Policy in compliance with Schedule 1, Part 4 of DPA 2018
Dear Information Commissioner’s Office,
Grateful for a copy of your Policy designed to show compliance with Schedule 1, Part 4 of DPA 2018.
Yours faithfully,
Linda McKee
Thank you for contacting the Information Commissioner’s Office. We confirm
that we have received your correspondence.
If you have made a request for information held by the ICO we will contact
you as soon as possible if we need any further information to enable us to
answer your request. If we don't need any further information we will
respond to you within our published, and statutory, service levels. For
more information please visit [1]http://ico.org.uk/about_us/how_we_comply
If you have raised a new information rights concern - we aim to send you
an initial response and case reference number within 30 days.
If you are concerned about the way an organisation is handling your
personal information, we will not usually look into it unless you have
raised it with the organisation first. For more information please see our
webpage ‘raising a concern with an organisation’ (go to our homepage and
follow the link ‘for the public’). You can also call the number below.
If you have requested advice - we aim to respond within 14 days.
If your correspondence relates to an existing case - we will add it to
your case and consider it on allocation to a case officer.
Copied correspondence - we do not respond to correspondence that has been
copied to us.
For more information about our services, please see our webpage ‘Service
standards and what to expect' (go to our homepage and follow the links for
‘Report a concern’ and ‘Service standards and what to expect'). You can
also call the number below.
For information about what we do with personal data see our [2]privacy
notice.
If there is anything you would like to discuss with us, please call our
helpline on 0303 123 1113.
Yours sincerely
The Information Commissioner’s Office
Our newsletter
Details of how to sign up for our monthly e-newsletter can be found at
[3]http://www.ico.org.uk/tools_and_resource...
Find us on Twitter at [4]http://www.twitter.com/ICOnews
References
Visible links
1. http://ico.org.uk/about_us/how_we_comply
2. https://ico.org.uk/global/privacy-notice/
3. http://www.ico.org.uk/tools_and_resource...
4. http://www.twitter.com/ICOnews
31 July 2018
Case Reference Number IRQ0767501
Dear L McKee
Acknowledgement of request – FOIA
Thank you for your recent request for information. We received your
request on 19 July.
We will be considering your request under the Freedom of Information Act
2000. You can expect us to respond in full by 17 August. This is 20
working days from the date we received your request. If, for any reason,
we can’t respond by this date, we will let you know and tell you when you
can expect a response.
If you have any questions please contact me using the IRQ case reference
number above or by replying to this email and leaving the subject field
unchanged.
Thank you for your interest in the work of the Information Commissioner's
Office.
Yours sincerely
Sarah Whelan
Senior Information Access Officer
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
T. 0330 414 6322 F. 01625 524510 [1]ico.org.uk [2]twitter.com/iconews
Please consider the environment before printing this email
For information about what we do with personal data see our [3]privacy
notice
References
Visible links
1. http://ico.org.uk/
2. https://twitter.com/iconews
3. https://ico.org.uk/global/privacy-notice/
17 August 2018
Case Reference Number IRQ0767501
Dear L McKee
Thank you for your recent request for information. We received your
request on 19 July.
We have considered your request under the Freedom of Information Act 2000.
Your request
In your email you asked:
‘Grateful for a copy of your Policy designed to show compliance with
Schedule 1, Part 4 of DPA 2018.’
Our response
In answer to your request I can confirm that the ICO holds a policy
document in respect of compliance with Schedule 1, Part 4, Data Protection
Act 2018. However, the information is being withheld under Section 22 of
the Freedom of Information Act 2000 (FOIA) as it is information which is
intended for future publication.
FOIA Section 22
As the information you have requested is held with the view to its
publication on our website at a future date, this information is exempt
under Section 22(1) of the FOIA.
Section 22(1) states that information is exempt from disclosure if:
“(a) the information is held by the public authority with a view to its
publication, by the authority or any other person, at some future date
(whether determined or not)
(b) the information was already held with a view to such publication at
the time when the request or the information was made, and
(c) it is reasonable in all the circumstances that the information should
be withheld from disclosure until the date referred to in paragraph (a).”
