Data Protection Officer & Data Subject Requests

Mike Kilby made this Freedom of Information request to Northumbria Police

Automatic anti-spam measures are in place for this older request. Please let us know if a further response is expected or if you are having trouble responding.

The request was partially successful.

Dear Northumbria Police,

Please can you provide the answers and statistics for the following questions in relation to Data Subject Access Requests made to the organisation for each calendar year between the 1st January 2018 to 25th August 2020 inclusive

1. How many Data Subject Access Request have been made to the force broken down by;
a. Requests made by the Data Subject themselves
b. Request made by a third-party on behalf of the Data Subject

2. How many requests were rejected and the broad reasons for those rejections

3. How many requests were responded to in full or in part, and for each of these;
o Whether the response was within one, two, three or longer calendar months after the valid request was received;
and where responded to outside of one calendar month;
• Whether the requestor was notified within the first calendar month of the delay to the response
• The broad categories for the delay in responding within the first calendar month

4. How many requests excluded the provision of personal data held which was later used or otherwise disclosed to the Data Subject (or a representative) for another reason, for example in evidence.

In addition to the above, please could you provide details of;
• The Name, Job Title, and Rank and Badge Number (if applicable) of the individual holding the role of Data Protection Officer for the organisation;
• If that individual has any other duties, what (in general) those duties are.
• What “professional qualities and, in particular, expert knowledge of data protection law and practices” (if any) are held by that individual in accordance with Article 35(5) of the GDPR
• If DPO the role holder is a Shared Resource, which other organisations are served by that DPO.
• How many people you have working within your Data Protection Compliance team.

Yours faithfully,

Mike Kilby

Freedom of Information Mailbox, Northumbria Police

Freedom of Information Act 2000 (FOIA)
 
Thank you for your email received today in which you make a request for
information that Northumbria Police may hold in accordance with the
Freedom of Information Act 2000.
 
We are in the process of dealing with your request and a response should
be provided to you by 16 October 2020 which is in accordance with the
legislation.
 
Although every effort will be made to ensure a response is provided within
statutory deadlines, due to current circumstances delays may be
unavoidable.  We apologise for any inconvenience and will endeavour to
process your request as quickly as is practicable.
 
Yours sincerely
 
Information Management Unit
[1]www.northumbria.police.uk | [2]www.northumbria-pcc.gov.uk

'Northumbria Police will be outstanding in the service we provide'

'We will do this through protecting the Vulnerable, delivering quality
Investigations and applying Problem solving to everything we do to protect
the communities we serve.'
 
 

show quoted sections

Freedom of Information Mailbox, Northumbria Police

1 Attachment

Provision of information held by Northumbria Police made under the Freedom
of Information Act 2000 (the 'Act')

 

Thank you for your email dated 17 September 2020 in which you made a
request for access to certain information which may be held by Northumbria
Police.

 

As you may be aware the purpose of the Act is to allow a general right of
access to information held at the time of a request, by a Public Authority
(including the Police), subject to certain limitations and exemptions.

 

You asked:

 

Please can you provide the answers and statistics for the following
questions in relation to Data Subject Access Requests made to the
organisation for each calendar year between the 1st January 2018 to 25th
August 2020 inclusive

 

1.   How many Data Subject Access Request have been made to the force
broken down by;

a.   Requests made by the Data Subject themselves

b.   Request made by a third-party on behalf of the Data Subject

 

2.   How many requests were rejected and the broad reasons for those
rejections

 

3.   How many requests were responded to in full or in part, and for each
of these;

a.   Whether the response was within one, two, three or longer calendar
months after the valid request was received;

      and where responded to outside of one calendar month;

b.   Whether the requestor was notified within the first calendar month of
the delay to the response

c.   The broad categories for the delay in responding within the first
calendar month

 

4.   How many requests excluded the provision of personal data held which
was later used or otherwise disclosed to the Data Subject (or a
representative) for another            reason, for example in evidence.

