Data collecting, storing, sharing or selling. And data breaches

Hana Bednarova made this Freedom of Information request to West Mercia Police

Automatic anti-spam measures are in place for this older request. Please let us know if a further response is expected or if you are having trouble responding.

The request was partially successful.

Dear West Mercia Police,

I am making a Freedom of Information request to find out the answers to the below
questions. Please provide your responses in electronic format. Thank you in advance for
your time spent answering them.

Can I have your records pertaining to sales of personal data from 2019 (01.01.2019) to 2020 (31.12.2020), including trading partners and money earned from transactions?

Do you use tracking cookies on your website, and can I have a list of third parties
that you share personal data with?

Have you received any complaints about how you handle personal data? This
includes collecting, storing, sharing or selling, as well as wider processing
practices. Please can I view records pertaining to these complaints for the years 2019 and 2020?

How many Subject access requests did you receive in the period 2019-2020,
broken down by year? What types of personal data did they typically receive? For
example email addresses, home address and telephone number?

How many data breaches have you experienced for the past 5 years (broken down by each year).

Yours faithfully,

Hana Bednarova

Information Compliance, West Mercia Police

Dear Ms Bednarova

 

FREEDOM OF INFORMATION REQUEST REFERENCE NO: 
64080                                                      

 

I write in connection with your request for information which was received
on 11^th March 2021.  Your request will now be considered in accordance
with the Freedom of Information Act 2000 (“the Act”).

 

We will aim to provide a response to your request within 20 working days
as stipulated by the Act.  Please note that there may be unavoidable
delays when making information rights requests during the COVID-19
pandemic.  We are triaging and addressing requests in the following
order:  Subject access and then FOI requests.   Every effort will be made
to meet our statutory timescales for responding.  Thank you for your
understanding.

 

There may be a fee payable for the retrieval, collation and provision of
the information you request.  If this is the case you will be informed and
the 20 working day timescale will be suspended until we receive payment
from you.  If you chose not to make payment then your request will be
withdrawn.

 

Some requests may also require either full or partial transference to
another public authority in order to answer your query in the fullest
possible way.  Again, you will be informed if this is the case.

 

Should you have any further enquiries concerning this matter, please
contact the Information Compliance Unit quoting the reference number
above.

 

 

Yours sincerely

 

 

Sue Cale

Information Compliance Assistant | Information Compliance Unit  | West
Mercia Police

Hindlip Hall Police Headquarters, Hindlip Hall, Worcester, WR3 8SP
Direct Dial: Working from Home Ext. Working from Home

Team email: [1][email address]

 

This email and any attachments may contain information that is
confidential, privileged, sensitive, or otherwise protected from
disclosure. Its unauthorised use, disclosure, storage or copying is not
permitted. If received in error, please destroy all copies and notify the
sender immediately by return email. Internet email is not a secure medium
of communication. Any views or opinions expressed in this email do not
necessarily represent those of West Mercia Police. All email activity may
be may be monitored, recorded and retained by West Mercia Police in
accordance with relevant legislation.

 

Please be aware that all information provided to West Mercia Police will
be held and treated in confidence in accordance with the Data Protection
Act 2018. It may be shared with other Force departments. Personal
information may also be used for statistical purposes, for fraud and crime
prevention and may be checked with/disclosed to regulatory bodies. The
information provided may be held electronically and/or in paper form and
will be kept secure at all times. Your personal data will be processed for
the performance of tasks carried out in the public interest or in the
exercise of the Police’s official authority and to comply with legal
obligations. 

References

Visible links
1. mailto:[email address]

Information Compliance, West Mercia Police

Dear Ms Bednarova

FREEDOM OF INFORMATION REQUEST REFERENCE NO: 64080

I write in connection with your request for information which was received
on 11^th March 2021. Please find below the response to your request:

 

Please provide your responses in electronic format. Thank you in advance
for your time spent answering them.

 

1) Can I have your records pertaining to sales of personal data from 2019
(01.01.2019) to 2020 (31.12.2020), including trading partners and money
earned from transactions?

 

2) Do you use tracking cookies on your website, and can I have a list of
third parties that you share personal data with?

 

3) Have you received any complaints about how you handle personal data?
This includes collecting, storing, sharing or selling, as well as wider
processing practices. Please can I view records pertaining to these
complaints for the years 2019 and 2020?

 

4) How many Subject access requests did you receive in the period
2019-2020, broken down by year? What types of personal data did they
typically receive? For example email addresses, home address and telephone
number?

 

5) How many data breaches have you experienced for the past 5 years
(broken down by each year).

 

 

Reply:-

Please be advised that the information that you have requested is not
available in a readily retrievable format. The information for question 4)
regarding How many Subject access requests did you receive in the period
2019-2020, broken down by year? What types of personal data did they
typically receive? For example email addresses, home address and telephone
number is not held centrally or in an electronically retrievable format.
We do not record this per calendar year and in order to ascertain what
personal data they received we would need to manually review all records
over this period. 

