Dear Northumbria Police and Crime Commissioner,

According to your response to my last FOIA request. copied below this one, you have stated " I further confirm that the OPCC for Northumbria is not a competent authority under Schedule 7 of the DPA 2018 and I can confirm that any reference to this has been removed from the OPCC website."

Under the requirements of law any data controller processing information in relation to law enforcement and or prosecution must be a "competent Authority" and yet my formal allegation of crime against the Chief Constable of Northumbria Police was processed by your office despite your lack of competent authority status.

Were you lawfully allowed to undertake any action in relation to any complaint regarding the police if you were not a competent authority at the time?

If you were please specify which legislation allows this apparently unlawful action.

Your Rights document which accompanied the previous response shown here https://www.whatdotheyknow.com/request/6... states "Prior to lodging a formal complaint you are welcome and encouraged to discuss the decision with the case officer that dealt with your request."

I have telephoned your office and spoken to Mr Duffy, the person who signed the previous response, only for him to deny he was the case officer and refuse to discuss the matter.

He specified he would find out who the case officer was and have them contact me, however the only person to contact me was your DPO, Ms Hayley Young, who stated ""I will not discuss any matters concerning yourself, Northumbria Police or the OPCC for Northumbria with you verbally."

I responded direct to Ms Young on the 10th of November asking her to confirm if she was the case officer who produced the response and despite a further 10 days elapsing she has not responded.

Please therefore identify the case officer responsible for the response to this request https://www.whatdotheyknow.com/request/c...

Please also provide any policy procedure or lawful reason for your refusal to afford me the right to discuss the content of that response with the case officer concerned.

If there is no policy, procedure or lawful reason for that refusal, please provide details of the process for raising a complaint of discrimination against your office for your failure to afford me the rights given to all other applicants.

Regards

W Hunter

Yours faithfully,

W Hunter

Mr W Hunter

6th November 2020

Dear Mr Hunter

Provision of information held by Northumbria Police & Crime Commissioner made under the Freedom of Information Act 2000 (the 'Act').

Thank you for your e mail dated 15 October 2020 in which you made a request for access to certain information which may be held by the Police and Crime Commissioner for Northumbria.

As you may be aware the purpose of the Act is to allow a general right of access to information held by a Public Authority (including the Police Crime Commissioner), subject to certain limitations and exemptions.

You asked:

According to information previously published under the auspices of Vera Baird the office of the PCC for Northumbria is defined as a competent authority under schedule 7 of the DPA (https://www.legislation.gov.uk/ukpga/201...)

1. Please specify what if any requirements and or checks were undertaken on any part of, or person within, the office of the PCC before this definition/ certification was applied to your office.

I can confirm that revision has been undertaken as part of our response to your request. I further confirm that the OPCC for Northumbria is not a competent authority under Schedule 7 of the DPA 2018 and I can confirm that any reference to this has been removed from the OPCC website. We take this opportunity to thank you for bringing this matter to our attention.

2. Please specify if there is any time limit applied to the "Competent Authority" certification? applied to your office.

As per our response to question 1, however in respect of time limits applied to the any competent authority certification, no data is held.

3. Please specify if there is any requirement for any checks or measures of any description to ensure maintenance of any "competencies" regarding this description and if so

As per our response to question 1, however regarding requirements for checks or measures to ensure maintenance of competencies, no data is held.

4. Please specify what they are and how often they are required to be undertaken.

As per our response to question 1. No data is held.

5. Please confirm whether you have any policy or procedure in place to address Data Security Incidents, and if so provide a copy along with any definitions for and or examples of any risk ratings used or incidents that have already happened.

The OPCC for Northumbria has adopted the policy and procedure attached. Risk ratings are rated as low, medium and high and are calculated in accordance with the format attached. In terms of any incidents that have occurred, I confirm that no data is held.

