Dear Home Office,

On 21 December 2021, you disclosed a Data Protection Impact Assessment (DPIA) relating to the Atlas system, which is replacing the Casework Information Database (CID). See https://www.whatdotheyknow.com/request/t.... On page 7, this DPIA lists a number of completed linked DPIAs.

Please provide me with a copy of the following linked DPIAs:
(1) Person Centric Data Platform
(2) Performance, Reporting and Analysis Unit (PRAU)
(3) Person Identity Products (PIP) (Draft DPIA)
(4) Decision
(5) Asylum Accommodation Support Transformation

Yours faithfully,
Tatiana Kazim

Dear Home Office,

On 09 March, you told me you were extending the 20-working day response target to consider the public interest test, and said you would let me have a full response by 10 May.

I note that the 10 May has now passed. I'd be grateful for an update on the status of my request.

Yours faithfully,

Tatiana Kazim

Dear Home Office,

A response to my request is now long overdue. Please can you give me an update as to when I might expect a response?

Yours faithfully,

Tatiana Kazim

Dear Home Office,

Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of the Home Office's handling of my FOI request 'Atlas and linked systems'.

I made my request on 9 March, and I have not yet recieved a substantive response. On 7 April, I was informed that the 20-day response period was being extended in order for the public interest test to be considered. I was told that I should recieve a response by 10 May. It is now 20 June, and I am yet to recieve a response.

By law, and in all the circumstances, I believe I ought to have recieved a response by now.

A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.whatdotheyknow.com/request/a...

Yours faithfully,

Tatiana Kazim

Dear Home Office,

Thank you for your response to my request.

I am writing to ask for clarification. You said that the Data Protection Impact Assessment on Decision is already published and you provided a link. However, the clickable link takes me to a request relating to the Luton and Bedfordshire Archives and Records Service.

Please can you clarify where the information is published?

Yours faithfully,

Tatiana Kazim

Dear N McKenzie,

Yes, I apologise, the case ref number is 68819. The full correspondence history is here: https://www.whatdotheyknow.com/request/a....

Yours sincerely,

Tatiana Kazim

Dear Home Office,

Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of Home Office's handling of my FOI request 'Atlas and linked systems'.

I made my request on 9 March 2022 and I received a substantive response on 20 June 2022.

I requested copies of a number of Data Protection Impact Assessments (DPIAs) linked to the Atlas DPIA (available at https://www.whatdotheyknow.com/request/t...). The DPIAs I requested were:
(1) Person Centric Data Platform
(2) Performance, Reporting and Analysis Unit (PRAU)
(3) Person Identity Products (PIP) (Draft DPIA)
(4) Decision
(5) Asylum Accommodation Support Transformation

In respect of the Decision DPIA, you say that this information is already available. However, even after I sought clarification, the link you provided was to the Atlas DPIA itself: https://www.whatdotheyknow.com/request/t.... I seek an internal review of the response to this aspect of my request on the basis that the Decision DPIA is not identical to the Atlas DPIA (rather, it is one of the ‘completed linked DPIAs’) and is not, in fact, available.

In respect of the Person Centric Data Platform and Person Identity Products (PIP) DPIAs, you refused my request in purported reliance on sections 24 and 31 FOIA. The considerations said to favour non-disclosure were as follows:

“Section 24(1) – National Security.
If we were to release this information, it would make the UK or its citizens more vulnerable to a national security threat. We are not at liberty to divulge any more information.

Section 31(1)(a)(e) – Law Enforcement.
Information relating to vulnerabilities on the Home Office IT estate, security and/or resilience controls in place and the management of incidents is sensitive and is likely to result in additional risks to the department. As such, the release of this information may undermine the department’s ability to deliver its operational policing and security remit. By identifying what type of data and information is held in these systems it would assist a malicious actor to undertake a cyber-attack and /or undermine border controls.”

In respect of the Asylum Accommodation Support Transformation and Performance, Reporting and Analysis Unit DPIAs, you refused my request in purported reliance on section 31 FOIA:

“Section 31(1)(a)(e) – Law Enforcement.
Information relating to vulnerabilities on the Home Office IT estate, security and/or resilience controls in place and the management of incidents is sensitive and is likely to result in additional risks to the department. As such, the release of this information may undermine the department’s ability to deliver its operational policing and security remit. By identifying what type of data and information is held in these systems it would assist a malicious actor to undertake a cyber-attack and /or undermine border controls. By disclosing how the payment and support system operates for Asylum Seekers, it could make them targets for crime.”

The factors cited in favour of the law enforcement and national security exemptions are generic. For example, there is no explanation of how the information in the DPIAs could make the UK vulnerable to a national security threat or could be used in a cyber-attack or to undermine border controls. It is therefore not possible meaningfully to balance these factors against those in favour of disclosure.

Further, I do not accept that disclosure of all, or even most, of the information included in the requested DPIAs would present a national security risk or could be of assistance to a malicious actor seeking to undertake a cyber-attack and/or undermine border controls. To the extent that there is any such information, it could be redacted.

Finally, to the extent that border controls would be prejudiced by disclosure of the DPIAs, I consider that the public interest in disclosure significantly outweighs any such prejudice. It is imperative that the public is informed of the manner in which public authorities use data on protected characteristics in algorithmic, automated decision-making, and/or profiling systems used in immigration control.

The paramount importance of transparency – including in law enforcement contexts – is widely acknowledged. For example, the Justice and Home Affairs Committee in their recent report ‘Technology Rules? The advent of new technologies in the justice system’ (30 March 2022, HL Paper 180) (available at https://publications.parliament.uk/pa/ld...) state that “public disclosure of what technology is currently being used, where, and for what purpose, is key to enable to sound deployment of technological solutions” (paragraph 90) and that a lack of transparency “risks undermining trust in the police, the justice system, and the rule of law” (paragraph 98).

A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.whatdotheyknow.com/request/a...

Yours faithfully,

Tatiana Kazim

Dear Home Office,

I note that a response to my request for internal review was due by 09 September 2022. This deadline has passed. Please could you provide me with an update on the status of my request?

Yours sincerely,

Tatiana Kazim

Dear Home Office,

A response to my request for internal review was due by 09 September 2022. This deadline has long since passed. I have previously requested an update, but received no response. Please could you provide me with an update on the status of my request?

Yours sincerely,

Tatiana Kazim