Finance Concerns

Dear Ormiston Academies Trust,

Further to my FOI, made on the 9th November 2021, regarding information from the minutes of the Ormiston Board meeting March 2019 . I have examined the minutes further and wish to raise another FOI that is regarding financial matters discussed during the same meeting.

I have raised this as a separate FOI in order to avoid any possible confusion with the FOI dated 09-11-2021 although they both refer to the same set of Board Minutes the requests differ.

In the minutes contained in a document dated 11-07-2019 under Section 7, Management Accounts there is detail that does not appear in the published minutes dated 25-11-2019 as follows:

"End of year forecast – aim is to ensure that every academy comes in on
budget. A few negative academies – Bushfield, NEW, WOA, Meridian. More
money come in this week for FSM – NEW – had to pay an unexpected £70k
to leaving principal. FSM funding will help rectify this. "

For completeness the earlier version of the minutes are archived here:

http://web.archive.org/web/2021110914553...

and the currently published minutes are posted here:

http://web.archive.org/web/2019112613030.... The conversation regarding 'NEW {North East Wolverhampton Academy} – unexpected £70k to leaving principle' does not appear in the version of the minutes published on the Ormiston website.

The NEW Academy website, in an announcement May 2019 does confirm the current principal taking post in 2019 with the predecessor principal, the School Leadership Team, the Board of Governors and OAT all working together to support the incoming principal's transition to his new role.

http://www.onewa.co.uk/news/principal-an...

Archived here:

http://web.archive.org/web/2019090514003...

The minutes allude to some concern of some academies going over budget ("negative academies") although the published minutes refer to these as "red academies".

There is discussion regarding the NEW academy that indicated the Ormiston "NEW – had to pay an unexpected £70k to leaving principal" and that "FSM funding will help rectify this".

Although the acronym "FSM" is not expanded in the minutes it is taken to mean "Free School Meals supplement" funding. This being the case the first FOI is to clarify if the "FSM funding" referred to in the minutes does mean the "Free School Meals supplement" funding.

FOI (1) Please clarify (expand) the use of the acronym "FSM" in the March 2019 Ormiston Board Minutes meeting.

The school records show that the incoming principal's post was publicised and the leaving principal remained to assist the new principal to become orientated, therefore:

FOI (2) Why was the payment to the 'leaving principal" unexpected?

FOI (3) What was the nature of the £70,000 payment to the leaving principal? The financial report for the financial year 2018/19 shows severance payments for that financial year as follows:

Non statutory/non-contractual staff severance payments.
Included in staff restructuring costs are non-statutory/non-contractual serverance payments totalling £67,719. Individually, the payments were; £9,601, £7,500, £6,781, £6,201, £5,978,
£5,538, £5,000, £5,000, £4,000, £2,600, £2,500, £2,500, £2,500, £2,000 and £20.

None of the above correspond to the amount of £70k and the total payments of £67,719 to 15 staff is less that the £70,000 paid to the leaving principal, hence it does not appear to be a severance payment.

Due to the amount of the payment (£70k) to a single staff member it's understood ESFA are required to grant prior approval.

FOI (4) Did the ESFA give prior approval of the £70,000 payment to the leaving principle?

Should it be the case that the acronym "FSM" does mean Free School Meals supplement and the wording indicates the funding was used to rectify the unexpected payment of £70,000 to the leaving principle ("NEW - had to pay an unexpected £70k to leaving principal. FSM funding will help rectify this") then:

FOI (5) Is the above interpretation correct? Are ESFA aware of this use of the funding?
FOI (6) What was the total amount of Free School Meals funding allocated to the Ormiston Academies Trust and how much was allocated to the NEW academy by ESFA for 2019?

In another meeting later in 2019, regarding a visit from HMRC, a section of the minutes document financial concerns as follows:

"Report on HMRC visit
SV provided a summary of the HMRC Employer Compliance and VAT review.
Trustees asked whether the Chairs could be asked to repay the tax to OAT.
This was not considered appropriate as the Chairs hadn’t followed incorrect
procedures. OAT had also followed the correct procedures, but a judgment
made on the IR35 assessment was disputed by HMRC. SV to send notification to academies that Chairs and Clerks are office holders, and payments must be subject to tax deductions.

IB asked what the potential exposure relating to VAT is. SV explained that SV
this is very difficult to quantify, but that a provision of c.£50k is included in
the head office budget for 19/20. "

It's understood this conversation about the HMRC visit was in reference to individuals working for Ormiston on "off payroll" or "IR35" basis. Understood to mean acting as self employed with the onus of accounting for Income tax and National Insurance payments previously incumbent on the contractor. However since 2017 the HMRC have brought in rules as follows:

The rules make sure that workers, who would have been an employee if they were providing their services directly to the client, pay broadly the same Income Tax and National Insurance contributions as employees. These rules are sometimes known as ‘IR35’.

Since 2017 the employer should have deducted the Tax and NI payments and paid directly to the HMRC, however from the conversation in the minutes it seems that this was not done and there was discussion regarding regarding reclaiming these payments from "Chairs" and "Clerks".

It would seem from the minutes that "Chairs" and "Clerks" were employed on an "off payroll" basis.

FOI (7) How many individuals were employed by Ormiston Academies Trust or their individual academies on an "off payroll" or "IR35" basis from 2017 to the the present.

FOI (8) How much is the total Tax and NI payments have the Ormiston been required to pay to HMRC for these individuals broken down by 2017/18, 2018/19 and 2019/20 tax years.

FOI (9) How much is the total of the payments been reclaimed by Ormiston from the individuals that was paid prior to the HMRC visit that should have been deducted from the payments to the individuals since 2017 but was not?

Regarding the potential exposure to VAT, the minutes show £50k was included in the budget for 19/20.

FOI (10) What was the final total exposure to VAT for 19/20 for this item?

For any corrections, inaccuracies or clarifications of the FOI request please don't hesitate to contact me.

