Has the Bristol Mayor learnt the wrong lessons from Cambridge Analytica?
On February 19, I revealed that Bristol City Council had contracted for £90,000 with a social media company called Impact Social so they…
On February 19, I revealed that Bristol City Council had contracted for £90,000 with a social media company called Impact Social so they could analyse what was being said about the mayor.
There are three issues with this contract: 1) the cost is very high for a time when the budget had just been cut by £33 million; 2) we don’t know what the purpose of the data collection was; and 3) there seems to be no clearly presented GDPR notice about how this data is to be/being used and for how long it will be kept.
Apart from the exorbitant cost of the service in the midst of millions of pounds in cuts to the council, the purpose of the analysis remains a mystery.
The contract states that it provides reports as “additional objective information and evidence base” so as “to inform corporate planning and organisational policy responses” and will be used “by the Policy Advisors and Head of Mayor’s Office”. “This is irrespective of who holds that office and information from the analysis will be available to anybody upon request.”
The reports are ‘additional objective information and evidence base’. Additional to what, you might ask.
The council already collects city-wide information in a regionally representative way through the Quality of Life survey. It includes 50 headline measures and over 200 indicators. Measures include topics such as: community and living, health and wellbeing, crime and safety, education and skills, sustainability and environment, culture and leisure, transport, housing, etc.
The measures also include Council and Democracy. One of the indicators might be a clue as to why the mayor was starting to worry about what people were saying. In that group is the question: “% who feel an elected mayor is improving the leadership of the city”. That percentage has gone down to 23% from 35% two years ago, and from 40% in 2012, which was the first year of the directly elected mayor.
In 2018, when the social media contract began, the percentage had gone down to 24%.
2. Bristol City Council also run the Bristol Citizens Panel, which is an online group of over 1300 residents. Ironically, when administration of this panel came under ire with a data breach, the council reported themselves to the Information Commissioner’s Office. The panel also retains demographic information about citizens. They have published these in response to an FOI I submitted.
It would be fair to say that the council have plenty of information about what people think. I don’t know how much they pay to support these two services but there must be a cost. They have information on demographics, regional areas affected, and a large number of topics. What they don’t have is sight of who is saying these things specifically.
The Impact Social reports may have been a way of finding this out. Individual tweeters are clearly identified in the sample report provided.
This list of social media users goes directly to the Mayor’s office. Indeed, its audience is identified as being the mayor.
An example report from the 8th to the 10th of December shows the users who have been Tweeting, and the search terms used to identify them. Those terms are: “Marvin Rees” / “mayor of bristol” / @MarvinJRees / @BrisMayorOffice / “Bristol Council”.
Four of the search terms were about the mayor and only one about the council. Surprisingly, the council isn’t even referred to as Bristol city council, which seems to return more search results.
I used a data scraper to identify which users these search terms would have identified and how many results would have been retrieved. The first surprising find was that the term @Brismayoroffice hadn’t been used since 2017. Even then, the query result returned only 187 tweets between June 2016 and October 2017.
The term Marvin Rees returned 488 Tweets by 160 users between 23 February 2020 and 19 November 2019; 93 of them had only Tweeted using that phrase just once. The ‘mayor of Bristol’ returned around the same number of hits as “Marvin Rees”.
The highest returning search result was that of the mayor’s Twitter handle “@marvinjrees” with an average of 129 Tweets per day (over around two weeks).
If the council were interested in seeing what additional evidence they could obtain through this social media analysis then why not include the term ‘Bristol City Council’ (link)? It returns more hits than ‘Bristol Council’ (link), which was used instead.
Also, it’s important to note that Twitter and Facebook are neither representative of the population, nor are they compulsory. You don’t have to be on there. Any data will ultimately be skewed in unknown ways because we don’t know who these people are.
The data collection programs already available by the council, on the other hand ‘are’ representative of Bristol. Their demographics are known.
The mayoral search terms seem designed to catch everything said about the mayor alone. Combine this with the fact that the opposition parties had not heard of this contract, and had not seen any of the reports that had gone directly to the mayor’s office, and it’s hard to deny that this use seems contrary to the claim that it was conducted for public engagement purposes.
If the data collection was not for the purposes of public engagement, then this brings up the issue of GDPR implications. I wrote about the requirements for legal data collection of this type in the following article.
“It makes little difference that the personal data (names, handles etc) is in the public domain, anyone processing that data must still comply with the law to protect the data subjects (the people whose data is collected),” I was told by David Traynier CIPP/E CIPM.
“In practice, this means (under GDPR Article 5(1) ) the processing must be lawful, limited to the purposes for which the data is initially collected, use only the minimum of data necessary to the purpose, that the data must be accurate, only kept as long as is needed, and must be kept securely.”
Article 14 requires that data subjects are informed of the processing but not if ‘the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest.’
They would need to ensure they include details of what they do in a transparency notice that is readily available to the public.
The council does have a web page that lists its privacy policies but it does not seem to include information about how information is treated when it has been obtained by social media scraping, what its use is meant to be, and for how long it has been kept. The council have posted a link to a Retention Schedule for all information captured, but the link is broken.
The below transparency notice was provided for the budget consultation and is an example of how it should be cited.
Data Protection: data you supply will be held and used in accordance with the General Data Protection Regulation. Personal information you supply is confidential. The council will only publish aggregate or summary results from the consultation, which will not identify individuals. Information will be stored for three years. (link)
Finally, I get to the point of Cambridge Analytica. The data breach in relation to this company is one of the most publicised affairs (including its own Netflix movie) and the company itself was fined the highest available amount of £500,000.
Their breach was in relation to electioneering. Data was captured from Facebook and then political messages were targeted at individuals. For political parties, this ability to identify who is saying what about a candidate, and then to target them with relevant information would seem to be of value.
The Impact Social contract promised a lot in terms of analysis and understanding. The council signed up to six oral presentations a year and monthly reporting based on individuals analysing the data. From the report provided, however, what seems to have been returned is a simple list of users and hashtags. There is no sentiment analysis in the report although there might be in others. I also don’t know what information was provided by the presentations.
It’s difficult to see from my own research, what possible value the data might have provided. In terms of identifying issues about future council policy, how would it have been greater than the Quality of Life survey and the Bristol Citizens Panel?
The only additional value I could see was that the mayor and his advisers could now see who was saying what about him.
In Bristol, the mayoral elections are being held on May 7, 2020.