Action taken in 2011

23 January 2012

Case Reference Number IRQ0431780

Dear Mr Suerre

Thank you for your email in which you have made a request for information
to the ICO. 
 
Your request has been passed to the Internal Compliance Team, and is being
dealt with in accordance with the Freedom of Information Act 2000 under
the reference number shown above.  We will therefore respond to your
request by 17 February 2012 which is 20 working days from the day after we
received your request.

We understand your request to relate to complaints received and action
taken with regard to the Data Protection Act 1998; if this is not the case
please let us know.
 
If you wish to add further information to your request case please reply
to this email, being careful not to amend the information in the ‘subject’
field. This will ensure that the information is added directly to your
case. However, please be aware that this is an automated process; the
information will not be read by a member of our staff until your case is
allocated to a request handler.
 
Yours sincerely

Helen Ward
Lead Internal Compliance Officer

show quoted sections

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Tel: 0303 123 1113 Fax: 01625 524 510 Web: www.ico.gov.uk

13th February 2012

Case Reference Number IRQ0431780

Dear Mr Seurre

I am writing further to our email dated 23 January 2012 in which we
acknowledged your request for information to the Information
Commissioner’s Office (ICO).
 
As previously explained we are treating your request as a request for
information under the Freedom of Information Act 2000 (FOIA).
 
As you have asked a number of questions in regard to cases resolved during
2011 for your ease of reference we will deal with each in turn.
 
“- The total number of complaints made against public bodies.”
As you may be aware the ICO deals with complaints under the Data
Protection Act 1998, the Privacy and Electronic Communications Regulations
2003 (PECR), the Freedom of Information Act 2000 and the Environmental
Information Regulations 2004
 
The ICO uses an electronic case management system in order to administer
the complaints which we receive and a case is created for each complaint. 
The system allows us to search for the cases we have dealt with in a
number of different ways, such as by the unique reference number the case
was given, the name and address of the person who contacted us and the
name of the organisation that has been complained about.  We can also
search for cases on the basis of the broad nature of the complaint, but we
can only search on a limited number of fixed criteria which are structured
around the legislation which we oversee.  
 
Unfortunately our system does not have a section which we can search on
for whether an organisation is a private or public body.
 
In regard to data protection complaints (known as “requests for
assessments) and PECR complaints unfortunately we are not able to provide
you with the information you have requested.  Section 12 of the Freedom of
Information Act 2000 (FOIA) makes clear that a public authority (such as
the ICO) is not obliged to comply with an FOIA request if the authority
estimates that the cost of complying with the request would exceed the
‘appropriate limit'.  The ‘appropriate limit’ for the ICO, as determined
in the ‘Freedom of Information and Data Protection (Appropriate Limit and
Fees) Regulations 2004’ is £450.  We have determined that £450 would
equate to 18 hours work. 
 
Whilst the information you have requested will sit within our electronic
case management system, as explained above this system is not set up to
easily provide us with the type of information you have requested.  In
order to find this information we would need to individually check every
request for assessment and PECR case resolved in 2011 to see if the
complaint was about a public body.
 
Having checked our case management system for broad figures I can confirm
that there were 13,247 request for assessment cases and 6697 PECR cases
closed in 2011.
 
Therefore, assuming that each search of each case would take approximately
3 minutes to complete (and it is certain that some searches would take
longer than that), this would equate to over 990 hours worth of
searching.  This is well in excess of the 18 hours which would accrue a
charge of £450.  It is for this reason, and in accordance with section 12
of the FOIA, that we are not obliged to comply with this part of your
request for information.
 
If you are able to narrow the scope of your request we may be in a
position to provide the information free of charge, if it will cost us
less than the appropriate limit to do so.  For example, if you can narrow
the dates you are interested in, or if you can name any of the specific
organisations that you want information about, then we may be able to
conduct further searches and provide the information you seek.  I should
point out that any reformulated request you may wish to make to the ICO
will be treated as a new FOI request, and the 20 working day time limit
will begin again.
 
However in regard to cases about the Freedom of Information Act 2000
(FOIA) and the Environmental Information Regulations 2004 (EIR) as you may
be aware this legislation only applies to public authorities.  We have
therefore conducted a search of our system for FOIA and EIR complaints
about public authorities closed in 2011 (excluding those complaints which
were closed because the complained about organisation was not a public
authority) and can confirm that there were 4683 such cases.

