SAR compliance times (Jul20,Aug20,Jun21,Jul21,Apr22)

The request was partially successful.

Dear Swansea Council,

For all subject access requests (SAR), namely requests made by or on behalf of an individual for the information which they are entitled to ask for under Article 15 of the UK GDPR, received in the months of July 2020, August 2020, June 2021, July 2021 and April 2022, please provide:

a) The date a data subject (or someone acting on their behalf) asserted their right of access to the Council

b) The method of asserting the right of access, eg being kettled through Swansea Council's badly worded webform, verbally, by email, via a letter mailed or hand delivered to the Council, by social media etc.

c) The party making the request, ie an individual themself, a relative, friend, solicitor, child advocacy service, charity, attorney etc. Please note I am not asking you to identify any individual or third party, just the relationship of the requestor to the data subject

d) The scope of the SAR, ie if limited to particular functional area(s) or set(s) of records within the Council, or whether the request encompassed all the processing of personal information performed by Swansea Council

e) The date on which Swansea Council fully complied with the SAR. By "fully" I mean that where a data subject had to lodge a complaint with the ICO or another supervisory authority, the final date that Swansea Council came into compliance

f) If Swansea Council has extended the time to respond (beyond the Controller's duty to the comply with a SAR without undue delay and at the latest within one month of receipt of the request or within one month of receipt of any information legitimately requested to confirm the requester’s identity) then please identify the reason to seek such an extension

Please ensure that all data provided is in a reusable format at 3* Level (or above), per the Welsh Government's Open Data Plan (2016).

Yours faithfully,

D Morris

Freedom of Information (Mailbox), Swansea Council

Bydd y manylion rydych wedi'u darparu'n cael eu trosglwyddo i'r adran
neu'r adrannau perthnasol sy'n cadw'r wybodaeth.

Bydd eich cais yn cael ei brosesu o fewn 20 niwrnod gwaith oni bai bod
angen mwy o fanylion oddi wrthych. Os dyma'r achos, byddwn yn cycylltu â
chi drwy'r manylion rydych wedi'u darparu ar y ffurflen hon.

Ni chodir ffi am wneud cais, os na fydd yr wybodaeth yn costio mwy na £450
i'r Awdurdod ei darparu. Os dyma fydd yr achos, byddwch yn cael eich
hysbysu.

 

 

 

The details you have provided will be passed on to the relevant department
or departments that hold the information.

 

Your request will be processed within 20 working days unless we require
more details from you. If this is the case, you will be contacted via the
details you have given on this form.

 

There is no fee for making a request, provided the information does not
cost the council more than £450 to produce. If this is the case you will
be informed.

show quoted sections

Michael Powney, Swansea Council

3 Attachments

Hello Mr Morris

Further to your freedom of information request regarding SAR compliance
times, please find our response attached.

Thanks

 

[1]Council Logo Michael Powney

Uned Llywodraethu Gwybodaeth
Information Governance Unit

 

[2][email address]

 

 

 

══════════════════════════════════════════════════════════════════════════

 

show quoted sections

Dear Swansea Council,

Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of Swansea Council's handling of my FOI request 'SAR compliance times (Jul20,Aug20,Jun21,Jul21,Apr22)'.

1) 12x under-reporting and misrepresentation to ICO

On 1 September 2020 a Complaints Officer at Swansea Council wrote:

"Thank you for your email which I have logged and passed to the appropriate information officer. I can confirm that between the 9th July and 6th August, one request was received via the SAR webform."

This data fed into an investigation by the Information Commissioner's Office.

Looking at the data Swansea Council has now disclosed, you show twelve times as many SAR Webmails were received (dates inclusive). Please explain this gross discrepancy.

2) Full compliance date missing

The disclosure completely omits the date when each SAR was fulfilled. In my request I asked you to supply:

'e) The date on which Swansea Council fully complied with the SAR.'

I also qualified the term "fully" as:

'By "fully" I mean that where a data subject had to lodge a complaint with the ICO or another supervisory authority, the final date that Swansea Council came into compliance.'

This was to cover, what I hoped was the rare occasion, where the ICO had needed to intervene.