The exemption at Section 22 is qualified by the public interest test,
meaning that the information should be disclosed if the public interest in
the maintenance of the exemption does not outweigh the public interest in
disclosure.
In this case the public interest factors in disclosing the information
are;
* There is public interest in transparency being demonstrated by the
disclosure of the information.
* There is a legitimate public interest in the compliance of the
ICO with the legislation we regulate.
The factors in withholding the information are;
* Transparency is achieved through the pro-active publication of this
information on the ICO website.
* The impact on ICO resources if we were to respond individually to
requests for information that is due to be published.
* There is no pressing public interest in disclosing the information
early.
Having considered the public interest arguments, we have decided to
withhold the policy as the public interest in withholding this information
at present outweighs the public interest in providing it.
Next steps
I hope this response is clear. If you would like me to clarify anything
about the way your request has been handled please contact me.
You can ask us to review the way we have handled your request. Please see
our review procedure [1]here.
Following our internal review, if you remain dissatisfied with the way we
have handled your request, there is a statutory complaints process and you
can report your concern to the regulator. I have included information
about how to do this separately.
Yours sincerely,
Sarah Whelan
Senior Information Access Officer
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
T. 0330 414 6322 F. 01625 524510 [2]ico.org.uk [3]twitter.com/iconews
Please consider the environment before printing this email
For information about what we do with personal data see our [4]privacy
notice
References
Visible links
1. https://ico.org.uk/media/about-the-ico/p...
2. http://ico.org.uk/
3. https://twitter.com/iconews
4. https://ico.org.uk/global/privacy-notice/
Dear Information Commissioner’s Office,
Please pass this on to the person who conducts Freedom of Information reviews.
I am writing to request an internal review of Information Commissioner’s Office's handling of my FOI request 'Policy in compliance with Schedule 1, Part 4 of DPA 2018'.
As per your guidance available at: https://ico.org.uk/media/for-organisatio... and in particular paras 22 -26 and 67, the Commissioner has failed to follow its own guidance. Firstly, the test of reasonableness has not been demonstrated and the anticipated date of publication has not been provided.
I also note comments made to the response by a third person and consideration to their representation should also be included as part of the review process.
A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.whatdotheyknow.com/request/p...
Yours faithfully,
Linda McKee
Thank you for contacting the Information Commissioner’s Office. We confirm
that we have received your correspondence.
If you have made a request for information held by the ICO we will contact
you as soon as possible if we need any further information to enable us to
answer your request. If we don't need any further information we will
respond to you within our published, and statutory, service levels. For
more information please visit [1]http://ico.org.uk/about_us/how_we_comply
If you have raised a new information rights concern - we aim to send you
an initial response and case reference number within 30 days.
If you are concerned about the way an organisation is handling your
personal information, we will not usually look into it unless you have
raised it with the organisation first. For more information please see our
webpage ‘raising a concern with an organisation’ (go to our homepage and
follow the link ‘for the public’). You can also call the number below.
If you have requested advice - we aim to respond within 14 days.
If your correspondence relates to an existing case - we will add it to
your case and consider it on allocation to a case officer.
Copied correspondence - we do not respond to correspondence that has been
copied to us.
For more information about our services, please see our webpage ‘Service
standards and what to expect' (go to our homepage and follow the links for
‘Report a concern’ and ‘Service standards and what to expect'). You can
also call the number below.
For information about what we do with personal data see our [2]privacy
notice.
If there is anything you would like to discuss with us, please call our
helpline on 0303 123 1113.
Yours sincerely
The Information Commissioner’s Office
Our newsletter
Details of how to sign up for our monthly e-newsletter can be found at
[3]http://www.ico.org.uk/tools_and_resource...
Find us on Twitter at [4]http://www.twitter.com/ICOnews
References
Visible links
1. http://ico.org.uk/about_us/how_we_comply
2. https://ico.org.uk/global/privacy-notice/
3. http://www.ico.org.uk/tools_and_resource...
