Data Protection Compliance 2023-24
Perth and Kinross Council · 20 November 2024
Back to Scrutiny and Performance Committee — 20 November 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
PERTH AND KINROSS COUNCIL Scrutiny and Performance Committee 20 November 2024 DATA PROTECTION COMPLIANCE 2023-24 Report by Data Protection Officer (DPO) 1. PURPOSE 1.1 This report is a professional assessment of the Council’s compliance with the UK General Data Protection Regulation (GDPR) by the Data Protection Officer. This report relates to the year 2023-24. 2. RECOMMENDATIONS 2.1 It is recommended that the Committee: (i) Notes the DPO’s assessment of the Council’s compliance with the requirements of data protection legislation. (ii) Considers the Council’s performance in terms of compliance with the GDPR and provides constructive scrutiny and comment. (iii) Notes that the DPO is confident that a reasonable degree of compliance with data protection legislation has been achieved during 2023-24 and that progress towards increased compliance across all Services will continue during 2024-25 3. STRUCTURE OF REPORT 3.1 This report is structured over the following sections: • Section 4: Background • Section 5: Data Breaches • Section 6: Data Subject requests • Section 7: Policy and Process • Section 8: Training • Section 9: Improvement Actions • Section 10: Conclusion 4. BACKGROUND 4.1 The UK General Data Protection Regulation (“GDPR”) requires the Council, as a public authority, to appoint a Data Protection Officer (“DPO”) and defines tasks that the person must undertake.
Page 2
These tasks include monitoring and reporting on compliance with the GDPR. The Council’s Data Protection Policy sets out that the DPO will present a report on the Council’s data protection compliance to the Scrutiny and Performance Committee annually or more frequently, if considered necessary. It is the role of the Scrutiny and Performance Committee to consider the DPO’s report in relation to the Council’s compliance and to provide appropriate constructive challenge and comment. Role of DPO 4.2 The role of the DPO is defined in the GDPR; the legislation places restrictions on both the DPO and the Council in terms of roles and responsibilities. The DPO, like the other Statutory Officers within the Council, has an independent and autonomous role and the Council cannot instruct the DPO how to undertake the role. It should be noted that legal responsibility for compliance with data protection law lies with the Council as a public body and not the DPO as an individual. The DPO does have a role in providing advice and guidance to support the Council in complying with the legislation and to monitor and report on its performance. Formal advice provided by the DPO, to support the organisation and ensure compliance, is generally accepted. 4.3 The DPO and the Information Rights Team sit within the wider Audit and Governance Team, with the DPO maintaining a separate and distinct reporting line to the Strategic Lead for Legal and Governance Services, who is also the SIRO (Senior Information Risk Owner) for the Council. Resources of DPO 4.4 The legislation also provides that adequate resources should be made available to the DPO to enable them to fulfil their role. 4.5 The Data Protection Officer function does not have a dedicated team but is supported by the Information Rights team and Information Security teams (referred to as the DPO’s team for the purposes of this report). In terms of skills and expertise, as well as the DPO, there are 2 officers (1.7 FTE) within the Information Rights team who have specialised data protection knowledge. Additional support is also provided by a solicitor from within the Council’s Legal service. 4.6 At present, almost all staff time is required to deal with increasing volumes of complex responsive work. This means that there is limited capacity for the proactive planning of work and wider provision of training. 4.7 A new case management system was introduced in August 2023, which is enabling information requests to be recorded, processed and reported. more efficiently.