 

We received 362 SARs in financial year 2018/19 and 385 in
2019/20. Therefore 747 requests were received over those two financial
years which would have to be reviewed in order for us to identify the
relevant information for your request. Should it take approximately 5 – 10
minutes per record this would equate to in excess of 62 – 125 hours of
work. Therefore the cost of providing you with the information is above
the amount to which we are legally required to respond i.e. the cost of
locating and retrieving the information exceeds the ‘appropriate level’ as
stated in the Freedom of Information (Fees and Appropriate Limit)
Regulations 2004.

 

In accordance with the Freedom of Information Act 2000, this letter acts
as a Refusal Notice for this part of the request and if one part of a
request exceeds the fees limit then S12 of the Act applies to the whole
request. Due to the volume of records that would need to be reviewed I
have been unable to identify any further information that could be
supplied within the fees limit for question 4.

 

However, In accordance with Section 16 of the Act I have a duty to provide
advice and assistance in relation to your request and can provide the
information requested for questions 1 & 2 as this was retrieved during our
initial research. This should not be taken as a precedent that additional
information would be supplied outside of the time/fees legislation for any
subsequent requests.

 

You may also wish to refine and resubmit your request to receive part of
the information. For example we may be able to supply the information you
have requested for questions 3 & 5 subject to any exemptions being
engaged.

 

Please contact us again should you wish to submit a request for
alternative/reduced information.

 

1) No information held. West Mercia Police do not sell personal data.

2) Yes.  Information on cookies is ascertainable when visiting our website
via the pop-up.

 

Every effort has been made to ensure that the information provided is as
accurate as possible.

Please accept my apologies for the delay in responding.

Your attention is drawn to the below which details your right of
complaint.

Should you have any further enquiries concerning this matter, please write
or telephone the Information Compliance Unit quoting the reference number
above.

Yours sincerely

 

Mrs S Biddle

Information Compliance Unit
West Mercia Police

PO Box 55

Hindlip

Worcester

WR3 8SP

01905 331545 / 331565

 

 

West Mercia Police in complying with their statutory duty under sections 1
and 11 of the Freedom of Information Act 2000 to release the enclosed
information will not breach the Copyright, Designs and Patents Act 1988.
However, the rights of the copyright owner of the enclosed information
will continue to be protected by law. Applications for the copyright
owner’s written permission to reproduce any part of the attached
information should be addressed to The Force Solicitor, West Mercia Police
Headquarters, PO Box 55, Hindlip, Worcester, WR3 8SP.

COMPLAINT RIGHTS

Are you unhappy with how your request has been handled or do you think the
decision is incorrect?

You have the right to require West Mercia Police (WMP) to review their
decision.

Prior to lodging a formal complaint you are welcome and encouraged to
discuss the decision with the person that dealt with your request.

Ask to have the decision looked at again -

The quickest and easiest way to have the decision looked at again is to
contact the person named at the end of your decision letter.

That person will be able to discuss the decision, explain any issues and
assist with any problems.

Complaint

If you are dissatisfied with the handling procedures or the decision of
WMP made under the Freedom of Information Act 2000 (the Act) regarding
access to information, you can lodge a complaint with WMP to have the
decision reviewed. WMP must be notified of your intention to complain
within 20 working days of the date of its response to your Freedom of
Information request. Complaints should be made in writing and addressed
to:

West Mercia Police Headquarters

Information Compliance Unit

Hindlip Hall

Hindlip

PO Box 55

Worcester

WR3 8SP

or

Email:  [West Mercia Police request email]

In all possible circumstances, WMP will aim to respond to your complaint
within 20 working days.

The Information Commissioner

After lodging a complaint with WMP if you are still dissatisfied with the
decision you may make application to the Information Commissioner for a
decision on whether the request for information has been dealt with in
accordance with the requirements of the Act.

For information on how to make application to the Information Commissioner
please visit their website at https://ico.org.uk/ Alternatively phone or
write to:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Phone: 0303 123 1113 (local rate) or 01625 545745 if you prefer to use a
national rate number

Fax:    01625 524 510

 

 

 

This email and any attachments may contain information that is
confidential, privileged, sensitive, or otherwise protected from
disclosure. Its unauthorised use, disclosure, storage or copying is not
permitted. If received in error, please destroy all copies and notify the
sender immediately by return email. Internet email is not a secure medium
of communication. Any views or opinions expressed in this email do not
necessarily represent those of West Mercia Police. All email activity may
be may be monitored, recorded and retained by West Mercia Police in
accordance with relevant legislation.

 

Please be aware that all information provided to West Mercia Police will
be held and treated in confidence in accordance with the Data Protection
Act 2018. It may be shared with other Force departments. Personal
information may also be used for statistical purposes, for fraud and crime
prevention and may be checked with/disclosed to regulatory bodies. The
information provided may be held electronically and/or in paper form and
will be kept secure at all times. Your personal data will be processed for
the performance of tasks carried out in the public interest or in the
exercise of the Police’s official authority and to comply with legal
obligations.