Request for updated information held relating to DESC
Dear Police Scotland,
It is some considerable time since I requested information relating to the DESC programme, initiated into a Pilot phase in early 2023 and I beleive it is therefore reasonable to make a further request now.
I would be grateful if you could provide the following information:
In the previously provided/published DPIA's, emails and supporting documentation for the DESC service, you or your partners provided information which indicated that personal data would be processed only within the United Kingdom in Microsoft Data Centres.
In the ICO's email to the DESC partners of 9th December 2022 they identified that use of servives supported from outside of the UK would constitute an international transfer, and that the contract terms may not adhere to S.59(5) of the DPA 2018.
The ICO also indicated that they would provide written guidance to the DESC partners.
I am interested to learn what clarifications, confirmations or new information may have been received since December 2022 wrt the above specifically.
I would be grateful therefore if you could provide me with the following information:
1 - A copy of any documents, emails, analysis conducted by yourself or other DESC party, or similar information in your possession which indicates or evidences that Microsoft and Axon shall not process any personal data outside of the UK - including any transfers conducted for support purposes, or as a function of their provided software and services.
OR Conversely;
2 - A copy of any documents, emails, analysis conducted by the ICO or other party, or similar information in your possession which indicates or evidences that Microsoft and Axon may process personal data outside of the UK - or conduct transfers for support purposes or as a function of their provided software and services.
NOTE: Since only one of those conditions can logically apply I am content to receive a response to either Element 1 or 2 - not both of them.
AND
3 - A copy of any guidance or communication received from the ICO wrt the DESC programme as referred to in their letter of 9th December, or other infomraiton received from them which indicates or clarifies the legal position of the DESC programme under the Data Protection Act 2018 Part 3 specifically.
Yours faithfully,
Owen Sayers
Thank you for your email.
This mailbox is for Freedom of Information (FOI) requests only.
If your email is an FOI request, please accept this email as confirmation
that it has been received.
We may contact you for clarification and/ or your full name if you have
not provided it but otherwise, you should expect a response within 20
working days.
If your email is not an FOI request, we will pass it on to the correct
department and/ or offer advice where we can.
For future reference, there is information available on our website
[1]https://www.scotland.police.uk/ as regards:
- Subject Access Requests
[2]https://www.scotland.police.uk/access-to...
- Provision of Road Traffic Collision (RTC)/ Crime Reports
[3]https://www.scotland.police.uk/access-to...
- Disclosure Scheme for Domestic Abuse Scotland
[4]https://www.scotland.police.uk/advice-an...
- The Sex Offender Community Disclosure Scheme
[5]https://www.scotland.police.uk/advice-an...
Always dial 999 in an emergency or call 101/ refer to our website for
contact details [6]https://www.scotland.police.uk/contact-us/ .
Regards,
FOI Team
References
Visible links
1. https://www.scotland.police.uk/
2. https://www.scotland.police.uk/access-to...
3. https://www.scotland.police.uk/access-to...
4. https://www.scotland.police.uk/advice-an...
5. https://www.scotland.police.uk/advice-an...
6. https://www.scotland.police.uk/contact-us/
Good Afternoon
I refer to the FOI request, detailed below, which you submitted to Police Scotland and would be obliged if you could provide me with some clarification.
Police Scotland is considering two different areas, namely personal data subject to UK GDPR and Law Enforcement Data (LED) subject to Part 3 of the Data Protection Act 2018.
Accordingly, could you please clarify if the questions relate solely to Law Enforcement Data or whether UK GDPR should be considered?
Your request will be put on hold until clarification is received. The 20 working days will commence upon receipt of the additional information requested. If, however, the additional information requested has not been received by 17 April 2024 , I shall assume that you no longer wish to proceed with this request and will treat it as withdrawn.
Kind Regards
Information Management
Police Scotland
2 French Street
Dalmarnock
Glasgow
G40 4EH
OFFICIAL
Good Afternoon
I refer to the FOI request, detailed below, which you submitted to Police
Scotland and would be obliged if you could provide me with some
clarification.
Police Scotland is considering two different areas, namely personal data
subject to UK GDPR and Law Enforcement Data (LED) subject to Part 3 of the
Data Protection Act 2018.
Accordingly, could you please clarify if the questions relate solely to
Law Enforcement Data or whether UK GDPR should be considered?