Page 3
5. PERFORMANCE: DATA BREACHES 5.1 A data breach is defined as an incident involving “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data”. The term ‘security’ refers to both technical measures and organisational measures such as policy, procedures and practice. 5.2 The Council is required to maintain a register of data breaches and, where appropriate, report them to the Information Commissioner’s office. 5.3 Between 1 April 2023 and 31 March 2024, the Council recorded a total of 168 data breaches (compared to 95 during the previous year). This significant increase in the number of breaches recorded year-on-year may appear perturbing; however, it should be noted that the number of breaches reported in 2021-22 was 134, following 146 breaches in 2020-21. This pattern would appear to suggest that the much lower number recorded in 2022-23 was anomalous. Figure 1 – Number of recorded data breaches 5.4 Close examination of the breaches reported to the DPO would suggest that greater awareness of how to recognise data breaches, along with increased pressure and volume of work across the organisation, may have been contributory factors in the increase in reported breaches during 2023-24. 5.5 The DPO takes all data breaches seriously and continues to provide advice to Strategic Areas on how to improve processes to minimise the risk of data breaches. The number of recorded breaches needs to be considered in the context of the many millions of interactions and transactions involving the processing of personal information entailed in the delivery of all Council services in a year. 0 20 40 60 80 100 120 140 160 180 2020-21 2021-22 2022-23 2023-24 Number of recorded breaches
Page 4
5.6 Organisational change during 2023-24 means that it is not possible to provide statistics about breaches based on Strategic Areas of the Council. However, examination of individual cases indicates that, as expected, the areas of the organisation which have higher numbers of interactions involving personal information report greater numbers of breaches. 5.7 The nature of the data breaches was as follows: - Figure 2 – Nature of breaches 5.8 In relation to the data breaches which have been recorded, the DPO confirms that: - • almost all recorded breaches were reported promptly to the DPO and any remedial action which was requested was taken quickly • where breaches have been identified, the relevant service area has, without exception, been keen to engage with the DPO to amend and improve practice • of the recorded breaches, particularly those categorised as email error or unauthorised disclosure breaches, almost all appear to be attributable to human error, often because of reported pressures within the relevant service areas as opposed to any systemic failure of process or policy. 5.9 Of the 168 breaches, the DPO determined that 8 required to be reported to the Information Commissioner’s Office (ICO) following a risk-based assessment of the potential impact on the data subject. 5.10 All 8 of the breaches reported to the ICO all were due to the unauthorised disclosure of personal data. In all 8 cases the ICO was satisfied that the actions taken by the Council in response to the breaches were appropriate and did not require any further action. 133 1 33 1 0 20 40 60 80 100 120 140 Unauthorised disclosure Unauthorised access Email error Data Loss Nature of breaches
Page 5
5.11 The DPO provides support and advice to services and teams when a data breach has occurred and, where necessary, provides additional staff training and written guidance. 5.12 Work is underway with colleagues in IT to identify possible technical solutions to some of the most common causes of data breaches, such as group emails being sent using the “CC” rather than “BCC” function. This work will continue during 2024-25. 5.13 Breaches will continue to be monitored and advice and training provided as appropriate. 6. PERFORMANCE: DATA SUBJECT REQUESTS 6.1 The GDPR gives data subjects a number of specific rights, such as accessing and receiving a copy of information held about them, and having inaccurate personal data rectified. Requests to exercise these rights must be responded to within 1 month (interpreted by the Council as 28 calendar days), unless the information requested is particularly complex in nature or the request is from an individual who has made multiple requests; in these cases, an additional two months to respond is permitted by the legislation. The DPO has responsibility for dealing with requests received by the Council. 6.2 There was a 9% increase in the number of subject access requests received during 2023-24 (229 requests received), compared to 2022-23 (211 requests received). This increase continues to be partly attributable to people seeking confirmation of their care experience, in order to apply to Scotland’s Redress Scheme for survivors of historical child abuse in care. As with other requests for social work records held by the Council, records processed in relation to this scheme may contain a very large volume of complex and highly sensitive information, which requires extensive preparation before release. 6.3 Between 1 April 2023 and 31 March 2024, the Council received 229 requests for access to personal information, of which: - • 27 are on hold pending further information from the requester (this is sometimes never provided) or a decision on whether they wish to proceed with making a request. 6.4 Of the 229 requests received during 2023-24, 202 responses have been completed and responses issued. This represented a 31% increase on the previous year’s figures. Whilst a similar number (211) of requests were received in 2022-23, in 57 cases the requestors did not provide the required documentation or clarification; hence only 154 responses were issued.
