Dear Her Majesty's Prison & Probation Service,

Please provide me with your Records of Processing records, or details of processing activities, in terms of Article 30 of GDPR, Article 24 of the Law Enforcement Directive and/or Section 61 of the Data Protection Act 2018, relating to the operation of the private prison estate.

Please ensure that you detail what processing activities HMPPS and/or Ministry of Justice are the Data Controller, and where the private prison operator are Data Processor. Please also provide details of processing activities where HMPPS and/or Ministry of Justice are joint data controller with a private prison operator. Data Controller and Data Processor are defined the same as in Article 4 of GDPR and Section 32 of the Data Protection Act 2018.

The data should, where possible, distinguish processing which is carried out for Law Enforcement Purposes, as defined in Section 31 of the Data Protection Act 2018, along with the appropriate lawful basis of processing.

Where you hold details of processing activities within private prisons which are carried out by a data controller other than HMPPS/MoJ, or where HMPPS/MoJ is a joint data controller with another organisation, please provide me with the identification of that Data Controller.

Where processing is for the law enforcement purposes, please identify the relevant Competent Authority who is data controller as per Section 30 and Schedule 7 of Data Protection Act 2018.

I would also be grateful for details of the contractual obligations in relation to data processing that are in place between HMPPS/MoJ and the private sector operators. Where these instructions are part of a PSI/PSO then please provide the details of such document.

Please advise me if you require any clarifications or further information in order to fulfil this request.

Yours faithfully,

Andrew Hill

Dear Her Majesty's Prison & Probation Service,

Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of Her Majesty's Prison & Probation Service's handling of my FOI request 'Article 30 Records of Processing - Private Prison Estate'.

Thank you for signposting me to the PSI-03-2018 document, the contents of which I have noted.

Section 5.2 details that the MoJ is a single data controller for all activities under HMPPS. Would I be correct in saying that MoJ is data controller for all processing of prisoner information and that the private prison operators are data processors? If you could clarify this for me then I would consider the controller/processor part of my request to be fulfilled.

I cannot see any details within this PSI document which would fulfil my request for information contained in your Article 30 Records of Processing. There are specific records which must be kept in terms of Article 30 of GDPR, which is quite similar to the information to be presented to a SAR applicant in terms of your PSI section 2.15.

It is my understanding that MoJ handle all SARs submitted throughout the estate for prisoner information and so these details should be quite readily available.

A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.whatdotheyknow.com/request/a...

Yours faithfully,

Andrew Hill