Buckinghamshire Council IT Security monitoring
Dear Buckinghamshire Council,
Please supply any data which describes:
1. what details are harvested from incoming emails to Buckinghamshire Council, including but not limited to:
A) IP addresses,
B) geo location,
C) device serial numbers or codes,
D) software platforms or browsers
2. and whether these identifying features are
( or can be used within the capability of the system )
to flag up, monitor, compile a report about, harvest data about or cross reference to other data sets such as incoming phone calls, web browsing, postal addresses or phone numbers?
3. Does the Council use cookies ( or Google Analytics codes ) to track people browsing across the councils platforms
4. Are any such cookies able to be combined with other information such as IP addresses, geo location, device serial numbers or codes and software platforms or browsers to compile or maintain a file on a person that could also be linked with their name?
5. Does the Council record any phone conversations:
A) between staff and
B) between staff and third parties and
C) how long are they stored for and
D) how are they accessed or requested under FOI or the councils constitutional obligations.
6. Does Buckinghamshire Council allow for internal council emails to be deleted and under what circumstances ?
A) Are deleted e mails retrievable once deleted and
B) for how long afterwards
C) Has the council ever had to retrieve deleted emails within the last 5 years
7. Removed by enquirer
8. Please supply details of where Buckinghamshire Council data is stored such as
A) The Councils own dedicated servers physically located in house
B) The Councils own dedicated servers located off site ( if so where )
C) Third party servers
If yes to third party servers then:
D) Who are the operators of the servers
E) Where are they located ( incl country )
F) Where are all their servers located
9. What is Buckinghamshire Councils signing policy for communications of staff and councillors?
10. Please supply details of how many people Buckinghamshire Council have classified as “vexatious”By month or year for the last 5 years
A) And confirm if there is a list or any file kept of these people or any alert, descriptor or flag attached to the communications of people so classified that could alert any council staff from a different department as to the status of a person so classified.
11. Has Buckinghamshire Council ever used any power under RIPA in connection with any person classed as “vexatious”.
12. Please supply a copy of the internal procedure or decision tree that staff are to follow when dealing with people classified as “Vexatious”
13. How many times has Buckinghamshire Council used any powers under RIPA this year and for each of the past 3 years
If these questions are outside the parameters of time or cost please advise and they will be edited down
Thank you for your time and consideration of this request
Yours faithfully,
Terry Maras
Information request
Our reference: 3344159
══════════════════════════════════════════════════════════════════════════
Dear Terry Maras
Thank you for your request for information that was received on 22
February.
We will handle your request under the most appropriate legislation.
You can expect to receive a response by 22 March.
The Council will be in touch if we need any further information.
Yours sincerely
Information Management Team
[Buckinghamshire Council request email]
NOTE: Please do not edit the subject line when replying to this email.
DISCLAIMER FOR BUCKINGHAMSHIRE COUNCIL
Any views expressed in this email are those of the individual sender and
are not necessarily those of Buckinghamshire Council unless explicitly
stated.
This email and any attachments may contain confidential or privileged
information and is intended solely for the use of the individual or entity
to whom it is addressed. Any confidential, sensitive or protectively
marked material must be handled accordingly.
If you are not the intended recipient you must not disclose, distribute,
copy, print or rely on any of the information contained in the email or
attachments, and all copies must be deleted immediately. If you do receive
this email in error please notify the sender immediately and note that
confidentiality or privilege is not waived or lost.
Buckinghamshire Council may monitor the contents of emails sent and
received via its network for the purposes of ensuring compliance with
relevant legislation and the Council's policies and procedures. All such
monitoring will take place in accordance with relevant legislation
including privacy and data protection legislation. For details of how
Buckinghamshire Council uses personal information please see the Council's
website.
Buckinghamshire Council has scanned this email and attachments for viruses
but does not accept any responsibilities for viruses once this email has
been transmitted. You should therefore carry out your own anti-virus
checks before opening any documents.
Information request
Our reference: 3344159
══════════════════════════════════════════════════════════════════════════
Dear Terry Maras
Thank you for your request for information received on 22 February 2023.
Please find attached our response to your request. We are sorry for the
delay.
Kind Regards
Francisca Harpur
Senior Information Governance Officer
enc
NOTE: Please do not edit the subject line when replying to this email.
DISCLAIMER FOR BUCKINGHAMSHIRE COUNCIL
Any views expressed in this email are those of the individual sender and
are not necessarily those of Buckinghamshire Council unless explicitly
stated.
This email and any attachments may contain confidential or privileged
information and is intended solely for the use of the individual or entity
to whom it is addressed. Any confidential, sensitive or protectively
marked material must be handled accordingly.
If you are not the intended recipient you must not disclose, distribute,
copy, print or rely on any of the information contained in the email or
attachments, and all copies must be deleted immediately. If you do receive
this email in error please notify the sender immediately and note that
confidentiality or privilege is not waived or lost.
