I have seen from your FOI dedicated website that one request concerning the National Analytics Solution (“NAS”) was received in January and partially answered.
I also note that the Information assurance page linked in the first PIT in the reply at
https://www.app.college.police.uk/app-content/information-management/information-assurance/ as at today’s date appears still to indicate that work is being undertaken that GDPR compliance is reflected.
- Please supply the Data Protection Impact Assessment for the NAS
- Please state from what databases the information has been collected & consolidated for the NAS..
- Please confirm which bodies are using and/or participating in the use of the NAS
- Please supply details of the supplier of the services, whose pricing schedule was deleted under Section 43(2) exemption but make up either the external running costs estimated at £3.9m for the Foundation phase.
- Please confirm which health and education databases are to be shared in partner services and what data sharing arrangements have been reached?
- Please confirm the 9th law enforcement partner or supply the exemption & PIT relating to its redaction.
- Please supply the report referred to in Q2 of the January 22 FOI request**, if it has been released into the public domain or, if it has not, state when or under what circumstances its release into the public domain will occur:
** The 38-page Report on the above proposal completed on 28 July 2017 by a small team drawn from the Turing’s Data Ethic Group and IDEPP, led by Professor Charles Raab (University of Edinburgh), co-Chair of IDEPP and member of the Alan Turing Institute’s Data Ethics Group
I can confirm that relevant information is held by West Midlands Police (please see attached 11377_19_attachment.pdf), however, although I am releasing information in full for questions 2, 3, 4, 5, 6 and 7, I am withholding some information with regard to question 1, since it is exempt by virtue of the following:
Section 23(1) (Information supplied by, or relating to, bodies dealing with security matters)
Section 31(1)(a)(b) (Law enforcement)
Section 40(2) (Personal information)
These exemptions and explanatory notes are shown here:
Section 23 is a class based absolute exemption and there is no requirement to consider the public interest. This exemption relates to the names of the NCA members on pages 10 and 13 of the NDAS Consultation Requirements section.
Section 40(2) allows for personal data to be withheld where release would breach the third party’s data protection rights. It would be unfair to release this information where any person could be identified from the data and in this case the right to privacy outweighs any public interest in release. This exemption relates to the individuals named on pages 9 to 14 of the NDAS Consultation Requirements section.
In line with Section 31 above, I am required to complete a Prejudice Test/Public Interest Test (PIT) on disclosure. Please find this PIT attached (11377_19_PIT.pdf). This exemption relates to the redactions on pages 6 to 9 and 36 to 47.