Page 6
6.5 Of the 202 requests that were processed: - • 184 were completed within 28 days (91%). • 10 were fully responded to outwith the 28-day timescale, but within the additional two-month period permitted in certain circumstances e.g. particular complexity (5%). In most cases within this category, information was released to requestors in batches, with at least part of the information requested being supplied within the first 28 days. • 8 requests were responded to outwith the 28-day timescale where there were no circumstances which would allow for the extension period to be applied (4% of all responses issued). In almost all these cases, the delay in complying with the permitted timescale was due to difficulties experienced in obtaining information from providers in other areas of the organisation. 6.6 This demonstrates an overall compliance with statutory timescales of 96%, which is considered to be a very high rate of compliance. It should be noted that this compliance rate has been achieved against a background of a significantly increased number of valid requests for information, with no increase in resources. 6.7 Over and above the 229 data subject access requests referred to above, the Council received 3 other data subject requests during 2023-24: - • 1 request for erasure (individuals have the right to request their personal data is deleted, although this is only applicable in certain limited circumstances); • 1 request for rectification (individuals can request that inaccurate personal data is corrected); and • 1 objection to processing 6.8 In addition, the Council also received 37 information related complaints (one fewer than during 2022-23), either directly from the data subjects or via the ICO, about the way personal data had been handled. All these complaints have been responded to appropriately. 6.9 During 2023-24 the Information Rights team also processed 51 requests for information made under a provision in data protection legislation which permits authorities, such as Police and HMRC, to request personal information to assist with criminal investigations and the assessment and collection of taxes. This is a 19% increase on the number of similar requests made during 2022-23, when 43 requests were received. 6.10 The Council is sometimes unable to provide information requested by survivors of historical child abuse in care, usually because the person in question was placed in an institution not run by local government. Recognising the distress that this may cause applicants, the Information Rights team undertake research to help identify the location of records and work with other local authorities and educational establishments to ensure as comprehensive a response as possible can be provided to the requester.
Page 7
6.11 Where information held about requestors may cause distress, the Information Rights team provides advance warning of this before issuing their response. Individuals are appropriately signposted to organisations that can provide them with support going through their records. The Information Rights team is continuing to seek ways of providing as much assistance and information as possible to requestors. 6.12 The DPO is satisfied that data subject requests are being handled well, with a high rate of compliance with statutory timescales, against a background of rising demand and fixed staffing resources. 7. SURVEILLANCE & INTERCEPTION OF COMMUNICATIONS 7.1 The Council has powers under the Regulation of Investigatory Powers (Scotland) Act to undertake directed surveillance and to utilise covert human intelligence sources. The Council also has powers under the Regulation of Investigatory Powers Act to obtain information (‘intercept’) about electronic communications. 7.2 Council officers have a duty to report on the use of these powers to Elected Members. 7.3 During 2023/24, no directed surveillance was authorised, no covert human intelligence sources were used, and no electronic communications information was obtained. 7.4 The Council’s policy statement on the use of directed surveillance and the intercept of communications is attached as Appendix 1. 8. TRAINING 8.1 Throughout the year, the importance of data protection has been signposted to all staff through use of the Council’s intranet and Managers’ briefings, as well as reminders about data protection issues in staff communications, at the DPO’s request. 8.2 The DPO has also delivered targeted training sessions, particularly on how to recognise and prevent data breaches, to individual teams and groups of staff, on request, throughout the year. 8.3 Support, and advice is provided to councillors on an ongoing basis, as required. 8.4 It is acknowledged that the continually increasing workload of the small team has limited the ability to provide more systematic training throughout the year. However, new online data protection training was made available to all Council staff during August 2023.
Page 8
8.5 The DPO considers there to be a reasonable level of general awareness across the Council and notes that staff appear to be willing to seek advice and support from the DPO. 9. DATA PROTECTION POLICY AND PROCESS 9.1 The DPO is satisfied that the Council has a Data Protection Policy which complies with the requirements of the UK GDPR and the Data Protection Act 2018. 9.2 It is a statutory requirement that the Council be able to always provide evidence of its compliance with the legislation. Compliance is therefore documented and evidenced by the Council’s use of: - • Data Protection Impact Assessments (DPIAs) • Data Processing Agreements • Privacy Notices • Data Sharing Agreements (DSAs) 9.3 It is the responsibility of the Council to carry out DPIAs and ensure Data Processing Agreements and Privacy Notices are in place. The role of the DPO is to assist and advise in their creation and to maintain registers of the documentation. 9.4 The DPO is satisfied that there is some form of privacy notice in place in relation to all processing of personal information carried out by the Council. Processing may be covered by the General Privacy Notice which appears on the Council website, or by more specific short or detailed privacy notices. The DPO continues to monitor, review and provide advice to services as required. Privacy notices are required where we collect personal data. 9.5 Where personal information requires to be shared with other parties (e.g., Police, Health etc) best practice requires that Data Sharing Agreements should be put in place. These are specialised documents which tend to be lengthy and time-consuming pieces of work, often needing extensive consultation with the other organisations involved. The DPO is satisfied that appropriate Data Sharing Agreements are generally in place and that the importance of these arrangements is increasingly recognised. 9.6 The previous UK government began a consultation on proposed changes to data protection legislation in 2021. The draft Data Protection and Digital Information Bill, which was introduced in June 2022, amended rather than repealed existing legislation. After a period of consideration, this Bill was withdrawn, and the Data Protection and Digital Information (No. 2) Bill was introduced to Parliament in March 2023. This Bill was expected to pass into law during 2024; however, with the dissolution of Parliament in May 2024, this Bill fell. There is now continuing uncertainty about the extent to which the new UK Government may seek to change data protection legislation; however, if they seek to do so, there will be a requirement once again to review Council policies and processes.