Yours faithfully,

Gary Symonds

Dear OAT - Data Protection Officer,

Thank you for your response, to my Freedom of Information request made on the 24th November 2021. Within your response you state:

"Our view is that the name you have provided for this request is not
currently valid under Section8 (1) (b) of the Freedom of Information Act
2000 as you have not provided enough of your real name to give a
reasonable indication of your identity."

You then provide a link to ICO guidance on making FOI requests (https://ico.org.uk/media/for-organisatio...). Which clarifies:

"Paragraph 21

For a request to be valid, the requester must provide enough of their real
name to give anyone reading that request a reasonable indication of their
identity."

I would like to ask you to revisit my original request (available here on the whatdoyouknow website (https://www.whatdotheyknow.com/request/f...) and you will see that I did sign the request as follows:

"Yours faithfully,
Gary Symonds"

As "Gary Symonds" is my full name I believe my request does comply with ICO guidance and is valid, hence I don't understand the nature of your response.

Yours faithfully,
Gary Symonds

Dear Ormiston Academies Trust,

Further to my response this morning (29th November 2021 09:35). This is to confirm that Gary Symonds is my real name.

Yours faithfully,

Gary Symonds

Dear OAT - Data Protection Officer,

(Resending to OAT - Data Protection Officer).

Further to my response this morning (29th November 2021 09:35). This is to confirm that Gary Symonds is my real name.

Yours faithfully,

Gary Symonds

Dear Ormiston Academies Trust,

Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of Ormiston Academies Trust's handling of my FOI request 'Finance Concerns.'.

This Request for Internal Review is quite long and complex, this is largely due to the lengthy and complicated response by the OAT DPO to my original request, as well as the nature of the OAT response which alludes to my request being vexatious and of a repeating nature. However the OAT DPO stops short of issuing a formal refusal based on Section 14 of the ICO guidance on these matters.

Within my review request there are a number of sources of external information with corresponding Internet links quoted. Due to the dynamics of Internet information resources, with information constantly updated, renewed, or deleted, where a resource link is quoted an archive of the active link at the time is presented within annotations to the request in order to preserve the validity of quoted resources in effect at the time of the request.

Where personal information such as names of personnel not already published within the quoted policy documents or Board Minutes they are redacted.

Prior to going into the detail why I request an internal review, I would like to address a paragraph of the initial response to my FOI by the OAT DPO which was as follows:

“You will be aware through our previous correspondence that we are
concerned about some of the behaviours evident in your interactions with
OAT. When you communicate with us we assess your communications against a
number of indicators of vexatious behaviour. These can be found in the ICO
publication “Dealing with vexatious requests (section 14)”.

For reference, when I received the initial response to my FOI, I submitted an 'Information Rights Concern' to the Ormiston Academies Trust Data Protection Officer via an email as I was concerned that the response revealed personal information regarding previous information requests. I believed that following the OAT Data Protection policy would be the best option to follow to raise the information rights concern. I believe the OAT DPO Laurence Boulter's response to my concerns will be in the public interest to whatdotheyknow.com users.

A copy of the full response is at the link:

https://myarchived.link/OAT-Response-12-...

I made the request in compliance with the OAT Data Protection and Freedom of Information Policy, which is a policy authored by Laurence Boulter, Data Protection Officer for the OAT. An archive copy of the policy in effect at the times of my requests is located at this link:

https://myarchived.link/oat-data-protect...

the OAT DPO offers adviced that goes on to say:

“During a discussion with the ICO on 20/12/2021:

The ICO have advised that we take this opportunity to make clear to you that any responses we
may feel we need to make to any request you may make using the WDTK website will be placed
in the public domain.”

“In a communication from WDTK received on the22/12/2021:

WDTK confirmed that 'Requests made via our service should be treated in the same way
that you would treat any other requests.”

As the UK DPA requires public authorities to have “appointed a DPO based on their professional qualities and expert knowledge of data protection law and practices. “ and the OAT DPO also confirms that advice was sought from the Information Commissioners Office I therefore believe I can assume the advice given by OAT DPO Laurence Boulter in the response is expert and authoritative advice and submit my request for internal review accordingly.

The response from the DPO to my information concerns then goes on to ask “for you exercise restraint if you are to avoid further application of Section 14 {of the Freedom of Information Act}”.

However I'm not aware of any record of a 'Section 14 application' to any of my requests to date.

For the purpose of this review request, as with any request, for good practice where quotes from documents or correspondence are made in my requests, a link to a full copy of that document or correspondence is included. At times some of my requests have been on behalf of third parties, including children, so I have been very careful to remove any reference within quoted correspondence that could identify third parties or children.

In view of this need to 'avoid further application of Section 14' I believe it is now incumbent on me to supply, within this review request, the background supported with documentary evidence of some of the previous requests to support that this request is not vexatious but intended to ensure transparency in the regulatory compliance of an Academy Trust, the majority of previous requests concerned the safeguarding of children - based on statements made in publicly available records. This can then be supplied to the ICO if necessary on the basis that the OAT DPO appears to have announced, in correspondence, the possibility of an intention to “apply an extension of the current application of Section 14 {FOI Section 14(1) vexatious request}” to this request.

The request was initiated because of information recorded in a number of documents, circulated in the public domain, of conversations and statements made by Trustees and Executive staff recorded in OAT meeting minutes (both Board Minutes as well as Financial Oversight and Risk Committee Meeting minutes). These appear to indicate ongoing areas of concern regarding Financial arrangements, not only at the one Academy specifically mentioned regarding a large payment to a leaving principal (to the value of £70,000) but appears in a Financial Oversight and Risk Committee Meeting held in May 2019.

For clarity a link regarding the document behind the initial concern is repeated below:

http://web.archive.org/web/2021110914553...

--------------------------------------------------------------------------------------------------------------------
BACKGROUND TO SOME PREVIOUS REQUESTS REFERRED TO BY OAT DPO:

Although the majority of my requests have been related to raising concerns regarding child safeguarding at the Ormiston Trust's Academies my request in this case relates to financial concerns. However as the OAT DPO chooses to mention previous requests I will review some of the previous requests and the outcomes as follows:

The OAT DPO will recall that in 2018, following an incident where a child was subject to significant harm whilst in the care of OAT at the City of Norwich School, an Ormiston Academy, an FOI request was made for the full Health and Safety Policy in effect at the time. The main policy and the supporting policies in question can be viewed at this archived link:

https://myarchived.link/OAT-Health-and-S...