In the two word documents provided to Mr Knight, which when downloaded from his response show a date of 10/15/2020 being todays date,

6. Please provide any date information detailing when those formats were originally brought into use.

I ask because the DPA 2018 came into force on the 23 May 2018 from which point the time limit for compliance with a SAR became one calendar month, and yet your template, in use apparently for the last 29 months has been unlawfully quoting the time limit for compliance with the DPA 1998.

In addition the GDPR became law in the UK on the 25 May 2018.

Both the DPA 2018 and GDPR state that where the data controller holds a reasonable belief that a Subject Access Request originates from a person not entitled to receive that information then the data controller may request two further forms of ID before complying with that request.

Your word document "SAR ACK Letter" to Mr Knight specifies a "Requirement" for two forms of ID without specifying any "reasonable belief" that the applicant is not entitled to receive the information requested.

In addition that standard template letter identifies the required ID to be "A copy of two identification documentation to contain your name in full and date of birth, the other to contain your name and current address, e.g. birth certificate, current passport, driving licence, medical card or utility bill." (The grammatical errors are copied directly from the Original)

The response from Mr Payne to Mr Knights request includes the statement "it may be worth noting that this office has yet to receive a subject access request other than by email since the introduction of the Data Protection Act 2018."

No information held. From the records reviewed, the date of the document defers to the date it is opened. The wording of this letter is the wording that is currently held as a revised acknowledgement letter is yet to be required. The letter your refer to has not been used/sent since the introduction of the GDPR 2018. If an acknowledgement is requested in the future, a relevant and applicable acknowledgement letter would be used.

7. Please specify how many SARs have been received by the OPCC since the 23 May 2018.

Seven SARS have been received into the OPCC for Northumbria since the 23rd May 2018.

8. Please specify how many of those recorded SARs arrived by email and how many by surface post or in person hand delivered.

Of the seven SARS received, six were received by email, one by post.

Of the total number of SARs ,

9. Please specify how many were required to provide the two forms of ID prior to your compliance with the requirements of law.

Of the SARS received into the OPCC for Northumbria since the 23rd May 2018, identification documentation to satisfy the requirements set out in our guidance is held for six applications. Accordingly, the OPCC for Northumbria was satisfied as to the identity of the individuals for those applications.

10. Please specify for how many of those requests any member of the OPCC detailed any "reasonable beliefs" or indeed any "unreasonable Beliefs" or any beliefs at all that the SAR had originated from anyone other than the lawful recipient and provide a list of the types of belief so specified.

As per our response to question 9, identification documentation was received from all applicants. Accordingly, of those where documentation was evident, we were satisfied that the applications were legitimate and sufficient ID documentation ensured that we were satisfied as to the applicants identity. One individual did not provide identification documentation. There is no “list” of beliefs that you refer to in this question and so no information is held for this part of our response.

11. In relation to the SARs received, please specify how many were received from a communication source which the OPCC had not been in regular communication with prior to the SAR being received.

No information held, we do not record whether people are in “regular correspondence” with the OPCC or not. All requests were from people that had previously entered into some form of correspondence with the OPCC.

12. In relation to the SARs received, please specify how many of the data subjects, who had been in communication with the OPCC for the OPCC to hold any data regarding them, had as part of their recorded information held, "verified" (i.e. checked with a secondary source other than the data subject, or by official documentation) their Full Name and Date of Birth, or their name and postal address prior to the SAR being received.

Of the SARS received, data was held for each individual that provided limited identification to the OPCC for Northumbria. Proof of identification to verify those individuals details was used for six of the SARS to satisfy the OPCC for Northumbria prior to processing of any data in accordance with the SAR. One applicant has not provided sufficient identification documentation that is necessary to verify that persons identity.

Since I would assume from Mr Paynes comment that all SARs had arrived by email, (a form of communication in which it is not usually accepted to include a surface mail return address, and if you reasonably believe the originator is lying about their identity then you must reasonably believe they would lie about their postal address also) and I believe there is no possible way the "required" documentation can possibly verify the data subjects identity in relation to the records held by the OPCC.

