Dear Her Majesty's Courts and Tribunals Service,

I would be grateful if you would provide me with the following information under the terms of the Freedom of Information Act 2000.

1 - A copy of all DPIA's completed for the HMCTS Common Platform Programme

2 - A copy of the security risk assessment for the HMCTS Common Platform Programme

3 - Details of the Data Controllers involved with the Common Platform Programme, including the legislation under which they are a Data Controller

4 - The designated Lead Data Controller for the Common Platform Programme

5 - A list of all processors and notified sub-processors for the Common Platform Programme

6 - A copy of the terms of service/contract between HMCTS and the processors (financial data may be redacted if you wish).

Yours faithfully,

O Sayers

Dear Sirs,

Freedom of Information Act (FOIA) Request – 200825006

Thank you for your response of 23rd inst. in which you confirm that all the information asked for is indeed held.

I am surprised that such a request should require the significant level of work you believe is necessary to reject the request on financial grounds.

However, as per your advice I would be satisfied at this time under THIS request if you fulfil it on the basis of the following modification:

Please fully respond to element 1 -' A copy of all DPIA's completed for the HMCTS Common Platform Programme'

This information is of material public interest and should be contained in specific documents created under your obligation S.64 of the DPA 2018, It should not therefore incur significant cost for its delivery, or if you prefer, its publication.

The key aspects of element 3 (Details of the Data Controllers) , element 5 (list of all processors and notified sub-processors for the provision of 'virtual court' hearings) and element 4 ( designated Lead Data Controller for the Common Platform Programme) should already be contained within that DPIA report,;and if so I shall be happy to consider those elements fulfilled without further work by the MOJ if the DPIA is provided in full.

For element 6 (copy of the terms of service/contract between HMCTS and the processors) I will be content for you to clarify as a simple confirmation if the MoJ has used the standard Cloud Service Provider terms of service for the cloud processing, or if special terms have been agreed .

The remaining element (2) I am happy at this time to withdraw in order to reduce to cost of finding it at this time, but may make a separate submission under suitable terms in future if this proves necessary to explore elements 2 & 6 further.

I am sure that this significant reduction in scope will remove the financial barrier to completing the request and I look forward to receiving this material as soon as possible

Please note that I will not accept these being treated as a new FOI request - these are merely clarifications and reductions in detail as suggested by the MoJ in your response to the original request and should therefore be answered as quickly as you are able.

Yours sincerely,

O Sayers

Dear Her Majesty's Courts and Tribunals Service,

Please see below email received from your ChangeInfo address (to whom I responded recently re an outstanding FOI request.

I would be grateful if you would process this expeditiously.

------

Dear Sir / Madam

We cannot respond to your enquiry via this inbox. You should send your correspondence to the Disclosure Team.

-----Original Message-----
From: O Sayers <[FOI #687314 email]>
Sent: 02 October 2020 17:27
To: Changeinfo <[email address]>
Subject: Re: FOIA response 200825006

Dear Sirs,

Freedom of Information Act (FOIA) Request – 200825006

Thank you for your response of 23rd inst. in which you confirm that all the information asked for is indeed held.

I am surprised that such a request should require the significant level of work you believe is necessary to reject the request on financial grounds.

However, as per your advice I would be satisfied at this time under THIS request if you fulfil it on the basis of the following modification:

Please fully respond to element 1 -' A copy of all DPIA's completed for the HMCTS Common Platform Programme'

This information is of material public interest and should be contained in specific documents created under your obligation S.64 of the DPA 2018, It should not therefore incur significant cost for its delivery, or if you prefer, its publication.

The key aspects of element 3 (Details of the Data Controllers) , element 5 (list of all processors and notified sub-processors for the provision of 'virtual court' hearings) and element 4 ( designated Lead Data Controller for the Common Platform Programme) should already be contained within that DPIA report,;and if so I shall be happy to consider those elements fulfilled without further work by the MOJ if the DPIA is provided in full.

For element 6 (copy of the terms of service/contract between HMCTS and the processors) I will be content for you to clarify as a simple confirmation if the MoJ has used the standard Cloud Service Provider terms of service for the cloud processing, or if special terms have been agreed .