Buckinghamshire Council may monitor the contents of emails sent and
received via its network for the purposes of ensuring compliance with
relevant legislation and the Council's policies and procedures. All such
monitoring will take place in accordance with relevant legislation
including privacy and data protection legislation. For details of how
Buckinghamshire Council uses personal information please see the Council's
website.
Buckinghamshire Council has scanned this email and attachments for viruses
but does not accept any responsibilities for viruses once this email has
been transmitted. You should therefore carry out your own anti-virus
checks before opening any documents.
Dear Buckinghamshire Council,
Thank you very much for your response,
Please consider the following clarifications:
You said:
“Please note that with the exception of 10 and 12, your questions do not meet the criteria of a request for information under Freedom of Information legislation. This is because the majority of your request is not asking for recorded data. The Information Commissioner’s Office advises:
"The [Freedom of Information] Act does not cover information that is in someone’s head. If a member of the public asks for information, you only have to provide information you already have in recorded form. You do not have to create new information or find the answer to a question from staff who may happen to know it."
It is appreciated that the council is providing the data to be helpful, however the question clearly requested: “any data which describes: “ and therefore please consider the request for the data as intended.
In 1 it was asked :
“1. what details are harvested from incoming emails to Buckinghamshire Council, including but not limited to:
A) IP addresses,
B) geo location,
C) device serial numbers or codes,
D) software platforms or browsers”
You answered giving a link to the Cookies policy on the website, however this does not explain “what” information is collected as listed such as “A) IP addresses,
B) geo location,
C) device serial numbers or codes, D) software platforms or browsers”
The cookies site lists “interactive mapping” geo location data, however this is too general to understand to what level of accuracy? Street, town, region, country?
Maybe a clarification can be provided regarding this please.
Other services
“Fix my street”
Does the council have access to the cookies or other data from the operator of this site?
And if so what type of data do they show? And how long is this data available to the council for?
Fix my street is operated by MySociety, does it have any affiliation to OpenSociety?
Nor how the data is used is clear in question 2 which was asked:
“Whether a combination of any these identifying features …are or can be used to flag up, monitor, compile a report about, harvest data about or cross reference to other data sets such as incoming phone calls, web browsing, postal addresses or phone numbers?”
I.e. a council employee can by knowing a name, phone number, email address or physical address stored on the councils system, then search both the internal system and the exterior system such as MySociety datasets to pull up more data from the system to see more expansive data points.
In 5 you answered:
“5. Does the Council record any phone conversations:
A) between staff, and
B) between staff and third parties and
C) how long are they stored for and
D) how are they accessed or requested under FOI or the councils constitutional obligations.
A) Yes in some circumstances
B) Yes in some circumstances (for training and monitoring purposes)
C) This depends on the relevant data retention schedule
D) If a data subject requires a copy of a telephone conversation they had with the Council, they can submit a “Subject Access Request” under data protection legislation.”
Please state the circumstances alluded to above under which the council records internal conversations and conversations with entities outside the council and how ( voice recording and/or transcript ) and where these are stored and how long they are stored for?
How would a citizen obtain a copy of a phone call between council staff? And under what circumstances would this be allowed?
6. B
Please expand on the scenarios under which deleted emails can be retrieved and how this process is operated
You refused to answer:
“F) Where are all their servers located”
In order to ensure that the council is complying with the data protection act and GDPR restrictions, and it is necessary to ensure that data is kept secure and within a jurisdiction that is not outside the scope of U.K. and EU law, I.e. a server in China. Therefore it is acceptable to define where the councils data is kept by general location such as “ the councils internal servers on council premises, or a data centre in London, or Madrid or the council are unaware of where the data is stored”
In 10 you have answered
“We consider a ‘fewer than five’ response to be appropriate. A more accurate number would potentially release personal information where individuals could be identified, either from this information alone, or a combination of this information and other information otherwise available to the public.”
Please explain how providing a number less that 5 can allow a data subject to be potentially identified as this is not clear.
Thank you for your continued cooperation
Yours sincerely,
Terry Maras
Dear Terry Maras
Thank you for your follow-up queries.
We will consider your queries and and will send you a response by 4 May
2023
Kind regards
Francisca Harpur
Senior Information Governance Officer
══════════════════════════════════════════════════════════════════════════
From: [FOI #953847 email]
Sent: 03/04/2023 11:15
To: [email address]
Subject: Re: Information request (ref: 3344159)
(Attachments:) Email (original message) from
[FOI #953847 email] received on 03/04/2023.eml,
Email from [FOI #953847 email] - Re: Information
request .txt
DISCLAIMER FOR BUCKINGHAMSHIRE COUNCIL
Any views expressed in this email are those of the individual sender and
are not necessarily those of Buckinghamshire Council unless explicitly
stated.
