Might the first point is a bit vague? As you know, they'll use any excuse to refuse disclosure. Maybe you'd have more luck asking for the names of the 40 organisations with access to the information management system.

Hi Peter
The names of the 40+ organisations is asked for in the request.
If they want clarification, all they have to do is ask. They've had plenty of time do ask by now, haven't they? Failing to inform a requestor of delay or request progress update is a breach, apart from being very rude.

One of the original requests was

" 1. "The information security management system used . . . to collect the Licence Fee" "

The refusal to answer suggests weak and inadequate security. Lawful replies, ignoring the BBC waffle and concealment of potentially poor procedures, might have included

(A) Our database system stores personal data in a highly encrypted format which, when extracted from the database, is decoded not on the server but on the individual workstation viewing that data subject to the user's individual security credentials contained on the inserted security smart card.

(B) Mindful of the main sources of hackers and attackers, the Internet gateway access to the network hosting the secure database has several firewalls which block IP addresses (both IPv6 and IPv4) from the major culprits including Russia and China. Additionally traffic from faraway places such as India, South America, Africa is automatically blocked on the basis those locations have no legitimate reason in attempting to access our network.

(C) To increase security we have, or we will, block all IP addresses generally allowing access only by exception from known static IP addresses which have a pre-approved reason to access our network.

(D) We block all Internet Protocols and all ports except for those pre-approved solely for the purpose of accessing our database.

(E) On workstations connected to our database network, we have no Internet browsers. Users are prohibited from using computers on our database network for all personal activities without exception. Anyone breeching our security policy will be immediately suspended prior to dismissal proceedings for gross misconduct.

(F) We review our database security every 2 weeks using staff comments and suggestions. We also run several open-source (safer than closed-source) monitoring systems.

(G) We liaise with GCHQ's computer security group.

(H) On our Linux systems we use SELINUX which was invented by the USA's National Security Agency.

(I) There are no USB connections on our workstations. This prevents any person removing data or inserting data, including viruses etc., into our systems and network.

(J) Contractors, Consultants and Agency Staff are not permitted access to our database system.

(K) We do not share or transfer our data outside the shores of mainland United Kingdom, thus no Northern Ireland, IoM or Channel Islands.

(L) Without exception, we do not share the data on our database with any other organisation.

In reality the security will be defective. Spread to 40 organisations, each with their own staff flows and lack of reliable confidence inspiring checks on their staff backgrounds, and with no efficient supervision of anything by anyone, no one can be confident their person data has not been unlawfully viewed or even "exported". Security is always weakened when access is shared by multiple commercial organisations. It is, in my opinion, a badly designed project - but just remember Capita's long history of computer incompetence and the vast amounts of public money poured down the drains.

This is definitively not how I would organise things.