It can be seen that Section 18 on Page 36 of the main policy clearly states:

“Sub-policies
The attached sub-policies make up the overall City of Norwich School Health
and Safety Policy to which each academy must have regard.”

The complete list of sub-policies is made on pages 2 & 3 of the main H&S policy where it does state:

“The following sub-policies form the rest of the City of Norwich School Health and Safety Policy” - making them a legal part of the H&S contract.

However an FOI for elements of the sub policies resulted in the CNS initially refusing to acknowledge their existence responding

“I hope this clarifies that we cannot pass to you {the sub-policies} POL-ICE02 or POL-PEG01
as these were never adopted by this Academy and we do not have them to share.”

The full email response from the CNS is at link:

https://myarchived.link/CNS-email-re-sub...

By subsequently reporting this to the ICO the OAT Company Secretary, in office at the time, did later acknowledge to the ICO their existence but then stated that:

“For clarity, this does not mean the City of Norwich School was following these policies or had adopted them, or was holding them.”

For context the full email is archived at:

https://myarchived.link/email-OAT-Compan...

The above case is an example of how, following resistance by the OAT to provide access to the policies ICO intervention resulted in the OAT confirming in writing that although the main H&S policy stated “must” have regard to sub-policies and the OAT themselves admitted to the ICO the H&S policies were mandatory but also at the same time the OAT confirmed the City of Norwich School did not follow the mandatory requirements of the main H&S policy.

The legitimate use of the functionality of the Information Acts is not always limited to successfully obtaining information from an organisation - but by using the legal processes of the Information Acts it can also be established that information does not exist within an organisation by their own acknowledgement – even when it legally or contractually should or must exist.

Academy Trusts are not only legally bound by a variety of laws and mandatory regulations concerning safeguarding, finances and education standards – the Trustees are also accountable and contractually bound, via a funding agreement, with the Secretary of State to ensure compliance with a variety of laws and mandatory regulation/guidance that includes the safeguarding of children.

The Education (Independent School Standards) Regulations 2014, which applies to academies, requires a number of standards such as those that concern the welfare, health and safety of pupils (part 3 of the regulations) and those that concern the quality of leadership in the management of schools (part 8)).

A link to the legislation:

https://www.legislation.gov.uk/uksi/2014...

A link to the guidance for the legislation:

https://www.legislation.gov.uk/uksi/2014...

This is why, although on occasions the OAT were adamant to the ICO that certain documents or information didn't exist or were not followed within the organisation, when it was felt they legally or contractually should have existed and been followed, it resulted in a complaint to the relevant regulatory authorities (e.g. Dept of Education and Ofsted – who lawfully must take investigatory action. Hence the information requests were often linked to a subsequent complaint to those regulatory authorities when it was felt there was a non-compliance with regulations.

A link to the ICO investigation and report (ICO Case Reference: FS50735105 for the above) is viewable on the British and Irish Legal Information Institute Law reports website here:

https://www.bailii.org/uk/cases/UKICO/20...

{In the links the name of the Company Secretary in post at the time is redacted as it is understood their leaving the OAT was announced at the subsequent Board Meeting in Dec 2018}.

As a result of the acknowledgement by the OAT that the CNS didn't fully follow the OAT documented H&S requirements, a concern was raised with Ofsted and subsequently an H&S audit was instructed by them to be undertaken by Norfolk County Council's Children's Services unit Education Quality Assurance & Intervention Service.

This is because valid Health and Safety Policies are one of the mandatory policies academies must have. That is a legal and contractual obligation:

Link to statutory Policies for Schools and Academies:

https://www.gov.uk/government/publicatio...

Full context supplied in the email from Norfolk County Council Children's Services is at this link:

https://myarchived.link/email-from-NCC-C...

By having a main policy that included references to sub-policies “to which each academy must have regard” the OAT invalidated large parts of their own H&S arrangements by claiming the sub-policies were not mandatory and were not held or followed. However in paragraph 19 of the ICO report the ICO mentions that in emails to the ICO the OAT advised that “the suite of mandatory health and safety policies previously written by Handsam” …..

As a result the OAT were required to cooperate with the Education and Skills Funding Agency regarding the provision of updates of the subsequent audit report recommendations as per the OAT statement:

“We have complied with three recent requests from ESFA regarding [child's name redacted] injury … We have fully cooperated with ESFA providing updates on completion of the report recommendations.”

Full context provided in a copy of the email at this link:

https://myarchived.link/email-OAT-cooper...

Therefore in that instance I believe the information requests and subsequent complaints to the DfE were not vexatious but were justified and in the public interest as well as child safeguarding, in order to ensure the safeguarding of children attending Ormiston Academies Trust schools is properly maintained. I feel this should not be considered as “contributing to an already significate accumulated burden of information requests, access requests and other
related communications received from you over recent years” as the OAT DPO feels to mention in their response to my FOI request but I view as a positive benefit for the safeguarding of children when they are away from their parents and under the responsibility of the OAT. From the result of my initial requests to the OAT, followed by ICO involvement and the subsequent concern raised to the ESFA, then ESFA action, the OAT were required to review their H&S arrangements and update the DfE accordingly.

The current FOI request is based on factual records, placed into the public domain, of a number of conversations involving senior figures of responsibility in the OAT (including Trustees and the Chair of Trustees) expressing concerns regarding the Financial matters of the Trust and it's academies.

The OAT will also recall that further requests were made including Freedom of Information and a Subject Access requests regarding child safeguarding records. The OAT will recall that the response to that request was a refusal letter, dated 9th June 2020, from the CEO and Trustee of the OAT, Nick Hudson, who refused the requests as follows:

“We have therefore made the decision to no longer respond to future information requests from you.
Please be advised that any further correspondence from you will be read and filed without acknowledgement. “

Full context of the letter is provided in this link:

https://myarchived.link/NH-letter-to-GS-...

