Provision of information held by Northumbria Police made under the Freedom of Information Act 2000 (the 'Act')
As you may be aware the purpose of the Act is to allow a general right of access to information held at the time of a request, by a Public Authority (including the Police), subject to certain limitations and exemptions.
You asked:
Please can you provide the answers and statistics for the following questions in relation to Data Subject Access Requests made to the organisation for each calendar year between the 1st January 2018 to 25th August 2020 inclusive
1. How many Data Subject Access Request have been made to the force broken down by;
a. Requests made by the Data Subject themselves
b. Request made by a third-party on behalf of the Data Subject
2. How many requests were rejected and the broad reasons for those rejections
3. How many requests were responded to in full or in part, and for each of these;
a. Whether the response was within one, two, three or longer calendar months after the valid request was received;
and where responded to outside of one calendar month;
b. Whether the requestor was notified within the first calendar month of the delay to the response
c. The broad categories for the delay in responding within the first calendar month
4. How many requests excluded the provision of personal data held which was later used or otherwise disclosed to the Data Subject (or a representative) for another reason, for example in evidence.
In addition to the above, please could you provide details of;
5. The Name, Job Title, and Rank and Badge Number (if applicable) of the individual holding the role of Data Protection Officer for the organisation;
6. If that individual has any other duties, what (in general) those duties are.
7. What "professional qualities and, in particular, expert knowledge of data protection law and practices" (if any) are held by that individual in accordance with Article 35(5) of the GDPR
8. If DPO the role holder is a Shared Resource, which other organisations are served by that DPO.
9. How many people you have working within your Data Protection Compliance team.
In Response:
Following receipt of your request, searches were conducted with the Information Management Unit of Northumbria Police. I can confirm that the information you have requested is held, in part, by Northumbria Police however cannot be disclosed in full for the following reasons.
The information requested at points 1 and 3 is not held in a format that would allow its extraction within the permitted 18 hour threshold. In excess of 1170 Subject Access applications would need to be manually reviewed to establish a response at these points. Even at a conservative estimate of 8 minutes per record, which we have considered as reasonable, we have estimated that to extract the information at these two points alone would take over 156 hours, therefore Section 12(1) of the Freedom of Information Act would apply. This section does not oblige a public authority to comply with a request for information if the authority estimated that the cost of complying with the request would exceed the appropriate limit of 18 hours, equating to £450.00.
You should consider this to be a refusal notice under Section 17 of the Act for your request.
Although excess cost removes Northumbria Police's obligations under the Freedom of Information Act 2000, as a gesture of goodwill I have supplied information below, relative to your request, retrieved or available before it was realised that the fees limit would be exceeded. I trust this is helpful, but it does not affect our legal right to rely on the fees regulations for the remainder of your request.
2. No valid requests are rejected.
4. No information held. This is not recorded.
5. Data Protection Officer is Hayley Young, Civilian, Information Management Unit Manager, more information on this is available via the Force website (https://beta.northumbria.police.uk/cookies-and-privacy/)
6. Manager of the Information Management Unit
8. This is not a shared resource.
9. We have an Information Management Unit that contains a number of areas of disclosure. Subject access requests are handled primarily by 2 Researchers and one Disclosure Advisor
With regards to point 7 – this would be classed as Personal Information and would have been withheld under Section 40 had Section 12 not been fully applicable. The skills and qualifications of an individual would be classed as the personal data of that person and it would not be fair to disclose such data into the public arena.
