All Policy & procedure documents regards staff using they're own private, personal - (non ICO) - email accounts for conducting ICO business - Martin McGartland request

Martin McGartland made this Freedom of Information request to Information Commissioner’s Office

This request has been closed to new correspondence from the public body. Contact us if you think it ought be re-opened.

The request was partially successful.

Martin McGartland

Martin McGartland

19 October 2017

Dear Information Commissioner’s Office,

1. Please provide me with copies of all policy or procedures for staff using they're own private, personal - (non ICO) - email accounts for conducting ICO business.

2. If staff are allowed to use their own private (non ICO) email accounts what policies or procedures are in place to allow the public to find out information that may be covered under data protection or Freedom of Information requests.

3. Regards 1 & 2 above, can the public request - under DPA - copies of such information (including private email, other documents) sent by ICO to staff personal (non ICO) private email accounts. Also, if so, is person/s named in those emails, correspondence (including if they are also the focus) entitled to copies of that information (requesters personal information)?

This request is also for copies (copies of originals please) of all ICO policy and procedure documents which relate to this request.

I have also made a SAR to you today (by email) regards this subject. Please reply to this FOI request on this (WDTK) page.

Yours faithfully,

Martin McGartland

AccessICOinformation, Information Commissioner’s Office

Thank you for contacting the Information Commissioner’s Office. We confirm
that we have received your correspondence.

 

If you have made a request for information held by the ICO we will contact
you as soon as possible if we need any further information to enable us to
answer your request. If we don't need any further information we will
respond to you within our published, and statutory, service levels. For
more information please visit [1]http://ico.org.uk/about_us/how_we_comply

 

If you have raised a new information rights concern - we aim to send you
an initial response and case reference number within 30 days.

 

If you are concerned about the way an organisation is handling your
personal information, we will not usually look into it unless you have
raised it with the organisation first. For more information please see our
webpage ‘raising a concern with an organisation’ (go to our homepage and
follow the link ‘for the public’). You can also call the number below.

 

If you have requested advice - we aim to respond within 14 days.

 

If your correspondence relates to an existing case - we will add it to
your case and consider it on allocation to a case officer.

 

Copied correspondence - we do not respond to correspondence that has been
copied to us.

 

For more information about our services, please see our webpage ‘Service
standards and what to expect' (go to our homepage and follow the links for
‘Report a concern’ and ‘Service standards and what to expect'). You can
also call the number below.

 

If there is anything you would like to discuss with us, please call our
helpline on 0303 123 1113.

 

Yours sincerely

 

The Information Commissioner’s Office

 

Our newsletter

Details of how to sign up for our monthly e-newsletter can be found at
[2]http://www.ico.org.uk/tools_and_resource...

 

Twitter

Find us on Twitter at [3]http://www.twitter.com/ICOnews

 

The ICO's mission is to uphold information rights in the public interest.
To find out more about our work please visit our website, or subscribe to
our e-newsletter at ico.org.uk/newsletter.

If you are not the intended recipient of this email (and any attachment),
please inform the sender by return email and destroy all copies without
passing to any third parties.

If you'd like us to communicate with you in a particular way please do let
us know, or for more information about things to consider when
communicating with us by email, visit ico.org.uk/email

References

Visible links
1. http://ico.org.uk/about_us/how_we_comply
2. http://www.ico.org.uk/tools_and_resource...
3. http://www.twitter.com/ICOnews

Information Commissioner’s Office

1 Attachment

15 November 2017

 

Case Reference Number IRQ0706707

 

Dear Mr McGartland

Request for Information
 
Further to your information request to the Information Commissioner’s
Office (ICO) of 19 October 2017, we can now respond.
 
We have dealt with your request in accordance with your ‘right to know’
under section 1(1) of the Freedom of Information Act 2000 (FOIA), which
entitles you to be provided with any information ‘held’ by a public
authority, unless an appropriate exemption applies.
 
Request
 
In your email you asked for the following information:
 
“1. Please provide me with copies of all policy or procedures for staff
using they're own private, personal - (non ICO) - email accounts for
conducting ICO business.

