Home > FOI 238 – Policies and Procedures

FOI 238 – Policies and Procedures

The OPCC is asked to provide information about data protection and disclosure policy and procedure.

FOI Request

  1. please can you send me a copy of the current subject access request acknowledgment AND response letter that you use
  2. a copy of the last 5 dpias completed
  3. a copy of any internal mandatory information governance training that you give to staff which was written in the last 2 years including presentation slides and videos and any other media
  4. a copy of any instructions given to staff members to reduce data security breaches, for example double checking work
  5. a copy of any policies implemented in the last 2 years within the organisation to help reduce the environmental impact that the organisation has?
  6. please can I have a copy of the risk rating that you use to evaluate data security incidents? 

FOI Response

I can confirm that the Office of the Police and Crime Commissioner for Cleveland does hold some of this information.

1. The OPCC does not have set templates for acknowledging and responding to Subject Access Requests. Each letter is prepared on a bespoke basis.

2. The OPCC holds no recorded information on this topic.

3. As part of their induction, all new members of staff are required to complete a mandatory online training course on information management via the National Centre for Applied Learning Technologies (NCALT). 

This information is held by Cleveland Police and I can transfer this part of the request should you wish.

Prior to the introduction of the General Data Protection Regulations in May 2018, staff from the Office of the Police and Crime Commissioner received a practitioner orientation session, supported by PowerPoint prompts. As this session does not fall under the description of ‘information governance training’, we have not disclosed these slides. Should you wish to access these slides, please contact me.

4. Where applicable, The Office of the Police and Crime Commissioner adheres to Cleveland Police’s policies, due to our use of their ICT and technology systems. Their Information Management Policy, Data Protection Impact Assessment Policy and Information Security Policy are published on their website.

The OPCC are in the process of developing their own suite of information management policies, which will be published on our website upon completion. 

5. The OPCC does not maintain a policy on this particular issue. As Cleveland Police maintain the Estates Strategy, I would be more than happy to transfer this part of your request to them, if you wish.

6. Please find the matrix attached.

Date responded: 27 January 2020