Dear City of London Police,

"Action Fraud" is part of the Data Controller "City of London Police" and has been since the first of April 2014 as stated by this page on the Action Fraud website

https://www.actionfraud.police.uk/news/a...

The firm "Concentrix" appears to be the recipient of £35,000,000 (excluding VAT) of public funding to provide a service under the brand "Action Fraud" for all UK Law Enforcement Agencies (LEAs) as specified by the contract here https://ted.europa.eu/udl?uri=TED:NOTICE...

As such it would be reasonable to assume that the services provided by "Action Fraud" would therefore have to be compatible with and indeed fully integrate with the various systems operated by the various LEAs throughout the UK and most especially with the systems of it's own organisation the City of London Police.

I was therefore somewhat surprised to be contacted by the Information Commissioners office who informed me of the following:-

"CoLP and Action Fraud

As you may be aware, CoLP is the controller for any personal data held by Action Fraud. Therefore, as you have requested all personal data from CoLP this will include personal data held by Action Fraud. However, whilst Action Fraud falls under the control of CoLP for data protection purposes, CoLP has explained to the ICO that these offices utilise different systems. As different systems are used by the force, CoLP is of the view that it requires to be satisfied of your identity for any personal data held on both of these systems. Otherwise, the force may risk inappropriately disclosing personal data to an individual who is not entitled to receive the personal data.

Personal data held by Action Fraud

CoLP has now confirmed to our office that is has been able to successfully satisfy itself of your identity held in relation to the system used by Action Fraud. This is because it is satisfied that it holds personal data which it has been able to use to identity you as an individual. We understand that this information has previously been provided by yourself to Action Fraud.

As a result, CoLP has now confirmed that it is in a positon to progress your SAR in relation to the personal data held by Action Fraud.

Personal data held by CoLP

However, CoLP has not yet been able to satisfy itself of your identity in relation to the personal data it holds in relation to the system used predominately by CoLP. It has confirmed that it has attempted to utilise the information it already holds in relation to yourself (as it did with information held on the system used by Action Fraud), however, it has not been able to conclude your identity.

Going forward, CoLP will consider the personal data it holds in relation to yourself on its systems to ascertain what information it now required to successfully confirm your identity. Once it has concluded what information it requires the police will inform you and will also inform the ICO."

As can clearly be seen within that convoluted response the ICO is stating that despite Action Fraud and the City of London Police being the same organisation, and the same Data Controller, the CoLP is stating that having fully identified myself to Action Fraud under the requirements of the DPA, the CoLP is still maintaining that they do not reasonably believe me to be the person identified in their own records, a situation which they have singularly failed to address since the 10 May despite the ICO requiring them to clarify the identification issues multiple times.

I would point out that the records held by Action Fraud are in relation to formal allegations of crime, subsequently passed to the National Fraud Intelligence bureau via police systems.

The NFIB subsequently passed the information on to Northumbria Police via the PNC system identifying an allegation of crime and in theory the identities of both the victim and suspect .

The victim, i.e. me, then raised a number of formal complaints regarding the processing of the criminal allegations to the CoLP, which were assigned to the deputy director of Professional Standards, Mr Ian Younger who wrote to me informing me that he had been assigned to deal with my issues regarding Action Fraud, and who proceeded to investigate them and send the results of the alleged investigations to me both by email and post.

However when served with a Subject Access Request on the 10 May 2019 Mr Younger initially denied ever having received it, and after that excuse was disproved, has since relied on the assertion that CoLP do not reasonably believe me to be the person entitled to receive the information held for refusing to comply.

CoLP whilst apparently claiming that I am not the person to whom the data held relates, have repeatedly disclosed portions of that information to me by email and post, have apparently stored and subsequently transmitted that allegedly false information on police computer systems to other LEAs so that a crime can be investigated on behalf of a person who the CoLP now claims they do not reasonably believe to exist.

Northumbria Police have spoken to me by telephone about these crimes and communicated with me as the victim via my email address, all whilst CoLP maintains that they do not reasonably believe me to be the person to whom that information relates.

I believe the actions of Action Fraud and the CoLP are criminal under section 173 of the DPA.

I believe they also constitute falsifying evidence in relation to the commission of a criminal offence which is subject to enquiry by the ICO.

By the very nature of the response from the ICO there appears to be a deliberate entry of allegedly false information onto Police systems, the transmission of false information via police systems and the wasting of police time by processing criminal allegations regarding a victim which CoLP is now maintaining they do not reasonably believe exists.

Please detail what criminal or police complaint categories would apply to the offences I believe have been undertaken by staff within the CoLP and Action Fraud.

Please specify how any allegations, crime or conduct, need to be reported, the relevant legislation applying to them and any policies, procedures and timescales which apply.

Please specify why it is that the data controller responsible for both the CoLP and Action Fraud is claiming that the DPA identification procedures for two parts of a single data controller are apparently completely incompatible.

Please provide all documentation, policies and or procedures detailing the DPA identification procedures for both parts of the data controller i.e. CoLP and Action Fraud or provide web links to where they can be found if already published.

Please provide any detail or information or links to same regarding any portion of the contractual documentation in relation to the £35,000,000 (excluding vat) contract for Concentrix services, which in any way applies to the compatibility and integration of their services with their data controller / CoLP and or any other LEA with whom they provide a service or communicate with as a requirement of or in respect to that contract.

Finally, if the situation is as stated, that £35,000,000 (excluding VAT) has been spent from the public purse to fund an organisation who’s systems cannot integrate with the systems of their own employer, irrespective of any other LEA then please provide details of how a formal allegation regarding abuse of the public purse can be made regarding this situation, who it needs to be made to and under which process or legislation it would need to be submitted.

Yours faithfully,

W Hunter