Freedom of Information Team
Department of Health and Social Care
39 Victoria Street
www.gov.uk/dhsc
London
SW1H 0EU
Mr Phil Booth
xxxxxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxxxxx.xxx
12 May 2021
Annex A:
DHSC’s response to initial request dated 29 March 2021
Annex B:
Request for internal review dated 5 April 2021
Dear Mr Booth,
FREEDOM OF INFORMATION ACT (FOIA): INTERNAL
REVIEW CASE REFERENCE IR 1270844
You originally wrote to the Department of Health and Social Care (DHSC) on 10 November
requesting details about JBC agreements, data sources and DPIAs. We responded to you on
29 March (our ref: FOI-1270844), stating that we do not hold the requested information. A
copy of our response, including the full text of your request, is at Annex A.
You subsequently emailed DHSC on 5 April requesting an internal review into the handling of
your original request. A copy of your email is at Annex B.
The purpose of an internal review is to assess how your FOI request was handled in the first
instance and to determine whether the decision given to you was correct. This is an
independent review as I was not involved in the original decision.
I have undertaken discussions with the team that has responsibility for your request, and we
have taken the opportunity to consider it again. I apologise for the delay in doing so, which I
acknowledge has fallen short of expectations.
Conclusion
After careful consideration of the subject matter, I have concluded that the response you
received was compliant with the requirements of the FOIA and I uphold DHSC’s statement
that the department does not hold the requested information for questions 1 and 2. I also
uphold the decision for question 3.
2
However, on review we have now considered DPIAs held, operated and reviewed by DHSC.
We have considered all those DPIAs which fall within our interpretation of “performed” by
JBC; that is, DPIAs which have been created by DHSC in relation to specific processing
activities of JBC and which contain relevant information provided by JBC. DHSC holds this
information. However, we consider that these particular DPIAs are exempt under Section
35(1)(a) of the FOIA, which provides protection for information that relates to the formulation
or development of Government policy.
JBC provides evidence-based, objective analysis to inform local and national decision-
making in response to COVID-19 outbreaks. JBC’s insights and analysis is used for the
formulation or development of Government policy and the DPIAs performed by JBC are
related to such formulation or development.
Section 35 is a qualified exemption and requires consideration of the public interest test.
DHSC recognises the general public interest in making this information available for the sake
of greater transparency and openness. DHSC is of the opinion that the information requested
in this particular request is exempt from disclosure after application of the public interest test.
Section 35(1)(a) covers information relating to the formulation and development of
Government policy and is used to protect the integrity of the policymaking process, and to
prevent disclosures which would undermine this process and result in less robust, well
considered or effective policies. The DPIAs are reviewed regularly, and updated, and are
subject to change. Given the close connection between these DPIAs and the JBC insights
and analyses that are being used for the formulation or development of Government policy
and fact that policy development is ongoing, it is our opinion that section 35(1)(a) applies in
this case.
In relation to your original question regarding “privacy and ethical standards”, please note
that the NHS Test and Trace privacy notice has recently been updated to provide information
on processing of personal data by JBC. Among other information, the privacy notice also
provides information on the lawful bases and security standards applicable to personal data.
The review is now complete.
If you are not content with the outcome of your complaint, you may apply directly to the
Information Commissioner (ICO) for a decision. The ICO can be contacted at:
The Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
https://ico.org.uk/concerns
Yours sincerely,
Nicole Mercer
Casework Manager
Freedom of Information Team
xxxxxxxxxxxxxxxxxxxx@xxxx.xxx.xx
3
Annex A:
DHSC’s response to initial request
Mr Phil Booth
xxxxxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxxxxx.xxx
29 March 2021
Dear Mr Booth,
Freedom of Information Request Reference FOI-1270844
Thank you for your request dated 10 November 2020 in which you asked the Department of
Health and Social Care (DHSC)
:
Subject: Re: Freedom of Information request - Joint Biosecurity Centre agreements,
data sources and DPIAs
Thank you for your reply of 4 November, and for confirming that DHSC holds the
information.
Given that, as you say, several hundred data sources are drawn upon I can appreciate
that it would be time-consuming to review them all. I presume that once it is fully
established, the JBC will be maintaining an information asset register and that - in line
with government transparency - the list of the personal and non-personal information
assets it holds will be published in due course.
In the meanwhile, I have refined my request as follows - please would you provide:
1) A copy of the framework agreement or 'establishing document' that defines how
DHSC and the Joint Biosecurity Centre work to serve the public and the taxpayer, and
how they discharge their responsibilities. (To be clear, I am asking for the *equivalent*
to the framework agreements that exists between, e.g. DHSC Public Health England:
https://www.gov.uk/government/publications/framework-agreement-between-the-
department-of-health-and-public-health-england - and also between DHSC Health
Education England, DHSC the Health Research Authority, etc.)
2) A copy of the partnership agreement, Memorandum of Understanding and/or any
other documents that lay out or define the relationship between the Joint Biosecurity
Centre (JBC) and Public Health England (PHE).
