Body Worn Video ( 502A/22)
Request
1 – A copy of the Data Protection Impact Assessment(s) conducted on the AXON ‘Evidence.com’ digital evidence management cloud service under the terms of s64 of the Data Protection Act 2018, to include any and all of the following families of Axon services in use or planned for deployment:
- a) Body Worn Video functionality
- b) Vehicle deployed video camera functionality (e.g. Axon Fleet 2)
- c) Axon Citizen
- d) Axon Interview
- e) Evidence.com services
Please note:
A DPIA should not in general contain any specific information of security measures requiring redaction before release, but I am aware that some Policing organisations do include this information in their DPIA products.
Reasonable redaction of such information strictly to the extent necessary to maintain the security of Police operations (if it is included in the DPIA) is acceptable.
General redaction of core information relating to relevant DPIA content required to evidence achievement against statutory obligations would however be unacceptable and should be unnecessary since its release is obviously and materially in the public interest and is the core function of a DPIA.
2 – A copy of the specific terms of service applied within the contract between Axon and the Authority relating to Data Protection Act Part 3, or confirmation that the standard Terms of Service have been applied without modification.
3a – Copies of any specific diligence material, contractual terms or other undertakings from Axon that they will not transfer any personal data processed for a Law Enforcement purpose by the Authority outside of the UK without the Authorities prior specific approval in each instance, as required under S59(7) go the Act; OR
3b – Copies of any guidance issued by the Authority to officers and staff relating to the steps and procedures required by the Authority (under DPA 2018 s.77) before the upload of personal data processed for a Law Enforcement purpose to any Axon cloud serviceswhere an undertaking not to transfer the data outside of UK has not been given in contract.
4 – Copies of all communications between the authority and the ICO, other Forces or national policing bodies/projects and/or other professional advisors, which informed the creation of the DPIA and/or supported decisions around the procurement or use of the Axon evidence.com related products; including any submissions made, or supporting materials provided, to the Police & Crime Commissioner or similar (PCFC/MOPAC/etc.) for the Authority which is not already in the public domain.
We clarified with you on 7th April 2022 and you replied on 19th April 2022
UK Data Protection Legislation (the Data Protection Act 2018 Part 3 [DPA Pt3]) requires a competent authority to have certain materials provided to it in writing including undertakings and contractual elements which demonstrate their selected processor will comply with the legislation.
It is this material, along with any 3rd party advice or any guidance provided to assess those materials that I seek when asking about ‘diligence material’.
YOUR CLARIFICATION REQUEST:
In question 3b I am unsure what you are asking?
MY CLARIFICATION:
Under DPA Pt3, Section 77 requires a competent authority to assess multiple factors before sending data to a processor or recipient other than another law enforcement entity outside of the UK.
I am asking if any guidance has been issued to officers relating to considerations they must take, and report they must write and send to the ICO before they upload of personal data processed for a law enforcement purpose into AXON cloud services and systems.
YOUR CLARIFICATION REQUEST:
What do you mean by ” services where an undertaking not to transfer the data outside of UK has not been given in contract.”?
MY CLARIFICATION:
The DPA Pt3 – Chapter 4 – lays down specific obligations for a data controller and their processors, including a specific undertaking that data shall not be sent outside of the UK unless approved on a case by case basis by the controller.
Any processor who does this without such authority has breached the DPA Pt3, as has the Controller if they allow this to occur.
If the contract specifically says the data shall of may be transferred outside of UK (and standard AXON contracts do in fact say this) then specific measures must be taken by the Controller to justify the transfer of the data.It is this area about which I am asking – if WMP do not have a written undertaking that no data will be sent outside of UK without prior express and case by case approval, then WMP staff and officers should have been provided with strict guidelines as what data can be uploaded and given specific instructions to complete certain tasks and a report to ICO. I am asking for a copy of this material.
………………………..
4 – Copies of all communications between the authority and the ICO, other Forces or national policing bodies/projects and/or other professional advisors, which informed the creation of the DPIA and/or supported decisions around the procurement or use of the Axon evidence.com related products; including any submissions made, or supporting materials provided, to the Police & Crime Commissioner or similar (PCFC/MOPAC/etc.) for the Authority which is not already in the public domain.