Your request will be put on hold until clarification is received. The 20
working days will commence upon receipt of the additional information
requested. If, however, the additional information requested has not been
received by 17 April 2024 , I shall assume that you no longer wish to
proceed with this request and will treat it as withdrawn.
Kind Regards
Information Management
Police Scotland
2 French Street
Dalmarnock
Glasgow
G40 4EH
Dear FOI Glasgow,
Thank you for your two identical communications of 19th and 20th March (the 15th and 16th working day after making my FOI request respectively) seeking clarification.
I do not understand the basis for your request for this clarification, since I expressly refer to DESC in the request (7 times) and refer to S.59(5) of the DPA 2018 - which falls within part 3 of the legislation relating to processing conducted for Law Enforcement purposes only as being my specific area of interest.
For element 3 I reiterated that I am referring to information relating to the DPA 2018 Part 3 specifically.
I therefore do not see any basis for your clarification request - or why you would have considered UK GDPR processing to be in scope for this request, or your possible response since the DESC system contains NO personal data processed under UK GDPR.
The request and relevant legislation should be reasonably obvious to any reader applying normal english language, and in particular to Police Scotland as the respondent, and a participant in the desC programme.
As a result, no examination of UK GDPR processing should ever have come into your scope for consideration, and nor do I accept that you have a reasonable basis for this clarification.
In addition, I note your intention to rely on the S10(1(b)) capability to reset the clock for responding by issuing a clarification to which I must respond.
I would remind you that this can only apply if the clarification question itself is a reasonable one (under Section 1(3)), and for the reasons given above I do not believe your question to be reasonable or necessary.
Given the very late point of issue (15th & 16th working day), it is indeed not unreasonable for me to wonder if your late clarification question is principally an egregious attempt to reset the response clock.
You should therefore not expect to rely on your email clarification requests to enable an extension for response beyond the initial 20 working day maximum.
I wholly reject your clarification question as being self-evident from the wording of the original request, and I shall include this in any referral made to the Scottish ICO should that prove necessary in due course.
So far as I remain concerned I expect this request to be completed within the normal delivery time frame of 20 working days, which I am exceptionally willing to extend by two working days to take into account the high likelihood that you have stopped work on the request whilst hoping to extend the overall timescale through your clarification request mechanism.
I cannot of course stop you from taking such time as you wish to apply to actually respond, but if this extends beyond the normal statutory timescale of 20 working days at most, I do reserve the right to ask the Scottish ICO to determine if your action was reasonable, and in keeping with your overarching responsibilities under the Act.
Yours sincerely
Owen Sayers
Dear FOI Glasgow,
I wish to bring to your attention that I have today had cause to write to the Scottish Government re their response to an associated FOISA request to this one, which mirrors your own request for clarification made to me on the same date.
By way of important context I wish to advise that I sent the same broad FOISA request as I sent to you on 27th February, to all of the DESC participants as individual requests.
The reasoning for my doing so is simple:
a) Each participant operates as a distinct legal entity and each has a different relationship to both the DESC system and to the applicable Data Protection 2018 Part 3 legislation.
b) Some of the DESC participants are legally unable to use any processor operating outside of the UK under
S.73(4)(b) of the Act.
For these organisations understanding if the processing requires international transfer is of public interest.
c) Others may be able to legally transfer data outside of the UK, but can only do so by following a complex set of conditions and obligations laid down in S. 77 of the Act.
FOI's from the ICO indicate this is not often adhered to, and therefore understanding if the processing requires international transfer is of public interest.
d) One particular DESC participant (the Scottish Government), fulfils a wholly peripheral role to the processing itself and is not a Controller, Processor, nor does it have any other obvious applicable DPA 2018 Part 3 status.
The Scottish Government awarded the DESC contract, but has no other legal relevance under UK Data Protection law.
As such it should not be reasonably expected not to play any key role in the determination of processing or adherence to the legal obligations of the other parties who do have DPA 2018 legal obligations and hold individual accountability for those obligations.
In making my requests I beleived (and I continue to beleive ) that it was both necessary and proper for each of the DESC participants to be contacted individually, and for each of your to respond to the request in the context of your own individual status wrt DESC and the DPA 2018 Part 3.
I am requesting that each of you disclose the information you may or may not individually hold in order to gain a representative view of the DESC operating landscape from each of your own organisational and DPA 2018 Part 3 legal perspectives.
I wish to bring to your attention that on 19th March (the 15th working day after the request was made) I received almost identical clarification requests from the Scottish Government and Police Scotland.
