Annual Data Protection Report for Financial Year 2021-22
North Lanarkshire Council · 1 March 2023
Back to Finance and Resources Committee — 1 March 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
North Lanarkshire Council Report Finance and Resources Committee Does this report require to be approved? ☐ Yes ☒ No Ref AA/AG/PC/GG Date 29/11/22 Annual Data Protection Report for Financial Year 2021-22 From Archie Aitken, Chief Officer (Legal and Democratic) E-mail aitkena@northlan.gov.uk Telephone 07939 280102 Executive Summary The purpose of this report is to provide Committee with information on the Council’s Data Protection compliance and activity in respect of financial year 2021-22. Recommendations It is recommended that Committee gives consideration to the contents of the report. The Plan for North Lanarkshire Priority Improve North Lanarkshire's resource base Ambition statement (25) Ensure intelligent use of data and information to support fully evidence based decision making and future planning
Page 2
1. Background 1.1 This report by the Chief Officer of Legal and Democratic, as the Council’s Data Protection Officer (DPO), provides an update in relation to the Council’s data protection compliance and activity in respect of the Financial Year 2021/22. 2. Report 2.1 The Information Governance Policy Framework brings together the Council’s information governance policies, including the Data Protection Policy. The Framework was reviewed in 2020/21 and approved by Policy and Strategy Committee before being issued as part of the Council’s Information Governance week in June 2021. A review of corporate data protection arrangements is currently underway and a report on the review will be submitted to Committee, once concluded. It was previously identified that there was a need to review corporate procedures for dealing with subject access requests to ensure that requests were being dealt with consistently across the Council. This work was impacted by the pandemic, however, comprehensive Subject Access Request Guidance was completed in April 2021 and circulated to Services in June 2021 alongside the following resources: - Personal Data Breach Case Study and Lessons Learned Note - Info Note 1: What is Personal Data - Info Note 2: Data Controllers and Data processors - Info Note 3: Data Protection Principles - Info Note 4: Privacy Notices 2.2 Personal Data Breaches 2.2.1 The Council has a statutory obligation to report a personal data breach (where it has been assessed as resulting in a risk to the rights and freedoms of the individual(s) affected) without undue delay and, where feasible, not later than 72 hours after having become aware of the breach, to the Information Commissioner’s Office (ICO). Where the risk to the data subject is considered to be high then the Council should also contact them to advise them of the breach. 2.2.2 The DPO maintains a record of personal data breaches in accordance with the Data Protection Act 2018 and the UK GDPR. The total number of breaches notified to the DPO in the financial year 2021/22 was 69. This compares with 49 in the previous year. Of these, 5 met the threshold for reporting to the ICO, compared with 12 in the previous year. This represents a year on year increase of 41% in the volume of data breaches recorded across the Council with a significant improvement in the proportion of cases meeting the threshold for reporting to the ICO. 2.2.3 The ICO did not take enforcement action in respect of any of the reported breaches. It did, however, make a number of observations and recommendations. - One breach resulted from a cyber-attack on one of the Council’s contractor’s systems, which culminated in a police investigation. Although actions were taken by the contractor, as data processor, to mitigate and report the breach, the Council were not timeously notified of the breach and this was the subject of a review with the data processor. - The importance of accurately recording information about data subjects within records and ensuring that any manually recorded information is accurately
Page 3
migrated into any electronic record. - Ensuring that any attachments to emails are correctly identified and that any manual correspondence is accurately addressed and contains only information properly intended for that recipient. - populated forms should not be provided in response to requests for blank forms - forms populated with an individual’s personal data must not be used as a template. - ensuring appropriate double checking and verification measures are in place. - managers must remind staff of their responsibilities to ensure that personal data is processed securely. 2.3 Subject Access Requests 2.3.1 As members are aware, a Subject Access Request (SAR) is a request made by an individual in order to access their personal information that is held by an organisation, which normally has to respond to the request within one month. However, if the individual has made a number of requests or if the request is complex then the organisation may need additional time to consider the request and can take up to a further two months to provide their response. If they intend to do this then they should let the individual know within one month that more time is required and the reason for this. 2.3.2 The Council’s SharePoint platform has been used since December 2019 to record the number of SARs received by services and the extent of compliance with statutory timescales in responding to such requests. The volume of SARS received throughout the Council and the extent of compliance is reported quarterly to the Data Governance Board. 2.3.3 167 SARs were recorded as received during 2021/2022. 73.7% of these were responded to within statutory timescales. This compares with 98 SARs received in 2020/2021, of which 62% were actioned within statutory timescales. There has therefore been an improvement in the rate of compliance with statutory timescales for responding to SARS despite a higher overall number of SARs being received. 41.3% of all recorded SARs received by the Council in 2021/2022 were in respect of Social Work. 2.4 Complaints 2.4.1 There were 5 recorded complaints received from the ICO during 2021/22. These related to the following: - a failure to respond timeously to one of a series of SARs made by a data subject - reference to outdated data protection legislation within one form issued by the Council - a complaint that the Council had failed to provide certain information in response to a SAR that required responses from a number of services
Page 4