2. If staff are allowed to use their own private (non ICO) email accounts
what policies or procedures are in place to allow the public to find out
information that may be covered under data protection or Freedom of
Information requests.

3. Regards 1 & 2 above, can the public request - under DPA - copies of
such information (including private email, other documents) sent by ICO to
staff personal (non ICO) private email accounts. Also, if so, is person/s
named in those emails, correspondence (including if they are also the
focus) entitled to copies of that information (requesters personal
information)?

This request is also for copies (copies of originals please) of all ICO
policy and procedure documents which relate to this request.”
 
Information Held
 
We can confirm that we do hold information within the scope of your
information request, namely the ICO’s Acceptable Use Standard (see
attached).
 
This standard defines what ICO staff can and can’t do with IT systems and
equipment.
 
In summary it confirms:
 
 

* Sending corporate information to private web mail accounts is
prohibited without management authorisation (4.3 refers).
* If staff wish to access private web mail accounts for personal use,
they must use their own personal devices or the standalone computers
(5.2 refers), which are not connected to our corporate systems.
* Anyone who doesn’t comply with the standard may be subject to
disciplinary action (6.3 refers).

 
It should be noted that staff can send emails from ICO managed computers
and devices to service users’ private email accounts so we can respond to
complaints, enquiries and information requests.  However, staff cannot use
ICO managed computers and devices to access their own private email
accounts, and any attempt to do so is blocked by our internet proxy
filters.
 
The ICO Code of Conduct, which is available on our website [1]here, may
also be of interest to you.  Whilst it does not make any specific
reference to staff use of private email accounts for conducting ICO
business, we would refer you to the section titled ‘8 – Official
Information’, which does refer to the confidentiality of information.
 
In response to point 2 above, we can confirm that any corporate
information that is sent to, or received from, private email accounts
which is held within our IT systems is still subject to the information
Acts, such as the FOIA and the Data Protection Act 1998.  There is no
specific policy or procedure which covers this particular situation.
 
In response to 3, we can also confirm that any requests to the ICO for
information that has been communicated to or from a private email account
will be considered for disclosure in accordance with the requirements of
the FOIA or DPA as appropriate, and will only be withheld if a relevant
FOIA exemption or subject access provision is applicable.  Again, there is
no specific policy or procedure which covers this situation.
 
Review Procedure
 
We hope this provides you with the information you require.  However, if
you are dissatisfied with this response and wish to request a review of
our decision or make a complaint about how your request has been handled
you should reply directly to this email (leaving the reference number in
square brackets intact), write to the Information Access Team at the
address below or email [2][ICO request email].
 
Your request for internal review should be submitted to us within 40
working days of receipt by you of this response.  Any such request
received after this time will only be considered at the discretion of the
Commissioner.
 
If having exhausted the review process you are not content that your
request or review has been dealt with correctly, you have a further right
of appeal to this office in our capacity as the statutory complaint
handler under the legislation.  To make such an application, please write
to our Customer Contact Team at the address given or visit our website if
you wish to make a complaint under either the Freedom of Information Act
or Environmental Information Regulations.
 
A copy of our review procedure can be accessed from our website [3]here.
 
Yours sincerely
 
 
 

Antonia Swann
Lead Information Access Officer
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
T. 01625 545894  F. 01625 524510  [4]ico.org.uk  [5]twitter.com/iconews
Please consider the environment before printing this email

 
 
 
 
 

The ICO's mission is to uphold information rights in the public interest.
To find out more about our work please visit our website, or subscribe to
our e-newsletter at ico.org.uk/newsletter.

If you are not the intended recipient of this email (and any attachment),
please inform the sender by return email and destroy all copies without
passing to any third parties.

If you'd like us to communicate with you in a particular way please do let
us know, or for more information about things to consider when
communicating with us by email, visit ico.org.uk/email

References

Visible links
1. https://ico.org.uk/media/about-the-ico/p...
2. mailto:[ICO request email]
3. https://ico.org.uk/media/about-the-ico/p...
4. http://ico.org.uk/
5. https://twitter.com/iconews

Looking for an EU Authority?

You can request documents directly from EU Institutions at our sister site AskTheEU.org . Find out more .

AskTheEU.org