This resulted in another complaint to the ICO. Unfortunately due to the recently introduced GDPR, the ICO, at the time, were under considerable pressure with a backlog of cases hence it did take several months for the case to be processed. However it can be seen from the ICO report regarding the FOI requests that the OAT were told by ICO:

“The Commissioner’s decision is that the Trust has failed to issue an adequate refusal notice in response to the request and has therefore breached section 17 of the FOIA.
The Commissioner requires the Trust to take the following steps to ensure compliance with the legislation
- Issue a response, under the FOIA, to the request.
If and to the extent that the Trust wishes to refuse the request, it should issue a refusal notice that complies with section 17 of the FOIA.
The Trust must take these steps within 35 calendar days of the date of this decision notice.
Failure to comply may result in the Commissioner making written certification of this fact to the High Court pursuant to section 54 of the Act and may be dealt with as a contempt of court.”

The ICO then went on to provide helpful advise and assistance to the OAT that they should address the matter of the refusal of the Trust to respond to an SAR:

“Other matters
Personal data
Whilst the Commissioner cannot compel it to do so as part of a decision notice issued under the FOIA, she would strongly advise the Trust to revisit those parts of the complainant’s correspondence of 11 May 2020 which would fall under data protection legislation and ensure that it has responded in accordance with that legislation. “

The above is documented on the British and Irish Legal Information Institute website under 'ICO Case Reference IC-47115-D9T5', the full report is provided at this link:

https://www.bailii.org/uk/cases/UKICO/20...

The OAT did not issue a refusal notice but instead did then go on to provided responses to the FOI requests after being ordered to by the ICO, however unfortunately the OAT didn't follow the ICO further advice and assistance and failed to respond to the SAR within obligatory timescales and it then required a further complaint and subsequent intervention from the ICO in order to get them to do so. This was done in January 2021 when the ICO gave OAT 28 days to respond to the SAR request advising the OAT:

“As a regulator we look to organisations to effectively manage and resolve the data protection complaints they receive. When your customer comes to us to complain, they are in effect telling the regulator that they believe you are breaking the law. Reports of this kind are something that we will treat seriously and robustly. “

Its a matter of concern to me that the OAT, responsible for the safeguarding of in excess of 30,000 children and several hundreds of thousands pounds of taxpayer funding, could be involved in breaking the law.

Full context in link:

https://myarchived.link/ICO-to-Ormiston-...

However, unfortunately, after 28 days and still no response from the OAT, a member of the OAT Executive wrote to me informing me there would yet again be a further delay past the 28 days ordered by the ICO. This is evidenced in the following link:

https://myarchived.link/SAR-Extension-to...

With such extensive delays caused by the documented reluctance of the OAT CEO & Trustee Nick Hudson to respond to the requests in a timely manner in accordance with the requirements of the law, and including further documented delays announced by an Executive staff member to delay my requests (around 9 months total from May 2020 to February 2021) close scrutiny of the response was made as to what could be the cause. When the information was finally received it was found to contain a report, authored by Norfolk County Council Children's Services (NCCCS) regarding a child safeguarding investigation. It was noticed that this document displayed evidence to have been altered from the original as authored by NCCCS and enquiries with NCCCS did reveal that at some point content had been deleted from their original report in comparison to the one OAT provided.

As this was an important child safeguarding investigation report created by NCCCS the alteration of it from the original became a matter of concern and this concern was raised with the ICO, Norfolk County Council Children's Services, the Regional Schools Commissioner and the Department for Education as well as Ofsted who have recently been contacted again as I understand an inspection of the CNS was conducted prior to the New Year.

Partial correspondence between ICO & OAT related to this matter is at the provided link below. It was necessary to use further SAR and FOI requests to identify the point at which the report was altered from the original. It transpired that the report was modified by the OAT Safeguarding Lead and Safeguarding Manager who, after further complaints to the ICO was later acknowledged to the ICO after the ICO advised the OAT: “Just to clarify it can be considered an offence, for a person to alter or conceal information with the intention of preventing disclosure of all or part of the information making the request.”

A copy of some of the correspondence between the ICO and the OAT about that case is shown below.

In order to safeguard the child concerned some information that identifies the child has been redacted but it can be seen that the OAT admitted that their Safeguarding Manager and Safeguarding Lead worked together to alter the information in the report in order to remove disclosure of “unprofessional” and “inappropriate” actions or behaviours that could “identify any other individual. This includes any actions or behaviours described about those individuals". This was taken to mean actions of third parties and after receiving the unmodified original report from the Norfolk County Council Children's Services and comparing it to the copy supplied by the OAT the identity was found to be of OAT personnel.

Full context of the correspondence is at the following link:

https://myarchived.link/ICO-CASE-48751-Q...

This case highlights how important documents can end up being amended for some reason or another, including attempting to conceal “unprofessional” and “inappropriate” behaviour of OAT staff. The means of discovery can be a lengthy and complex process.

Another instance is ICO case reference RFA0872602 where documents consisting of notes taken during a safeguarding conversation regarding a rapidly developing medical episode involving a child whilst on OAT premises, the documents were later claimed by the OAT to not exist. This again involved Information Requests and subsequent ICO involvement. Although the ICO stated that they had no authority to investigate the OAT claim that “likely that these {notes} were shredded shortly after the event” it did reveal a lack of compliance by the OAT with their own document retention policies. This is because the OAT Records Retention Policy requires safeguarding information to be retained until the child reaches 25 years of age: as per the requirements of the 'Keeping Children Safe in Education Statutory Guidance'. Hence there is now an entry in the OAT Child Online Protection Management System (CPOMS) that points to other records or information that no longer exist because they were 'shredded shortly after the event'.

A link to the KCSIE Statutory Guidance:

https://assets.publishing.service.gov.uk...

A copy of the OAT Records Retention Policy is archived at the following link:

https://myarchived.link/OAT-record-reten...

