Emergency investigations of DPA 2018 breaches by the ICO?

S. Grove (Account suspended) made this Freedom of Information request to Information Commissioner's Office

This request has been closed to new correspondence. Contact us if you think it should be reopened.

Information Commissioner's Office did not have the information requested.

S. Grove (Account suspended)

Dear Information Commissioner’s Office,

It is understood that FOI legislation does not require the Information Commissioner’s Office to create new data or information.
In circumstances where an organisation refuses to comply with the Data Protection Act 2018 and a Subject Access Request is not completed in full that failure (to provide all of the information requested) could compromise a criminal defence case. When the ICO is informed that a criminal case is sub-justice and that an organisation has failed to comply with the DPA 2018 what is the written policy and procedure within the ICO that expedites the investigation in a timeline that is faster than the current 24 week limit?

Yours faithfully,
S. Grove

AccessICOinformation, Information Commissioner's Office

Thank you for contacting the Information Commissioner’s Office. We confirm
that we have received your correspondence.

If you have made a request for information held by the ICO we will contact
you as soon as possible if we need any further information to enable us to
answer your request. If we don't need any further information we will
respond to you within our published, and statutory, service levels. For
more information please visit [1]http://ico.org.uk/about_us/how_we_comply

If you have raised a new information rights concern - we aim to send you
an initial response and case reference number within 30 days.

If you are concerned about the way an organisation is handling your
personal information, we will not usually look into it unless you have
raised it with the organisation first. For more information please see our
webpage ‘raising a concern with an organisation’ (go to our homepage and
follow the link ‘for the public’). You can also call the number below.

If you have requested advice - we aim to respond within 14 days. 

If your correspondence relates to an existing case - we will add it to
your case and consider it on allocation to a case officer.

Copied correspondence - we do not respond to correspondence that has been
copied to us.

For more information about our services, please see our webpage ‘Service
standards and what to expect' (go to our homepage and follow the links for
‘Report a concern’ and ‘Service standards and what to expect'). You can
also call the number below.

For information about what we do with personal data see our [2]privacy
notice.

If there is anything you would like to discuss with us, please call our
helpline on 0303 123 1113.

Yours sincerely

The Information Commissioner’s Office

Our newsletter

Details of how to sign up for our monthly e-newsletter can be found at
[3]http://www.ico.org.uk/tools_and_resource...

Twitter

Find us on Twitter at [4]http://www.twitter.com/ICOnews

 

References

Visible links
1. http://ico.org.uk/about_us/how_we_comply
2. https://ico.org.uk/global/privacy-notice/
3. http://www.ico.org.uk/tools_and_resource...
4. http://www.twitter.com/ICOnews

Information Commissioner's Office

25 March 2019

 

Case Reference Number IRQ0823083

 

Dear S Grove

I can confirm we are now in a position to provide you with a response to
your information request of 22 February sent to us via the
WhatDoTheyKnow.com website. 
 
Your Request
 
“In circumstances where an organisation refuses to comply with the Data
Protection Act 2018 and a Subject Access Request is not completed in full
that failure (to provide all of the information requested) could
compromise a criminal defence case. When the ICO is informed that a
criminal case is sub-justice and that an organisation has failed to comply
with the DPA 2018 what is the written policy and procedure within the ICO
that expedites the investigation in a timeline that is faster than the
current 24 week limit?”
 
We understand this to be a request for information on our written
procedure for expediting the progress of complaint cases brought to us
under data protection legislation.
 
We have dealt with your request in accordance with your ‘right to know’
under section 1(1) of the Freedom of Information Act 2000 (FOIA), which
entitles you to be provided with any information ‘held’ by a public
authority, unless an appropriate exemption applies.
 
Our Response
 
I can confirm we hold information that falls in the scope of your request.
Requests for prioritisation are looked at by the relevant manager. The
reasons for the request are considered, such as pending court proceedings,
and decisions are made on a case by case basis.
 