The remaining element (2) I am happy at this time to withdraw in order to reduce to cost of finding it at this time, but may make a separate submission under suitable terms in future if this proves necessary to explore elements 2 & 6 further.

I am sure that this significant reduction in scope will remove the financial barrier to completing the request and I look forward to receiving this material as soon as possible

Please note that I will not accept these being treated as a new FOI request - these are merely clarifications and reductions in detail as suggested by the MoJ in your response to the original request and should therefore be answered as quickly as you are able.

Yours sincerely,

O Sayers

Dear Her Majesty's Courts and Tribunals Service,

I would be grateful if you would provide an update on this request - it is now quite seriously overdue and I have not had confirmation since my clarification on scope that indicates if you shall be responding or not with the requested information.

Yours faithfully,

O Sayers

Dear Disclosure Team,

Thank you for your response - I am of course disappointed that at this point you have elected not to disclose this information, but shall wait whilst you conduct your review of what information can be disclosed without it "being prejudicial to the prevention or detection of crime"; though I wish to make clear that I do not believe this is or indeed can be the case.
Many DPIA's produced within the Criminal Justice Sector are published in whole or in part on public web-pages and there can be few if any details in such a document that would manifestly affect crime prevention or detection.

Once you have completed this review I shall decide if your response warrants an internal review, and thereafter escalate to the ICO if necessary.
The public interest in this request is high, since it seeks to obtain evidence that HMCTS have in fact met their legal obligation to complete a DPIA and to act upon its findings and failures in the creation of adequate DPIA's have already resulted in CJS activities being examined by the courts.

You should therefore be under no illusion that it is my intention to continue to press for this information and if necessary to escalate to the highest level possible to ensure it is made available in as full a form as possible.

Yours sincerely,

O Sayers

Dear Changeinfo,

I have now reviewed the materials sent to me on 2nd December in response to my two FOI requests:

'Request for copies of Data Protection Impact Assessments' and 'Data Protection documentation for Virtual Courts Services' made on 25th August 2020 which you chose to bundle into a single request despite my repeated indications that this was inappropriate and unlikely to be able to meet the requests as tabled.

Unfortunately this appears now to have had the result which I raised concerns about and I am disappointed that some of the data I requested in these submissions (as amended and clarified in my letter of 24th September) has still not been provided, the answers provided do not fully align to the two requests correctly and the reasons for non-provision of some of the data remain to be made clear.

For these reasons I am now asking you to review the requests in their entirety and the responses provided to them and to specifically consider the following areas of omission and concern:

A - Virtual Courts Request
i) Element 1 :"A copy of all DPIA's completed for the HMCTS use of technologies in provision of 'virtual court' hearings; including Skype, Zoom and the Kinly Cloud Video Platform."
This information remains of material public interest and should be contained in specific documents created under your obligation S.64 of the DPA 2018.

No DPIA has been received relating to this service and it has been confirmed that the Virtual Courts Platform is not covered under the Common Platform DPIA response.
I would therefore still like to receive the DPIA created specifically for the HMCTS Virtual Courts progamme and services as requested in August 2020.

ii) Element 3 (Details of the Data Controllers) and Element 5 (list of all processors and notified sub-processors for the provision of 'virtual court' hearings) have not been provided.

These should be in the DPIA and since it is necessary to understand who the processors and sub-processors are to confirm that the service is being ioperated within the requirements of GDPR and DPA 2018 Part 3 I request that the failure to respond to this request and provide this information is reviewed.

iii) I am content that your confirmation to the effect that the MoJ has used the standard Cloud Service Provider terms of service for the cloud processing, fulfils the final (Element 6) of the request.

B - Common Platform Request
i) Element 1 -' A copy of all DPIA's completed for the HMCTS Common Platform Programme'

Some of the information presented in the provided document in your response does not meet the criteria and required statutory content of a DPIA under the terms of DPA 2018 Part 3 Section 64.
I would therefore be grateful if it could be confirmed that this is the limit of the available DPIA content requested and that no other valid DPIA documentation exists.