This email and any attachments may contain confidential or privileged
information and is intended solely for the use of the individual or entity
to whom it is addressed. Any confidential, sensitive or protectively
marked material must be handled accordingly.
If you are not the intended recipient you must not disclose, distribute,
copy, print or rely on any of the information contained in the email or
attachments, and all copies must be deleted immediately. If you do receive
this email in error please notify the sender immediately and note that
confidentiality or privilege is not waived or lost.
Buckinghamshire Council may monitor the contents of emails sent and
received via its network for the purposes of ensuring compliance with
relevant legislation and the Council's policies and procedures. All such
monitoring will take place in accordance with relevant legislation
including privacy and data protection legislation. For details of how
Buckinghamshire Council uses personal information please see the Council's
website.
Buckinghamshire Council has scanned this email and attachments for viruses
but does not accept any responsibilities for viruses once this email has
been transmitted. You should therefore carry out your own anti-virus
checks before opening any documents.
Dear Buckinghamshire Council
Please note that a response to this request is now seriously overdue.
Yours faithfully,
Terry Maras
Dear Terry Maras
Thank you for your email. Please accept our apologies for this
oversight. We are looking into the matter and will send you a response as
soon as possible.
Kind regards
Francisca Harpur
Senior Information Governance Officer
Deputy Chief Executive Directorate
Buckinghamshire Council
[Buckinghamshire Council request email]
Walton Street, Aylesbury, Bucks, HP20 1UA
══════════════════════════════════════════════════════════════════════════
From: [FOI #953847 email]
Sent: 09/06/2023 21:40
To: [Buckinghamshire Council request email]
Subject: Re: Freedom of Information request - Buckinghamshire Council IT
Security monitoring
(Attachments:) Email (original message) from
[FOI #953847 email] received on 09/06/2023.eml,
Email from [FOI #953847 email] - Re: Freedom of
Information request - Buckinghamshire Council IT Security monitoring.txt
DISCLAIMER FOR BUCKINGHAMSHIRE COUNCIL
Any views expressed in this email are those of the individual sender and
are not necessarily those of Buckinghamshire Council unless explicitly
stated.
This email and any attachments may contain confidential or privileged
information and is intended solely for the use of the individual or entity
to whom it is addressed. Any confidential, sensitive or protectively
marked material must be handled accordingly.
If you are not the intended recipient you must not disclose, distribute,
copy, print or rely on any of the information contained in the email or
attachments, and all copies must be deleted immediately. If you do receive
this email in error please notify the sender immediately and note that
confidentiality or privilege is not waived or lost.
Buckinghamshire Council may monitor the contents of emails sent and
received via its network for the purposes of ensuring compliance with
relevant legislation and the Council's policies and procedures. All such
monitoring will take place in accordance with relevant legislation
including privacy and data protection legislation. For details of how
Buckinghamshire Council uses personal information please see the Council's
website.
Buckinghamshire Council has scanned this email and attachments for viruses
but does not accept any responsibilities for viruses once this email has
been transmitted. You should therefore carry out your own anti-virus
checks before opening any documents.
Information request
Our reference: 3344159
══════════════════════════════════════════════════════════════════════════
Dear Terry Maras
Thank you for your follow-up questions.
Please find attached our response to your request. We are sorry for the
delay.
Kind Regards
Francisca Harpur
Senior Information Governance Officer
enc
NOTE: Please do not edit the subject line when replying to this email.
DISCLAIMER FOR BUCKINGHAMSHIRE COUNCIL
Any views expressed in this email are those of the individual sender and
are not necessarily those of Buckinghamshire Council unless explicitly
stated.
This email and any attachments may contain confidential or privileged
information and is intended solely for the use of the individual or entity
to whom it is addressed. Any confidential, sensitive or protectively
marked material must be handled accordingly.
If you are not the intended recipient you must not disclose, distribute,
copy, print or rely on any of the information contained in the email or
attachments, and all copies must be deleted immediately. If you do receive
this email in error please notify the sender immediately and note that
confidentiality or privilege is not waived or lost.
Buckinghamshire Council may monitor the contents of emails sent and
received via its network for the purposes of ensuring compliance with
relevant legislation and the Council's policies and procedures. All such
monitoring will take place in accordance with relevant legislation
including privacy and data protection legislation. For details of how
Buckinghamshire Council uses personal information please see the Council's
website.
Buckinghamshire Council has scanned this email and attachments for viruses
but does not accept any responsibilities for viruses once this email has
been transmitted. You should therefore carry out your own anti-virus
checks before opening any documents.