The nature of these clarifications is so unlikely to have been arrived at independently, that I can only conclude they were discussed prior to being sent.
For these to have been issued at exactly the same point in processing the request; sent to me on the same date; and seeking to extend the time for fulfiment of the request by a further 20 working days after I respond, is so unlikely that it further leads me to the conclusion that these letters for clarification may have been created after collaboration and some form of agreement between the yourselves and the Scottish Government.
I would like to make clear that whilst I accept that some communication between DESC participants might be necessary or reasonable to some degree in the answering of my request, I do not believe this can legitimately extend to discussion of the nature of individual requests themselves, nor to any discussion as to the means of response to be made by each of the authorities as appears to have been the case here.
Each authority has its own FOISA obligations, and as my introductory text above should make clear, your individual organisational planned (or actual) form of use for DESC places each of you into different categories of possible applicability of the DPA 2018 Act.
It is my expectation that when answering these requests, or any requests I may make in future in relation to DESC, that communication between the participating parties shall be limited only and solely to legitimate consideration of the release of information each of you may individually hold where this could have bearing on one or more third parties.
I also ask that you respect the sharing of my own personal data to the extent applicable under UK law and disclose only such information as is necessary to facilitate such reasonable discussions.
I make these requests individually for good reason, and I seek your own individual responses - not a collective or agreed position.
I have already responded to you relating to your own cllarification letter and explained why I beleive it is foundrous. I hope you shall process that and respond accordingly to this request.
I would however like to make clear that should further evidence appear that suggests actual collaboration or creation of group responses is taking place, rather than the minimum of reasonable communication allowed for under FOISA, I shall ask the Scottish ICO to determine if such collaboration has extended to the formulation of group responses or any other improper outcome.
I hope that will not prove necessary, since it is not in the interests of the Scottish Taxpayer to incur such additional costs.
Yours faithfully,
Owen Sayers
Dear Police Scotland,
Please pass this on to the person who conducts Freedom of Information reviews.
I am writing to request an internal review of Police Scotland's handling of my FOISA request 'Request for updated information held relating to DESC'.
This request was made on 27th February 2024, and should have had a response on or before 27th March.
On 19th and 20th March (the 15th and 16th working day of my request) I received identical repeat clarifications from PSoS, along with an indication that the request would not commence processing until the PSoS clarification was answered.
I responded to you on 20th March to identify that I felt the basis of the clarification request was spurious and unecessary, since the request clearly identifie dthe data in scope and your request was based on your own interpretation of the scope; but nonetheless providing the information requested in order to progress the request.
I made clear at that time that in any appeal I consequently found necessary to make to the Scottish ICO I would express my concerns as to both the late presentation of the clarification and why I believed it was unnecessary.
As a result of that clarification response on 20th March, I ought to have received your completed output from this request by 18th April (according to the SICO calculator).
I further wrote to you on 25th March (for information) to express my concern that it appeared likely from an almost identical clarification received around the same time as you oen that PSoS and other DESC participants may have been liaising over response to the individual requests I made to each party for the information each independently holds.
Since submission of my clarification on 20th March and subsequent follow-on email of 25th March I have not received any further communications from you.
As a result, this request is now 6 working days overdue from your requested point of clock reset, and substantially more overdue from the original timeline.
I now require you to examine why this request has not been fulfilled and arrange for it to be answered as a priority.
If I do not receive confirmation that you have initiated an internal review of the request I shall escalate directly to the Scottish ICO 10 working days from today (May 13th).
I would remind you that under Para 7.4.1 of the Scottish Ministers Code of Practice on the discharge of functions by Scottish Public authorities under the Freedom of Infofmration (Scotland) Act 2002 and the Environmental Information (Scotland) Regulations 2004, consultation is not considered sufficient basis to delay an FOISA request. If this is the cause of continued delay I urge you to respond fully now.
Yours faithfully,
Owen Sayers
Thank you for your email.
This mailbox is for Freedom of Information (FOI) requests only.
If your email is an FOI request, please accept this email as confirmation
that it has been received.
We may contact you for clarification and/ or your full name if you have
not provided it but otherwise, you should expect a response within 20
working days.
If your email is not an FOI request, we will pass it on to the correct
department and/ or offer advice where we can.
For future reference, there is information available on our website
[1]https://www.scotland.police.uk/ as regards:
- Subject Access Requests
[2]https://www.scotland.police.uk/access-to...
