Dear Information Commissioner’s Office,

BACKGROUND:
The ICO will also be launching a second investigation that focuses on how partners of the police handle information, such as that provided through the Gangs Matrix, and is already investigating a data breach at Newham Borough Council involving the Matrix.
https://ico.org.uk/about-the-ico/news-an...

REQUEST:
Provide all data held relating to "investigating a data breach at Newham Borough Council involving the Matrix."

NOTE:
I am particularly interested in the 'data breach'.
I am of course happy for you to redact personal information.

Thank you.

Yours faithfully,

Edward Williams

AccessICOinformation, Information Commissioner's Office

Thank you for contacting the Information Commissioner’s Office. We confirm
that we have received your correspondence.

If you have made a request for information held by the ICO we will contact
you as soon as possible if we need any further information to enable us to
answer your request. If we don't need any further information we will
respond to you within our published, and statutory, service levels. For
more information please visit [1]http://ico.org.uk/about_us/how_we_comply

If you have raised a new information rights concern - we aim to send you
an initial response and case reference number within 30 days.

If you are concerned about the way an organisation is handling your
personal information, we will not usually look into it unless you have
raised it with the organisation first. For more information please see our
webpage ‘raising a concern with an organisation’ (go to our homepage and
follow the link ‘for the public’). You can also call the number below.

If you have requested advice - we aim to respond within 14 days. 

If your correspondence relates to an existing case - we will add it to
your case and consider it on allocation to a case officer.

Copied correspondence - we do not respond to correspondence that has been
copied to us.

For more information about our services, please see our webpage ‘Service
standards and what to expect' (go to our homepage and follow the links for
‘Report a concern’ and ‘Service standards and what to expect'). You can
also call the number below.

For information about what we do with personal data see our [2]privacy
notice.

If there is anything you would like to discuss with us, please call our
helpline on 0303 123 1113.

Yours sincerely

The Information Commissioner’s Office

Our newsletter

Details of how to sign up for our monthly e-newsletter can be found at
[3]http://www.ico.org.uk/tools_and_resource...

Twitter

Find us on Twitter at [4]http://www.twitter.com/ICOnews

 

References

Visible links
1. http://ico.org.uk/about_us/how_we_comply
2. https://ico.org.uk/global/privacy-notice/
3. http://www.ico.org.uk/tools_and_resource...
4. http://www.twitter.com/ICOnews

Dear Information Commissioner’s Office,

response now due.

Yours faithfully,

Edward Williams

AccessICOinformation, Information Commissioner's Office

Thank you for contacting the Information Commissioner’s Office. We confirm
that we have received your correspondence.

If you have made a request for information held by the ICO we will contact
you as soon as possible if we need any further information to enable us to
answer your request. If we don't need any further information we will
respond to you within our published, and statutory, service levels. For
more information please visit [1]http://ico.org.uk/about_us/how_we_comply

If you have raised a new information rights concern - we aim to send you
an initial response and case reference number within 30 days.

If you are concerned about the way an organisation is handling your
personal information, we will not usually look into it unless you have
raised it with the organisation first. For more information please see our
webpage ‘raising a concern with an organisation’ (go to our homepage and
follow the link ‘for the public’). You can also call the number below.

If you have requested advice - we aim to respond within 14 days. 

If your correspondence relates to an existing case - we will add it to
your case and consider it on allocation to a case officer.

Copied correspondence - we do not respond to correspondence that has been
copied to us.

For more information about our services, please see our webpage ‘Service
standards and what to expect' (go to our homepage and follow the links for
‘Report a concern’ and ‘Service standards and what to expect'). You can
also call the number below.

For information about what we do with personal data see our [2]privacy
notice.

If there is anything you would like to discuss with us, please call our
helpline on 0303 123 1113.

Yours sincerely

The Information Commissioner’s Office

Our newsletter

Details of how to sign up for our monthly e-newsletter can be found at
[3]http://www.ico.org.uk/tools_and_resource...