13. Please specify any policy, procedure or document of any description which clearly specifies how an identity document showing a full name and date of birth along with a name and postal address can possibly be used to identify a data subject in relation to the information held, who's only avenues of communication have been with the OPCC via Email and or Telephone.

The Data Protection procedure advises that "Individuals must provide evidence of their identity and address by supplying copies of at least two official documents which between them clearly show their name, date of birth, current address and signature." The Data Protection Policy does not specifically relate to the scenario set out in your question.

14. Please also provide a link to or a copy of any provision within the DPA 2018 or GDPR which states that any Data Subject can only request information be sent to a registered postal address.

I refer you to the legislation which is publicly available so that you can assess whether the information you request is available.

15. Please specify any policy or procedure which would allow Mr Scott Duffy, Director of Confidence, Standards and Statutory Reviews within the OPCC to respond to communication addressed to Ms McGuinness almost immediately upon receipt and where that ability is specified in his stated role profile.

There is no policy or documented procedure relating to this part of your request and accordingly, no information is held.

16. Finally, please specify the contact details for the person and the organisation responsible for awarding the OPCC Northumbria the accreditation of being a "Competent Authority" as I wish to contact them regarding having that accreditation removed forthwith.

Please refer to our response at question 1.

You may be interested to know that Northumbria Police & Crime Commissioner routinely publish information via the Disclosure Log. The aim of the Disclosure Log is to promote openness and transparency by voluntarily placing information into the public arena. The Disclosure Log contains copies of some of the information that has been disclosed by Northumbria Police & Crime Commissioner in response to requests made under the Freedom of Information Act 2000. Whilst it is not possible to publish all responses we will endeavour to publish those where we feel that the information disclosed is in the public interest. The Disclosure Log will be updated once responses have been sent to the requester. The information we have supplied to you is likely to contain intellectual property rights of Northumbria Police & Crime Commissioner. Your use of the information must be strictly in accordance with the Copyright Designs and Patents Act 1988 (as amended) or such other applicable legislation. In particular, you must not re-use this information for any commercial purpose. How to complain If you are unhappy with our decision or do not consider that we have handled your request properly and we are unable to resolve this issue informally, you are entitled to make a formal complaint to us under our complaints procedure which is attached. If you are still unhappy after we have investigated your complaint and reported to you the outcome, you may complain directly to the Information Commissioner’s Office and request that they investigate to ascertain whether we have dealt with your request in accordance with the Act.

Yours sincerely

Scott

Scott Duffy
Director of Confidence, Standards and Statutory Reviews.

Dear OPCC FOI Mailbox,

The email was sent to you on the 20 Nov 2020 and the time limit for compliance starts from the time your system received it, not when you actually decided to read it.

The 20 working day time limit expires on the 18th of December and not the 21st as you erroneously specify.

In addition I would again draw your attention to the wording of the FOIA as written, which specifies under section 10

"10.—(1) Subject to subsections (2) and (3), a public authority must comply with section 1(1) promptly and in any event not later than the twentieth working day following the date of receipt."

The key wording in law is " IN ANY EVENT NOT LATER THAN THE TWENTIETH WORKING DAY FOLLOWING THE DATE OF RECEIPT"

Your automatic response stating "Although every effort will be made to ensure a response is provided within
statutory deadlines, due to current circumstances delays may be unavoidable" appears therefore to be stating that your organisation habitually breaks the requirements of law and fails to comply with the legal time limit set.

Going into the process of responding with a statement implying a habitual failure to comply, gives the impression that your organisation has failed to take adequate action to provide staff and resources sufficient to habitually comply with the requirements of law despite knowing, apparently for some considerable period of time, that you cannot meet your legal obligations.