 

In addition to the above, please could you provide details of;

 

5.   The Name, Job Title, and Rank and Badge Number (if applicable) of the
individual holding the role of Data Protection Officer for the
organisation;

 

6.   If that individual has any other duties, what (in general) those
duties are.

 

7.   What "professional qualities and, in particular, expert knowledge of
data protection law and practices" (if any) are held by that individual in
accordance with Article 35(5) of the GDPR

 

8.   If DPO the role holder is a Shared Resource, which other
organisations are served by that DPO.

 

9.   How many people you have working within your Data Protection
Compliance team.

 

We have now had the opportunity to fully consider your request and I
provide a response for your attention.

 

Following receipt of your request, searches were conducted with the
Information Management Unit of Northumbria Police.  I can confirm that the
information you have requested is held, in part, by Northumbria Police
however cannot be disclosed in full for the following reasons.

 

The information requested at points 1 and 3 is not held in a format that
would allow its extraction within the permitted 18 hour threshold.  In
excess of 1170 Subject Access applications would need to be manually
reviewed to establish a response at these points.  Even at a conservative
estimate of 8 minutes per record, which we have considered as reasonable,
we have estimated that to extract the information at these two points
alone would take over 156 hours, therefore Section 12(1) of the Freedom of
Information Act would apply.  This section does not oblige a public
authority to comply with a request for information if the authority
estimated that the cost of complying with the request would exceed the
appropriate limit of 18 hours, equating to £450.00.

 

You should consider this to be a refusal notice under Section 17 of the
Act for your request.

 

Although excess cost removes Northumbria Police's obligations under the
Freedom of Information Act 2000, as a gesture of goodwill I have supplied
information below, relative to your request, retrieved or available before
it was realised that the fees limit would be exceeded.  I trust this is
helpful, but it does not affect our legal right to rely on the fees
regulations for the remainder of your request.

 

2.   No valid requests are rejected.

 

4.   No information held.  This is not recorded.

 

5.   Data Protection Officer is Hayley Young, Civilian, Information
Management Unit Manager, more information on this is available via the
Force website ([1]https://beta.northumbria.police.uk/cooki...)

 

6.   Manager of the Information Management Unit

 

8.   This is not a shared resource.

 

9.   We have an Information Management Unit that contains a number of
areas of disclosure.  Subject access requests are handled primarily by 2
Researchers and one Disclosure Advisor

 

With regards to point 7 – this would be classed as Personal Information
and would have been withheld under Section 40 had Section 12 not been
fully applicable.  The skills and qualifications of an individual would be
classed as the personal data of that person and it would not be fair to
disclose such data into the public arena.

 

Due to the different methods of recording information across 43 forces, a
specific response from one constabulary should not be seen as an
indication of what information could be supplied (within cost) by another.
Systems used for recording these figures are not generic, nor are the
procedures used locally in capturing the data. For this reason responses
between forces may differ, and should not be used for comparative
purposes.

 

The information we have supplied to you is likely to contain intellectual
property rights of Northumbria Police. Your use of the information must be
strictly in accordance with the Copyright Designs and Patents Act 1988 (as
amended) or such other applicable legislation. In particular, you must not
re-use this information for any commercial purpose.

 

You may be interested to know that Northumbria Police routinely publish
information via the Disclosure Log. The aim of the Disclosure Log is to
promote openness and transparency by voluntarily placing information into
the public arena.

 

The Disclosure Log contains copies of some of the information that has
been disclosed by Northumbria Police in response to requests made under
the Freedom of Information Act 2000.

 

Whilst it is not possible to publish all responses we will endeavour to
publish those where we feel that the information disclosed is in the wider
public interest.

 

The Disclosure Log will be updated once responses have been sent to the
requester.

 

I have provided the relevant link below.

 

[2]https://beta.northumbria.police.uk/about...

 

How to complain

 

If you are unhappy with our decision or do not consider that we have
handled your request properly and we are unable to resolve this issue
informally, you are entitled to make a formal complaint to us under our
complaints procedure, attached.

 

If you are still unhappy after we have investigated your complaint and
reported to you the outcome, you may complain directly to the Information
Commissioner’s Office and request that they investigate to ascertain
whether we have dealt with your request in accordance with the Act.

 

Yours sincerely

 

 

 

Michael Cleugh

Data Protection and Disclosure Advisor

 

[NOT PROTECTIVELY MARKED]

 

'Northumbria Police will be outstanding in the service we provide'

'We will do this through protecting the Vulnerable, delivering quality
Investigations and applying Problem solving to everything we do to protect
the communities we serve.'