Dear Buckinghamshire Council,
You were asked:
“1. what details are harvested from incoming emails to Buckinghamshire Council, including but not limited to:
A) IP addresses,
B) geo location,
C) device serial numbers or codes,
D) software platforms or browsers”
You answered giving a link to the Cookies policy on the website, however this does not explain “what” information is collected as listed such as
C) device serial numbers IMEI numbers or codes, D) software platforms or browsers”
You pointed to the councils privacy and cookie policy but this does not explain whether you or your 3rd party partners harvest Device serial numbers or codes such as IMEI numbers. Could you please revisit this answer to expand on the scope, such that it satisfies all of the question.
Companies have recently been prosecuted for sending data to China, and the taxpayers of Buckinghamshire have a reasonable expectation to know where the data is being held, and in particular the jurisdiction that applies to it, whether it is the UK, the EU or elsewhere. Simply refusing to reply to enquiries to this reasonable question could leave the public under the impression that the data is not being held lawfully, therefore, it would be helpful to provide some information that allays the concern in this respect. Saying the country or region, in which the councils data is held, would not necessarily compromise the security of that data.
Yours sincerely,
Terry Maras
Dear Mr Maras
Thank you for your follow-up query.
We will handle it under the most appropriate legislation. We will send
you a response by 18 July 2023.
Kind regards
Francisca Harpur
Senior Information Governance Officer
Deputy Chief Executive Directorate
Buckinghamshire Council
[Buckinghamshire Council request email]
Walton Street, Aylesbury, Bucks, HP20 1UA
══════════════════════════════════════════════════════════════════════════
From: [FOI #953847 email]
Sent: 19/06/2023 11:51
To: [email address]
Subject: Re: Information request (ref: 3344159)
(Attachments:) Email (original message) from
[FOI #953847 email] received on 19/06/2023.eml,
Email from [FOI #953847 email] - Re: Information
request .txt
DISCLAIMER FOR BUCKINGHAMSHIRE COUNCIL
Any views expressed in this email are those of the individual sender and
are not necessarily those of Buckinghamshire Council unless explicitly
stated.
This email and any attachments may contain confidential or privileged
information and is intended solely for the use of the individual or entity
to whom it is addressed. Any confidential, sensitive or protectively
marked material must be handled accordingly.
If you are not the intended recipient you must not disclose, distribute,
copy, print or rely on any of the information contained in the email or
attachments, and all copies must be deleted immediately. If you do receive
this email in error please notify the sender immediately and note that
confidentiality or privilege is not waived or lost.
Buckinghamshire Council may monitor the contents of emails sent and
received via its network for the purposes of ensuring compliance with
relevant legislation and the Council's policies and procedures. All such
monitoring will take place in accordance with relevant legislation
including privacy and data protection legislation. For details of how
Buckinghamshire Council uses personal information please see the Council's
website.
Buckinghamshire Council has scanned this email and attachments for viruses
but does not accept any responsibilities for viruses once this email has
been transmitted. You should therefore carry out your own anti-virus
checks before opening any documents.
Dear Mr Maras
Further to your query, please see the clarification below from our IT
team:
We do not harvest details from inbound emails and the data is not shared
with a third party. Buckinghamshire Council is compliant with UK data
protection laws.
Kind regards
Francisca Harpur
Senior Information Governance Officer
Deputy Chief Executive Directorate
Buckinghamshire Council
[Buckinghamshire Council request email]
Walton Street, Aylesbury, Bucks, HP20 1UA
══════════════════════════════════════════════════════════════════════════
From: [FOI #953847 email]
Sent: 19/06/2023 11:51
To: [email address]
Subject: Re: Information request (ref: 3344159)
(Attachments:) Email (original message) from
[FOI #953847 email] received on 19/06/2023.eml,
Email from [FOI #953847 email] - Re: Information
request .txt
DISCLAIMER FOR BUCKINGHAMSHIRE COUNCIL
Any views expressed in this email are those of the individual sender and
are not necessarily those of Buckinghamshire Council unless explicitly
stated.
This email and any attachments may contain confidential or privileged
information and is intended solely for the use of the individual or entity
to whom it is addressed. Any confidential, sensitive or protectively
marked material must be handled accordingly.
If you are not the intended recipient you must not disclose, distribute,
copy, print or rely on any of the information contained in the email or
attachments, and all copies must be deleted immediately. If you do receive
this email in error please notify the sender immediately and note that
confidentiality or privilege is not waived or lost.
Buckinghamshire Council may monitor the contents of emails sent and
received via its network for the purposes of ensuring compliance with
relevant legislation and the Council's policies and procedures. All such
monitoring will take place in accordance with relevant legislation
including privacy and data protection legislation. For details of how
Buckinghamshire Council uses personal information please see the Council's
website.
Buckinghamshire Council has scanned this email and attachments for viruses
but does not accept any responsibilities for viruses once this email has
been transmitted. You should therefore carry out your own anti-virus
checks before opening any documents.
