The Complete Register

The request was partially successful.

Dear Sir or Madam,

Rather than take pot luck on asking organisations whether they hold information on me, I would like to be able to ask all organisations that are registered if they hold information on me.

To do this I would like a copy of the complete register. I have found that your website search only returns results where 100 or fewer matches are found.

Also I am intrigued by the coverage of CCTV cameras in Brighton that might catch me while out shopping - so could you supply details of all registered CCTV cameras that cover the area of Brighton in the area bordered by Kings Road/Grand Jct Road on the south, old stein to the east, west street to the west and north street to the north?

If this might be considered 'information likely to be of help to a terrorist' or be illegal for me to have for any other reason, I would of course not want it (and presumably you should not have it either). Please advise me on this.

Yours faithfully,

Paul Perrin

Information Commissioner's Office

Link: [1]File-List

24 March 2009

Case Reference Number IRQ0240485

Dear Mr Perrin

Thank you for your e-mail of 24 March 2009, in which you have made an
information request.

Your request is being dealt with in accordance with the Freedom of
Information Act 2000 under the reference number shown above.  We
will therefore respond to your request by 23 April 2009 which, allowing
for the Good Friday and Easter Monday bank holidays, is 20 working days
from the day after we received your request.

Yours sincerely

Adam Stevens

Assistant Internal Compliance Manager.

show quoted sections

http://www.ico.gov.uk or email: [email address]
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Tel: 01625 545 700 Fax: 01625 524 510

References

Visible links
1. file:///tmp/rad13EE4_files/filelist.xml

Information Commissioner's Office

Link: [1]File-List

7 April 2009

Case Reference Number IRQ0240485

Dear Mr Perrin

Further to our acknowledgement dated 24 March, I am writing with reference
to your request for information.

We are currently looking into whether it is possible to release the
register in full. However at this point in order to provide advice and
assistance, it may be helpful to explain what you will and will not be
able to obtain from the register.

From the wording of your request, I understand that you are seeking to ask
all organisations that are registered whether they hold information on
you. I have consulted our Notifications department who have informed me
that there are currently approximately 317 000 register entries. In order
to find out whether each organisation holds information on you, you would
need to make a [2]Subject Access Request to each organisation.
Organisations are entitled to charge up to £10 for this, and most are
unlikely to waive this charge.

It is also important to note that some data controllers are exempt from
having to notify. For example,

· data controllers who only process personal information for;

o staff administration (including payroll);

o advertising, marketing and public relations (in connection with
their own business activity); and

o accounts and records.

· Some not-for-profit organisations.

· Processing personal information for personal, family or household
affairs (including recreational purposes).

· Maintenance of a public register.

· Processing personal information without an automated system such
as a computer.

Therefore, even if you were to make a [3]Subject Access Request to all
registered organisations, this would be unlikely to give a complete list
of every organisation that may hold information on you.

It is important to note that we are simply providing advice and assistance
at this point, and this is not a refusal notice. However, it may be that
refining your request may provide you with more useful information. It may
then be that our [4]search tool actually provides all the relevant
information (for example, all entries for businesses in your postcode
area, or information on the particular entry for a business/organisation
you have dealings with).

Briefly, with reference to the second part of your request, we do not hold
details of specific CCTV cameras within an area, however I am looking into
whether we hold any information that may assist you, or be within the
scope of your request.

If we are able to provide the complete register, we would be unable to
send it electronically due to its size. Therefore, if you wish to be
provided with it, please can you send us a postal address so that we can
send it via CD-Rom. If you wish to email us with this outside of the
WhatDoTheyKnow site, please email [5][ICO request email]
.

Yours sincerely

Adam Stevens

Assistant Internal Compliance Manager

show quoted sections

http://www.ico.gov.uk or email: [email address]
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Tel: 01625 545 700 Fax: 01625 524 510

References

Visible links
1. file:///tmp/rad11E3E_files/filelist.xml
2. http://www.ico.gov.uk/Home/what_we_cover...
3. http://www.ico.gov.uk/Home/what_we_cover...
4. http://www.ico.gov.uk/ESDWebPages/search...
5. mailto:[ICO request email]

Dear Sir or Madam,

I can give you a postal address for a CD by direct email.