- Provision of Road Traffic Collision (RTC)/ Crime Reports
[3]https://www.scotland.police.uk/access-to...
- Disclosure Scheme for Domestic Abuse Scotland
[4]https://www.scotland.police.uk/advice-an...
- The Sex Offender Community Disclosure Scheme
[5]https://www.scotland.police.uk/advice-an...
Always dial 999 in an emergency or call 101/ refer to our website for
contact details [6]https://www.scotland.police.uk/contact-us/ .
Regards,
FOI Team
References
Visible links
1. https://www.scotland.police.uk/
2. https://www.scotland.police.uk/access-to...
3. https://www.scotland.police.uk/access-to...
4. https://www.scotland.police.uk/advice-an...
5. https://www.scotland.police.uk/advice-an...
6. https://www.scotland.police.uk/contact-us/
OFFICIAL
Good Morning,
Prior to raising your request for review due to our response being
delayed. I wanted to inform you that only one review can be processed per
FOI request. This means that if a review is processed in relation to the
delayed timescale, you will be unable to request a review if you are
unhappy with any information provided in our response.
I appreciate our response has not been provided within the 20 working day
timescale. We are working to have this with you as soon as possible.
If you wish to progress with your review request, please reply to this
email and I will have this raised for you.
Kind regards,
FOI Team
Dear FOI,
Many thanks for your last.
I think that given the extensive delay to my request, and the now limited confidence I hold that the request shall at any point in the near future be fulfilled, I would like to initiate the review into your handling of the request thus far.
Whilst I acknowledge that this may limit opportunities for me to ask you to re-consider your response (if and when it is issued), this does not in any way limit my ability to pass the request, responses and outputs of your internal review to the Scottish ICO for their consideration should I require to do so.
In the review I would like you to consider and explain the reasons for the delay in responding to the request in the laid down timescale, consideration of the purpose and foundation of the request for clarification made on day 15 of the initil request timeline, the basis and content of any discussions held between PSOS and other parties, and any effect this has had on the fulfilment of your response within the statutotry timescale.
COPFS and Scottish Government have thus far identified that discussions have been held with Police Scotland under the terms of the Scottish Ministers Code of Practice.
Although that COP requires that such discussions must not impinge on the statutory timescale for fulfillment of a request, this appears not to have been adhered to in this case by PSoS, and I am specifically interested to identify why this is the case.
The nature of those discussions is one specific area I expect to ask the Scottish ICO to examine, since they appear to have led to delays across multiple recipients of the requests made to each party.
As a co-signatory to the COP the Scottish ICO may well be interested in the efficacy and operation of those arrangements.
It is therefore only reasonable that I give PSoS the clear opportunity to explain why or how these may have contributed to your delay in fulfilment of this request, if indeed they have.
Yours sincerely,
Owen Sayers
Thank you for your email.
This mailbox is for Freedom of Information (FOI) requests only.
If your email is an FOI request, please accept this email as confirmation
that it has been received.
We may contact you for clarification and/ or your full name if you have
not provided it but otherwise, you should expect a response within 20
working days.
If your email is not an FOI request, we will pass it on to the correct
department and/ or offer advice where we can.
For future reference, there is information available on our website
[1]https://www.scotland.police.uk/ as regards:
- Subject Access Requests
[2]https://www.scotland.police.uk/access-to...
- Provision of Road Traffic Collision (RTC)/ Crime Reports
[3]https://www.scotland.police.uk/access-to...
- Disclosure Scheme for Domestic Abuse Scotland
[4]https://www.scotland.police.uk/advice-an...
- The Sex Offender Community Disclosure Scheme
[5]https://www.scotland.police.uk/advice-an...
Always dial 999 in an emergency or call 101/ refer to our website for
contact details [6]https://www.scotland.police.uk/contact-us/ .
Regards,
FOI Team
References
Visible links
1. https://www.scotland.police.uk/
2. https://www.scotland.police.uk/access-to...
3. https://www.scotland.police.uk/access-to...
4. https://www.scotland.police.uk/advice-an...
5. https://www.scotland.police.uk/advice-an...
6. https://www.scotland.police.uk/contact-us/
OFFICIAL
Good afternoon,
Your request for a review is acknowledged and will be dealt with by one of
our Disclosure Managers.
A response will be provided to you within the legislative timeframe.