4. http://www.twitter.com/ICOnews
23 August 2018
Case Reference Number RCC0779247
Dear L McKee
Thank you for your correspondence dated 22 August.
This correspondence will now be treated as a request for an internal
review of the response we provided to your recent request for information
under the Freedom of Information Act 2000.
We will aim to respond by 20 September which is 20 working days from the
day after we received your recent correspondence. This is in accordance
with our internal review procedures which were provided with our response.
Yours sincerely
Sarah Whelan
Senior Information Access Officer
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
T. 0330 414 6322 F. 01625 524510 [1]ico.org.uk [2]twitter.com/iconews
Please consider the environment before printing this email
For information about what we do with personal data see our[3]privacy
[4]notice
References
Visible links
1. http://ico.org.uk/
2. https://twitter.com/iconews
3. https://ico.org.uk/global/privacy-notice/
4. https://ico.org.uk/global/privacy-notice/
20th September 2018
Case Reference Number RCC0779247
Dear L McKee
Thank you for your email dated 22 August 2018 in which you requested an
internal review to your case reference above.
I have been unable to complete my review within the 20 day time frame so
please accept my apologies. I will come back to you at the earliest
opportunity with the outcome of my review.
Yours sincerely
Elizabeth Baxter
Information Access Group Manager
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
T. 0330 3131840 F. 01625 524510 [1]ico.org.uk [2]twitter.com/iconews
For information about what we do with personal data see our [3]privacy
notice
Please consider the environment before printing this email
References
Visible links
1. http://ico.org.uk/
2. https://twitter.com/iconews
3. https://ico.org.uk/global/privacy-notice/
Dear Information Commissioner’s Office,
Great for an update as to when I should expect the outcome of the internal review.
Yours faithfully,
Linda McKee
Thank you for contacting the Information Commissioner’s Office. We confirm
that we have received your correspondence.
If you have made a request for information held by the ICO we will contact
you as soon as possible if we need any further information to enable us to
answer your request. If we don't need any further information we will
respond to you within our published, and statutory, service levels. For
more information please visit [1]http://ico.org.uk/about_us/how_we_comply
If you have raised a new information rights concern - we aim to send you
an initial response and case reference number within 30 days.
If you are concerned about the way an organisation is handling your
personal information, we will not usually look into it unless you have
raised it with the organisation first. For more information please see our
webpage ‘raising a concern with an organisation’ (go to our homepage and
follow the link ‘for the public’). You can also call the number below.
If you have requested advice - we aim to respond within 14 days.
If your correspondence relates to an existing case - we will add it to
your case and consider it on allocation to a case officer.
Copied correspondence - we do not respond to correspondence that has been
copied to us.
For more information about our services, please see our webpage ‘Service
standards and what to expect' (go to our homepage and follow the links for
‘Report a concern’ and ‘Service standards and what to expect'). You can
also call the number below.
For information about what we do with personal data see our [2]privacy
notice.
If there is anything you would like to discuss with us, please call our
helpline on 0303 123 1113.
Yours sincerely
The Information Commissioner’s Office
Our newsletter
Details of how to sign up for our monthly e-newsletter can be found at
[3]http://www.ico.org.uk/tools_and_resource...
Find us on Twitter at [4]http://www.twitter.com/ICOnews
References
Visible links
1. http://ico.org.uk/about_us/how_we_comply
2. https://ico.org.uk/global/privacy-notice/
3. http://www.ico.org.uk/tools_and_resource...
4. http://www.twitter.com/ICOnews
2 November 2018
Case Reference Number RCC0779247
Dear L McKee
I understand you are awaiting the outcome of the review of case reference
above. I wrote to you on 20 September 2018 to explain I had been unable to
complete the review within the 20 day time frame and would come back to
you at the earliest opportunity with an outcome of my review.
I will be able to provide you a further update shortly and wanted to
reassure you that your review is still live and I will respond as soon as
possible.
Apologies for any inconvenience.