Our service guide provides information on how we handle the cases brought
to us by members of the public and organisations. Page 55 outlines the
process for ‘Requests for prioritisation’ on cases. Page 79 also gives
details on our service standards and timescales. You can read the ICO
Operations Directorate Service guide online [1]here

The information you have requested is therefore technically withheld under
section 21 of the FOIA which explains that we are not required to provide
information in response to a request if it is already reasonably
accessible to you from another source.
 
Please note due to the way information is displayed on the
WhatDoTheyKnow.com website online links may appear at the bottom of this
response.
 
Complaint and Review Procedure
 
I hope this provides you with the information you require. 
 
However, if you are dissatisfied with your request for information under
FOI and wish to request a review of our decision or make a complaint about
how your request has been handled you should write to the Information
Access Team at the address below or e-mail
[2][ICO request email].

Your request for internal review should be submitted to us within 40
working days of receipt by you of this response. Any such request received
after this time will only be considered at the discretion of the
Commissioner.

A copy of our review procedure can be accessed from our website
[3]here
 
Yours sincerely
 
Claire Elliott
Lead Information Access Officer
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
T. 0330 414 6200  F. 01625 524510 
[4]ico.org.uk  [5]twitter.com/iconews
 
For information about what we do with personal data see our [6]privacy
notice. Our retention policy can be found [7]here
 

References

Visible links
1. https://ico.org.uk/media/about-the-ico/p...
2. mailto:[ICO request email]
3. https://ico.org.uk/media/1883/ico-review...
4. http://ico.org.uk/
5. https://twitter.com/iconews
6. https://ico.org.uk/global/privacy-notice/
7. https://ico.org.uk/media/about-the-ico/p...

S. Grove (Account suspended)

Dear Information Commissioner’s Office,

Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of Information Commissioner’s Office's handling of my FOI request 'Emergency investigations of DPA 2018 breaches by the ICO?'.

This request has not been completed to a satisfactory level. The question asked was what specific process is currently in place at the ICO for expediting complaint cases where complaints have been made regarding DPA 2018 Subject Access Requests to organisations for information that could be required as defence evidence in criminal prosecutions. If there is no specific process in place at the ICO for these situations then the ICO should state clearly in it's response that there is no specific process in place for dealing with these scenarios.

I want a response that states that there is no specific process in place (if that is the real situation) so that this FOI request can be closed as the ICO "not having the requested information".

A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.whatdotheyknow.com/request/e...

Yours faithfully,

S. Grove

AccessICOinformation, Information Commissioner's Office

Thank you for contacting the Information Commissioner’s Office. We confirm
that we have received your correspondence.

If you have made a request for information held by the ICO we will contact
you as soon as possible if we need any further information to enable us to
answer your request. If we don't need any further information we will
respond to you within our published, and statutory, service levels. For
more information please visit:

[1]https://ico.org.uk/about-the-ico/our-inf...

If you have raised a new information rights concern - we aim to send you
an initial response and case reference number within 30 days.

If you are concerned about the way an organisation is handling your
personal information, we will not usually look into it unless you have
raised it with the organisation first. For more information please see our
webpage ‘raising a concern with an organisation’ (go to our homepage and
follow the link ‘for the public’). You can also call the number below.

If you have requested advice - we aim to respond within 14 days. 

If your correspondence relates to an existing case - we will add it to
your case and consider it on allocation to a case officer.

Copied correspondence - we do not respond to correspondence that has been
copied to us.

For more information about our services, please see our webpage ‘Service
standards and what to expect' (go to our homepage and follow the links for
‘Report a concern’ and ‘Service standards and what to expect'). You can
also call the number below.

For information about what we do with personal data see our [2]privacy
notice.

If there is anything you would like to discuss with us, please call our
helpline on 0303 123 1113.

Yours sincerely

The Information Commissioner’s Office

Our newsletter

Details of how to sign up for our monthly e-newsletter can be found
[3]here.

Twitter

Find us on Twitter [4]here.