However your email address has been stripped from your reply - if you send me an email directly I will happily oblige.

Yours sincerely,

Paul Perrin

Alex Skene left an annotation ()

The email address they provide is the same one as here:

http://www.whatdotheyknow.com/body/ico/v...

Information Commissioner's Office

1 Attachment

Link: [1]File-List

15 April 2009

Case Reference Number IRQ0240485

Dear Mr Perrin

Further to our email to you dated 7 April 2009, I am now in a position to
address your request for information.

In your email to us dated 24 March 2009 you ask for a copy of the complete
register of data controllers. This information is collected by our
Notification department using a database application. This has been
designed to provide access to individual entries and to provide access to
entries via the [2]website search tool. As you correctly state, search
results are limited to 100 per query, and as a result it does not enable
you to build a complete list of all data controllers through conducting
multiple searches. Therefore, I have contacted our IT team in order to
assess whether we would be able to extract all of the information
contained within the database.

I have been advised that in order to extract the information our IT
department would require approximately 22 hours and 12 minutes. This
estimate is based on half a working day to produce a search query in order
to retrieve the information and to locate the files where the information
is held, and then between two and three days for our IT contractors to
extract the information from the database in a readable format. The
standard working day for an ICO employee is seven hours, 24 minutes. This
would be in addition to the time spent to retrieve and extract any further
information falling within the scope of the rest of the request. It would
take this time as the system has not been designed so that a complete copy
can be extracted. Therefore, our IT department would need to run a query
on the database in much the same way as on the online search tool
(although they would not be limited). A complete copy of the register is
not held other than in database format.

[3]Section 12 of the Freedom of Information Act 2000 makes clear that a
public authority (such as the ICO) is not obliged to comply with an
Freedom of Information request if the authority estimates that the cost of
complying with the request would exceed the ‘appropriate limit'. The
‘appropriate limit’ for the ICO, as determined in the ‘Freedom of
Information and Data Protection (Appropriate Limit and Fees) Regulations
2004’ is £450. We have determined that £450 would equate to 18 hours
work. Therefore extracting the complete register to be provided to you
would exceed the cost limit.

However, from the further information provided in your request it would
seem that you are specifically seeking the name and address of every data
controller that is registered. I have also contacted our IT team about
this and found that if we were to simply supply the name of
businesses/organisations (eg Information Commissioner) and an address in
order to contact them, we would be able to perform this extraction in
approximately four hours and therefore this would fall within the cost
limit. Therefore, if you were to request this information, we would be
able to supply it. This would also enable you to extract any other
information yourself by using the information provided to search the
online database. You still would have access to all of the information in
the register. Although not the ‘complete register’ requested,
hopefully this may be of assistance to you.

I have been informed that we would provide this information in Word, Excel
or PDF format. At this point I am unsure of how large the file would be
and whether it would need to be sent by post on a disc. Obviously we would
so far as reasonably practicable give effect to any preference with regard
to format.

Additionally you asked for ‘details of all registered CCTV cameras that
cover the area of Brighton in the area bordered by King’s Road/Grand Jct
Road on the south, Old Stein to the east, West Street to the west and
North Street to the north’. We do not hold details of individual CCTV
cameras within a certain area. The only information that may help you in
locating CCTV cameras can again be found using the register of data
controllers. Where a business/organisation uses CCTV, this should appear
on their register entry. However, this will only give the address of the
business head office location, and not individual branches. It will also
not cover CCTV that is being used for domestic purposes. I would recommend
consulting our [4]CCTV Code of Practice for further details about
obligations relating to CCTV.

If you do wish to refine the first part of your request as detailed in the
fifth paragraph of this email, please reply to this response. This will be
treated as a new request.

I hope this information is of assistance to you, However, If you are
dissatisfied with the response you have received and wish to request a
review of our decision or make a complaint about how your request has been
handled you should write to the Internal Compliance Team at the address
below or e-mail [5][email address]

Your request for internal review should be submitted to us within 40
working days of receipt by you of this response. Any such request
received after this time will only be considered at the discretion of the
Commissioner.