Dear Buckinghamshire Council,
Sorry, but it is not clear whether this is simply an interim answer or the answer in total?
If this is intended to be the complete answer, then unfortunately the answer given does not provide for the eventuality whereby Buckinghamshire councils IT department themselves are not harvesting data but they simply outsource this to somebody else that does it for them, which means that they still have the data themselves but that somebody else has just done the “ harvesting” of it, instead of it being directly harvested.
The questions regarding whether the data goes outside of the UK, or the EU still remains to be answered.
Yours sincerely,
Terry Maras
Dear Terry
Many thanks for your query. I have gone back to the IT team.
We will aim to send you a response by 25 July 2023.
Kind regards
Francisca Harpur
Senior Information Governance Officer
Deputy Chief Executive Directorate
Buckinghamshire Council
01296 585771
[Buckinghamshire Council request email]
Walton Street, Aylesbury, Bucks, HP20 1UA
══════════════════════════════════════════════════════════════════════════
From: [FOI #953847 email]
Sent: 11/07/2023 00:10
To: [email address]
Subject: Re: Information request (ref: 3344159) - response to follow-up
query (ref: 3344159)
(Attachments:) Email (original message) from
[FOI #953847 email] received on 11/07/2023.eml,
Email from [FOI #953847 email] - Re: Information
request .txt
DISCLAIMER FOR BUCKINGHAMSHIRE COUNCIL
Any views expressed in this email are those of the individual sender and
are not necessarily those of Buckinghamshire Council unless explicitly
stated.
This email and any attachments may contain confidential or privileged
information and is intended solely for the use of the individual or entity
to whom it is addressed. Any confidential, sensitive or protectively
marked material must be handled accordingly.
If you are not the intended recipient you must not disclose, distribute,
copy, print or rely on any of the information contained in the email or
attachments, and all copies must be deleted immediately. If you do receive
this email in error please notify the sender immediately and note that
confidentiality or privilege is not waived or lost.
Buckinghamshire Council may monitor the contents of emails sent and
received via its network for the purposes of ensuring compliance with
relevant legislation and the Council's policies and procedures. All such
monitoring will take place in accordance with relevant legislation
including privacy and data protection legislation. For details of how
Buckinghamshire Council uses personal information please see the Council's
website.
Buckinghamshire Council has scanned this email and attachments for viruses
but does not accept any responsibilities for viruses once this email has
been transmitted. You should therefore carry out your own anti-virus
checks before opening any documents.
Dear Mr Maras
Thank you for your follow up query. Please see your query and our
response in bold below.
Query/Response
Sorry, but it is not clear whether this is simply an interim answer or the
answer in total?
If this is intended to be the complete answer, then unfortunately the
answer given does not provide for the eventuality whereby Buckinghamshire
councils IT department themselves are not harvesting data but they simply
outsource this to somebody else that does it for them, which means that
they still have the data themselves but that somebody else has just done
the ' harvesting' of it, instead of it being directly harvested.
Under the Freedom of Information Act, we are not required to provide
information on the 'eventuality' of a situation. This is a request
concerning a hypothetical situation - it is not a request for recorded
data.
The questions regarding whether the data goes outside of the UK, or the EU
still remains to be answered.
We can confirm that the data is not stored outside the UK or the EU.
We now consider this request closed. Any further requests, unless
substantially different, will be considered exempt from disclosure under
section 14 of the Freedom of Information Act (repeated requests).
Please refer to our original letter where you will find details of what to
do if you remain dissatisfied with our responses.
Kind regards
Francisca Harpur
Senior Information Governance Officer
Deputy Chief Executive Directorate
Buckinghamshire Council
01296 585771
[Buckinghamshire Council request email]
Walton Street, Aylesbury, Bucks, HP20 1UA
══════════════════════════════════════════════════════════════════════════
From: Buckinghamshire Council<[email address]>
Sent: 18/07/2023 11:10
To: [FOI #953847 email]
Subject: Re: Information request (ref: 3344159) - acknowledgement
Dear Terry
Many thanks for your query. I have gone back to the IT team.
We will aim to send you a response by 25 July 2023.
Kind regards
Francisca Harpur
Senior Information Governance Officer
Deputy Chief Executive Directorate
Buckinghamshire Council
01296 585771
[Buckinghamshire Council request email]
Walton Street, Aylesbury, Bucks, HP20 1UA
══════════════════════════════════════════════════════════════════════════
From: [FOI #953847 email]
Sent: 11/07/2023 00:10
To: [email address]
Subject: Re: Information request (ref: 3344159) - response to follow-up
query (ref: 3344159)
(Attachments:) Email (original message) from
[FOI #953847 email] received on 11/07/2023.eml,
Email from [FOI #953847 email] - Re: Information
request .txt
DISCLAIMER FOR BUCKINGHAMSHIRE COUNCIL
Any views expressed in this email are those of the individual sender and
are not necessarily those of Buckinghamshire Council unless explicitly
stated.