 

NORTHUMBRIA POLICE PRIVACY AND CONFIDENTIALITY NOTICE The information
contained in this message and any attachment(s) is confidential and
intended only for the attention of the named organisation or individual to
whom it is addressed. The message may contain information that is covered
by legal, professional or other privilege. No mistake in transmission is
intended to waive or compromise any such privilege. This message has been
sent over public networks and the sender cannot be held responsible for
its integrity. If you are not the intended recipient be aware that any
disclosure, copying, distribution or action taken in reliance of the
information contained herein is strictly prohibited, and is contrary to
the provisions of the Copyright Designs and Patents Act, 1988 and of the
Data Protection Act, 2018. Any views expressed are those of the sender
and, unless specifically stated, do not necessarily represent the view of
Northumbria Police. We cannot accept any liability for any loss or damage
sustained as a result of software viruses. It is your responsibility to
carry out such virus checking as is necessary. If you have received this
message in error, please notify the sender by e-mail at once and delete
the message immediately. For more information about Northumbria Police
please visit our website - http://www.northumbria.police.uk

References

Visible links
1. https://beta.northumbria.police.uk/cooki...
2. https://beta.northumbria.police.uk/about...

Dear Freedom of Information Mailbox,

Thank you for providing the information in respect of your DPO and the limited responses to my other questions.

In light of your comments regarding question 1 of my request, please take this as a refinement of the request to reduce this to information that, as a Data Protection Practitioner myself, I would expect any organisation to hold in order to be accountable to it's DPO and the ICO. Please provide the number of SAR's received each year for the period of 2018, 2019 and 2020, by year and of those, how many have you responded to within one month, two months, three months or longer.

I appreciate that you may subtract any time spend on your previous response from your available time and therefore should there still be a time issue, please provide the information for 2020 first, working backwards for 2019 and 2018 respectively until the time limit is reached.

Yours sincerely,

Mike Kilby PC.dp

Freedom of Information Mailbox, Northumbria Police

Mr Kilby
 
Thank you for your e mail.
 
I can advise that we are not obliged to work up to the 18 hour threshold.
 
As it stands your refined request would still exceed the 18 hours.  Its
only recently that figures have been collated and supplied to the National
Police Chief Council, so to go back to 2018 and provide a response down
to  how many have been responded to within one month, two months, three
months or longer, would exceed the permitted time, and therefore Section
12 would be applicable.
 
What we may be able to provide would be :
 
The number of SARs received in 2018, 2019 and 2020 (up until September
2020)
The number of SARs received in 2020 (up until September 2020) that were
responded to within
A, one month,
B, two months,
C, three months or longer.
 
If you are happy to receive the above please advise.
 
Regards
 
FOI team
 

show quoted sections

Dear Freedom of Information Mailbox,

Thank you for your message. Yes please provide the information you indicated as follows;

The number of SARs received in 2018, 2019 and 2020 (up until September
2020)
The number of SARs received in 2020 (up until September 2020) that were
responded to within
A, one month,
B, two months,
C, three months or longer.

Yours sincerely,

Mike Kilby PC.dp

Freedom of Information Mailbox, Northumbria Police

Freedom of Information Act 2000 (FOIA)
 
Thank you for your email received today in which you make a request for
information that Northumbria Police may hold in accordance with the
Freedom of Information Act 2000.
 
We are in the process of dealing with your request and a response should
be provided to you by 16 November 2020 which is in accordance with the
legislation.
 
Although every effort will be made to ensure a response is provided within
statutory deadlines, due to current circumstances delays may be
unavoidable.  We apologise for any inconvenience and will endeavour to
process your request as quickly as is practicable.
 
Yours sincerely
 
Information Management Unit
[1]www.northumbria.police.uk | [2]www.northumbria-pcc.gov.uk

'Northumbria Police will be outstanding in the service we provide'

'We will do this through protecting the Vulnerable, delivering quality
Investigations and applying Problem solving to everything we do to protect
the communities we serve.'
 