If having exhausted the review process you are not content that your
request or review has been dealt with correctly, you have a further right
of appeal to this office in our capacity as the statutory complaint
handler under the legislation.  To make such an application, please write
to the Case Reception Team, at the address below or visit the
‘Complaints’ section of our website to make a Freedom of Information
Act or Environmental Information Regulations complaint online.

 

A copy of our review procedure is enclosed.

Yours sincerely

Adam Stevens

Assistant Internal Compliance Manager.

show quoted sections

http://www.ico.gov.uk or email: [email address]
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Tel: 01625 545 700 Fax: 01625 524 510

References

Visible links
1. file:///tmp/radD0275_files/filelist.xml
2. http://www.ico.gov.uk/ESDWebPages/search...
3. http://www.ico.gov.uk/upload/documents/l...
4. http://www.ico.gov.uk/upload/documents/l...
5. mailto:[email address]

Dear Sir or Madam,

Thank you for your reponse, can you tell me what other fields of information could be provided (in addition to organisation name and address) within the time/cost limit, and what information you hold that cannot be provided within the time/cost limit? Particularly (but not exclusively) the registration number of the organisation?

Yours sincerely,

Paul Perrin

Information Commissioner's Office

Link: [1]File-List

22 April 2009

Case Reference Number IRQ0240485 (Enquiry relating to response)

Dear Mr Perrin

I am writing in response to your follow up enquiry dated 21 April 2009. I
have consulted our IT team once again to ask what fields we would be able
to extract within the cost limit.

The entries are made up of fields of information, such as the data
controller’s name, address ands the registration number, as you are
aware. We would be able to extract the name, address and registration
number details within the cost limit. However, looking at other fields, it
would really depend on what you require. It is probably worth consulting
the [2]sample entry on the online register. For example, if you wanted to
know the purposes for holding information, it would be possible to provide
this too, eg;

Registration Number: Z5347709

Data Controller: INFORMATION COMMISSIONER

Address: WYCLIFFE HOUSE, WATER LANE, WILMSLOW, CHESHIRE, SK9 5AF

Purpose 1 Staff Administration

Purpose 2 Accounts & Records

Purpose 3 Licensing and Registration

Purpose 4 Crime Prevention and Prosecution of Offenders

Purpose 5 Research

Purpose 6 Method 2

Purpose 7 Advertising, Marketing & Public Relations

Purpose 8 Information and Databank Administration

Purpose 9 Method 2

It is the provision of the register as a complete document, including some
or all of the more detailed fields that results in the time being required
for extraction, due to the sheer volume of information being obtained.
However, we would be able to provide more that simply a name and address
within the cost limit if this is what you require. You would need to refer
to the sample entry and specify fields.

It is also worth noting however that the reason for the name and address
originally being suggested is that though having this information, it is
then possible to search the online register should you require for all of
the rest of the data. Therefore, if we were to provide this information,
all of the rest of the information would be accessible though the online
register. As a result, although we will attempt to provide any further
information that may assist you though our commitment to openness, the
rest of the information would technically be exempt under section 21.
Section 21(1) states that ‘information which is reasonably accessible to
the applicant otherwise that under section 1 is exempt information’. The
online register can be found listed in our guide to information under
[3]‘Lists and registers’ as part of our publication scheme. Although,
as you highlight, there may be difficulties in finding all the information
by simply using a general search term, it would be possible to extract all
of the information once we provide supplementary details such as the name
and address using the [4]website search tool.

If you do wish to request information for entries on the register, please
specify the fields you require and we will treat this as a new request. It
is important to note, however, that although we will try to accommodate
any future request and provide the information within the fields you
specify in a form acceptable to you, all of the information would be
technically be exempt under section 21 if adequate fields are provided to
you to search by.

Yours sincerely

Adam Stevens

Assistant Internal Compliance Manager.

show quoted sections

http://www.ico.gov.uk or email: [email address]
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Tel: 01625 545 700 Fax: 01625 524 510

References

Visible links
1. file:///tmp/rad21F80_files/filelist.xml
2. http://www.ico.gov.uk/ESDWebPages/Search...
3. http://www.ico.gov.uk/tools_and_resource...
4. http://www.ico.gov.uk/ESDWebPages/search...

