WhatDoTheyKnow Transparency report

In 2021 WhatDoTheyKnow users made 100,092 Freedom of Information requests.

Those requests, and the responses they received, are public on the website for anyone to see. But what’s not quite so visible is the work the WhatDoTheyKnow team do behind the scenes — answering users’ questions, removing inappropriate content and keeping everything ticking over.

Some of the team’s most difficult calls arise around the removal of information. WhatDoTheyKnow’s guiding principle is that it is a permanent, public archive of Freedom of Information requests and responses, open to all.

For this reason, the default position is not to remove substantive public information requests and responses; however, we act quickly if problematic content is reported to us. And, to help everyone understand exactly what has been removed and why, where possible we record these details on the request page.

This year, for the first time, we’re extending our efforts towards transparency even further, with this report in which we’ll summarise the information removal requests and actions taken during the last twelve months.

To allow for a full 12 months of data, the date range used throughout this report is 1 November 2020 to 31 October 2021

Headline facts and figures

  • 20,714,033 visitors to WhatDoTheyKnow.com this year
  • 22,847 new WhatDoTheyKnow user accounts this year, taking the total to 222,694
  • 7,971 total number of email threads in the support inbox in 2021
  • 822 requests hidden from WhatDoTheyKnow in 2021
    …in the context of 100,092 requests made in the year, and a total of 772,971 requests now published on the site
  • 196 Total number of published requests where we redacted some material in 2021
    …usually due to the inappropriate inclusion of personal information, or defamation.
  • 126 The number of users who created accounts this year banned
    …that’s just 0.06% of new users.
  • WhatDoTheyKnow is a project of mySociety run by a small team of staff and dedicated volunteers.

And in more detail…

Requests flagged for our attention

The table below shows the reasons that requests were reported for admin attention this year. Note that we also receive many reports directly by email, so while not comprehensive, this is indicative.

Reason for attention request Total number
Contains personal information 143
Not a valid request 108
Vexatious 94
Request for personal information 85
Contains defamatory material 51
Other 287
Total 768

Material removed from the site

The following tables show where members of the support team have acted to remove or hide requests from WhatDoTheyKnow in the last year, and the reason why.

There is a range of options available to moderators, from ‘hidden’ (the most extreme) to ‘discoverable with link’. This is in addition to the censor rules that are used to hide certain information within a request or response.

Request visibility Total number
Visible only to the request maker 805
Discoverable only to those who have the link to the request 11
Hidden 8
Reason for removing from public view Total number
Not a valid FOI request 701
Vexatious use of FOI 29
Other (reason not programmatically recorded*) 124

*Current processes do not create an easily retrievable list of reasons beyond the two above, but we are hoping to improve our systems so future transparency reports can include a more detailed breakdown.

Censor rules (programmatically hiding the problematic part/s of a request) Total number
Number of censor rules applied 881
Number of requests with censor rules applied 196 
Number of requests with censor rules applied which are still publicly visible, but with problematic material hidden 188

Data protection issues raised to the WhatDoTheyKnow user support inbox 

The following data shows the number of email threads* received into the WhatDoTheyKnow user support inbox regarding the most common types of concern around information published on the site. Not all issues raised resulted in material being removed from the site.

GDPR = UK General Data Protection Regulations
DPA: Data Protection Act

Label Total number of threads
GDPR Right to Erasure 317
Defamation  130
Data breach 96
GDPR & DPA concerns (type not specified) 42
GDPR Right to Rectification 33
GDPR Right of Access 21
Harassment 17
GDPR Right to Object 12
Data breach – internal** 2
Impersonation 1
Total 674

* Email threads may be either automatically categorised by the system, or manually categorised by the WhatDoTheyKnow support team on the basis of the information given by the person reporting them.

** “Data Breach – internal” refers to cases where WhatDoTheyKnow has identified that a data breach may have been caused due to our own staff actions. We take our obligations seriously, and use such instances as a learning opportunity, so these are reported even if very minor, and often when they’re nothing more than a near miss — which both of these cases were.

High risk concerns raised for review 

Our policies ensure that certain issues can be escalated for review by the wider team and, where more complex, by a review panel that includes mySociety’s Chief Executive and the Chair of the Trustees.  Escalation is typically prompted by threats of legal action, complaints, notifications of serious data breaches, complex GDPR cases, or cases that raise significant policy questions.

Case type* Total number
Defamation 66
GDPR Right to Erasure 42
Data breach 40
Complaints 33
GDPR & DPA concerns 11
GDPR Right of Access 6
Harassment 5
Takedown 2
GDPR Right to Object 2
GDPR Right to Rectification 1
Other 78
Total 286

* Email threads may be either automatically categorised by the system, or manually categorised by the WhatDoTheyKnow support team on the basis of the information given by the person reporting them.

Users

User accounts Total 
WhatDoTheyKnow users with activated accounts 222,694
New user accounts activated in 2021 22,847
Reason for banning users in 2021 Total 
Spam 3,936
Other site misuse 166
Total number of users banned in 2021 4,102
Anonymisation* Total 
Accounts anonymised in 2021 170

* Where accounts have been anonymised this is at the user’s request, generally to comply with GDPR Right to Erasure requests.

Users are banned and their accounts may be closed due to site misuse and breach of the House Rules. Anonymised and banned users are no longer able to make requests or use their accounts.

Thank you for reading

This is the first time we’ve compiled a Transparency Report like this for WhatDoTheyKnow, but it’s something we’ve been wanting to do for some time. We demand transparency from public authorities and it’s only right that we also practice it ourselves. 

Additionally, we hope that the report goes some way to showing the type of work the team do behind the scenes, and that moderating a well-used site like WhatDoTheyKnow is not without challenges.

In future years, we hope to build on this initial report, ideally automating many of the stats so that they can be seen on a live dashboard. For now, we thought it was worthwhile making a manually-compiled proof of concept. 

If there are specific statistics that you’d like to see in subsequent Transparency reports, or you’d like to know more about any of those above, do drop the team a line. They’ll get back to you as soon as the urgent moderation work is done!

See mySociety’s 2021 annual review

Image: Create & Bloom