An excerpt from the system that shows the Pastoral Manager (name redacted) confirms “handing all that was spoken about {in the safeguarding meeting}” to the Head Teacher and Deputy Head Teacher. According to the OAT response to the ICO, it was 'likely that these {notes} were shredded shortly after the event'.

Link to copy of record {redacted to protect the identity of the child}:

https://myarchived.link/pastoral-record-...

A copy of the relevant ICO Decision Notice (RFA0872602) is archived at this link:

https://myarchived.link/ICO-case-referen...

It does show that the although legislation and CNS policies indicating compliance with legislation meant that CNS would or should have kept the notes it was the ICO opinion not evidence that it held the notes at the time of the request. That is the OAT acknowledged to acting in non-compliance of their own records retention policy as any safeguarding documents (including notes of meetings) must be stored until the child reaches 25. The OAT did not offer an explanation as to why the safeguarding notes were shredded so quickly.

The above all demonstrate the validity of my previous requests and that they raised child safeguarding concerns as well as H&S concerns at the time. It also demonstrates once again how a request can elicit confirmation that documents or information are not held {e.g. shredded} when legally and contractually they should be held. It does beg the question of why a notes concerning a child safeguarding conversation with a pastoral manager were shredded.

The above is also not an exhaustive list, there are other incidences such as a complaint I made regarding a contractor employed by the OAT, who was acting as a data processor/controller and in receipt of a quantity of personal information to their systems, including that of children, all without their consent. This was during a period the contractor, whilst acting as a data controller/processor receiving sensitive personal information including that of children, on the contractor's own systems, without their consent. It's understood that the contractor does now appear on the ICO register as from 10th December 2019 but the personal data in question was transferred to their systems prior to that date. An example of the sensitivity of some of the data is shown in a copy of an email dated 1st October 2019 where the sender of the email queries that Children's Services information should be handled by them:

https://myarchived.link/OAT-email-re-Chi...

Of course this is all supported by documentary evidence including emails from the contractor themself. Should the OAT DPO, or any interested party, wish to view that contractor's correspondence I am happy to provide, here in annotations, a link to the evidence. In the meantime I will just present a link to an email from the OAT that confirms that the OAT had contacted the contractor who had then been ordered to delete all personal information held on his systems as per my information concern request:

https://myarchived.link/OAT-Confirm-Dele...

The above links show that the contractor had been in receipt and processing on his own systems of information regarding a child and sensitive information concerning Children's Services information about the child, without the appropriate consents as required by the GDPR.

The OAT DPO will recall that around the time of the above a number of complaints were made to the ICO about the OAT information practices. During 2019 the ICO conducted a Data Protection Audit of the OAT and found a number of areas where urgent remedy was recommended. These included but are not limited to:

-- Update all existing contracts with data processors so that they fully comply with Article 28 of the GDPR.

--Put in place a formalised DPIA procedure, i.e. a prescribed risk assessment for high risk processing which assesses the impact on the rights and freedoms of the data subjects and sets out the subsequent mitigations to control these risks.

-- Ensure that there is oversight of additional or specialised training used by the academies. It is important that there is mandated criteria for the third party providers such as an assessment or minimum pass rate.

-- Put in place a system of formalised assessment of the legality of data sharing. This should include a determination of whether there is a lawful basis for sharing, an express or implied legal power; and in the case of special category data that the necessary condition for processing in the GDPR and Data Protection Act 2018 can also be satisfied

-- Ensure there are data sharing agreements in place in relation to controller to controller data sharing arrangements and that they include high level matters such as setting out the common rules to be followed by all partners. They should also include, for example, formalised arrangements for the reporting, investigation and resolution of security incidents

These items of concern are very similar to the items of concern I raised in complaints to the ICO. A link to the ICO Audit report is available here:

https://myarchived.link/ormiston-academi...

Additionally, in 2021 a number of concerns were raised with the Education and Skills Funding Agency (an Agency of the Department for Education). These included, but were not limited to, safeguarding concerns (re: the alteration of safeguarding investigation reports to remove reference to 'unprofessional' and 'inappropriate' behaviour of OAT staff) as well as Data Protection concerns (regarding the OAT reluctance to attend to information requests in a transparent and timely manner). The ESFA response, regarding the Information Rights concern clearly states they have:

“... sought assurances from the trust ‘s CEO {Nick Hudson} on how the ICO findings would be implemented and how future practice would be monitored. “

Clearly the ESFA holds OAT CEO and Trustee, Nick Hudson, to account for any Information Rights failings in implementing compliant Information Rights Practice. This is rightly so as effective Data Protection is not only a matter of the GDPR/UK Data Protection Act 2018 but it is also a contractual requirement the Ormiston Academies Trust as part of their funding agreement with the Secretary of State. The funding agreement is signed, on behalf of the Ormiston Academies Trust, by Nick Hudson, CEO and Trustee of the Ormiston Academies Trust. A copy of the signed funding agreement can be viewed here:

https://www.ormistonacademiestrust.co.uk...

A copy of the ESFA report into the response regarding seeking assurances from the OAT CEO can be viewed here:

https://myarchived.link/ESFA-CASE-CI-007...

So it is confusing that Nick Hudson, CEO and Trustee of the OAT signs an agreement for funding with the Secretary of State then has to be told by the ICO to comply with one of the clauses of the agreement or face contempt of court proceedings and additionally the ESFA (an agency of the Department of Education) having to request assurances that the CEO will comply with the requirements of the funding agreement the CEO has signed. This is bound to attract requests under the Information Acts that by their very nature are in the public interest and are not vexatious.

The OAT DPO goes on to state that current costs of responding to two recent FOI requests as follows:

“The resource limit is £450. It may be helpful for you to know that the
estimated total costs for responding to this request (parts 1- 6) and your
request of the 9^th November is £175.”

The OAT DPO provides no evidence to support the claim however. I believe the ICO will require (a) tangible evidence of the costs incurred and (b) a breakdown of how the costs apply to the individual FOI requests and not as a total of two FOI requests. I understand the ICO prefer to deal with any FOI dispute cases individually not collectively.