Dear Sir or Madam,

If the data you provide allows me to extract the full information via the search on your website (and I can be sure that it contains all that information) that will be satisfactory.

Thank you for your assistance.

Yours sincerely,

Paul Perrin

Information Commissioner's Office

Link: [1]File-List

5 May 2009

Case Reference Number IRQ0240485

Dear Mr Perrin

Thank you for your e-mail of 1 May 2009 in which you have asked for the
data that will enable you to extract all the information from the register
of data controllers. As previously discussed, this would be possible if
names of data controllers and addresses are provided. For ease of
reference, we can also provide the registration numbers. All of the rest
of the information can be obtained using the online register.

Your email is being treated as a new request and is being dealt with in
accordance with the Freedom of Information Act 2000 under the reference
number shown above.  We will therefore respond to your request by 2 June
2009 which is 20 working days (taking into account Bank Holidays) from the
day after we received your request.

Yours sincerely

Adam Stevens

Assistant Internal Compliance Manager.

show quoted sections

http://www.ico.gov.uk or email: [email address]
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Tel: 01625 545 700 Fax: 01625 524 510

References

Visible links
1. file:///tmp/radB0E5E_files/filelist.xml

Information Commissioner's Office

Link: [1]File-List

8 May 2009

Case Reference Number IRQ0240485

Dear Mr Perrin

Following my acknowledgement email of 5 May 2009 I am now writing to
inform you that I have been able to extract the required information.

However, because the total file sizes amount to approximately 100 MB, as
previously mentioned, we are unable to attach this information to an
email. Therefore, please can you send us a postal address so that we can
send it via CD-Rom. Our email address can be found on the WhatDoTheyKnow
site (as I am aware that the site removes email addresses from responses);

[2]http://www.whatdotheyknow.com/body/ico/v...

Please email us directly with your postal address, and I will then be able
to post the information to you.

Yours sincerely

Adam Stevens

Assistant Internal Compliance Manager.

show quoted sections

http://www.ico.gov.uk or email: [email address]
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Tel: 01625 545 700 Fax: 01625 524 510

References

Visible links
1. file:///tmp/rad9A4D0_files/filelist.xml
2. http://www.whatdotheyknow.com/body/ico/v...

M Bimmler left an annotation ()

FYI, if you don't want to receive it via postal mail, you could maybe ask him to submit it via

http://www.whatdotheyknow.com/upload/req...

Dear Sir or Madam,

Thank you for your resposne.

The whatdothey know site has an upload facility for large files:

http://www.whatdotheyknow.com/upload/req...

Which would seem the quickest and most convenient method of transfer - it this possilbe?

Yours sincerely,

Paul Perrin

Information Commissioner's Office

1 Attachment

Link: [1]File-List

1 June 2009

Case Reference Number IRQ0240485

Dear Mr Perrin

I write further to your email dated 9 May 2009 and in response to your
request for information enabling you to search for and extract all
information held within the register of data controllers.

I apologise for the initial handling of your request but must now advise
you that actually the data protection register and any information
contained in it is exempt from disclosure due to section 21 of the Freedom
of Information Act. This states:-

21.- (1) Information which is reasonably accessible to the applicant
otherwise than under section 1 is exempt information.

(2) For the purposes of subsection (1)—

(a) information may be reasonably accessible to the applicant even though
it is accessible only on payment, and

(b) information is to be taken to be reasonably accessible to the
applicant if it is information which the public authority or any other
person is obliged by or under any enactment to communicate (otherwise than
by making the information available for inspection) to members of the
public on request, whether free of charge or on payment.

(3) For the purposes of subsection (1), information which is held by a
public authority and does not fall within subsection (2)(b) is not to be
regarded as reasonably accessible to the applicant merely because the
information is available from the public authority itself on request,
unless the information is made available in accordance with the
authority’s publication scheme and any payment required is specified in,
or determined in accordance with, the scheme.

The register of data controllers is in our publication scheme, and is
therefore exempt under section 21(3). This is an absolute exemption,
therefore is not subject to the public interest test.