If other content or versions do exist but have been held back I would request that this is reviewed and copies of the relevant DPIA's are provided.

ii) I requested Element 3 (Details of the Data Controllers) , Element 5 (list of all processors and notified sub-processors for the provision of 'virtual court' hearings) and Element 4 ( designated Lead Data Controller for the Common Platform Programme), which should be contained within the DPIA.

Element 4 has been clarified - thank you - but the remainder of the information has not been provided (though it may be contained in the redacted sections of the provided 'Crime Programme DPIA').

I would be grateful if you review cand onsidereif there is a valid exemption applicable to support not providing this information since it is of fundamental importance and relevance in determining whether the legal obligations for the services once they in operation with live data have in fact been fully met.

This public interest in the transparency of the judicial process must, I feel, take precedence over any commercial concerns and unless the systems are of national security import (which at OFFICIAL they cannot be under the HMG Security Classification Policy) there is no clear justification not to supply that information.

iii) For element 6 (copy of the terms of service/contract between HMCTS and the processors) I am content with your confirmation to the effect that the MoJ has used standard Cloud Service Provider terms of service for cloud processing.

I would respectfully request that all the above information and my original requests are reviewed.
If after review you will still not provide this information, please provide the reasons for not doing so in order that I can escalate this to the ICO for their determination.

Yours sincerely,

O Sayers

Dear Sirs,

i write with regard to my email of 2nd January in respect of this request for information relating to the Common Platform programme in HMCTS/MOJ - which was originally made almost 6 months ago on August 25th 2020.

In the interim I have had various communications from you regarding this request, and a separate request made on the same day for wholly different information but which you elected to link.

For the purposes of this request, I refer you to the salient points of my last email:

B - Common Platform Request
i) Element 1 -' A copy of all DPIA's completed for the HMCTS Common Platform Programme'

Some of the information presented in the provided document in your response does not meet the criteria and required statutory content of a DPIA under the terms of DPA 2018 Part 3 Section 64.
I would therefore be grateful if it could be confirmed that this is the limit of the available DPIA content requested and that no other valid DPIA documentation exists.

If other content or versions do exist but have been held back I would request that this is reviewed and copies of the relevant DPIA's are provided.

>>Please can you examine the above Element 1 and provide an answer to my outstanding question - is the provided document the entirety of the Common Platform DPIA that has been performed?

ii) I requested Element 3 (Details of the Data Controllers) , Element 5 (list of all processors and notified sub-processors for the provision of 'virtual court' hearings) and Element 4 ( designated Lead Data Controller for the Common Platform Programme), which should be contained within the DPIA.

Element 4 has been clarified - thank you - but the remainder of the information has not been provided (though it may be contained in the redacted sections of the provided 'Crime Programme DPIA').

I would be grateful if you would review and consider if there is a valid exemption applicable to support not providing this information since it is of fundamental importance and relevance in determining whether the legal obligations for the services once they in operation with live data have in fact been fully met.

This public interest in the transparency of the judicial process must, I feel, take precedence over any commercial concerns and unless the systems are of national security import (which at OFFICIAL they cannot be under the HMG Security Classification Policy) there is no clear justification not to supply that information.

>> Please provide the requested details of Data Controllers and the list of processors and approved sub-processors

Given the long delays to providing valid responses, and the prevarication you have applied by linking the two separate requests but responding to both incompletely but in parallel at the same time; I do not beleive it is unreasonable to expect this to be fulfilled within 10 working days (i.e. 26th February 2021), when the request will be 6 months old.
If I do not receive a valid response by this data I shall escalate this to the ICO for their determination as to whether you have in fact fulfilled your statutory obligations in this request.

Yours faithfully,

O Sayers

Dear Sirs,

i write with regard to my email of 2nd January and follow up of 15th February in respect of this request for information relating to the Common Platform programme in HMCTS/MOJ - which was originally made over 6 months ago on August 25th 2020.

Although you have provided some information this falls short of fulfilling my request and I have not as requested received form you a final position on the remaining elements.

As intimated in my last email therefore I feel I have no choice but to now refer this to the ICO for theiur attention and action.

Yours faithfully,

O Sayers