This email and any attachments may contain confidential or privileged
information and is intended solely for the use of the individual or entity
to whom it is addressed. Any confidential, sensitive or protectively
marked material must be handled accordingly.
If you are not the intended recipient you must not disclose, distribute,
copy, print or rely on any of the information contained in the email or
attachments, and all copies must be deleted immediately. If you do receive
this email in error please notify the sender immediately and note that
confidentiality or privilege is not waived or lost.
Buckinghamshire Council may monitor the contents of emails sent and
received via its network for the purposes of ensuring compliance with
relevant legislation and the Council's policies and procedures. All such
monitoring will take place in accordance with relevant legislation
including privacy and data protection legislation. For details of how
Buckinghamshire Council uses personal information please see the Council's
website.
Buckinghamshire Council has scanned this email and attachments for viruses
but does not accept any responsibilities for viruses once this email has
been transmitted. You should therefore carry out your own anti-virus
checks before opening any documents.
Dear Buckinghamshire Council,
In the Council privacy policy it mentions “cloud servers” ( which could be anywhere )
You have also confirmed that all the data is stored in the U.K. and not abroad
Therefore can you also please just confirm that the “cloud servers” mentioned are also in the U.K. and have always been in the U.K. as well and not overseas.
Thanks
Yours sincerely,
Terry Maras
Dear Mr Maras
Thank you for your latest query. Please see our previous responses. We
consider that we have answered your questions.
As previously advised, any further requests, unless substantially
different, will be considered exempt from disclosure under section 14 of
the Freedom of Information Act (repeated requests).
Please refer to our original letter where you will find details of what to
do if you remain dissatisfied with our responses.
Kind regards
Francisca Harpur
Senior Information Governance Officer
Deputy Chief Executive Directorate
Buckinghamshire Council
[Buckinghamshire Council request email]
Walton Street, Aylesbury, Bucks, HP20 1UA
══════════════════════════════════════════════════════════════════════════
From: [FOI #953847 email]
Sent: 27/07/2023 01:24
To: [email address]
Subject: Re: Information request (ref: 3344159)
(Attachments:) Email (original message) from
[FOI #953847 email] received on 27/07/2023.eml,
Email from [FOI #953847 email] - Re: Information
request .txt
DISCLAIMER FOR BUCKINGHAMSHIRE COUNCIL
Any views expressed in this email are those of the individual sender and
are not necessarily those of Buckinghamshire Council unless explicitly
stated.
This email and any attachments may contain confidential or privileged
information and is intended solely for the use of the individual or entity
to whom it is addressed. Any confidential, sensitive or protectively
marked material must be handled accordingly.
If you are not the intended recipient you must not disclose, distribute,
copy, print or rely on any of the information contained in the email or
attachments, and all copies must be deleted immediately. If you do receive
this email in error please notify the sender immediately and note that
confidentiality or privilege is not waived or lost.
Buckinghamshire Council may monitor the contents of emails sent and
received via its network for the purposes of ensuring compliance with
relevant legislation and the Council's policies and procedures. All such
monitoring will take place in accordance with relevant legislation
including privacy and data protection legislation. For details of how
Buckinghamshire Council uses personal information please see the Council's
website.
Buckinghamshire Council has scanned this email and attachments for viruses
but does not accept any responsibilities for viruses once this email has
been transmitted. You should therefore carry out your own anti-virus
checks before opening any documents.
Dear Buckinghamshire Council,
You were asked where the data is stored, and you answered that it was stored on “cloud servers”. Unfortunately saying that the data is stored on cloud servers doesn’t actually answer the question of “where” the actual data is stored because a cloud server by its very nature could be anywhere.
You presumably appreciate that data must be stored securely and within a relevant jurisdiction and that the council would need to demonstrate this in any case outside of the scope of an FoI request so it is hoped that you could please revisit this question and simply provide the answer without an internal review becoming necessary.
Yours sincerely,
Terry Maras
Dear Mr Maras
As previously advised, we are considering your repeated requests to be
exempt from disclosure under section 14 of the Freedom of Information Act.
With regards to your comment: You presumably appreciate that data must be
stored securely and within a relevant jurisdiction, please note that we
have already confirmed that our data is stored securely and is not held
outside the UK or the EU.
You are therefore asking us questions that we have already answered.