In your original request you make the point that search results are
limited to 100, which may mean you are unable to extract a complete list
of organisations. I can advise you that it is possible to search by
various criteria including by individual postcodes. According to the
[2]Office of National Statistics, individual unit postcodes (eg SK9 5AF)
typically contain approximately 15 postcodes. If addresses belong to
larger businesses, they may have their own postcode. Unit postcodes can
only contain up to 100 addresses, and our search tool within the register
will deliver results where 100 or fewer results are found. Therefore, if
individual unit postcodes are used to search the database, it is possible
to extract the complete register. Lists of postcodes can be obtained from
various sources, including the [3]Royal Mail (a fee is charged by them for
this).

I hope this information is of assistance to you, however, If you are
dissatisfied with the response you have received and wish to request a
review of our decision or make a complaint about how your request has been
handled you should write to the Internal Compliance Team at the address
below or e-mail [4][email address]

Your request for internal review should be submitted to us within 40
working days of receipt by you of this response. Any such request
received after this time will only be considered at the discretion of the
Commissioner.

If having exhausted the review process you are not content that your
request or review has been dealt with correctly, you have a further right
of appeal to this office in our capacity as the statutory complaint
handler under the legislation. To make such an application, please write
to the Case Reception Team, at the address below or visit the
‘Complaints’ section of our website to make a Freedom of Information
Act or Environmental Information Regulations complaint online.

A copy of our review procedure is attached.

Yours sincerely

Adam Stevens

Assistant Internal Compliance Manager.

show quoted sections

http://www.ico.gov.uk or email: [email address]
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Tel: 01625 545 700 Fax: 01625 524 510

References

Visible links
1. file:///tmp/radB5EF1_files/filelist.xml
2. http://www.statistics.gov.uk/geography/p...
http://www.statistics.gov.uk/geography/p...
3. http://www.royalmail.com/portal/rm/jump2...
http://www.royalmail.com/portal/rm/jump2...
4. mailto:[email address]
mailto:[email address]

Dear Sir or Madam,

As part of your publication schedule, I am sure you are aware that you are expected to provide printed copies of website content on demand.

Accordingly I would like a print out of the database from your website - this would be most useful printed to PDF, GIF other digital format for easy processing and OCR (if required) rather than on paper.

Thank you for your cooperation.

Yours sincerely,

Paul Perrin

Ganesh Sittampalam left an annotation ()

It's actually pretty easy to script a download from their site. The URLs for the registration details themselves are of the form

http://www.ico.gov.uk/ESDWebPages/DoSear...

where only the reg number changes. I don't know what possible range it can fall into, but it's actually quite feasible to exhaustively search. I have a colocated computer with a faster internet connection and 1000 ids took about 90 seconds and downloaded 9MB of data. So it might take a few weeks to get the whole lot.

Normally I'd consider this kind of automated screen scraping a bit rude and would be concerned about the load it'd place on their servers, but as they've explicitly said that's the way to get the data, it must be ok.

Drop me a message via the site if you'd like any help taking this approach further.

Dear Sir or Madam,

Further to your change of mind regarding the provision of data from the register, and your proposal that it can be taken from your website. Can you just confirm that you are waiving your copyright notice at the bottom of each entry? And explain the extent of the waiver that you are offering.

Yours sincerely,

Paul Perrin

Information Commissioner's Office

Link: [1]File-List

12 June 2009

Case Reference Number IRQ0240485

Dear Mr Perrin

Thank for your emails dated 2 June. The first has been treated as a
request for information in our publication scheme (in accordance with the
Freedom of Information Act 2000). The second has been treated as an
enquiry.

Your request for information in our publication scheme

In your email you state ‘as part of your publication schedule, I am sure
you are aware that you are expected to provide printed copies of website
content on demand’.

The ICO’s Model Publication Scheme, which we have adopted, states;

“Where it is within the capability of a public authority, information
will be provided on a website. Where it is impracticable to make
information available on a website or when an individual does not wish to
access the information by the website, a public authority will indicate
how information can be obtained by other means and provide it by those
means.”

In this case, we do not hold the complete register in hard copy form. I
estimate that providing it in hard copy form would use in excess of 600
000 sheets of A4. Therefore, it would be impracticable to provide a hard
copy, if possible.

