Procedures for managing personal data

Henry Pitcairn made this Freedom of Information request to Powys County Council

This request has been closed to new correspondence. Contact us if you think it should be reopened.

The request was partially successful.

Dear Powys County Council,
Please provide full details of the review referred to in the Council’s written answer as below.

CYNGOR SIR POWYS COUNTY COUNCIL County Council
11th July 2019
REPORT AUTHOR: County Councillor Martin Weale, Portfolio Holder for Economy and
Planning
SUBJECT: Question from Dr Christine Hugh-Jones
The Planning Department is apparently operating new “paperless” procedures for handling
incoming documents from applicants, statutory consultees, stakeholder groups and
members of the public.
At the same time representations from the public and stakeholder organisations are not
included on the planning portal as they are for many other local authorities.
The current procedures effectively conceal information, which is material to planning
decisions, from the public view. This raises serious concerns about public accountability
and public participation in the planning process
What urgent action does the Council intend to take to ensure that all relevant planning
documents, including public responses to planning consultations, are available for public
view on the planning portal and how will the Council engage with the public in achieving
this?
Response
Following a data breach which was reported to and investigated by the Information Commissioner,
the Council reviewed its procedures for managing personal data to prevent and avoid further
breaches in relation to the processing of planning applications and the high volume of
correspondence received from third parties. This review found that the authority faces significant
continued risk of breaching the data protection regulations if it were to continue to publish third
party representations on its website. In order to remove this significant risk, further staff resource
would be required in order to read through and redact all personal data before publishing any third
party correspondence. Unfortunately this staff resource is not available within the financial climate
that the authority currently operates within. Whilst third party correspondence is not available on
the Council’s website, this information is available for inspection at either Powys County Hall or
Neuadd Maldwyn by appointment only. An appointment is necessary because staff time has to be
allowed to fully prepare the information by redacting all sensitive data.
Page 135
Page 136
7.3
CYNGOR SIR POWYS COUNTY COUNCIL County Council
11th July 2019
REPORT AUTHOR: County Councillor Martin Weale, Portfolio Holder for Economy and
Planning

Yours faithfully,

Henry Pitcairn

Information Compliance, Powys County Council

 

Cyfarwyddwr Strategol: Rheoli Gwybodaeth/
Adnoddau
Information Compliance
Acting Director: Resources
Neuadd Y Sir / County Hall

Spa Road East

Llandrindod Wells

Powys LD1 5LG
  If calling please ask for / Os yn galw
gofynnwch am
 
Information Compliance
 
Tel / Ffôn:  01597 82 7543        
 
Email/Llythyru electronig:
  [1][email address]

  Our ref / Ein cyf:  F2019-0755

Date / Dyddiad:   09/07/19

 

 

Request Accepted

 

FREEDOM of INFORMATION ACT 2000

Reference No: F2019/0755

 

Dear,

 

Thank you for your request for information, received at this office on 
09/07/2019, in which you requested details of the following:

 

Procedures for Managing Personal Data

 

The above is a summary of your request. The full details of the
information sought is provided to the officer to whom the request is
tasked.

 

Your request will now be considered and you will receive a response within
the statutory timescale of 20 working days as defined by the Act, subject
to the information not being exempt or containing a reference to a third
party. In some circumstances Powys County Council may be unable to achieve
this deadline. If this is likely you will be informed and given a revised
time-scale at the earliest opportunity.

 

There may be a fee payable for the retrieval, collation and provision of
the information you request. If this is the case you will be informed and
the 20 working day timescale will be suspended until we receive payment
from you. If you choose not to make a payment then your request will
remain unanswered.

 

Some requests may also require either full or partial transference to
another public authority in order to answer your query in the fullest
possible way. Again, you will be informed if this is the case.

 

The due date for responding to this request for information is 08/08/2019.

 

Should you need to discuss this further please contact the Information
Compliance Team on 01597 827543.

 

I would like to take this opportunity to thank you for your interest in
Powys County Council.

 

Yours sincerely,

 

Information Compliance Team

 

 

We keep your details safe and we have updated our privacy notice in line
with the requirements set out in General Data Protection Regulations.  We
will only ever use the details you share with us to enable us to undertake
our statutory obligations.  You can find out more by looking on our web
site. [2]https://en.powys.gov.uk/privacy

 

show quoted sections

References

Visible links
1. mailto:[email address]
2. https://en.powys.gov.uk/privacy

Information Compliance, Powys County Council

Dear, Mr. Pitcairn

 

Thank you for your recent Freedom of Information Act 2000 (FOIA) request.

 

Further to our acknowledgement letter, our reference to your request has
now been renamed to “Cessation of publication of third party
correspondence.”

