Dear Department of Health and Social Care,

Dear DHSC
Thank you for your message of 6 June 2024 via WhatDoTheyKnow.com:
https://www.whatdotheyknow.com/request/d...

In this message you invited me to submit a new request for the information I had asked for in my request for an internal review but which you refused because it was unrelated to the original FoI request. You said “Questions relating to material that was not relevant to your request will not be addressed as part of the review; only to state that it was released erroneously.”

The information you had “erroneously sent to me” were 5 pdf files relating to the approval of purchase orders for PPE (including FFP3 respirators). They may be found here : https://www.whatdotheyknow.com/request/d... .

There were a significant number of redactions in these documents and I had simply requested that you “review the exemptions which you claimed under the public interest test for redaction under section 43(2) and section 31(a)(b)(c) and (g) to ensure that they are valid and lawful”. It is this which you refused to do as it was not related to my original request (which was for minutes of the PPE Decision Making Committee). I fully understand that you were within your rights to do that, and I am grateful to you for suggesting that I might wish to submit a new request via the usual channels – which is the purpose of this request.

This FoI request is therefore ask you to send me the following documents:
1) DHSC PPE Clearance Board Minutes Wednesday 1st July 2020
This was file you sent me previously: https://www.whatdotheyknow.com/request/d...

2) 02/07/2020- PPE Board Meeting
https://www.whatdotheyknow.com/request/d...

3) DHSC PPE Clearance Board Minutes Friday 3rd July 2020
https://www.whatdotheyknow.com/request/d...

4) PPE Clearance Board meeting minutes 14/07/20
https://www.whatdotheyknow.com/request/d...

5) Update the deals log : Daily PPE Clearance Process Minutes and Actions
https://www.whatdotheyknow.com/request/d...

Judging by the file name including “CO” the document appears to have been received by you from the Cabinet Office. However I note that there is no evidence within the document that the document did, in fact, originate from the Cabinet Office. This may have been in some of the text which you redacted, but I would remind you that it is not within your power to redact names of organisations associated with the data request. Please therefore provide some confirmation, if only in the text of your letter of reply that the document did originate from the Cabinet Office.
I am seeking this confirmation because, in a letter the Cabinet Office sent to me, they say that they were not involved in matters pertaining to the PPE Decision Making Committee – and thereby contradict your assertion that it is they who hold the PPE DMC minutes.

It should not take you long to send me this information since you have already sent it to me. However, since you would not include issues relating to these documents in the previous internal review you are forcing me through this route.

Although I do not need to signal my intentions in making this request, in fairness and by way of full disclosure, my purpose is to ask the ICO review the redactions you have made in order to verify for themselves that your redactions were in fact lawful and in line with their guidance, since it appears that there have been issues with DHSC reliance on exemptions in the past.

In this respect I refer to the letter sent to you by the ICO on 1 September 2021 and, in particular, their mention of Section 43 (commercial interests) and the evidential requirements that the ICO expects before this exemption can be used. If you no longer have a copy of that letter, either I or the ICO will be able to provide it for you.

You will appreciate that I cannot refer this matter to them until we have been through the internal review process. However, you have made it clear that this will not happen unless I submit a fresh FoI request. This is it.

Yours faithfully,

David Osborn

Dear Department of Health and Social Care,

Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of Department of Health and Social Care's handling of my FOI request 'DO-22 Request meetings of PPE Clearance Cttee'.

Thank you for your response letter and for forwarding the information requested.
I note your explanation of the various redactions under sections 23, 31, 40 and 43.

My reason for requesting an internal review is to ask you to double-check that you have carried out these redactions in strict compliance with legislation and ICO guidance.

You would find it easier to understand the reasons for my concern had you not mislaid the ICO letter to you of 1st September 2021. I have to say it is rather odd that important correspondence from a Regulatory Body can so easily go missing in a Government Department. Nevertheless, in order to carry out the internal review effectively you will probably need to request a copy from the ICO in order that you can fully appreciate my concern in this area.

If you are confident about the redactions then I would hope that your review will not take too long.
I hope to hear from you soon.

A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.whatdotheyknow.com/request/d...

Yours faithfully,

David Osborn

Dear Department of Health and Social Care,

Firstly, I should respectfully point out that I do not need to justify or explain to you the details behind my request for you to review your responses. It should be sufficient reason that, as a data-requester, I asked you to carry out an internal review to ensure that you had redacted them correctly and in line with legislation and ICO guidance.
I had noted your explanation of the various redactions under sections 23, 31, 40 and 43 and had good reason to doubt them. I didn’t think that I would need to disclose my reasons to you, particularly since this is a publicly accessible forum.