Yours sincerely
Elizabeth Baxter
Information Access Group Manager
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
T. 0330 3131840 F. 01625 524510 [1]ico.org.uk [2]twitter.com/iconews
For information about what we do with personal data see our [3]privacy
notice
Please consider the environment before printing this email
References
Visible links
1. http://ico.org.uk/
2. https://twitter.com/iconews
3. https://ico.org.uk/global/privacy-notice/
Dear Linda McKee
Please accept my apologies that I have been unable to respond to your
internal review request as yet. I will be in a position to reply no later
than Monday 10th December 2018.
Many thanks for your patience.
Yours Sincerley
Elizabeth Baxter
Information Access Group Manager
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
T. 0330 3131840 F. 01625 524510 [1]ico.org.uk [2]twitter.com/iconews
For information about what we do with personal data see our [3]privacy
notice
Please consider the environment before printing this email
References
Visible links
1. http://ico.org.uk/
2. https://twitter.com/iconews
3. https://ico.org.uk/global/privacy-notice/
mckeelinda left an annotation ()
This is amazing that it will take an organisation a minimum of 16 weeks to complete an internal review and goes against their own good practice advise. I anticipate the Policy will be published on their website before the review is completed.
Dear Information Commissioner’s Office,
It is now 22:20 pm on the 10th December 2018 and a response to the internal review was promised no later than today. It is now three months since the internal review was requested and I have again sent by email to the ICO's casework email address, a formal complaint regarding this request for access to information.
Yours faithfully,
Linda McKee
Thank you for contacting the Information Commissioner’s Office. We confirm
that we have received your correspondence.
If you have made a request for information held by the ICO we will contact
you as soon as possible if we need any further information to enable us to
answer your request. If we don't need any further information we will
respond to you within our published, and statutory, service levels. For
more information please visit [1]http://ico.org.uk/about_us/how_we_comply
If you have raised a new information rights concern - we aim to send you
an initial response and case reference number within 30 days.
If you are concerned about the way an organisation is handling your
personal information, we will not usually look into it unless you have
raised it with the organisation first. For more information please see our
webpage ‘raising a concern with an organisation’ (go to our homepage and
follow the link ‘for the public’). You can also call the number below.
If you have requested advice - we aim to respond within 14 days.
If your correspondence relates to an existing case - we will add it to
your case and consider it on allocation to a case officer.
Copied correspondence - we do not respond to correspondence that has been
copied to us.
For more information about our services, please see our webpage ‘Service
standards and what to expect' (go to our homepage and follow the links for
‘Report a concern’ and ‘Service standards and what to expect'). You can
also call the number below.
For information about what we do with personal data see our [2]privacy
notice.
If there is anything you would like to discuss with us, please call our
helpline on 0303 123 1113.
Yours sincerely
The Information Commissioner’s Office
Our newsletter
Details of how to sign up for our monthly e-newsletter can be found at
[3]http://www.ico.org.uk/tools_and_resource...
Find us on Twitter at [4]http://www.twitter.com/ICOnews
References
Visible links
1. http://ico.org.uk/about_us/how_we_comply
2. https://ico.org.uk/global/privacy-notice/
3. http://www.ico.org.uk/tools_and_resource...
4. http://www.twitter.com/ICOnews
Dear Ms McKee
With regret, I have been unable to complete your review referenced above
at this time and will do so on my return to work in January.
Apologies for any inconvenience.
Elizabeth Baxter
Information Access Group Manager
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
T. 0330 3131840 F. 01625 524510 [1]ico.org.uk [2]twitter.com/iconews
For information about what we do with personal data see our [3]privacy
notice
Please consider the environment before printing this email
References
Visible links
1. http://ico.org.uk/
2. https://twitter.com/iconews
3. https://ico.org.uk/global/privacy-notice/
mckeelinda left an annotation ()
This is a similar request which indicates the policy was only approved in December 2018. https://www.whatdotheyknow.com/request/a...
Thank you for the practical lesson in how to manage FOI requests. It has been most enlightening and I have learnt the following:
1. A response under FOI should be issued within the statutory timeline, however, accuracy is not important nor is adhering to ICO guidelines as how to apply a s21 exemption.