 

References

Visible links
1. https://ico.org.uk/about-the-ico/our-inf...
2. https://ico.org.uk/global/privacy-notice/
3. https://ico.org.uk/about-the-ico/news-an...
4. http://www.twitter.com/ICOnews

Information Commissioner's Office

27 March 2019

 

Case Reference Number RCC0832810

 

Dear S Grove

Further to your email yesterday, we acknowledge your request for an
internal review of the response we provided on 25 March to your request
for information under the Freedom of Information Act 2000, our reference
IRQ0823083.
 
We aim to respond by 25 April which is 20 working days from the day after
we received your email. This is in accordance with our internal review
procedures which were provided with our response.
 
The above reference number of RCC0832810 refers to the request for review.
 
Yours sincerely
 
Claire Elliott
Lead Information Access Officer
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
T. 0330 414 6200  F. 01625 524510 
[1]ico.org.uk  [2]twitter.com/iconews
 

References

Visible links
1. http://ico.org.uk/
2. https://twitter.com/iconews

Information Commissioner's Office

5 April 2019

 

Case Reference Number RCC0832810

 

Dear S Grove

I write further to your email of 26 March, in which you request an
internal review of our response to your information request, which we
handled under the case reference number IRQ0823083.
 
My name is Ian Goddard and I am an Information Access Service Manager. I
have been asked to review the way we handled your request for information.
I can confirm that I have had no prior involvement in the handling of this
request.
 
I have undertaken the review and confirm that the request was responded to
appropriately. I will explain my decision below.

In your request of 22 February you described a specific set of
circumstances and asked for the ICO’s policy and procedure for the
expediting of complaints in this situation.
 
Ms Elliott responded to you on 25 March, explaining that requests for
prioritisation are considered on a case by case basis and directed you to
the relevant section of our Service Guide. She also explained that as this
information is reasonably accessible to you via our website it was exempt
from disclosure under section 21 of the FOIA.
 
You argued in your request for internal review that:
 
“The question asked was what specific process is currently in place at the
ICO for expediting complaint cases where complaints have been made
regarding DPA 2018 Subject Access Requests to organisations for
information that could be required as defence evidence in criminal
prosecutions. If there is no specific process in place at the ICO for
these situations then the ICO should state clearly in it's response that
there is no specific process in place for dealing with these scenarios. I
want a response that states that there is no specific process in place (if
that is the real situation) so that this FOI request can be closed as the
ICO "not having the requested information"
 
I do not agree with this reasoning. As Ms Elliott explained, each request
for prioritisation is handled on a case by case basis in line with the
procedure set out in the service guide. Regardless of the specific
circumstances of the case, this is the procedure that is followed.
Therefore the information we hold in relation to how we would deal with a
request for prioritisation in the circumstances you describe is the
process described in the service guide.
 
I therefore find that Ms Elliott responded to your request correctly in
stating that we hold information that falls in scope of your request and
that she applied the appropriate exemption to this information. This
concludes my response to your internal review. I realise that this
response may be disappointing to you but hope our reasoning is clear.
 
Complaint procedure

If you are dissatisfied with the outcome of this review you can make a
formal complaint with the ICO in its capacity as the regulator of the
Freedom of Information Act 2000. Please follow the link below to submit
your complaint:

[1]https://ico.org.uk/concerns/
 
Yours sincerely

Ian Goddard
Information Access Service Manager, Risk and Governance Department
Corporate Strategy and Planning Directorate
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
T. 0330 4146823  F. 01625 524510  [2]ico.org.uk  [3]twitter.com/iconews
For information about what we do with personal data see our [4]privacy
notice
Please consider the environment before printing this email

References

Visible links
1. https://ico.org.uk/concerns/
2. http://ico.org.uk/
3. https://twitter.com/iconews
4. https://ico.org.uk/global/privacy-notice/

S. Grove (Account suspended)

Dear Information Commissioner's Office,

The ICO is thanked for their timely responses. As there is no formal process in place to deal with expediting DPA 2018 Subject Access Request complaints/breaches in cases where such information is required for legal subjustice cases and the ICO state that matters are dealt with on a case-by-case basis then this FOI request has to be closed with a "not holding the information requested".

Yours faithfully,

S. Grove