Kind regards
Francisca Harpur
Senior Information Governance Officer
Deputy Chief Executive Directorate
Buckinghamshire Council
[1][email address]
Walton Street Offices , Walton Street , Aylesbury Bucks, HP20 1UA
══════════════════════════════════════════════════════════════════════════
From: [FOI #953847 email]
Sent: 17/08/2023 19:50
To: [email address]
Subject: Re: Information request (ref: 3344159)
(Attachments:) Email (original message) from
[FOI #953847 email] received on 17/08/2023.eml,
Email from [FOI #953847 email] - Re: Information
request .txt
DISCLAIMER FOR BUCKINGHAMSHIRE COUNCIL
Any views expressed in this email are those of the individual sender and
are not necessarily those of Buckinghamshire Council unless explicitly
stated.
This email and any attachments may contain confidential or privileged
information and is intended solely for the use of the individual or entity
to whom it is addressed. Any confidential, sensitive or protectively
marked material must be handled accordingly.
If you are not the intended recipient you must not disclose, distribute,
copy, print or rely on any of the information contained in the email or
attachments, and all copies must be deleted immediately. If you do receive
this email in error please notify the sender immediately and note that
confidentiality or privilege is not waived or lost.
Buckinghamshire Council may monitor the contents of emails sent and
received via its network for the purposes of ensuring compliance with
relevant legislation and the Council's policies and procedures. All such
monitoring will take place in accordance with relevant legislation
including privacy and data protection legislation. For details of how
Buckinghamshire Council uses personal information please see the Council's
website.
Buckinghamshire Council has scanned this email and attachments for viruses
but does not accept any responsibilities for viruses once this email has
been transmitted. You should therefore carry out your own anti-virus
checks before opening any documents.
References
Visible links
1. mailto:[email address]
Dear Buckinghamshire Council,
If this was the case your reply should have been an explicit response to the question and not implied response. The requester has a reasonable right to an answer to a question rather than having to infer it or piece it together from other information. The question was distinctly different from the other questions and meant that the council would have had to check where the servers were located and there is no confirmation that you did this. An acceptable and explicit answer to that question would have been
“We use cloud servers and can confirm that are only located in the U.K. or EU”
Please respond accordingly so we don’t have to escalate this to an internal review and waste everyone’s time.
Yours sincerely,
Terry Maras
Dear Mr Maras
Thank you for your email. I have asked IT to confirm.
We will send you a response as soon as possible.
Kind regards
Francisca Harpur
Senior Information Governance Officer
Deputy Chief Executive Directorate
Buckinghamshire Council
[1][email address]
Walton Street Offices , Walton Street , Aylesbury Bucks, HP20 1UA
══════════════════════════════════════════════════════════════════════════
From: [FOI #953847 email]
Sent: 31/08/2023 11:32
To: [email address]
Subject: Re: Information request (ref: 3344159)
(Attachments:) Email (original message) from
[FOI #953847 email] received on 31/08/2023.eml,
Email from [FOI #953847 email] - Re: Information
request .txt
DISCLAIMER FOR BUCKINGHAMSHIRE COUNCIL
Any views expressed in this email are those of the individual sender and
are not necessarily those of Buckinghamshire Council unless explicitly
stated.
This email and any attachments may contain confidential or privileged
information and is intended solely for the use of the individual or entity
to whom it is addressed. Any confidential, sensitive or protectively
marked material must be handled accordingly.
If you are not the intended recipient you must not disclose, distribute,
copy, print or rely on any of the information contained in the email or
attachments, and all copies must be deleted immediately. If you do receive
this email in error please notify the sender immediately and note that
confidentiality or privilege is not waived or lost.
Buckinghamshire Council may monitor the contents of emails sent and
received via its network for the purposes of ensuring compliance with
relevant legislation and the Council's policies and procedures. All such
monitoring will take place in accordance with relevant legislation
including privacy and data protection legislation. For details of how
Buckinghamshire Council uses personal information please see the Council's
website.
Buckinghamshire Council has scanned this email and attachments for viruses
but does not accept any responsibilities for viruses once this email has
been transmitted. You should therefore carry out your own anti-virus
checks before opening any documents.
References
Visible links
1. mailto:[email address]
Dear Terry Maras
Please see the response below to your latest comments:
We use cloud servers and can confirm that they are only located in the U.K
or EU.
We hope that this now clarifies the matter.
Kind regards
Francisca Harpur
Senior Information Governance Officer
Deputy Chief Executive Directorate
Buckinghamshire Council
01296 585771
[1][email address]
Walton Street Offices , Walton Street , Aylesbury Bucks, HP20 1UA
══════════════════════════════════════════════════════════════════════════
From: [FOI #953847 email]
Sent: 31/08/2023 11:32
To: [email address]
Subject: Re: Information request (ref: 3344159)
(Attachments:) Email (original message) from
[FOI #953847 email] received on 31/08/2023.eml,
Email from [FOI #953847 email] - Re: Information
request .txt
DISCLAIMER FOR BUCKINGHAMSHIRE COUNCIL
Any views expressed in this email are those of the individual sender and
are not necessarily those of Buckinghamshire Council unless explicitly
stated.