2. When an internal appeal is requested (21 August), it is not important to adhere to the ICO best practice of 20 working days and no later than 40 working days to respond, rather acknowledge and issue periodic holding letters. (to date 4 holding letters have been issued, one of which stated” I will be in a position to reply no later than Monday 10th December 2018” and another stated “I have been unable to complete your review referenced above at this time and will do so on my return to work in January”.
3. When the requester seeks to use the public authority’s formal complaint process, issue automated responses, but do not engage with the complainant, effectively blocking the complaint process.
4. The only course of redress is to complain to the 'Regulator' ……
5. As the internal review was requested over 5 months ago, if helpful to discuss, please contact me as per the details in my letter of complaint.
Yours faithfully,
Linda R McKee
Thank you for contacting the Information Commissioner’s Office. We confirm
that we have received your correspondence.
If you have made a request for information held by the ICO we will contact
you as soon as possible if we need any further information to enable us to
answer your request. If we don't need any further information we will
respond to you within our published, and statutory, service levels. For
more information please visit [1]http://ico.org.uk/about_us/how_we_comply
If you have raised a new information rights concern - we aim to send you
an initial response and case reference number within 30 days.
If you are concerned about the way an organisation is handling your
personal information, we will not usually look into it unless you have
raised it with the organisation first. For more information please see our
webpage ‘raising a concern with an organisation’ (go to our homepage and
follow the link ‘for the public’). You can also call the number below.
If you have requested advice - we aim to respond within 14 days.
If your correspondence relates to an existing case - we will add it to
your case and consider it on allocation to a case officer.
Copied correspondence - we do not respond to correspondence that has been
copied to us.
For more information about our services, please see our webpage ‘Service
standards and what to expect' (go to our homepage and follow the links for
‘Report a concern’ and ‘Service standards and what to expect'). You can
also call the number below.
For information about what we do with personal data see our [2]privacy
notice.
If there is anything you would like to discuss with us, please call our
helpline on 0303 123 1113.
Yours sincerely
The Information Commissioner’s Office
Our newsletter
Details of how to sign up for our monthly e-newsletter can be found at
[3]http://www.ico.org.uk/tools_and_resource...
Find us on Twitter at [4]http://www.twitter.com/ICOnews
References
Visible links
1. http://ico.org.uk/about_us/how_we_comply
2. https://ico.org.uk/global/privacy-notice/
3. http://www.ico.org.uk/tools_and_resource...
4. http://www.twitter.com/ICOnews
9 February 2019
Case Reference Number RCC0779247
Review of response to information request
I write further to your email of 22 August 2018 in which you requested a
review of the handling of your request dealt with under the reference
number IRQ0767501. My name is Elizabeth Baxter and I am the Group Manager
in the Information Access service team. I have been asked to review the
way we handled your request for information. I can confirm that I have had
no prior involvement in the handling of this request.
Your request for review concerns the handling of your request of 19^th
July 2018. You had asked:
“I am writing to request an internal review of Information Commissioners
Office's handling of my FOI request 'Policy in compliance with Schedule 1,
Part 4 of DPA 2018'. As per your guidance available at (URL link provided)
and in particular paras 22 -26 and 67, the Commissioner has failed to
follow its own guidance. Firstly, the test of reasonableness has not been
demonstrated and the anticipated date of publication has not been
provided. I also note comments made to the response by a third person and
consideration to their representation should also be included as part of
the review process. A full history of my FOI request and all
correspondence is available on the Internet at this address.”
This was in relation to your request for information about our Policy
which we handled with case reference IRQ0767501.You received our response
on 17^th August 2018. In this response we confirmed that we are not able
to disclose a copy of the requested information. In her response, Sarah
Whelan cited section 22 (1) of The Freedom of Information Act in
withholding this information.
Part one of your request for review is that the appropriate test of
reasonableness was not applied. Within this request for information under
The Freedom of Information Act we, as a public authority, must consider
whether it is reasonable to withhold information until the date of
publication within a section 22 exemption. Before applying the public
interest test which was applied in your request we first determined if it
was reasonable to withhold the information. In doing so we considered
whether or not it is:
? sensible;
? in line with accepted practices; and
? fair to all concerned.