When making allegations indicating a requester's motivations are vexatious there is a need to support those allegations with tangible evidence, especially when the allegations are made publicly as the OAT DPO has – currently the OAT DPO does not provide that evidence at all – merely publicly stating the claim, stating:

“When assessing this most recent request against this guidance we are
concerned that this request does meet criteria outlined in that guidance
that identifies a request as vexatious ..”

However, due to the OAT DPO publicly mentioning a Section 14 (vexatious) requests application regarding my FOI request, I am now duty bound to publicly provide all of the above evidence, and other evidence, to support my claim that my request is valid and in the public interest. I do so with documentary evidence as shown above.

Regarding some parts of my FOI request the OAT DPO then goes on to state:

“As a result of these considerations we will not be responding to the
second part of this request (parts 7–10) at this time and respectfully ask
that you consider the resubmission of these question as a separate request
and after an appropriate interval.”

However this is not compliant with ICO guidelines as a valid refusal, the OAT should either formally issue a refusal notice for the requested items or provide them, not ask for them to be requested again at a later date. I view the notion to ask a requester to re-submit parts of an FOI is as an enticement to submit overlapping and frequent requests. The ICO are clear on the procedure for refusals to respond to an FOI and this is documented in ICO case number IC-47115-D9T5 where the OAT were specifically told to either issue a proper refusal notice or provide the information, or in the absence of either the OAT could face ICO action including the possibility of Contempt of Court proceedings. The link to that order is documented on the British and Irish Legal Information website at:

https://www.bailii.org/uk/cases/UKICO/20...

The OAT DPO, Laurence Boulter is the author of the OAT Data Protection and Freedom of Information Policy where it clearly states the procedures for the OAT to refuse FOI requests.

The policy, marked as authored by Laurence Boulter and dated May 2021 making it very up to date with ICO guidelines and the requirements of the UK DPA 2018 is viewable here:

https://myarchived.link/oat-data-protect...

--------------------------------------------------------------------------------------------------

REGARDING BOARD MINUTES:

Regarding the DPO claim that the Board Minutes referenced were not Board Minutes but personal notes of the Clerk to the Board:

Quote from response:

“You requested information around financial concerns you had after reading
unedited personal notes taken during a Board meeting.”

For clarity the document in question, showing Sunita Yardley-Patel as 'Clerk to the Board' and thus the minutes recorder, is viewable at this link:

http://web.archive.org/web/2021110914553...

This document does not appear on the Ormiston Academies Trust website but is superseded by a revised document at the following link:

http://www.ormistonacademiestrust.co.uk/...

For completeness a copy of the revised document is now archived at the following link:

https://myarchived.link/oat-board-minute...

Both documents clearly state that they are Board Minutes albeit the later version currently displayed on the OAT website is an altered version in relation to the one referred to in my original request. There is no reference to the content being personal notes which would have been taken by the Clerk to the Board. For reference the Board Minutes document shows that the Clerk to the Board is Sunita Yardley-Patel.

Sunita Yardley-Patel is also the OAT Head of Governance, and the current OAT Company Secretary as well as being a director/trustee of the Shine Academies hence I question the notion that someone of such high position would not be aware of Company Law or the requirements of the Academy Trust Handbook regarding the importance of correctly documenting Board Meetings. Hence I retain the belief the document quoted is a Board Meeting minutes document.

The Academy Trust Handbook states:

2.51 The trust must make available for public inspection:
- the agenda for every meeting of the trustees, local governing bodies and committees
- the approved minutes of each meeting
- any report, document or other paper considered at each meeting {this should include presentations, electronic or otherwise}.

https://assets.publishing.service.gov.uk...

The Academy Trust Handbook also requires Academy Trusts to appoint a 'Governance Professional (Clerk to the Board)' whose role is to:

contribute to the efficient functioning of the board by providing:
- guidance to ensure the board works in compliance with the appropriate legal and regulatory framework, and understands the potential consequences of non-compliance
- independent advice on procedural matters relating to operation of the board
- administrative and organisational support.”

The two documents largely are the same information, except the original version contains more detail. For example in the earlier version it clearly states that Dr Paul Hann (Chair) says “PH – why is everyone else doing compliance and not CNS? “ as well as another academy being mentioned. The difference is that in the altered version it is changed to Dr Paul Hann asking “PH asked why a few academies have areas of non-compliance? “

Therefor much as the OAT DPO states the Board Minutes mentioned to be viewed as personal notes they are clearly marked as Board Minutes of the meeting held on the 14th March 2019. I believe all the evidence points to the document being official Board Minutes.

There are other examples which can be provided to support that any other information requests were valid but I will await any 'Section 14 Vexatious Request' refusal from the OAT DPO as that will require the intervention of the Information Commissioner's Office when they can be supplied to the ICO and other relevant authorities if needed.

The OAT DPO, in reference to my FOI request, then goes on to state:

“You then go on to ask a series of questions concerning the “minutes” of a
further unidentified meeting. In this part of your request you ask a
series of questions about the employment of staff on an iR35 (off payroll)
basis across the Trust and associated payments to the HMRC.

It is not clear how the two parts of the request are related.”

Thank you for asking for that clarification of this item, the relationship with all the questions within the original FOI is that they all relate to financial concerns: in general financial concerns regarding an 'unexpected' payment of £70,000 to a 'leaving principal' as well as financial concerns regarding reclaiming (or not reclaiming) taxes paid to HMRC where payments to self employed staff did not have the taxes correctly deducted from payments made by OAT in accordance with the 'IR35' rules.

Regarding the comment about minutes of a 'further unidentified meeting'. Thank you for asking for clarification on that matter. I did omit to identify the meeting details which I can clarify took place as follows:

Financial Oversight and Risk Committee Meeting Date: Wednesday 15 May 2019 Time: 12.00 pm Location: Thistle Holborn, The Kingsley, Bloomsbury Way, London, WC1A 2SD

Although the minutes do not now appear on the OAT web site under the heading 'Minutes (Commitee Meeting Minutes) at the following link:

http://www.ormistonacademiestrust.co.uk/...

The November 2019 minutes on the OAT website do refer to the May 2019 minutes as being approved.