As such any failure to meet the time limits for compliance would therefore be a deliberate failure to comply with the requirement of law and a criminal offence under section 77 of the FOIA.

I therefore look forward to your response "Promptly" and "In Any Event" within the 20 working day time limit specified in Law.

Yours sincerely,

W Hunter

Dear Northumbria Police and Crime Commissioner,

Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of Northumbria Police and Crime Commissioner's handling of my FOI request 'Lawfulness of Processing'.

The person responding has apparently deliberately mis read question one in order to avoid responding to the question asked.

The premise of the question clearly stated "my formal allegation of crime against the Chief
Constable of Northumbria Police was processed by your office despite your
lack of competent authority status." before asking

1. "Were you lawfully allowed to undertake any action in relation to
any complaint regarding the police if you were not a competent authority
at the time?.

The response provided refused to address the premise and failed to acknowledge that the Chief Constable of Northumbria Police is in fact a member of "The Police " and indeed the subject of the complaint which was addressed whilst the OPCC stated that the OPCC is not a competent authority as defined by law.

Were you lawfully allowed to deal with any complaint in respect to any matter falling within your remit to do with law enforcement etc when your organisation is not defined as a competent authority to do so?

In respect to question 2 you responded with a link to the statutory guidance.

The Statutory guidance is written with the automatic assumption that the various organisations are in compliance with the requirements under law to undertake the duties required.

It does not appear to contain any reference to allowing an organisation to address matters to do with the processing of law enforcement or prosecution information without having the "Competent Authority" classification.

Therefore your response to question 2 has not provided any response as to whether you were lawfully allowed to undertake any action to process data in relation to any complaint at the time.

In respect to question 3 you provided the name Michael Cleugh, a member of Northumbria Police and not the OPCCs office.

Your office structure chart here http://www.northumbria-pcc.gov.uk/v2/wp-... does not include Mr Cleugh or Ms young, who are the OPCC Data Protection Officer and OPCC case officer for FOIA requests.

In light of the fact that the OPCC is supposed to be a separate corporate entity and Data Controller in it's own right https://ico.org.uk/ESDWebPages/Entry/Z34... it is somewhat difficult to believe you can be an independent corporate entity when Your whole information handling staff are actually employees of Northumbria Police and the case officer you assigned to my FOIA request has already been the subject of multiple formal complaints via the police complaints system for discriminatory behaviour and abuse of police power in respect to my requests.

Question 4 clearly stated "4. Please also provide any policy procedure or lawful reason for your
refusal to afford me the right to discuss the content of that response
with the case officer concerned."

To which the OPCC response simply refused to address the rights afforded by the response document in favour of saying that there is no legal requirement for any such communication in the first place.

Yet again a document clearly stating "COMPLAINT RIGHTS" with the definition of rights being "Rights are legal, social, or ethical principles of freedom or entitlement; that is, rights are the fundamental normative rules about what is allowed of people or owed to people according to some legal system, social convention, or ethical theory.[1] Rights are of essential importance in such disciplines as law and ethics, especially theories of justice and deontology. "

Therefore the response from the OPCC appears to be that whilst these Rights are afforded to every other applicant, in my case I am not entitled to these rights and there is no legal requirement to provide them.

As such you have failed to provide any answer to question 4 in that you have refused to provide any legal justification for denying my rights in this matter and as such your behaviour constitutes discrimination and an abuse of authority.

Since your response to question 5 appeared to state that complaints regarding the OPCC are to be made to the PSD of Northumbria Police, a position which is quite frankly idiotic, I am requesting via this communication, to the OPCC Information Rights staff that the OPCC:-

Please record as a formal complaint, that the OPCCs office have discriminated against me, denied me access to rights afforded by the process and abused the authority of their office to do so thereby committing misconduct in public office.

Have them refer the allegation to the Police and Crime Panel for Adjudication via the IOPC as serious corruption.

A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.whatdotheyknow.com/request/l...

Yours faithfully,

W Hunter