Please could you provide me with the following information which I am requesting under the Freedom of Information Act.

1. How many Information Governance staff are currently (2013)employed by your council:

Information Manager

Records Manager

Information Security Manager

2 x Information Governance Officers

a. Information Governance officers/managers b. Data protection Officers/managers c. Freedom of information officers/managers d. Records management officer/manager e. Other IG professionals f. Information policy officers

2. Please could you indicate the above for the following years:

a. 2012/b. 2011

Information Manager plus 2 x Information Governance Officers

c. 2010

1 Information Manager

3. Please could you tell me how much the council has spent in 2010/2011, 2011/2012, 2012/2013 in the following areas:

a. Information Governance training:

i. Data Protection training

ii. Records management training

iii. Freedom of Information training

iv. Data Quality training

b. Processing Subject Access Requests

The information you request is not held.

Training is/will be provided as part of the team’s remit but there is no time recording mechanism in place that is able to separate out time spent on training against the cost associated with delivery.

4. Please could you tell me how many data protection Section 10 requests have been received by the council in the period 2010/2011, 2011/2012, 2012/2013

The receipt of section 10 notices is not recorded on a central database.

See note below regarding Section 12

5. Please could you tell me how many subject access requests have been received by the council for the period: 2012/2013, 2011/2012, 2010/2011.

The receipt of subject access requests is not recorded on a central database.

See notes below regarding section 12

6. Please could you tell me whether the authority charges for subject access requests under the data protection act 1998? The Corporate policy does not prescribe the charging of the fee, and departments are able to do so on a discretionary basis

7. Please could you let me have a copy of your breach management policy or equivalent.

This information is not currently held and is under development

8. Please could you send me a copy of your information Governance policy or procedures.

I have provided copies of the policies within the Council as outlined below. Please clarify whether you would like to obtain policies/procedures relating to a different subject matter within Information Governance. Please note if clarification is not forthcoming within 3 months, this element of the request will considered to be lapsed.

Policy / Attachment
Data Protection Act policy /
Freedom of Information Act policy /
Subject Access Request policy /
Records Management policy /

9. Please could you tell me how many times if any the council has breached the data protection act since 2010?

The Data Protection Act 1998 contains 8 principles and to breach any or part of a single principle breaches the Act. Given the date you refer to ie, 2010, I have interpreted this question to mean incidents involving data loss and information security incidents in line with the monetary penalties/enforcement powers of the Information Commissioners Office effective 6/04/2010.

Please confirm if this is the case, or clarify your question to enable consideration of the appropriate answer. Please note if clarification is not forthcoming within 3 months, this element of the request will considered to be lapsed.

Question 4 and 5 response

In relation to question 4 and 5, Section 12 of the Freedom of Information Act 2000 states — 12. (1) Section 1(1) does not oblige a public authority to comply with a request for information if the authority estimates that the cost of complying with the request would exceed the appropriate limit.

I would like to inform you that with regards to the information you have requested we are likely to hold the said data; however, this is not in an extractable format for reasons outlined below.

Oldham Council receives requests under the Data Protection Act on an ongoing basis. The requests come through many different channels throughout the Council. This may be directly to the team involved or the information governance team. Should a request me made through the information governance team, the team deals with the request in line with the Data Protection Act. The team would ascertain identity required and contact the service which holds the information. The team would then support / assist and record the process.

The requests however may also be reverted to the individual departments from the outset, therefore not involving the information governance team. The information governance team do however, assist and advise when required to do so. With regards to requests made through to the Council as a whole, the information would not be held in a central place. In order to respond to your query, we would have to contact each department within the Council as to retrieve the information requested along with breaking down the information, would require the interrogation of all departments within the Council. Following this interrogation, each individual file would have to be analyzed in order to ascertain said information. We are likely to hold the data you requested, however, as the format in which the data is recorded, I am satisfied that the cost limit would be exceeded if this information was to be retrieved and that the Council is therefore not obliged to comply.

Section 12 relieves a public authority from the obligation to comply with a request for information under Section 1(1) of the Act where the estimated time required to locate, review and extract the information exceeds a certain threshold set out in Regulations.

The Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004 (SI 2004/3244) set out the rules in relation to the cost limit (otherwise called the “appropriate limit”). These Regulations are published by the Office of Public Sector Information (OPSI) and are viewable on their web site from this link: http://www.opsi.gov.uk/si/si2004/uksi_20043244_en.pdf

The Regulations set out the cost limit for Government departments and for other public authorities. For local government, Regulation 3 states that the cost limit is £450 and Regulation 4(4) states that the prescribed hourly rate is £25.

Regulation 4(4) further provides that where the local authority estimates the time taken to gather the information would exceed this limit (which based on the prescribed hourly rate, equates to 18 officer hours), it may refuse the request under section 12 of FoIA.

We are in process of reviewing policies and procedures and working towards a database, allowing the information governance team to keep an update and true record of the status of requests made under the Data Protection Act 1998.

If you are dissatisfied with the handling of your request, you have the right to ask for an internal review. Internal review requests should be submitted within two months of the date of receipt of the response to your original letter and should be addressed to:

Paul Entwistle

Borough Solicitor

OBC, PO Box 33,

Civic Centre, West Street,

Oldham OL1 1UL

Tel 0161 770 4822 Fax: 0161 770 5185

Email:

If you are not content with the outcome of the internal review, you have the right to apply directly to the Information Commissioner for a decision. Details are as follows:-

Office of the Information Commissioner

Wycliffe House

Water Lane

Wilmslow

Cheshire SK9 5AF

www.informationcommissioner.gov.uk

Tel: 01625 545700 Fax: 01625 524510

Yours Sincerely

Nadeer Hussain
Information Governance Officer
Oldham Council