 

show quoted sections

Freedom of Information Mailbox, Northumbria Police

1 Attachment

Provision of information held by Northumbria Police made under the Freedom
of Information Act 2000 (the 'Act')

 

Thank you for your email dated 15 October 2020 in which you made a request
for access to certain information which may be held by Northumbria Police.

 

As you may be aware the purpose of the Act is to allow a general right of
access to information held at the time of a request, by a Public Authority
(including the Police), subject to certain limitations and exemptions.

 

You asked:

 

1.The number of SARs received in 2018, 2019 and 2020 (up until September
2020)

 

The number of SARs received in 2020 (up until September 2020) that were
responded to within

2. one month

3, two months

4. three months or longer.

 

 

 

We have now had the opportunity to fully consider your request and I
provide a response for your attention.

 

Following receipt of your request, searches were conducted with the
Information Management Unit of Northumbria Police. I can confirm that the
information you have requested is held by Northumbria Police.

 

I am able to disclose the located information to you as follows.

 

1.

2018 – 393

2019 – 451

2020 – up to Sept 2020 – 334 (some of which remain open)

 

2. 306

3. 24

4. 1, which requires further consideration due to the sensitivity of the
data held.

 

 

Due to the different methods of recording information across 43 forces, a
specific response from one constabulary should not be seen as an
indication of what information could be supplied (within cost) by another.
Systems used for recording these figures are not generic, nor are the
procedures used locally in capturing the data. For this reason responses
between forces may differ, and should not be used for comparative
purposes.

 

The information we have supplied to you is likely to contain intellectual
property rights of Northumbria Police. Your use of the information must be
strictly in accordance with the Copyright Designs and Patents Act 1988 (as
amended) or such other applicable legislation. In particular, you must not
re-use this information for any commercial purpose.

 

You may be interested to know that Northumbria Police routinely publish
information via the Disclosure Log. The aim of the Disclosure Log is to
promote openness and transparency by voluntarily placing information into
the public arena.

 

The Disclosure Log contains copies of some of the information that has
been disclosed by Northumbria Police in response to requests made under
the Freedom of Information Act 2000.

 

Whilst it is not possible to publish all responses we will endeavour to
publish those where we feel that the information disclosed is in the wider
public interest.

 

The Disclosure Log will be updated once responses have been sent to the
requester.

 

I have provided the relevant link below.

 

[1]https://beta.northumbria.police.uk/about...

 

How to complain

 

If you are unhappy with our decision or do not consider that we have
handled your request properly and we are unable to resolve this issue
informally, you are entitled to make a formal complaint to us under our
complaints procedure, attached.

 

If you are still unhappy after we have investigated your complaint and
reported to you the outcome, you may complain directly to the Information
Commissioner’s Office and request that they investigate to ascertain
whether we have dealt with your request in accordance with the Act.

 

Yours sincerely

 

 

 

Michael Cleugh

Data Protection and Disclosure Advisor

 

[NOT PROTECTIVELY MARKED]

 

'Northumbria Police will be outstanding in the service we provide'

'We will do this through protecting the Vulnerable, delivering quality
Investigations and applying Problem solving to everything we do to protect
the communities we serve.'

 

 

NORTHUMBRIA POLICE PRIVACY AND CONFIDENTIALITY NOTICE The information
contained in this message and any attachment(s) is confidential and
intended only for the attention of the named organisation or individual to
whom it is addressed. The message may contain information that is covered
by legal, professional or other privilege. No mistake in transmission is
intended to waive or compromise any such privilege. This message has been
sent over public networks and the sender cannot be held responsible for
its integrity. If you are not the intended recipient be aware that any
disclosure, copying, distribution or action taken in reliance of the
information contained herein is strictly prohibited, and is contrary to
the provisions of the Copyright Designs and Patents Act, 1988 and of the
Data Protection Act, 2018. Any views expressed are those of the sender
and, unless specifically stated, do not necessarily represent the view of
Northumbria Police. We cannot accept any liability for any loss or damage
sustained as a result of software viruses. It is your responsibility to
carry out such virus checking as is necessary. If you have received this
message in error, please notify the sender by e-mail at once and delete
the message immediately. For more information about Northumbria Police
please visit our website - http://www.northumbria.police.uk

References

Visible links
1. https://beta.northumbria.police.uk/about...