Independent review of Scottish Government's use of mobile messaging apps and non-corporate technology
Emma Martins' report of her independent review
1. Foreword
It may be difficult to right the wrongs of the past, but there are things we can do to set a new course for the future.
The backdrop to this review is complex, and a number of key matters remain ongoing, but there is one essential element that sits at the core: information.
Information is now at the heart of all our lives, and it impacts us in ways we often do not realise. The digital revolution that has led to a rapid acceleration of that core information position is one of the reasons we cannot afford to opt-out of difficult discussions when things go wrong.
And the way in which information is managed by those who are charged with that responsibility matters, especially if they are found to have fallen short.
The importance of information is reflected in the statutory frameworks that sit around it. Data protection, freedom of information, and public records are all significant areas of legislation with associated wide ranging responsibilities, rights, and sanctions.
The Scottish Government's Information Management Strategy[1] describes information as 'the lifeblood of our organisation' and talks of the need to 'make information management a strategic priority.'
They are right.
The pandemic has served to shine a bright light onto some of the practices not only of the government in Scotland, but across the UK, by those at the centre of power. There is now extensive evidence that 'private' communication channels were widely used, before and during the pandemic, by Ministers and officials at all levels. The prominence of the issue rightly heightened the deep disquiet and often anger felt by the community about these practices because of the correlation with critical questions of accountability, trust, and transparency. Things that are all important parts of the foundations of democracy.
The UK Covid-19 Inquiry (the Inquiry)[2] is expected, at the right time, to determine whether those communication channels were used appropriately, and whether information has been stored and disclosed properly. And the Scottish Information Commissioner [3] will, in due course, determine whether the Freedom of Information (Scotland) Act 2002 (FOISA) has been complied with. Outside, and in advance of those two statutory matters, there is the opportunity to put things in place to try and avoid repeating mistakes of the past and start to rebuild some of the trust that has been lost.
Something went wrong for the Scottish Government despite the extensive framework of risk and compliance controls and measures that they have in place. It is to misunderstand the nature of the challenge (and the critical importance of responding to it) to consider that a new or updated policy or a longer spreadsheet of risk assessment questions will resolve it. It is an issue that runs much deeper than a single policy document or checklist.
All organisations require those operating within it to share a basic set of values. It is not enough to write new policies or update existing ones. Compliance is not a tick box exercise, or an end result, it is a way of thinking and of operating and it needs to be embedded into everything, not simply because of the threat of sanction, but because it is the right thing to do.
If something has gone wrong, it is necessary to understand why, and then commit to preventing (or at least reducing the likelihood) of a recurrence.
This review seeks to understand and respond to the part played by wider social and cultural influences, as well as the more obvious legal and regulatory frameworks. The recommendations focus on human behaviours as much as they do the instruments of policy and guidance because this is not just a technology or legal issue, it is also a cultural and ethical one. It is also impossible to talk of values in relation to the deployment and use of technologies without considering values more broadly. Technologies are increasingly interwoven into our personal and professional lives and thus influence, and are influenced by, our values and conduct.
In the 2021 Review of Corporate Information Management[4], the Scottish Government described themselves as having "reached a strategic tipping point" and of the need to "re-evaluate and re-set".
They are a government that is still relatively young in service. Organisational change as well as technological developments will put pressure on even the most mature of organisations. The commissioning of this review indicates a desire to acknowledge and learn from what has happened and to make improvements going forward. I hope it can be used to support the 'reset' that has been called for.
Government data collection applies to everyone and is often compulsory. We do not, as citizens, have the option to choose an alternative provider (the way we do with our bank, for example). The approach government takes to data governance impacts everyone in a myriad of ways, but we should be in no doubt that it gets to the core of the relationship between the citizen and the state. And as we look ahead to a future which is increasingly driven and impacted by advancing technologies, the question of governance becomes increasingly important if we are to preserve the values that underpin our democracy. All governments are a party to a social contract with their citizens and contracts need to be based on mutual trust.
"Poor data governance is often at the heart of public mistrust" (Clement-Jones, 2024, p.120)[5] and the events leading up to the commissioning of this review are evidence of that. But if poor governance erodes trust, good governance can build it. It is my hope that, even in a small way, this short review contributes to the rebuilding of some of the trust that has been lost. I hope too that it serves to remind us that information sits at the heart of everything and needs our attention and our care.
The report findings are my own and the conclusions have been drawn from evidence I have seen. The short timescale for the review necessarily means that despite all reasonable efforts being made to consider relevant information, it may not have been possible to be entirely exhaustive in this respect.
I wish to express my thanks to the Scottish Government officials who have given so generously of their time and been so open in their responses.
Emma Martins
October 2024
Contact
Email: helen.findlay@gov.scot
There is a problem
Thanks for your feedback