“- The total number of complaints made against public bodies that
resulted in undertakings being issued.”
In answer to this part of your request there were 53 data protection
undertakings issued in relation to public bodies in 2011.  Copies of data
protection undertakings are available from the data protection "taking
action" section of our website via the following link;
[1]http://www.ico.gov.uk/what_we_cover/taki...
 
As you may be aware undertakings can also be issued in relation to the
Freedom of Information Act 2000 (FOIA).  There were eight undertakings
issued in relation to the FOIA in 2011.  Copies of freedom of information
undertakings are available from the freedom of information "taking action"
section of our website via the following link;
[2]http://www.ico.gov.uk/what_we_cover/taki...

“- The total number of complaints made against public bodies that
resulted in enforcement notices being issued.”
In answer to this part of your request there was one Enforcement Notice
issued in relation to a public body in 2011. A copy of this notice is
available from our data protection “taking action” webpage (link above).

“- The total number of complaints made against public bodies that
resulted in assessment notices being issued.”
The ICO has not issued any assessment notices.  For your information
currently the only data controllers who potentially could be subject to
such notices are central government departments.  Further information in
regard to this can be found in the assessment notices code of practice
which is available on our website;
[3]http://www.ico.gov.uk/upload/documents/l...

“- The total number of complaints made against public bodies that
resulted in monetary penalty notices being issued.”
In answer to this part of your request there were six Monetary Penalty
Notices issued in relation to public bodies in 2011.
 
Copies of the Monetary Penalty Notices which the ICO has issued to public
bodies in 2011 are available from the data protection “taking action”
section of our website (link provided above).

“- The total sum of any monetary penalty notices issued against
public bodies.”
The six Monetary Penalty Notices which we have issued in 2011 in relation
to public bodies are publicly available from our website and each one
shows the amount of the penalty;
[4]http://www.ico.gov.uk/what_we_cover/taki...
 
We have not provided you with the actual figure in this email as this
information would be exempt under section 21 of the FOIA as it is
reasonably accessible to you via our website.

“- The total number of complaints made against organisations in the
private sector.”
Firstly as you may be aware the FOIA and EIR do not apply to private
sector organisations.  As explained in relation to part one of your
request unfortunately our electronic case management system does not have
a section for whether an organisation is a private or public body,
therefore we are unable to search specifically on this.  Therefore in
regard to request for assessment cases and PECR cases in accordance with
section 12 of the FOIA, we are not obliged to comply with this part of
your request for information for the reasons explained in part one of this
response.

“- The total number of complaints made against organisations in the
private sector that resulted in undertakings being issued.”
In answer to this part of your request there were 18 data protection
undertakings issued in relation to the private sector in 2011.  Copies of
data protection undertakings are available from our website via the
following link;
[5]http://www.ico.gov.uk/what_we_cover/taki...

“- The total number of complaints made against organisations in the
private sector that resulted in enforcement notices being issued.”
In answer to this part of your request there were no enforcement notices
issued in relation to the private sector in 2011.

“- The total number of complaints made against organisations in the
private sector that resulted in assessment notices being issued.”
Currently assessment notices do not apply to any private sector
organisations, therefore we do not hold any recorded information which
would answer this part of your request.  For information a link to the
assessment notices code of practice can be found earlier in this email.

“- The total number of complaints made against organisations in the
private sector that resulted in monetary penalty notices being
issued.”
In answer to this part of your request there was one Monetary Penalty
Notice issued in relation to the private sector in 2011.
 
A copy of the Monetary Penalty Notice which the ICO has issued to the
private sector organisation in 2011 is available from our website via the
following link;
[6]http://www.ico.gov.uk/what_we_cover/taki...

“- The total sum of any monetary penalty notices issued against
organisations in the private sector.”
The one Monetary Penalty Notice issued in 2011 to a private sector
organisation is publicly available from our website and shows the amount
of the penalty;
[7]http://www.ico.gov.uk/what_we_cover/taki...
 
We have not provided you with the actual figure in this email as this
information would be exempt under section 21 of the FOIA as it is
reasonably accessible to you via our website.
 
I trust that this information is of use to you however if you are
dissatisfied with the response you have received and wish to request a
review of our decision or make a complaint about how your request has been
handled you should write to the Internal Compliance Department at the
address below or e-mail [8][email address]
 
Your request for internal review should be submitted to us within 40
working days of receipt by you of this response.  Any such request
received after this time will only be considered at the discretion of the
Commissioner.
 