However, since you press me on the point, there are three reasons which gives rise to my concerns:

1) Variations in the level of redactions between documents you have provided

2) Previous ICO concerns about DHSC’s use of sections 35 (development of government policy) and, relevant to my FoI, section 43 (Commercial interests) as reasons to withhold/redact documents;

3) Historical concerns about the completeness of your response.

Taking these in turn:

1) You have now provided me with these same documents four times over and the level of redaction is inconsistent (i.e. as a pdf and as a htm file attached to two separate FoI requests).

In some versions you have redacted data which in other versions of the same document you have not redacted at all. I therefore have no way of knowing whether some of the documents were over-redacted or whether the others were under-redacted.

It seems to me as a layman that there must be some rules pertaining to what data you are allowed to redact (or, indeed, required to redact) and so one would expect consistency in redaction between the same documents. Well, more than “consistent”, the redaction should be the same – and it is not.

You previously provided these documents in relation to my FoI :
https://www.whatdotheyknow.com/request/d...

And this FoI:
https://www.whatdotheyknow.com/request/d...

If we check two of these files for instance i.e. the DHSC PPE Clearance Board Minutes from 1st July 2020 and compare the htm versions you will see that if you look at the version you have sent me this time:
https://www.whatdotheyknow.com/request/d...

and compare it with the document sent last time:
https://www.whatdotheyknow.com/request/d...
you will be able to see the difference.

In the information you sent this time you have redacted data such as the number of units (FFP3 respirators) to be supplied and the cost per individual unit. You have also redacted names of most of the names of the individuals at the meetings.

However, in the data you sent me last time these data were not redacted. I hope you can see what I mean about inconsistencies? It is the same in the other similar files.

I’m not an expert in data-protection or freedom-of-information laws, so I’m trying to figure out whether you have over-redacted the data on this occasion or under-redacted on the previous occasion. If the latter, then it would appear that you have released personal data and commercially sensitive information into the public domain for all the world to see (including competitor suppliers).

To be on the safe side I have referred the matter to the DHSC Data Protection Officer to have a look at.

2) I referred you to the letter that ICO sent to you on 1 September 2021 which you appear to have mislaid. That letter related to your use of section 43 (Commercial interests) as an excuse to withhold data. I have explained my concerns about section 43 in (1) above.

If you refer to previous FoI’s you will find the letter with the filename “FOI-1467865 - Annex 3 - ICO to PA - Initial Letter_redacted” which you emailed to me on 22 Sept 2023 at 15:52. I hope this helps.

3) Historical concerns about the completeness of your response.

This relates to a previous incident involving an FoI (your reference FOI-1326888) and your letter dated 5 August 2022. In this letter you denied that DHSC held the information requested although you did have it, you knew that you had it and eventually did release it.

The information requested was a version of the IPC guidance sent by Professor Van Tam to the NHS and PHE on 12 March 2020 recommending the downgrade of protection for healthcare workers from FFP3 respirators to surgical masks. This happened the day before COVID-19 had been declassified as a high consequence infectious disease (HCID) and so was in breach of health and safety rules for HCIDs – which were that FFP3 respirators should be used for protection of doctors, nurses and other health and social care workers.

Your assertion that DHSC did not hold this document was untrue. A further FoI (your reference FOI-1440903) provided the internal DHSC emails which confirmed that your staff knew very well that you had the document and even where it was held i.e. in the Chief Medical Officer’s office (who wanted to see the response before it was sent to me). Eventually, 27 months after requesting it, you released the document. Data requestors really should not have to struggle like this.

I hope this satisfactorily answers your questions and now enables you to carry out an effective internal review. Thank you for your commitment to respond within 20 working days. This enquiry has been going on for too long. I look forward to hearing from you by 10th September.

Yours faithfully,

David Osborn

Dear Department of Health and Social Care,

Thank you for the update which you provided on 8 October.

Whilst I appreciate that Internal Reviews can take some time to complete, I believe this review should be relatively straightforward, given the detailed information I provided in August.

I think it reasonable that you complete your review within 10 working days from the date of your last message, beyond which I shall need to involve the ICO, since this request has been dragging on for so long.

Yours faithfully,

David Osborn