- personal data relating to an individual had wrongly been made available on one of the Council’s online public portals - a complaint that a SAR had not been properly responded to because the information provided in response to it had not covered the period of time specified in the request. 2.4.2 The ICO have adopted a policy of increasingly encouraging data controllers to engage directly with individuals who have made complaints to their office as regulator, rather than directly intervening. At the conclusion of the complaint, where the ICO have not decided to take any formal enforcement, they will usually make recommendations to the data controller about any steps which they feel could be taken to address any shortcomings in respect of their compliance highlighted in the particular case (as referred to in Section 2.2 above). Any such recommendations have been fed back directly to relevant Services by the Information Governance Team and also by periodic reporting through meetings of the Council’s Data Governance Board. 2.4.3 The total of 5 reported regulator complaints compares with one reported ICO complaint for the year 2020/2021. This represents a significant increase from a low comparator. It is not possible to definitively ascertain whether this increase results from a reduction in compliance or whether because of an increased general awareness of the right to complain to the regulator. The majority of ICO complaints related, as would be expected, to responses to SARs. The Council received a 70.4% increase in the level of SARs received during this financial year. A corresponding increase could therefore be anticipated in ICO complaints. 2.5 Data Protection Training 2.5.1 The Council’s online training portal has several mandatory modules which staff are required to complete every two years. Data Protection and Information Security Awareness training falls within the category of mandatory training and the level of uptake of these modules is reported to and monitored by the Data Governance Board. In addition to the basic Data Protection training module, an advanced module has also been developed. Since June 2021, the advanced training module has been mandatory for all employees who have responsibility for staff and for those whose roles have been identified as requiring an enhanced level of training. 2.5.2 A review of the Council’s Information Governance and Security arrangements was undertaken and is detailed in the Internal Audit Progress Report which was reported to the Audit and Scrutiny Panel in March 2021. The review concluded that, while there was a ‘reasonable assurance’ that the Council had appropriate and generally effective arrangements in place in relation to information governance and security, the uptake of mandatory training across the Council by relevant staff was low and in need of improvement. Training compliance in respect of the mandatory online training modules increased from between 6 to 13% compliance in 2019/2020 to between 54 to 61% in 2020/2021. The compliance level in respect of the advanced Data Protection module for 2020/2021 was 69%. 2.5.3 As at March 2022, 50% of relevant staff had completed the Data Protection Essentials Module, 63% of staff had completed the Advanced Data Protection module and 48% had completed the Information Security Awareness and Records and Information Management mandatory modules. Although levels of training undertaken in this area has increased significantly from a low base in 2019/2020, the level of uptake has fallen short of levels achieved in the previous financial year.
Page 5
2.6 Service Specific Training 2.6.1 Further training sessions have been developed and delivered by Legal Services’ Information Governance Team. At the request of the Social Work Service, face to face training has been delivered through Microsoft Teams to officers who have direct responsibility for responding to subject access requests, and 75 officers have received the training to date. This encompasses a variety of posts, including but not restricted to, social workers, senior social workers and residential and house managers. The training encompassed and reinforced principles contained within the Corporate Subject Access Request Guidance, with a particular emphasis on good practice in the redaction of information in response to requests. The training also focused on the importance of responding within statutory timescales and of appropriately supporting social work clients who may be receiving substantial quantities of very sensitive personal information. 2.6.2 Legal Services aim to continue to deliver similar training to the other Council Services as part of a rolling programme during Financial Year 2022/2023. 3. Measures of success 3.1 Continued compliance with statutory responsibilities and improved uptake of mandatory training. 4. Supporting documentation None Archie Aitken Data Protection Officer & Chief Officer of Legal and Democratic
Page 6
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? If Yes, has an assessment been carried out and published on the council’s website? https://www.northlanarkshire.gov.uk/your-community/equalities/equality- and-fairer-scotland-duty-impact-assessments Yes ☐ No ☐ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ If Yes, have all relevant financial impacts have been discussed and agreed with Finance? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ If Yes, have all relevant HR impacts have been discussed and agreed with People Resources? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☒ No ☐ If Yes, have all relevant legal impacts have been discussed and agreed with Legal and Democratic? Yes ☒ No ☐ If Yes, please provide a brief summary of the impact? This report forms part of the duties of the Council’s Data Protection Officer (DPO) whose role is to facilitate compliance with data protection legislation 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ If Yes, is the processing of this personal data likely to result in a high risk to the data subject? Yes ☐ No ☐ If Yes, has a Data Protection Impact Assessment (DPIA) been carried out and e- mailed to dataprotection@northlan.gov.uk Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi?
Page 7
Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? Where the impact identifies a requirement for significant technology change, has an assessment been carried out (or is scheduled to be carried out) by the Enterprise Architecture Governance Group (EAGG)? Yes ☐ No ☐ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? This report contains tracking and monitoring performance information relating to Information Governance and Information Security. The Information Governance and Information Security Risk is a key corporate risk on the Council’s Risk Register, and tracking and monitoring performance in this area forms part of the management controls which aim to reduce the risk and provide assurance on how effectively it is being managed. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ If Yes, please provide a brief summary of the provision which has been made to ensure there has been appropriate consideration of the particular needs of the Armed Forces community to make sure that they do not face disadvantage compared to other citizens in the provision of public services.