Kind regards,
FOI Team
Dear FOI,
I submitted a request for internal review to you for your handling of my FOISA request on 7th May and received a notification that this would be responded to within the statutory timescale (normally accepted as 20 working days).
The Scottish ICO calculator thus identifies that a respoinse to my review should have been completed by 5th June, but as of todays date (11th June) I have still not received this.
Please can you advise as to when I shall receive your response?
Yours sincerely,
Owen Sayers
Thank you for your email.
This mailbox is for Freedom of Information (FOI) requests only.
If your email is an FOI request, please accept this email as confirmation
that it has been received.
We may contact you for clarification and/ or your full name if you have
not provided it but otherwise, you should expect a response within 20
working days.
If your email is not an FOI request, we will pass it on to the correct
department and/ or offer advice where we can.
For future reference, there is information available on our website
[1]https://www.scotland.police.uk/ as regards:
- Subject Access Requests
[2]https://www.scotland.police.uk/access-to...
- Provision of Road Traffic Collision (RTC)/ Crime Reports
[3]https://www.scotland.police.uk/access-to...
- Disclosure Scheme for Domestic Abuse Scotland
[4]https://www.scotland.police.uk/advice-an...
- The Sex Offender Community Disclosure Scheme
[5]https://www.scotland.police.uk/advice-an...
Always dial 999 in an emergency or call 101/ refer to our website for
contact details [6]https://www.scotland.police.uk/contact-us/ .
Regards,
FOI Team
References
Visible links
1. https://www.scotland.police.uk/
2. https://www.scotland.police.uk/access-to...
3. https://www.scotland.police.uk/access-to...
4. https://www.scotland.police.uk/advice-an...
5. https://www.scotland.police.uk/advice-an...
6. https://www.scotland.police.uk/contact-us/
OFFICIAL
Good Afternoon
Please find attached the response to your information request/review
request. Please accept our apologies for delay in responding.
Kind Regards
Information Management
Freedom of Information
Police Scotland
Clyde Gateway
2 French Street
Dalmarnock
G40 4EH
Dear FOI,
Thank you for your long list of exemptions on this ridiculously overdue and generally refusenik response to my FOISA request.
I am sure you are already aware that given the many months since the request was made you have limited or no legal grounds to now claim most of these exemptions, and I must admit surprise that you have still tried to do so.
Unfortunately I have already raised complaint with the Scottish ICO both for the failure to respond as legally required within the statutory timescale, and for what I believe are breaches of the Scottish Ministers Code of Practice for FOISA requests.
I trust they shall be in contact with you shortly, but shall also send them this response as part of that complaint for their consideration.
Yours sincerely,
Owen Sayers
Thank you for your email.
This mailbox is for Freedom of Information (FOI) requests only.
If your email is an FOI request, please accept this email as confirmation
that it has been received.
We may contact you for clarification and/ or your full name if you have
not provided it but otherwise, you should expect a response within 20
working days.
If your email is not an FOI request, we will pass it on to the correct
department and/ or offer advice where we can.
For future reference, there is information available on our website
[1]https://www.scotland.police.uk/ as regards:
- Subject Access Requests
[2]https://www.scotland.police.uk/access-to...
- Provision of Road Traffic Collision (RTC)/ Crime Reports
[3]https://www.scotland.police.uk/access-to...
- Disclosure Scheme for Domestic Abuse Scotland
[4]https://www.scotland.police.uk/advice-an...
- The Sex Offender Community Disclosure Scheme
[5]https://www.scotland.police.uk/advice-an...
Always dial 999 in an emergency or call 101/ refer to our website for
contact details [6]https://www.scotland.police.uk/contact-us/ .
Regards,
FOI Team
References
Visible links
1. https://www.scotland.police.uk/
2. https://www.scotland.police.uk/access-to...
3. https://www.scotland.police.uk/access-to...
4. https://www.scotland.police.uk/advice-an...
5. https://www.scotland.police.uk/advice-an...
6. https://www.scotland.police.uk/contact-us/
We work to defend the right to FOI for everyone
Help us protect your right to hold public authorities to account. Donate and support our work.
Donate Now
O Sayers left an annotation ()
Due to ongoing refusals / failures to respond to this request or to perform the internal review within a reasonable timeline I have now escalated this request to the Scottish Information Commisisoner for their attention and consideration.
Whilst I could provide PSoS with more time, I have low confidence that they now intend to respond to this request as asked.