Twitter

Find us on Twitter at [4]http://www.twitter.com/ICOnews

 

References

Visible links
1. http://ico.org.uk/about_us/how_we_comply
2. https://ico.org.uk/global/privacy-notice/
3. http://www.ico.org.uk/tools_and_resource...
4. http://www.twitter.com/ICOnews

Information Commissioner's Office

15 February 2019

 

Case Reference Number IRQ0814822

 

Dear E Williams

Request for Information
 
Thank you for your message, sent through whatdotheyknow.com and which we
received on 18 January.
 
You have made a request for information held by the Information
Commissioner's Office (ICO). Your request has been dealt with in
accordance with the Freedom of Information Act 2000 (FOIA) under the
reference number shown above. 
 
Request
 
In your email you asked:
 
“BACKGROUND: The ICO will also be launching a second investigation that
focuses on how partners of the police handle information, such as that
provided through the Gangs Matrix, and is already investigating a data
breach at Newham Borough Council involving the Matrix.
 
Provide all data held relating to "investigating a data breach at Newham
Borough Council involving the Matrix." NOTE: I am particularly interested
in the 'data breach'. I am of course happy for you to redact personal
information.”
 
Our response
 
In summary, I can confirm that we are investigating a data breach at
Newham Borough Council involving the Gangs Matrix. We hold information
regarding the breach and which falls within the scope of your request.
 
However I can confirm that we are withholding this information. Our
investigation into the breach is ongoing, and we consider that disclosure
of all data held regarding the breach would be prejudicial to our ability
to regulate data protection legislation. As a result the information you
have sought is exempt under section 31 of the FOIA.
 
Should it be of interest I have explained more about how this exemption
applies below.
 
FOIA section 31
 
As you will be aware, the FOIA provides the right to request recorded
information held by a public authority, and to have copies of that
information provided unless an appropriate exemption applies.
 
I can explain that the exemption at section 31 of the FOIA applies in this
instance. Section 31(1)(g) of the FOIA refers to circumstances where the
disclosure of information “would, or would be likely to, prejudice – … the
exercise by any public authority of its functions for any of the purposes
specified in subsection (2).”
 
The purposes referred to at sections 31(2)(a) and (c) are –
 
“(a) the purpose of ascertaining whether any person has failed to comply
with the law” and
 “(c) the purpose of ascertaining whether circumstances which would
justify regulatory action in pursuance of any enactment exist or may arise
…”   
 
Clearly, these subsections apply when the Information Commissioner is
considering whether or not a data controller such as Newham Council is
properly complying with its obligations under data protection legislation.
 
We believe that disclosure of the requested information at this time would
be likely to prejudice our ability to effectively carry out our regulatory
function.
 
This is because disclosing information regarding the breach could
prejudice the ICO’s ability to conduct the investigation in an appropriate
manner.  It is probable that any disclosure at this stage would discourage
our ongoing discussions with the relevant stakeholders and may damage our
ability to conduct and conclude the investigation fairly and
proportionately.
 
Disclosure could also jeopardise the ICO’s ability to obtain information
either relating to this case or others in the future.
 
In our view harm could be caused if either party were reluctant to enter
into any further discussions if information had already been disclosed in
response to information requests or even general enquiries. This is likely
to result in other parties being reluctant to engage with the ICO in the
future.  In addition, any information released at this stage could be
misinterpreted, which in turn could distract from the investigation
process.
 
Given that our investigation is still ongoing, I consider that the
likelihood of prejudice to our ability to regulate the law is increased
further still.

Public interest test
 
With this in mind, we have considered the public interest test for and
against disclosure. This is because the exemption at section 31 is not an
absolute exemption, which means it is subject to a public interest test.
When applying the exemption at section 31, public authorities must
consider whether the public interest favours withholding or disclosing the
requested information. 
 
In this case the public interest factors in disclosing information
regarding the breach are:
 

* Transparency regarding the specific nature of the breach
* Disclosure may be helpful in assisting other data controllers avoid
similar breaches 

 
With the public interest test in favour of maintaining the exemption being
that:
 
 

* It ensures that data controllers are not deterred or inhibited from
participating fully and candidly with the our investigations;
* The ICO’s ability to conduct investigations as it thinks fit without
undue external comment or influence before it has concluded is
maintained;
* Disclosing information regarding the specific breach could prejudice
further investigations being conducted by this or other public
authorities;
* The ICO proactively publishes information regarding such breaches once
a case has been concluded. If enforcement action is required, details
will be placed on the ICO website, with other communications regarding
it being made in line with our communicating regulatory activity
policy.
* Specific issues raised in the investigation which would assist other
data controllers will be considered for inclusion in more appropriate
forums such as our Guide to Data Protection. The ICO has a track
record of regularly issuing such guidance and is committed to
publishing more in the future.

