WEST MERCIA PCC: DISCLOSURE LOG
RESPONSE TO REQUEST
Reference: 2021 – 240 / WE4008
Date of response: 9th April 2021
FREEDOM OF INFORMATION ACT 2000 – INFORMATION REQUEST
Request
Please provide all documentation regarding data sharing protocols with Sancus Solutions Ltd, detailing how members of the public information is shared and what audits and control measures are in place to ensure compliance.
Response
Please see the below response to your request.
The information you have requested is held by the Office of the Police and Crime Commissioner.
Your request under the Freedom of Information Act (FOIA) is refused. In accordance with s.17(2) of the FOIA, this acts as a Refusal Notice.
Your request is exempt from disclosure under the following:
Section 43(2) – Commercial Interests
Section 36(2)(c) – Prejudice to the Effective Conduct of Public Affairs
The following points have been considered in respect of harm/ prejudice and public interest in this decision:
S.43(2) – Commercial Interests
Harm
- Risk of damaged organisational reputation through compromised procurement exercise.
- Third party commercial interests would be compromised in respect of disclosing their business operating methods.
- Damage to commercial relationship between OPCC and service provider.
- Compromised future procurement exercise.
Public Interest Consideration
| FOR DISCLOSURE | AGAINST DISCLOSURE |
| Increased transparency for OPCC, and therefore reassurance for public in respect of how their data is handled, and the fact that the OPCC incorporates proper processes to that end in its dealings with third party service providers. | – Risk of jeopardising OPCC organisational reputation through compromised procurement exercise. An OPCC that conducts its affairs properly and lawfully is in the public’s interests. Non-disclosure eliminates the risk of legal action by interested commercial parties, which may cost the public purse. – Third party commercial interests would be compromised in respect of disclosing their business operating methods. This may harm relationship between OPCC and service provider. This is not in the public’s interest when the service provider helps the OPCC fulfil a key statutory function. – Risk in respect of disclosing details of existing contract and potential future operating models. May result in compromised future procurement exercise, resulting in poorer service to the public in the future, or worse value for public money. – Reassurance is already provided to the public in respect of data handling via privacy notice and other published documents, without going into specific tactical details. – Any resulting efforts to compromise police / OPCC information security may have commercial implications in terms of issues of cost arising, all coming from the public purse. |
| Increased transparency for OPCC, and therefore reassurance for public in respect of how their data is handled, and the fact that the OPCC incorporates proper processes to that end in its dealings with third party service providers. | – Disclosure of specific information security techniques and processes employed by OPCC (and police force via the same ICT systems) may lead to increased vulnerability to cyber enabled crime / attempts to compromise sensitive policing information. The maintenance of information security is important to the continued effectiveness of policing and by extension public safety. – Any resulting efforts to compromise police / OPCC information security may have commercial implications in terms of issues of cost arising, all coming from the public purse. |
Balance test for public interest considerations
The risks to the public associated with the disclosure of police and OPCC security information are significant, particularly for the police force.
Whilst this FOI is for the OPCC to determine, the OPCC uses force ICT in all its functions. This includes the specific arrangements in place with this third party provider. The OPCC and police ICT are one and the same and it is only appropriate that they be considered as such for the purposes of this decision.
The continuity and protection of policing services to the public (including where necessary the handling of sensitive data) is of very significant public interest. The disclosure of such specific measures in respect of data security, which could then be used against both the OPCC and the police force, is therefore not in the public’s interest when they could subsequently be used to attempt to compromise public safety. Given the importance of this matter and its potential impact, it seems clear that this is the guiding and over-riding consideration in this matter when considering the public interest test.
The public interest in respect of transparency and reassurance is much more limited. While there is always value and an inherent public interest in a public body acting with openness and transparency, there are limits in respect of how far this can reasonably go in respect of some functions and still be in the public’s interest. Particularly around such sensitive details as the security of police ICT infrastructures. While the public may be interested in such matters, this is not the test. It is clear that the greater public interest remains with the protection and maintenance of effective policing services, which is safeguarded by not disclosing information that could see these services compromised.
Yours sincerely,
FOI Officer
West Mercia PCC
Complaints
If you think that the Police and Crime Commissioner has failed to supply information in accordance with the publication scheme, then you should write in the first instance, to the:
Chief Executive, OPCC – West Mercia, Hindlip Hall, Worcester. WR3 8SP
The PCC will aim to deal with your complaint within 10 working days. If you are dissatisfied with the response you can ask for the matter to be internally reviewed. Internal reviews will be completed promptly and a response given to you within 20 working days of your further request.
If, after the internal review, you remain dissatisfied, then you can complain to the Information Commissioner (Office of the Information Commissioner), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF).
