WEST MERCIA PCC: DISCLOSURE LOG
RESPONSE TO REQUEST
Reference: 2023 – 341 / WE7803
Date of response: 09th August 2023
FREEDOM OF INFORMATION ACT 2000 – INFORMATION REQUEST
Request
Dear Sir/Madam,
I am writing to make a formal request for information under the provisions of the Freedom of
Information Act 2000. I kindly request that you provide me with the following information:
- A copy of your organisation’s Records of Processing Activity (ROPA) as defined in Article
30 of the UK General Data Protection Regulation (UK GDPR). - A copy of all legitimate interest assessments conducted by your organisation where you
rely on Article 6(1)(f) legitimate interests as your lawful basis for processing. - A copy of all privacy impact assessments conducted by your organisation.
- A copy of all data protection impact assessments conducted by your organisation.
- A copy of all international transfer risk assessments conducted by your organisation.
- A recent copy of your organisation’s data protection compliance assessment using the
Information Commissioner’s Office (ICO)’s accountability framework template. If you are
using your own standards to monitor compliance with the Data Protection 2018, please
provide me with copy of it. - A copy of your organization’s data protection policy.
- A copy of your organization’s subject access request policy, procedures, and processes,
including any guidance material such as folder structure, naming conventions, and redaction
guides. - A copy of your organisation’s privacy notices, including but not limited to employees,
customers, ministers, special advisors (SPADs), complaints, NEDS, visitors, and CCTV.
Complaints
If you think that the Police and Crime Commissioner has failed to supply information in accordance with the publication scheme, then you
should write in the first instance, to the:
Chief Executive, OPCC – West Mercia, Hindlip Hall, Worcester. WR3 8SP
The PCC will aim to deal with your complaint within 10 working days. If you are dissatisfied with the response you can ask for the matter
to be internally reviewed. Internal reviews will be completed promptly and a response given to you within 20 working days of your further
request.
If, after the internal review, you remain dissatisfied, then you can complain to the Information Commissioner (Office of the Information
Commissioner), 3 Peel Cross Road, Manchester, M5 4). - A copy of your organisation’s due diligence questions for vendor management such as
independent data controllers or processors.
I understand that under the Freedom of Information Act, you are required to respond within
20 working days. To stay within section 12 – cost limits, I suggest asking your Data
Protection Officer for the information. If this is not possible, I suggest a search of your
compliance platform and your Microsoft estate for the following search terms (not case
sensetive): - “records of processing activity” OR “ropa”
- “legitimate interest assessment” OR “LIA”
- “privacy impact assessment” OR “privacy impact assessments” OR “PIA”
- “data protection impact assessment” OR “DPIA”
- “transfer risk assessment” AND “personal data”
- “accountability framework”
Response
Please see the below response to your request.
It is judged that the work required to assess the volume of material covered by the search
criteria specified would impose a disproportionate burden on the Office of the Police and Crime Commissioner (OPCC). There are significant numbers of folders and files in electronic and paper format, a full review of all this information would be required to assess for disclosure.
Therefore, based on the total amount of documentation held relating to this FOI request, it
has been determined that it would be impossible to conduct a review within a reasonable
amount of time. As such to proceed with this request would impose a significant burden on
the OPCC, for a member of staff to assess at least all the relevant electronic and paper
folders and files within.
In relation to the assessment, we would need to consider whether the information would be suitable for disclosure in its entirety. If a partial disclosure is deemed to be appropriate, then redactions would need to be made to the document based on an assessment on whether any of the information triggers any relevant exemptions under the Freedom of Information Act. This could include any names, addresses, persons of interest, information provided in confidence and police intelligence, which through disclosure would either harm law enforcement or breach Data Protection principles.
It is impossible to say exactly how long this process would take. However, a conservative
estimate would be a member of staff spending 8 hours per day, for over 26 days in total, to
undertake only this piece of work.
Therefore, for a member of staff to spend over 26 days solely on one case would result in a
large burden on the OPCC. I do not believe public money would be well spent with a
member of staff spending this amount of time working solely on one case.
Considering all the arguments above, it is for these reasons that Sections 12 1 (1)
and Section 14(1) have been applied.
Yours sincerely,
FOI Officer
West Mercia PCC
Complaints
If you think that the Police and Crime Commissioner has failed to supply information in accordance with the publication scheme, then you
should write in the first instance, to the:
Chief Executive, OPCC – West Mercia, Hindlip Hall, Worcester. WR3 8SP
The PCC will aim to deal with your complaint within 10 working days. If you are dissatisfied with the response you can ask for the matter to be internally reviewed. Internal reviews will be completed promptly and a response given to you within 20 working days of your further
request.
If, after the internal review, you remain dissatisfied, then you can complain to the Information Commissioner (Office of the Information Commissioner), 3 Peel Cross Road, Manchester, M5 4).