We stated in our original response that it was reasonable in all the
circumstances to withhold the information requested as, at the time of the
request, it was our intention to publish this information in line with our
accepted practices and following the model publication scheme. Therefore
as long as the public authority has decided that it or another person will
publish the information at some time in the future, the exemption may
apply. You can find the guidance here:
[1]https://ico.org.uk/media/for-organisatio...
I do not consider, however, that the Section 22 exemption used should have
been applied, therefore I uphold this part of your review request. This is
based on the policy not being finalised but rather being in draft form at
the time of your request.
The second part of your request for review was that no anticipated date of
publication had been given. The Freedom of Information Act Section 22 (1)
a states:
“(a) the information is held by the public authority with a view to its
publication, by the authority or any other person, at some future date
(whether determined or not)”
It is clear from this that no intended date of publication is required in
our response. However, I uphold it is good practice to provide this where
possible. At the time of your information request there was no set date
for publication. I can now confirm that the policy has now been published
on our website and is available here:
[2]https://ico.org.uk/about-the-ico/our-inf...
[3]https://ico.org.uk/about-the-ico/our-inf...
[4]https://ico.org.uk/global/privacy-notice...
As the information regarding the date of publication was not available at
the time of your request, I do not uphold the second part of your
complaint but am happy to have provided you with further information to
your original request.
I would like to take the opportunity to apologise again that your request
was outstanding for such a long period of time. I note that you have sent
further correspondence on 6 February 2019 and am happy to discuss this
using the contact details below should you wish to.
This concludes my internal review and all matters have been addressed.
Complaint procedure
If you are dissatisfied with the outcome of this review you can make a
formal complaint with the ICO in its capacity as the regulator of The
Freedom of Information Act 2000. Please follow the link below to submit
your complaint:
[5]https://ico.org.uk/concerns/
Yours sincerely
Elizabeth Baxter
Information Access Group Manager
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
T. 0330 3131840 F. 01625 524510 [6]ico.org.uk [7]twitter.com/iconews
For information about what we do with personal data see our [8]privacy
notice
Please consider the environment before printing this email
References
Visible links
1. https://ico.org.uk/media/for-organisatio...
2. https://ico.org.uk/about-the-ico/our-inf...
3. https://ico.org.uk/about-the-ico/our-inf...
4. https://ico.org.uk/global/privacy-notice...
5. https://ico.org.uk/concerns/
6. http://ico.org.uk/
7. https://twitter.com/iconews
8. https://ico.org.uk/global/privacy-notice/
Ibrahim Hasan left an annotation ()
This disclosure does not seem to comply with the original #FOI request. The link goes to the ICO policy under S.35(4) and (5)DPA 2018 - which is a policy required when doing sensitive processing for law enforcement purposes.
The schedule 1 Part 4 policy document is required when processing Special Category Data under GDPR under certain condition in Art 9.
mckeelinda left an annotation ()
Complaint made to ICO which to date has only been electronically acknowledged.
We work to defend the right to FOI for everyone
Help us protect your right to hold public authorities to account. Donate and support our work.
Donate Now
Jonathan Baines left an annotation ()
This is a remarkable refusal by ICO.
Firstly, they have failed to state - before moving to the public interest test - why it is reasonable in the circumstances to withhold. This is contrary to their own guidance (paras 22-26 at https://ico.org.uk/media/for-organisatio...).
Secondly, they fail to acknowledge that it is manifestly in the public interest to know how the regulator is dealing with its own compliance obligations under new and complex data protection legislation.
Thirdly, they give no indication of when the information will or may be published. Although the law doesn’t oblige them to do so, it would clearly be good practice to at least give an indication.
Fourthly, they claim that it would be contrary to the public interest to respond to individual requests for information intended for future publication. Things suggests an unlawful blanket approach, and a failure to exercise discretion.
I hope the requester seeks an internal review and IOC rapidly corrects these errors, which show a worrying lack of transparency.