The key issue is ensuring access to information. Although it is good
practice to provide information in hard copy where possible, it is not a
requirement of the Freedom of Information Act 2000, or the Model
Publication Scheme. I am aware that the ‘[2]How to operate’ guidance
stated that an authority must provide hard copies. However, this is simply
guidance interpreting the Model Publication Scheme, and not a legal
requirement. There is no stated requirement for an authority to provide
hard copies in the Act or Model Publication Scheme, simply a requirement
to provide access. I have raised this issue with our Good Practice team
who have stated that they will amend the guidance to accurately reflect
the requirements of the publication scheme and Act.

It may also be helpful to mention the section of the ‘[3]How to
operate’ guidance that discusses the requirements relating to public
registers;

“If a public authority is required to maintain a register and to make
the information in it available for the public to inspect, the existing
provisions covering access will usually be adequate. However, we expect
authorities to publicise which registers they hold and how the public can
access the information in them. If registers contain personal information,
authorities must ensure they have applied the data protection
principles”.

Therefore the requirements relating to the provision of the register are
in section 18(6) of the Data Protection Act 1998. This states;

“(6)The Commissioner –

(a) shall provide facilities for making the information contained in the
entries in the register available for inspection (in visible and legible
form) by members of the public at all reasonable hours and free of charge,
and

(b) may provide such other facilities for making the information contained
in those entries available to the public free of charge as he considers
appropriate”

Therefore, the Data Protection Act 1998 places no requirement on us to
make the register available in hard copy form.

If you were unable to access the online version either at home, or in a
public library, we may be able to provide the opportunity to access the
information on a computer in situ, fulfilling our obligations under the
Model Publication Scheme in terms of ensuring accessibility. Otherwise,
the way to access the information requested remains as set out in my
previous email, and in our guide to information.

Copyright

In your second email you state ask us to ‘confirm that you are waiving
your copyright notice at the bottom of each entry’ and to ‘explain the
extent of the waiver’. I can confirm that we are not waiving our
copyright, and this remains intact. The Freedom of Information Act 2000
provides access to information, but does not provide permission for
re-use. The copyright therefore continues to apply to the information even
if you were to print a copy for your own use.

Complaints procedure

If you are dissatisfied with our previous response to your request, you
may request an internal review, as set out the complaints procedure in my
previous email.

Yours sincerely

Adam Stevens

Assistant Internal Compliance Manager.

show quoted sections

http://www.ico.gov.uk or email: [email address]
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Tel: 01625 545 700 Fax: 01625 524 510

References

Visible links
1. file:///tmp/rad87A62_files/filelist.xml
2. http://www.ico.gov.uk/what_we_cover/free...
3. http://www.ico.gov.uk/what_we_cover/free...

Dear Sir or Madam,

I must admit that I am sorely disappointed in your change of attitude over my request.

From an initially helpful and open response you seem to have to an attitude that I have found more common in other government departments of doing as little as possible to assist.

I have now found that your claim that the register could be retrieved from the website in conjunction with the post office post code data to be incorrect, as not all data controllers are registered with UK addresses.

I suggest that rather than you continuing to be evasive on this matter, you hand it back to the helpful/open person/people who were originally handling it and provide the originally agreed data, uploaded to this site as discussed.

As your response (regarding the website and PAF) was in correct, I expect this to be handled as part of the original request, which is now long over due.

I do hope that your current behaviour is not a sign of things to come, given the ending of the current information commissioners tenure.

Regards

Paul Perrin

Information Commissioner's Office

Link: [1]File-List

16 June 2009

Case Reference Number RCC0253743

Dear Mr Perrin

Thank you for your email dated 14 June in which you ask us to review our
response to you in which we have suggested that you use postcodes to
extract the information in the complete register. This was given in
response to your refined request made on 1 May 2009 for data that allows
you to extract the full information. Your request was treated in
accordance with the Freedom of Information Act 2000.

As you state that the response we have given is incorrect, this has been
treated as a request for internal review. This is in line with the section
45 Code of Practice, which requires public authorities to have a procedure
in place for dealing with complaints in relation to their handling of
requests for information.