 
Having considered these factors we have taken the decision that the public
interest in withholding the information outweighs the public interest in
disclosing it.
 
This therefore concludes our response to your information request. I
appreciate our response will be disappointing but I hope I have been able
to provide useful information about why the relevant exemption in FOIA
applies.
 
Review Procedure
 
In the event that you are dissatisfied with our response and wish to
request a review of our decision or make a complaint about how your
request has been handled you should write to the Information Access Team
at the address below or e-mail [1][ICO request email].
 
Your request for internal review should be submitted to us within 40
working days of receipt by you of this response. Any such request received
after this time will only be considered at the discretion of the
Commissioner.
 
If having exhausted the review process you are not content that your
request or review has been dealt with correctly, you have a further right
of appeal to this office in our capacity as the statutory complaint
handler under the legislation. To make such an application, please write
to our Customer Contact Team at the address given or visit our website if
you wish to make a complaint under the Freedom of Information Act.
 
A copy of our review procedure can be accessed from our website.
[2]here.
 
Yours sincerely
 
 

Danny Langley
Information Access Service Manager
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
T. 0330 414 6784  F. 01625 524510  [3]ico.org.uk 
For information about what we do with personal data see our [4]privacy
notice.
Please consider the environment before printing this email

 
 
 

References

Visible links
1. mailto:[ICO request email]
2. https://ico.org.uk/media/about-the-ico/p...
3. http://ico.org.uk/
4. https://ico.org.uk/global/privacy-notice/

Dear Information Commissioner’s Office,

Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of Information Commissioner’s Office's handling of my FOI request 'Newham council gang matrix MPS'.

A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.whatdotheyknow.com/request/n...

Yours faithfully,

Edward Williams

AccessICOinformation, Information Commissioner's Office

Thank you for contacting the Information Commissioner’s Office. We confirm
that we have received your correspondence.

If you have made a request for information held by the ICO we will contact
you as soon as possible if we need any further information to enable us to
answer your request. If we don't need any further information we will
respond to you within our published, and statutory, service levels. For
more information please visit [1]http://ico.org.uk/about_us/how_we_comply

If you have raised a new information rights concern - we aim to send you
an initial response and case reference number within 30 days.

If you are concerned about the way an organisation is handling your
personal information, we will not usually look into it unless you have
raised it with the organisation first. For more information please see our
webpage ‘raising a concern with an organisation’ (go to our homepage and
follow the link ‘for the public’). You can also call the number below.

If you have requested advice - we aim to respond within 14 days. 

If your correspondence relates to an existing case - we will add it to
your case and consider it on allocation to a case officer.

Copied correspondence - we do not respond to correspondence that has been
copied to us.

For more information about our services, please see our webpage ‘Service
standards and what to expect' (go to our homepage and follow the links for
‘Report a concern’ and ‘Service standards and what to expect'). You can
also call the number below.

For information about what we do with personal data see our [2]privacy
notice.

If there is anything you would like to discuss with us, please call our
helpline on 0303 123 1113.

Yours sincerely

The Information Commissioner’s Office

Our newsletter

Details of how to sign up for our monthly e-newsletter can be found at
[3]http://www.ico.org.uk/tools_and_resource...

Twitter

Find us on Twitter at [4]http://www.twitter.com/ICOnews

 

References

Visible links
1. http://ico.org.uk/about_us/how_we_comply
2. https://ico.org.uk/global/privacy-notice/
3. http://www.ico.org.uk/tools_and_resource...
4. http://www.twitter.com/ICOnews

Information Commissioner's Office

7 March 2019

 

Case Reference Number RCC0827284

 

Dear E Williams

Thank you for your recent request for an internal review of our response
to your information request.
 
You can expect us to respond in full by 15 March 2019. This is 20 working
days from the date we received your request for internal review. If, for
any reason, we can’t respond by this date, we will let you know and tell
you when you can expect a response.
 