By means of a worked example:

On 23 July 2020, following a member of the public revealing a data breach, the ICO advised a data subject to submit a Subject Access Request. This was done through Swansea Council's Webform.

On 25 August 2020 the Data Subject emailed Swansea Council's registered Data Protection Officer (contact from ICO register of fee payers) and complained "Subject Access Request ignored by Swansea Council"

On 25 August 2020 the Data Subject also opened a complaint file with the ICO.

On 23 September 2020 Swansea Council's Information Governance Unit responded to "your Subject Access Request dated 28th August 2020" and claimed "we have conducted several searches in all possible locations and I can confirm that we do not hold any data about yourself."

On 07 December 2020 the Data Subject reminded the ICO that more than 12 weeks had elapsed since a complaint was opened and asked for a progress update.

On 20 January 2021 a representative of the Data Subject spoke directly with the ICO Case Officer, following up in writing with 17 (seventeen) areas where Swansea Council clearly held personal data, over nearly a quarter of century.

On 29 January 2021 the ICO instructed Swansea Council to conduct an investigation and resolve

On 23 February 2021 Swansea Council's DPO wrote a nine page letter to the Data Subject and the ICO. It listed 48 (forty eight) "additional pieces of personal information which have been located" [0 + 48 == 48]. Fragments of Swansea Council's retention schedule were also provided.

On 24 February 2021 Swansea Council's IGU provided a portal link to a 28MiB archive containing the pieces of personal information, amounting to some 300 pages.

For the above, the Column "SAR Opened" ought to have included an entry for "23/07/2020. The missing Column "SAR complied" ought to have read "24 February 2021".

(Although it is a matter of record that months later it was apparent that the release had been incomplete and had to be re-visited).

3) pdf rather than xlsx

I requested that you 'Please ensure that all data provided is in a reusable format at 3* Level (or above), per the Welsh Government's Open Data Plan (2016).'. You have simply made further busywork to frustate and delay onward processing and analysis of the information.

4) H R O D?

Please explain the acronym "H R O D"

A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.whatdotheyknow.com/request/s...

Yours faithfully,
D Morris

Freedom of Information (Mailbox), Swansea Council

Bydd y manylion rydych wedi'u darparu'n cael eu trosglwyddo i'r adran
neu'r adrannau perthnasol sy'n cadw'r wybodaeth.

Bydd eich cais yn cael ei brosesu o fewn 20 niwrnod gwaith oni bai bod
angen mwy o fanylion oddi wrthych. Os dyma'r achos, byddwn yn cycylltu â
chi drwy'r manylion rydych wedi'u darparu ar y ffurflen hon.

Ni chodir ffi am wneud cais, os na fydd yr wybodaeth yn costio mwy na £450
i'r Awdurdod ei darparu. Os dyma fydd yr achos, byddwch yn cael eich
hysbysu.

 

 

 

The details you have provided will be passed on to the relevant department
or departments that hold the information.

 

Your request will be processed within 20 working days unless we require
more details from you. If this is the case, you will be contacted via the
details you have given on this form.

 

There is no fee for making a request, provided the information does not
cost the council more than £450 to produce. If this is the case you will
be informed.

show quoted sections

Andrew Brown, Swansea Council

2 Attachments

Dear Daniel Morris,
Please find attached the result of our review of your FOI reply.
Regards 

Andrew Brown MSc Econ Records Management 

Swyddog Cofnodion 

Records Officer 

  

( 01792 636590 | 

* [1][email address
* [2][email address

show quoted sections

References

Visible links
1. mailto:[email address]
2. mailto:[email address]

Daniel Morris left an annotation ()

Wow! <20% in 1 month, avg 126 days. So much for GDPR/DPA2018.

Another stellar IR. Despite being spoon fed:
1) reviewer still hasn't provided reason for extension column (f).
2) data is suspect, worked example provided shows opened 2020-08-28 closed 2020-09-23, instead of 2020-07-23 & 2021-02-24.
3) 92% of SAR webforms didn't come from the SAR webform. Suggests other forms needs fixing alongside terminology and the kettling SAR webform - which obviously isn't fit for purpose itself. as it lost the 23 July 2020 submission, and how many more...?