We will respond by 10 July 2009 which is 20 working days from the date we
received your recent correspondence.  This is in accordance with our
internal review procedures.

Yours sincerely

Adam Stevens

Assistant Internal Compliance Manager.

show quoted sections

http://www.ico.gov.uk or email: [email address]
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Tel: 01625 545 700 Fax: 01625 524 510

References

Visible links
1. file:///tmp/radA2F13_files/filelist.xml

Information Commissioner's Office

1 Attachment

Link: [1]File-List

6 July 2009

Case Reference Number RCC0253743

Dear Mr Perrin

I am writing in response to your request for an internal review of our
decision not to release to you a copy of the complete Data Protection
Register of Data Controllers. In your email of 14 June you stated that our
response to you was incorrect, and so we took this as a request for a
review of that decision.  I have now had the opportunity to review the
decision, and I set out my conclusions below.

You will remember that, in refusing your request, we referred you to our
website, where the Register is available to the public, and we claimed
reliance on the exemption at Section 21(1) of the Freedom of Information
Act. The full text of section 21 was included in our Refusal Notice to you
so I have not reproduced it again here, but in brief, it states that if
information is reasonably accessible to an applicant elsewhere, then it
becomes exempt from the individual right of access under the Act, and the
public authority does not have to provide it in response to a request.

The thinking behind the exemption is that if there is another route to
obtaining the information, then there is no need for the Act to provide
the way of access. The Register of Data Controllers is expressly designed
to allow access to anyone who wants to find contact details and a
description of the purposes for which an organisation processes personal
information, and it is available on our website for that very reason.

Section 21 goes on to define information which will be reasonably
accessible to an applicant, regardless of their individual circumstances.
Subsection (3) in particular provides that information is not reasonably
accessible to an applicant just because it is available from the public
authority on request, unless it is included in a publication scheme.  In
other words, the information will by definition be considered reasonably
accessible, and the exemption will apply, if it is included in the
authority’s publication scheme. As you know, the Register is included in
the ICO’s scheme.

The applicability of section 21 to your request is re-inforced by a
consideration of the purpose of the Register itself. It was created to
comply with the statutory requirements at section 19 of the Data
Protection Act. The Commissioner has a statutory obligation to maintain
the Register and to

“provide facilities for making the information contained in the entries
in the Register available for inspection (in visible and legible form) by
members of the public at all reasonable hours and free of charge” (Data
Protection Act 1998, section 19(6)(a))

The main aim of the notification process is transparency and openness, and
the Register is effectively a mechanism by which the public can obtain
information about a particular organisation’s processing activities. If
the Register did not make information reasonably accessible then there
would be questions over whether the Commissioner was fulfilling the above
statutory duty.

So, having looked at the case file, and having reconsidered our actions
and the reasoning behind them, I have reached the conclusion that section
21 does apply to the information you have requested. Consequently I am
upholding the original decision, and we will not be supplying you with a
copy of the full Register.  Instead, as you are aware, you will be able
to access it via our website.

However I fully understand the frustration expressed in your recent email
as a result of our handling of your original request. In view of this I
have decided to send you a file which includes the registration numbers of
all organisations currently registered with us. In order to access the
organisations’ details you will need to cut and paste each registration
number into the search facility on the Register, this will return the full
details for that organisation. The file will ensure access to every
registration that we hold, as it will guarantee no missed or duplicate
entries due to searching by other means such as post-code or alphabet. You
should be aware however that the Register changes almost on a daily basis,
and so this file constitutes a snapshot in time (as at 2 July 2009) which
will become more and more out-dated as time passes.

As you will be aware, if you remain unhappy with the outcome of this
review then you have a right of appeal to the ICO in our capacity as the
statutory regulator for the FOI Act. If you wish to appeal, then please
visit the ‘Complaints’ section of our website to make a complaint
online, or alternatively please write directly to the Case Reception Unit
at our head office in Wilmslow.

Yours sincerely

Anne Jones

Assistant Commissioner (Wales)

show quoted sections

http://www.ico.gov.uk or email: [email address]
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Tel: 01625 545 700 Fax: 01625 524 510

References

Visible links
1. file:///tmp/rad12F24_files/filelist.xml