 

Kind Regards,

 

Joe

 

Joseph Wozencraft

Information Compliance Officer

Powys County Council

__________________________________________
Tel           | Ffôn   | 01597 826238 |

Email      | Ebost | [1][email address]

 

 

Cyfarwyddwr Strategol: Rheoli Gwybodaeth/
Adnoddau
Information Compliance
Acting Director: Resources
Neuadd Y Sir / County Hall

Spa Road East

Llandrindod Wells

Powys LD1 5LG
  If calling please ask for / Os yn galw
gofynnwch am
 
Information Compliance
 
Tel / Ffôn:  01597 82 7543        
 
Email/Llythyru electronig:
  [2][email address]

  Our ref / Ein cyf:  F2019-0755

Date / Dyddiad:   09/07/19

 

 

Request Accepted

 

FREEDOM of INFORMATION ACT 2000

Reference No: F2019/0755

 

Dear,

 

Thank you for your request for information, received at this office on 
09/07/2019, in which you requested details of the following:

 

Procedures for Managing Personal Data

 

The above is a summary of your request. The full details of the
information sought is provided to the officer to whom the request is
tasked.

 

Your request will now be considered and you will receive a response within
the statutory timescale of 20 working days as defined by the Act, subject
to the information not being exempt or containing a reference to a third
party. In some circumstances Powys County Council may be unable to achieve
this deadline. If this is likely you will be informed and given a revised
time-scale at the earliest opportunity.

 

There may be a fee payable for the retrieval, collation and provision of
the information you request. If this is the case you will be informed and
the 20 working day timescale will be suspended until we receive payment
from you. If you choose not to make a payment then your request will
remain unanswered.

 

Some requests may also require either full or partial transference to
another public authority in order to answer your query in the fullest
possible way. Again, you will be informed if this is the case.

 

The due date for responding to this request for information is 08/08/2019.

 

Should you need to discuss this further please contact the Information
Compliance Team on 01597 827543.

 

I would like to take this opportunity to thank you for your interest in
Powys County Council.

 

Yours sincerely,

 

Information Compliance Team

 

 

We keep your details safe and we have updated our privacy notice in line
with the requirements set out in General Data Protection Regulations.  We
will only ever use the details you share with us to enable us to undertake
our statutory obligations.  You can find out more by looking on our web
site. [3]https://en.powys.gov.uk/privacy

 

show quoted sections

References

Visible links
1. mailto:[email address]
2. mailto:[email address]
3. https://en.powys.gov.uk/privacy

Dear Information Compliance,

You have failed to respond to this FOI request within the statutory deadline.

As it is fair to assume that the document requested was in existence when the Council responded to Dr Hugh-Jones' question, can you please respond immediately to this request which effectively is only a matter of posting a document already in existence?

Yours sincerely,

Henry Pitcairn

Information Compliance, Powys County Council

Dear, Mr. Pitcairn

Thank you for your email. We regret the delay you have experienced with this request. We acknowledge that Powys County Council has failed in its obligation under the Freedom of Information Act 2000, to provide you with a response to your request within the statutory timescale of 20 working days. Please accept our apologies for this and for any inconvenience this may have caused.

Our draft response is currently being checked and approved by the Head of Service so we believe a response will be immanent.

Kind Regards,

Joe

Joseph Wozencraft
Information Compliance Officer
Powys County Council
__________________________________________
Tel | Ffôn | 01597 826238 |
Email | Ebost | [email address]

show quoted sections

Information Compliance, Powys County Council

14 Attachments

 

 

Rheoli Gwybodaeth/

Information Compliance

Neuadd Y Sir / County Hall

Spa Road East

Llandrindod Wells

Powys LD1 5LG
  If calling please ask for / Os yn galw gofynnwch am

   

Tel / Ffôn: 01597 82 7543

Email/Llythyru electronig: [1][email address]

Our ref / Ein cyf: F2019-0755

Date / Dyddiad: 23/8/19

 

Reference No: F2019-0755

 

 

Dear Mr Pitcairn

 

Thank you for your request for information dated 9/7/19 concerning
Cessation of publication of third party correspondence

 

This is to inform you that your request has been considered and I can
provide the following response:

 

The Request:

 

Please provide full details of the review referred to in the Council’s
written answer as below.

 

CYNGOR SIR POWYS COUNTY COUNCIL County Council 11th July 2019 REPORT
AUTHOR: County Councillor Martin Weale, Portfolio Holder for Economy and
Planning

SUBJECT: Question from Dr Christine Hugh-Jones The Planning Department is
apparently operating new “paperless” procedures for handling incoming
documents from applicants, statutory consultees, stakeholder groups and
members of the public.

At the same time representations from the public and stakeholder
organisations are not included on the planning portal as they are for many
other local authorities.

The current procedures effectively conceal information, which is material
to planning decisions, from the public view. This raises serious concerns
about public accountability and public participation in the planning
process What urgent action does the Council intend to take to ensure that
all relevant planning documents, including public responses to planning
consultations, are available for public view on the planning portal and
how will the Council engage with the public in achieving this?

Response

Following a data breach which was reported to and investigated by the
Information Commissioner, the Council reviewed its procedures for managing
personal data to prevent and avoid further breaches in relation to the
processing of planning applications and the high volume of correspondence
received from third parties. This review found that the authority faces
significant continued risk of breaching the data protection regulations if
it were to continue to publish third party representations on its website.
In order to remove this significant risk, further staff resource would be
required in order to read through and redact all personal data before
publishing any third party correspondence. Unfortunately this staff
resource is not available within the financial climate that the authority
currently operates within. Whilst third party correspondence is not
available on the Council’s website, this information is available for
inspection at either Powys County Hall or Neuadd Maldwyn by appointment
only. An appointment is necessary because staff time has to be allowed to
fully prepare the information by redacting all sensitive data.