The relevant section of the minutes referred to is is 'Section 7 – Report on HMRC Visit'. This is where Sarah Vout, the OAT Head of Finance at the meeting spoke about the “IR35” matters.

I hope the above now allows the OAT DPO to identify the relevant document, I would like to suggest that it may be appropriate for the OAT to update their website with these meeting minutes now. They should remain in existence as it is a requirement for such meeting minutes to be kept for a number of years (10 years at least I believe). Should the OAT DPO require further clarification to identify the meeting minutes in question, please do not hesitate to ask.

The OAT DPO then goes on to state:

“You will be aware through our previous correspondence that we are
concerned about some of the behaviours evident in your interactions with
OAT. When you communicate with us we assess your communications against a
number of indicators of vexatious behaviour. These can be found in the ICO
publication “Dealing with vexatious requests (section 14)”. 
When assessing this most recent request against this guidance we are
concerned that this request does meet criteria outlined in that guidance
that identifies a request as vexatious, as follows. 
Frequent or overlapping requests  
“The requester submits frequent correspondence about the same issue or
sends in new requests before the public authority has had an opportunity
to address their earlier enquiries.”
Dealing with vexatious requests (section 14) Page 8”

When submitting my request I did clearly state it should not be confused with a previous request that was regarding Health and Safety Concerns. The two requests are different areas. I believe the OAT DPO's interpretation that the current request (Financial Concerns) overlaps a previous request (Health and Safety Concerns) is mistaken. I believe the interpretation of ICO guidance on this matter is if I had submitted a further request regarding Health and Safety concerns that largely repeated or 'overlapped' the previous FOI then that could be construed as a 'Frequent or overlapping' request but the two are very different.

With the history of the OAT taking a 'request denied' approach to a number of my requests (as previously detailed) resulting in ICO intervention (also as previously detailed) then the FOI legal system would grind to a halt given that one request took around nine months to be completed – this is the request where Nick Hudson, the CEO and Trustee of the OAT personally intervened to write to me to refuse the requests and it resulted in the ICO ordering the OAT to respond appropriately or face action from the ICO which could include contempt of court.

i.e. “Failure to comply may result in the Commissioner making written certification of this fact to the High Court pursuant to section 54 of the Act and may be dealt with as a contempt of court.”

(Full detail at the British and Irish Legal Information Institute at link:
https://www.bailii.org/uk/cases/UKICO/20...).

As detailed previously the OAT response contained a document authored by Norfolk County Council Children's Services Department that detailed a Child Safeguarding investigation that turned out to have been altered by the OAT Safeguarding management to remove reference to “unprofessional” and “inappropriate” behaviour of OAT staff.

The OAT DPO has gone on to make allegations as follows:

“This request contains two sets of unrelated questions that asks OAT to
consider information contained in two unrelated documents and this in
fact constitutes two requests. The principle of maintaining separation
between requests would seem to be one that you recognise:”

However all the questions in this request are related by the nature of the subject 'Financial Concerns'.

The OAT DPO then states the request is considered to be two different requests implying I made 3 different requests in 11 days that overlap. The argument fails though because it is one request not two and the requests submitted are not overlapping.

I therefore request the OAT to review the refusal to respond to my FOI requests 7 to 10 as in my original FOI. However when doing so I wish to clarify the request FOI 10 as follows:

Originally I asked:

“Regarding the potential exposure to VAT, the minutes show £50k was included in the budget for 19/20.
FOI (10) What was the final total exposure to VAT for 19/20 for this item?”

I wish to clarify that my public interest in this VAT item is only if any of the “IR35” payments to staff also involved VAT payments. Should this not be the case then I would withdraw FOI item 10, however I would like the OAT to confirm or deny if any of the payments to “IR35” staff included VAT requirement or payments. In the event that any payments to “IR35” staff do consist of VAT payments then I will submit further requests to consider these payments.

For clarity, within this request for an internal review, I will repeat the original FOI questions, together with the responses and annotate if the response is accepted or a request for review is made:

My request FOI 1:    Please clarify (expand) the use of the acronym "FSM" used in the March
2019 Ormiston Board Minutes meeting 
OAT response: 1. FSM is an initialism of “Free School Meals” 

This response is accepted. Thank You.

My request FOI 2:    Why was the payment to the 'leaving principal" unexpected? 
OAT response: 1. Data not held by the Trust. 

Please review this response, the statement made in the OAT March 2019 Board Minutes is very clear that the payment was unexpected. There would be a reason for this, e.g. lack of financial control. The OAT is a recipient of money from the public purse and has a duty to regulate and control expenditure with propriety. This is part of the funding agreement signed by Nick Hudson, CEO and Trustee of the OAT.

My request FOI 3:    What was the nature of the £70,000 payment to the leaving principal?
 
OAT response:  1. A contractual payment. 

Please review this response by expanding on the contractual purpose. e.g. redundancy, severance payment, invoice submitted by the 'leaving principle', non-disclosure agreement?.
e.g. what is the class of the payment as described in the OAT DPO response to my FOI item 4 (The OAT DPO states “There is no requirement to seek approval from the EFSA for this class of payment. This payment adheres to EFSA guidelines.”)

The ESFA requirement of Academy Trusts is as follows:

“The Trustees are responsible for keeping adequate accounting records that are sufficient to show and explain the charitable company’s transactions and disclose with reasonable accuracy at any time the financial position of the charitable company and enable them to ensure that the financial statements comply with the Companies Act 2006. They are also responsible for safeguarding the assets of the charitable company and hence for taking reasonable steps for the prevention and detection of fraud and other irregularities. The
Trustees are responsible for ensuring that in its conduct and operation the charitable company applies financial and other controls, which conform with the requirements both of propriety and of good financial management. They are also responsible for ensuring that grants received from ESFA/DfE have been applied for the purposes intended.”

My request FOI 4:    Did the ESFA give prior approval of the £70,000 payment to the
leaving principle? 