If you have any questions please contact me using the RCC case reference
number above or by replying to this email and leaving the subject field
unchanged.
 
Thank you for your interest in the work of the Information Commissioner's
Office.
 
Yours sincerely
 

Sarah Whelan
Senior Information Access Officer
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
T. 0330 414 6322  F. 01625 524510  [1]ico.org.uk  [2]twitter.com/iconews
Please consider the environment before printing this email
For information about what we do with personal data see our [3]privacy
notice

References

Visible links
1. http://ico.org.uk/
2. https://twitter.com/iconews
3. https://ico.org.uk/global/privacy-notice/

Information Commissioner's Office

Dear Mr Williams

Please accept my apologies I have been unable to complete your request for
an information request internal review as yet. I will respond to your
request no later than Friday 29 March 2019.

Regards
 

Elizabeth Baxter
Information Access Group Manager
 
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
T. 0330 3131840  F. 01625 524510  [1]ico.org.uk  [2]twitter.com/iconews
For information about what we do with personal data see our [3]privacy
notice
Please consider the environment before printing this email

References

Visible links
1. http://ico.org.uk/
2. https://twitter.com/iconews
3. https://ico.org.uk/global/privacy-notice/

Information Commissioner's Office

23 March 2019
 
Case Reference Number RCC0827284
 
Review of response to information request
 
I write further to your email of 15 February 2019 in which you requested a
review of the handling of your request dealt with under the reference
number IRQ0814822.  I am the Group Manager in the Information Access
service team and I have been asked to review the way we handled your
request for information. I can confirm that I have had no prior
involvement in the handling of this request.
 
 
Your information request
 
Your request for review concerns the handling of your request of 18
January 2019. You had asked:
 
“Newham council gang matrix MPS Dear Information Commissioners Office,
BACKGROUND: The ICO will also be launching a second investigation that
focuses on how partners of the police handle information, such as that
provided through the Gangs Matrix, and is already investigating a data
breach at Newham Borough Council involving the Matrix.: Provide all data
held relating to "investigating a data breach at Newham Borough Council
involving the Matrix." NOTE: I am particularly interested in the 'data
breach'. I am of course happy for you to redact personal information.
Thank you. Yours faithfully, Edward Williams”
 
Our response
 
On 15 February 2019 my colleague Sarah Whelan wrote to you in response to
your request and stated:
 
“In summary, I can confirm that we are investigating a data breach at
Newham Borough Council involving the Gangs Matrix. We hold information
regarding the breach and which falls within the scope of your request.
 
However I can confirm that we are withholding this information. Our
investigation into the breach is ongoing, and we consider that disclosure
of all data held regarding the breach would be prejudicial to our ability
to regulate data protection legislation. As a result the information you
have sought is exempt under section 31 of the FOIA.”
 
Further to this you wrote to us on 15 February 2019 and requested an
internal review of our response.
 
Our internal review
 
I have reviewed your request and our response to this as requested. I am
in agreement with the response you obtained from Sarah Whelan which
refused you the information requested under section 31 of The Freedom of
Information Act 2000. As a regulator, The Information Commissioners Office
must fully investigate any potential data breaches and any information
surrounding an investigation, whilst on-going, must be utilised to
substantiate or refute this and we must not have interference in the
investigative process for any reason. Once concluded you may wish to
resubmit your request.
 
 
This concludes my internal review and all matters have been addressed.

 
Complaint procedure
 
If you are dissatisfied with the outcome of this review you can make a
formal complaint with the ICO in its capacity as the regulator of The
Freedom of Information Act 2000. Please follow the link below to submit
your complaint:

[1]https://ico.org.uk/concerns/

 
Yours sincerely
 
 
 
 
 
 
 

Elizabeth Baxter
Information Access Group Manager
 
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
T. 0330 3131840  F. 01625 524510  [2]ico.org.uk  [3]twitter.com/iconews
For information about what we do with personal data see our [4]privacy
notice
Please consider the environment before printing this email

References

Visible links
1. https://ico.org.uk/concerns/
2. http://ico.org.uk/
3. https://twitter.com/iconews
4. https://ico.org.uk/global/privacy-notice/