If having exhausted the review process you are not content that your
request or review has been dealt with correctly, you have a further right
of appeal to this office in our capacity as the statutory complaint
handler under the legislation.  To make such an application, please write
to the First Contact Team, at the address below or visit the ‘Complaints’
section of our website to make a Freedom of Information Act or
Environmental Information Regulations complaint online.
 
A copy of our review procedure is available [9]here.

Yours sincerely

Joanne Crowley
Lead Internal Compliance Officer

show quoted sections

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Tel: 0303 123 1113 Fax: 01625 524 510 Web: www.ico.gov.uk

References

Visible links
1. http://www.ico.gov.uk/what_we_cover/taki...
2. http://www.ico.gov.uk/what_we_cover/taki...
3. http://www.ico.gov.uk/upload/documents/l...
4. http://www.ico.gov.uk/what_we_cover/taki...
5. http://www.ico.gov.uk/what_we_cover/taki...
6. http://www.ico.gov.uk/what_we_cover/taki...
7. http://www.ico.gov.uk/what_we_cover/taki...
8. mailto:[email address]
9. http://www.ico.gov.uk/about_us/~/media/d...

14th February 2012

Case Reference Number RCC0435012

Dear Mr Seurre

Thank you for your email of 13 February 2012.
 
This email will now be treated as a request for review of your recent
request for information under the Freedom of Information Act 2000.
 
We will respond by 12 March 2012 which is 20 working days from the date we
received your recent correspondence.  This is in accordance with our
internal review procedures.

Yours sincerely

Joanne Crowley
Lead Internal Compliance Officer

show quoted sections

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Tel: 0303 123 1113 Fax: 01625 524 510 Web: www.ico.gov.uk

22nd February 2012

Case Reference Number RCC0435012

Dear Mr Seurre  
 
Thank you for your correspondence of 13 February 2012 requesting an
internal review in relation to your information request.
 
Your request for an internal review of the handling of your information
request has been passed to me to undertake.  I have carefully considered
all the relevant information, including your request, the response and
your request for review.  I have also read the articles which you refer to
in your request for review.
 
As I understand it the focus of your request for an internal review is
that you believe that the breakdown of the figures you requested could be
provided.  In particular into complaints about the public and private
sector.
 
The response you received focussed on complaints made to this office about
alleged breaches of the legislation we regulate.  Given that you use the
word ‘complaint’ in the majority of the points in your original request I
conclude that this was the correct interpretation.  The response then
explained how such ‘complaints’ or cases are held and processed within the
office and that this system could not differentiate between public and
private bodies without going through each case.  I conclude that in this
case Section 12 of FOIA was correctly applied.
 
It may however be helpful to give you some background information
concerning the two articles that you reference and to explain why in one
of those articles they refer to private and public organisations.  I
appreciate that this gives the impression that this should have been
possible in respect of your request. 
 
The first article makes reference to sectors we use within our casework
management system which again do not indicate which is in the private or
public sector.  I am aware you have made a new request for information
concerning this article and this is currently being processed.  The second
article is not reporting on complaints brought to the office but on
breaches reported by the organisations themselves.  Whilst these cases are
also processed using our casework managements system a separate and
additional record is kept for those self reported breaches.  This does
record whether is from a public or private organisation.  These are not
however complaints and therefore were not considered as within the scope
of your request.
 
I hope this provides you with some clarification and is helpful .
If however you are dissatisfied with the outcome of the review you may
make a section 50 complaint to the ICO. 

How to complain

Information on how to complain is available on the ICO website at:
[2][1]http://www.ico.gov.uk/complaints/freedom...
By post: If your supporting evidence is in hard copy, you can fill in the
Word version of our complaint form, print it out and post it to us with
your supporting evidence. A printable Freedom of Information Act
complaints form is available from the ICO website. Please send to:

First Contact Team
Customer Service Team
Information Commissioner's Office, Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

By email: If all your supporting evidence is available electronically, you
can fill in our online complaint form. Important: information included in
the form, and any supporting evidence will be sent to us by email.

Yours sincerely
 
Charlotte Powell
Internal Compliance Manager

show quoted sections

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Tel: 0303 123 1113 Fax: 01625 524 510 Web: www.ico.gov.uk

References

Visible links
1. http://www.ico.gov.uk/complaints/freedom...