Page 9
9.7 The rapid advances in the capabilities and potential use within the Council of Artificial Intelligence places significant requirements on the organisation in terms of its obligations under data protection legislation. The DPO recognises the importance of providing the authority with advice that enables it to demonstrate its accountability with these obligations. Work with Information Security and Legal colleagues on a Responsible Artificial Intelligence Governance Policy, which will provide a framework for safe, accountable and legally compliant use of AI technologies, is now underway. 10. IMPROVEMENT ACTIONS In addition to the ongoing actions identified above, the following improvement actions have been identified; 10.1 Work to further streamline subject access request processes, particularly in relation to identifying information held by services which can be accessed and extracted directly by the Information Rights team. 10.2 For those requestors who are enquiring about their time in care, work to develop a care history form to better understand their knowledge of their time in care, in order to maximise the information which can be released to them. 10.3 Continue to raise awareness across the authority about how to identify and report data breaches, as well as providing support and training on how to avoid them. 10.4 Continue to work with colleagues in IT to identify technical solutions to reduce the likelihood of certain categories of data breaches. 11. CONCLUSION 11.1 Given the breadth of all local authorities’ activities and the millions of transactions involving personal data that are processed each year, no local authority can state categorically that it is fully compliant with data protection legislation. It is the opinion of the DPO, however, that the Council continues to achieve a reasonable and acceptable level of compliance. 11.2 The DPO is satisfied that the principles of GDPR compliance are understood and embedded as normal practice across the Council. When procedural failings involving data protection occur, these can almost always be attributed to human error as opposed to a systemic failure in terms of policy or process. 11.3 Whilst the Council would wish to avoid any data breach, given the volume and range of personal information which it processes, the number of reported breaches remains very low, with only a small percentage of these meeting the threshold requiring them to be reported to the Information Commissioner’s Office. Author(s)
Page 10
Name Designation Contact Details Jillian Walker Data Protection Officer DPO@pkc.gov.uk Approved Name Designation Date Lisa Simpson Strategic Lead, Legal & Governance 3 September 2024 Clare Mailer Director (Strategy, People & Resources) 3 September2024
Page 11
ANNEX 1. IMPLICATIONS, ASSESSMENTS, CONSULTATION AND COMMUNICATION Strategic Implications Yes / None Community Plan / Single Outcome Agreement n/a Corporate Plan n/a Resource Implications n/a Financial n/a Workforce n/a Asset Management (land, property, IST) n/a Assessments n/a Equality Impact Assessment n/a Strategic Environmental Assessment n/a Sustainability (community, economic, environmental) n/a Legal and Governance n/a Risk n/a Consultation n/a Internal n/a External n/a Communication n/a Communications Plan n/a 1. Strategic Implications Not applicable. 2. Resource Implications Not applicable. 3. Assessments • Equality Impact Assessment – not applicable • Strategic Environmental Assessment – not applicable • Sustainability – not applicable • Legal and Governance – not applicable • Risk – not applicable 4. Consultation Not applicable. 5. Communication Not applicable.
Page 12
2. BACKGROUND PAPERS None. 3. APPENDICES The Regulation of Investigatory Powers (Scotland) Act 2000 Policy Statement.