3) A copy of any and all Data Protection Impact Assessments (DPIAs) that the JBC has
performed, and - if this is not covered in the DPIAs - a description of the operational
steps JBC has taken to ensure robust privacy and ethical standards are upheld. (If the
number of DPIAs is too many for you to provide copies within the legal cost limit, or if
they are not yet
4
completed or in place, please could you provide instead a full LIST of all such
Assessments that will be required.) This was a follow up to your request dated 7 October 2020, to which we responded on 4
November (our reference FOI 1261423).
Your request has been handled under the Freedom of Information Act (FOIA).
Q1) A copy of the framework agreement or 'establishing document' that defines how
DHSC and the Joint Biosecurity Centre work to serve the public and the taxpayer, and
how they discharge their responsibilities. (To be clear, I am asking for the *equivalent*
to the frame-work agreements that exists between, e.g. DHSC Public Health England: https://www.gov.uk/government/publications/framework-agreement-between-the-
department-of-health-and-public-health-england - and also between DHSC Health
Education England, DHSC the Health Research Authority, etc.)
A copy of the framework agreement or ‘establishing document’ that defines how DHSC and
the Joint Biosecurity Centre (JBC) work to serve the public and the taxpayer and how they
dis-charge their responsibilities is not held. The JBC is part of NHS Test and Trace, a
division with-in DHSC. In view of this, no frameworks agreements that are bespoke to JBC
have been necessary.
Q2) A copy of the partnership agreement, Memorandum of Understanding and/or any
other documents that lay out or define the relationship between the Joint Biosecurity
Centre (JBC) and Public Health England (PHE).
As the Joint Biosecurity Centre (JBC) is a part of NHS Test and Trace within DHSC, a
partnership agreement, Memorandum of Understanding and/or any other documents laying
out or defining the relationship between the JBC and Public Health England (PHE) has not
been necessary.
3) A copy of any and all Data Protection Impact Assessments (DPIAs) that the JBC has
per-formed, and - if this is not covered in the DPIAs - a description of the operational
steps JBC has taken to ensure robust privacy and ethical standards are upheld. (If the
number of DPI-As is too many for you to provide copies within the legal cost limit, or if
they are not yet completed or in place, please could you provide instead a full LIST of
all such Assessments that will be required.)
As the Joint Biosecurity Centre (JBC) is a part of NHS Test and Trace, a division within
DHSC, the JBC has not individually or exclusively undertaken any Data Protection Impact
Assessments (DPIAs). The JBC utilises the DPIAs held, operated and continually reviewed
by DHSC.
We note that the deadline for this request has been extended four times, to ensure that you
received a complete answer. We apologise for being unable to facilitate your request within
the originally specified deadline.
If you are not satisfied with the handling of your request, you have the right to appeal by
asking for an internal review. This should be submitted within two months of the date of this
letter and sent to xxxxxxxxxxxxxxxxxxxx@xxxx.xxx.xx, or to the address at the top of this
letter.
5
Please remember to quote the reference number above in any future communication.
If you are not content with the outcome of your internal review, you may complain directly to
the Information Commissioner’s Office (ICO). Generally, the ICO cannot make a decision
unless you have already appealed our original response and received our internal review
decision. You should raise your concerns with the ICO within three months of your last
meaningful contact with us.
The ICO can be contacted at:
The Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
https://ico.org.uk/concerns/
6
Annex B:
Request for internal review
Phil Booth
xxxxxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxxxxx.xxx
05 April 2021
Dear Department of Health and Social Care,
Please pass this on to the person who conducts Freedom of Information reviews.
I am writing to request an internal review of Department of Health and Social Care's handling
of my FOI request 'Joint Biosecurity Centre agreements, data sources and DPIAs' to which
you responded that documents establishing a new directorate within DHSC on1 June 2020,
and documents defining its relationship to an Executive Agency of DHSC, were "not
necessary".
For absolute clarity, and according to your public duty under Section 16 of the Act, is it
DHSC's position that such documents DO NOT EXIST - or just that they are not in any sort
of DHSC 'filing cabinet’, or on any DHSC IT system? (Or that they were at somepoint, but
have been deleted?)
I remind you also that best practice guidelines are that DHSC should forward my request to
the appropriate body if it knows the information is held elsewhere - e.g. if any such
establishing documents are ‘held’ by Test and Trace or the JBC, even if not by DHSCdirectly
- and that Section 3(2)(b) of the Act entitles me to ‘information held on behalf of an authority’.
Your response states that the JBC "utilises" DPIAs held by DHSC, which falls well within my
definition of "operational steps JBC has taken to ensure robust privacy and ethical standards
are upheld" - this is indeed one of the key reasons why DPIAs are done!For avoidance of
doubt, in response to my request I would expect to have been provided with copies of all of
the DPIAs that the JBC has utilised that were held by DHSC.
Your response confirms that DHSC does hold these DPIAs, and not only refuses to release
them but fails to provide reasons under the Act for witholding the information requested.
I look forward to a prompt response, i.e. within within 20 working days.
A full history of my FOI request and all correspondence is available on the Internet at this
address:https://www.whatdotheyknow.com/request/joint_biosecurity_centre_agreeme
Yours faithfully,
Phil Booth
7