This email and any attachments may contain confidential or privileged
information and is intended solely for the use of the individual or entity
to whom it is addressed. Any confidential, sensitive or protectively
marked material must be handled accordingly.
If you are not the intended recipient you must not disclose, distribute,
copy, print or rely on any of the information contained in the email or
attachments, and all copies must be deleted immediately. If you do receive
this email in error please notify the sender immediately and note that
confidentiality or privilege is not waived or lost.
Buckinghamshire Council may monitor the contents of emails sent and
received via its network for the purposes of ensuring compliance with
relevant legislation and the Council's policies and procedures. All such
monitoring will take place in accordance with relevant legislation
including privacy and data protection legislation. For details of how
Buckinghamshire Council uses personal information please see the Council's
website.
Buckinghamshire Council has scanned this email and attachments for viruses
but does not accept any responsibilities for viruses once this email has
been transmitted. You should therefore carry out your own anti-virus
checks before opening any documents.
References
Visible links
1. mailto:[email address]
Dear Buckinghamshire Council,
In addition to the servers that are used by MySociety to monitor the “fix my street” platform it has been revealed that NEC computers that run the council tax software also have access to the council database and host their data on cloud servers as well.
It would therefore be appreciated if you could please enquire from NEC where they host their data and whether it is on servers that are within the UK or the EU and whether they comply with the relevant data protection requirements.
Yours sincerely,
Terry Maras
Information request
Our reference: 3344159
══════════════════════════════════════════════════════════════════════════
Dear Mr Maras
Information request
NEC Computers - Council Tax
Thank you for your query regarding the above. The Council do not hold the
information you have requested.
Please don't edit the subject line if replying to this email.
Kind Regards
Francisca Harpur
Senior Information Governance Officer
DISCLAIMER FOR BUCKINGHAMSHIRE COUNCIL
Any views expressed in this email are those of the individual sender and
are not necessarily those of Buckinghamshire Council unless explicitly
stated.
This email and any attachments may contain confidential or privileged
information and is intended solely for the use of the individual or entity
to whom it is addressed. Any confidential, sensitive or protectively
marked material must be handled accordingly.
If you are not the intended recipient you must not disclose, distribute,
copy, print or rely on any of the information contained in the email or
attachments, and all copies must be deleted immediately. If you do receive
this email in error please notify the sender immediately and note that
confidentiality or privilege is not waived or lost.
Buckinghamshire Council may monitor the contents of emails sent and
received via its network for the purposes of ensuring compliance with
relevant legislation and the Council's policies and procedures. All such
monitoring will take place in accordance with relevant legislation
including privacy and data protection legislation. For details of how
Buckinghamshire Council uses personal information please see the Council's
website.
Buckinghamshire Council has scanned this email and attachments for viruses
but does not accept any responsibilities for viruses once this email has
been transmitted. You should therefore carry out your own anti-virus
checks before opening any documents.
Dear Buckinghamshire Council,
Please clarify, are you saying that you do not hold the information because the council do not operate an
NEC computer system?
If this is the case please disclose what alternative computer system is used by Buckinghamshire Council and substitute the name NEC for the relevant contractor.
Yours sincerely,
Terry Maras
Information request
Our reference: 5904390
══════════════════════════════════════════════════════════════════════════
Hi Terry
Thank you for your request for follow-up query received on 31 January
2024.
Please find attached our response to your request.
Kind Regards
Francisca Harpur
Senior Information Governance Officer
enc
NOTE: Please do not edit the subject line when replying to this email.
DISCLAIMER FOR BUCKINGHAMSHIRE COUNCIL
Any views expressed in this email are those of the individual sender and
are not necessarily those of Buckinghamshire Council unless explicitly
stated.
This email and any attachments may contain confidential or privileged
information and is intended solely for the use of the individual or entity
to whom it is addressed. Any confidential, sensitive or protectively
marked material must be handled accordingly.
If you are not the intended recipient you must not disclose, distribute,
copy, print or rely on any of the information contained in the email or
attachments, and all copies must be deleted immediately. If you do receive
this email in error please notify the sender immediately and note that
confidentiality or privilege is not waived or lost.
Buckinghamshire Council may monitor the contents of emails sent and
received via its network for the purposes of ensuring compliance with
relevant legislation and the Council's policies and procedures. All such
monitoring will take place in accordance with relevant legislation
including privacy and data protection legislation. For details of how
Buckinghamshire Council uses personal information please see the Council's
website.
Buckinghamshire Council has scanned this email and attachments for viruses
but does not accept any responsibilities for viruses once this email has
been transmitted. You should therefore carry out your own anti-virus
checks before opening any documents.
We work to defend the right to FOI for everyone
Help us protect your right to hold public authorities to account. Donate and support our work.
Donate Now