YOUR CLARIFICATION REQUEST:
Do you have a start / end date for this search? Currently it is too broad. The whole question 4 is too broad and will most likely fall into the exemption of cost, please consider refining this question, as to explore 43 police forces, ICO, national policing bodies/projects and/or other professional advisors (a bit vague and could be a large number ). Please define “all” communication, this is likely to incur cost exemption. For the purpose of FOI the time limit is 18 hours for the search / collation of data.
MY CLARIFICATION:
I understand, let me reduce this scope for you to assist in controlling possible cost as follows:
“Copies of all communications since May 2018 when the DPA 2018 came into effect, between:
- a) WMP and the ICO,;
- b) National policing bodies or projects;
- c) Other professional advisors; and/or
- d) The WMP Police & Crime Commissioner (or similar party)
which informed the creation of the DPIA and/or supported decisions around the procurement or use of Axon evidence.com related products.”
I have reduced the timescale only to the minimum period relevant to when the DPA Pt3 has had effect (ie since May 2018), and to communications specifically associated with the procurement and/or use of Axon evidence.com and associated products or services in a legal manner.
This should drastically reduce the amount of material to be reviewed and tighten the scope to matters that are likely to be retrievable from simple word searches.
Response
Our data are not organised in such a way as to allow us to provide all of this information within the appropriate (cost) limit within the Freedom of Information (FOI) Act (see ‘Reason for Decision’ below).
In Question 4: There are in excess of 512 files in two project locations. In order to locate any information relevant to your request would require an individual search of each individual file / communication.
Please note that researching each individual case in Question 4 would exceed the appropriate limit (FOIA, s.12). Therefore, the cost of compliance with the whole of your request is above the amount to which we are legally required to respond, i.e. the cost of locating and retrieving the information would exceed the appropriate costs limit under section 12(1) of the FOI Act 2000. For West Midlands Police, the appropriate limit is set at £450, as prescribed by the Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004, S.I. 3244. In accordance with the Freedom of Information Act 2000, this letter acts as a Refusal Notice for this part of the request and if one part of a request exceeds the fees limit then S12 of the Act applies to the whole request
Further information on S12, of FOI is available here:
However, although excess cost removes the force’s obligations under the Freedom of Information Act, as a gesture of goodwill I have supplied information, relative to your request, retrieved before it was realised that the fees limit would be exceeded. I trust this is helpful, but it does not affect our legal right to rely on the fee’s regulations for the remainder of the request.
With regards to questions 1 – 3, We can confirm that relevant information is held by West Midlands Police. However, we are withholding some of that information since it is exempt by virtue of the following exemptions
Section 31 (1) (a) (b) (c) (Law enforcement)
Section 40 (2) personal data
Section 40(2) is an absolute and class-based exemption if to release the information exists would breach the third party’s data protection rights. In this case to release this personal information would not constitute fair processing of the data. As this exemption is class based I am not required to identify the harm in disclosure and in this instance, I believe that the right to privacy outweighs any public interest in release
These exemptions and explanatory notes are shown here:
In line with the above, I am required to complete a Prejudice Test/Public Interest Test (PIT) on disclosure. Please find this PIT attached (502A-22 PIT)
Question 1
Please see attachments:
502A_22 Attachment 2 DPIA Document (Exemptions as per S40 (2) Personal Information)
502A_22 Attachment 3 Axon security questions (Exemptions as per S31 (1) Law enforcement)
Please note that some of the information is withheld as per the exemptions detailed above.
Please refer to the attached Public interest test – PIT (502A – 22 PIT)
Question 2
Please see Attachment 502A-22 4 Contract.
Please note that some of the information is withheld as per the exemptions detailed above.
Please refer to the attached Public interest test – PIT (502A – 22 PIT)
Question 3A
Please see attachment 502A_22 Attachment 1 Cloud security (Exemptions as per S31 (1) Law enforcement)
Question 3B
No information held.
Attachments
502A 22 Attachement 1 Cloud security
502A_22 Attachment 3 Axon Security questions