OAT response: 1. No 

Thank you for this response which is accepted. I understand however that any payments over a certain limit to staff has to be approved by ESFA, I understand this to be £50,000 but I now need to clarify this with the ESFA. I will place a link in annotations of this request when the request to ESFA is made by WDTK.

The Academy Trust Handbook (Part 5) clearly states:

“Certain transactions by public bodies may fall outside their usual planned range of activity, and may exceed statutory and contractual obligations. HM Treasury calls these special payments, (see annex 4.13 of Managing Public Money), and are subject to greater control than other payments. They include:
staff severance payments
compensation payments
ex gratia payments”

A copy of the Academy Trust Handbook is available at:

https://www.gov.uk/guidance/academy-trus...

My request FOI 5:    Should it be the case that the acronym "FSM" does mean Free School
Meals supplement and the wording indicates the funding was used to rectify
the unexpected payment of £70,000 to the leaving principle ("NEW - had to
pay an unexpected £70k to leaving principal. FSM funding will help rectify
this") then is the above interpretation correct? Are ESFA aware of this
use of the funding? 

OAT response:  1. No. The payment was made within ESFA guidelines. 

Please review this response by clarifying what the ESFA guidelines the OAT DPO refers to and providing clarification of the class of payment.

My request FOI 6:    What was the total amount of Free School Meals funding allocated to
the Ormiston Academies Trust and how much was allocated to the NEW academy
by ESFA for 2019? 
OAT response:  1. Data not held 

Response accepted although it is a matter of concern that the data is not held.

The OAT DPO appears to acknowledge that a payment of almost £300,000 from the public purse to the Ormiston Academies Trust by the Dept of Education for the purposes of Free School Meals for disadvantaged children cannot be accounted for. Although there is some reference information from the OAT March 2019 Board Minutes that the grant could be used towards mitigating an unexpected payment of £70,000 to a leaving principle.

The ESFA requires full accounting for any such payments made to schools and academy trusts. I had contacted the Department of Education and have been given the following information:

A spreadsheet of FSM payments made to all schools and academy trusts for the financial year 2018/19. This can be viewed at the following link:

https://myarchived.link/free_school_meal...

By extracting all the Ormiston Academy Trust information it can be seen that a total of £279,840 was paid from the public purse to the OAT for the purposes of Free School Meals for disadvantaged children. A total of £25,080 from that was specifically for Free School Meals at the Ormiston New Academy.

Https://myarchived.link/Ormiston-Free-Sc...

A copy of the Free School Meals Guidance for 2018/19 is archived at the following link:

https://myarchived.link/FSM_Supplementar...

My request FOI 7:    How many individuals were employed by Ormiston Academies Trust or their individual academies on an "off payroll" or "IR35" basis from 2017
to the [the] present. 

OAT response 1. Please resubmit this question as part of a new request. 

Please review this response and either issue a formal refusal notice that complies with ICO guidelines or provide the information,

My request FOI 8:     How much is the total Tax and NI payments have the Ormiston been
required to pay to HMRC for these individuals broken down by 2017/18,
2018/19 and 2019/20 tax years.

OAT response 1. Please resubmit this question as part of a new request.
 
Please review this response and either issue a formal refusal notice that complies with ICO guidelines or provide the information,

My request FOI 9.    How much is the total of the payments been reclaimed by Ormiston
from the individuals that was paid prior to the HMRC visit that should
have been deducted from the payments to the individuals since 2017 but was
not? 

OAT response  1.  Please resubmit this question as part of a new request. 

Please review this response and either issue a formal refusal notice that complies with ICO guidelines or provide the information,

My request 10.  What was the final total exposure to VAT for 19/20 for this item 

OAT reponse 1. Please resubmit this question as part of a new request. 

Please review this response and either issue a formal refusal notice that complies with ICO guidelines or provide the information. When reviewing the response please bear in mind that I am only interested in this item if payments to “IR35” staff involved VAT payments.

A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.whatdotheyknow.com/request/f...

Yours faithfully,

Gary Symonds

Dear OAT - Data Protection Officer,

Thank you for updating me on the progress of my request for internal review of the Ormiston Academies Trust's response to my FOI request made on the 24th November 2021 regarding Finance Concerns.

I believe the scheduled date of 18th March 2022 falls outside the requirements of the FOI requirements. This is because the Act allows 20 working days to respond which means the date of response should be no later than 16th March. In the response it states "due to half term holiday". However the ICO guidelines state that academies may take into account "non-school days" as non working days but Academy Trusts cannot claim non-school days.

This is acknowledged within Trusts Data Protection and Freedom of Information Policy authored by the previous Ormiston Academies Trust Data Protect Officer, Laurence Boulter.

A copy of that policy is archived at the following link:

https://myarchived.link/oat-data-protect...

As there have been significant delays in the response due to the actions of the previous DPO I believe the Trust is now in breach of the FOI Act although this is to be determined by the ICO.

The initial response made by the previous DPO also stated that Board Minutes for the 14th March 2019 that I based my original FOI request on were not official Board Minutes but were "unedited personal notes taken during a Board meeting". However I would like to point out that although the copy referred to was a copy archived on the Internet Archive at the following link:

http://web.archive.org/web/2021110914553...

The copy was archived from a response, by the Ormiston Academies Trust to an FOI made via the WhatDoTheyKnow.com system at the following link:

https://www.whatdotheyknow.com/request/r...

A direct link to the attached Board Minutes is here:

https://www.whatdotheyknow.com/request/5...

Therefore the Board Minutes in question were stated by the Trust as being Board minutes on the 15th August 2019 but then the previous Trust's DPO stated they were not Board Meeting Minutes but were "unedited personal notes taken during a Board meeting"

You will see from the links supplied above that the two copies of the Board Minutes referred too are exactly the same, meaning that either the initial response for copies of the minutes was misleading or the previous DPO's response stating "unedited personal notes taken during a Board meeting" was misleading.

I'm concerned that one or the other statements about the Board Minutes referred to is misleading and I seek clarity from the Trust regarding this discrepancy of statements regarding the 14th March 2019 Ormiston Academy Trust Board meeting minutes.

Yours sincerely,

Gary Symonds