Page 135

Page 136

7.3

CYNGOR SIR POWYS COUNTY COUNCIL County Council 11th July 2019 REPORT
AUTHOR: County Councillor Martin Weale, Portfolio Holder for Economy and
Planning.

 

The Response:

 

The review that has been referred to is not available as a single piece of
information or document but as information within emails, communications
and impact assessments which relate to and support how and why the
decision was made for ceasing the publication of third party
correspondence. Please find all relevant documentation attached.

 

You will note that we have applied redactions to all of these documents we
have attached. This has been done in line with Powys County Council’s
obligations to not only protect the personal data of individuals (data
subjects) but also that of Powys County Council staff as the seniority of
these staff members would not expect their details to be released to the
public. This does not just apply to a data subject’s name, but to all
references that refer to their planning applications, which could also
identify them. Data subjects hold the expectation that this information
would remain anonymous, and that their name, or any information that could
identify themselves which would not be released to the public. We
therefore issue Section 40(2) of the FOIA. The details of this exemption
can be found below.

 

Section 17 of the Freedom of Information Act 2000 requires Powys County
Council, when refusing to provide such information (because the
information is exempt) to provide you the applicant with a notice which:

(a)states that fact;

(b)  specifies the exemption in question and

(c)  states (if that would not otherwise be apparent) why the exemption
applies.

Part of the information you requested is being withheld because it falls
under the exemption in section 40 (2) of the Freedom of Information Act
2000.

 

Section 40 (2) applies to third party personal data. This would not be
released under the Freedom of Information Act unless there is strong
public interest to do so. This is because any release would breach the
Data Protection Principles as contained within the General Data Protection
Regulations.

Information released under the Freedom of Information is considered to be
released into the public domain, without caveat, not just to the
individual requesting the information. We believe that information
relating to identifiable individuals constitutes their personal data and
if released would contravene the first data protection principle.

The first principle of the General Data Protection Regulations states in
part that: “Personal data shall be processed “lawfully, fairly and in a
transparent manner in relation to data subjects” and, in particular, shall
not be processed unless at least one of the conditions in Article 6 is
met, and in the case of sensitive personal data, at least one of the
conditions in Article 9 is also met”. We have to assess whether the
information relates to living individuals, whether an individual can be
identified from the information requested.

 

We are obliged to comply with the first principle where we are required to
‘handle people’s personal data only in ways they would reasonable expect’.
It is reasonable in these circumstances that the identity of the
individuals and the information relating to them would not be disclosed in
response to a Freedom of Information request.

Therefore, based on the considerations above the exemption afforded under
Section 40 (2) of the Freedom of Information Act 2000 is engaged and in
accordance with Section 17 of the Freedom of Information Act 2000, this
letter acts as a Refusal Notice for this element of your request.

 

We believe that this request is now complete and shall be closed
immediately. Should any further information be requested regarding this
topic, a separate request will need to be submitted.

 

We regret the delay you have experienced with this request. We acknowledge
that Powys County Council has failed in its obligation under the Freedom
of Information Act 2000, to provide you with a response to your request
within the statutory timescale of 20 working days. Please accept our
apologies for this and for any inconvenience this may have caused.

 

We would like to take this opportunity to thank you for your interest in
Powys County Council.

 

Yours sincerely,

 

Information Compliance Team

 

 

The supply of documents under Freedom of Information does not give the
person or organisation who receives them an automatic right to re-use the
documents in a way that would infringe copyright.

 

You are free to use any information supplied for your own use, including
for non-commercial research purposes. The information may also be used for
the purposes of news reporting. However, any other type of re-use, for
example, by publishing the information or issuing copies to the public
will require the permission of the copyright owner.

 

The copyright of most of the information that we provide in response to
Freedom of Information Act requests will be owned by Powys County Council.
The copyright in other information may be owned by another person or
organisation, as indicated in the information itself.

 

For HMSO Guidance Notes on a range of copyright issues, see the Office of
Public Sector Information(OPSI) website.

[2]http://www.opsi.gov.uk/advice/crown-copy...

 

If you are dissatisfied with the service you have received in relation to
your request and wish to make a complaint, please contact Information
Compliance. Our complaints procedure is available on request or on our
website.

 

If you are still not satisfied following this, you can make an appeal to
the Information Commissioner, who is the statutory regulator. The
Information Commissioner can be contacted at:

 

Information Commissioner's Office

2nd floor

Churchill House

Churchill way

Cardiff

CF10 2HH

Tel: 0330 414 6421

Email: [3][email address]

[4]www.ico.org.uk

 

 

[5]Footer_banner[1]

show quoted sections

References

Visible links
1. mailto:[email address]
2. http://www.opsi.gov.uk/advice/crown-copy...
3. mailto:[email address]
4. http://www.ico.org.uk/