ability to be clear and unambiguous that there is a word invented for the way they refer to pronouns, “legalese”, is being unclear and ambiguous about which subjects in his text he is referring to.  And, if so, then he is not making any legal argument that the Rhino can’t report names and postcodes so long as she doesn’t report on those residents’ ethnicity, which they don’t ask their employees about anyway, or other special category data.  Just to be clear, the Rhino didn’t enter anything into the fields for age group, ethnicity, gender or ex-offender status and I didn’t query these omissions.  I only asked her to add the names and postcodes of the residents.

Generally, the tone of this “counsel” is that reporting any personal data is generally prohibited and that no organisation has ever tried doing so before and, therefore, my request is outrageous.  It suggests that the intention of GDPR was to ensure that no data is ever shared between interested parties when trying to help people and deliver services to them, even with their consent.  That is just simply not the case.

“It would… be useful to understand”, he suggests, “why the Council need to verify any personal data we give them and why they will not accept, for example, a unique employee number rather than full name and postcode.”  Because, as I’ve already told the Rhino, the council needs to verify it.

I haven’t heard back from the Rhino since her legal counsel addressed this email to me and her.  I assume she’s waiting for me to reply.  But I think it should be clear that I’m not going to.  Why would I reply to unsolicited legal counsel that completely contradicts the council’s own lawyers who drafted the S106 agreement in the first place?  Do they expect me to get into a conversation about the legality of all the historical S106 agreements made by LBHF even if I did accept any of his arguments and observations?  Do they expect me to renegotiate the S106 agreement after it has been agreed and sealed and upon which planning permission is dependent and, by extension, all S106 agreements we have with developers?  He says in his email, “In light of the above, it would be useful to understand where exactly it has been determined and/or agreed that LOR must provide identifiable personal data.  The email below [my email] would suggest that it has been “specifically agreed” and so having sight of that specific agreement (presumably the S106 Agreement?) might help us all navigate a path through the legal complexity.”  Is he asking me to send LO’R their own S106 agreement?  I don’t think he thinks I’m his paralegal administrator.  This is one for the Rhino to reply to and, in the meantime, I’m not arranging to meet her; we’ve already met.