Freedom of Information Policy

IMAGE: The Orkney Islands Council coat of arms appears above the document title, “Freedom of Information Policy”. The cover also states: “All our written information can be made available, on request, in a range of different formats and languages. If you would like this document in any other language or format please contact on 01856873535 or email Corporate Services.”

All our written information can be made available, on request, in a range of different formats and languages. If you would like this document in any other language or format please contact on 01856873535 or email Corporate Services.

Contents

1. Purpose of Report — 4
2. Statement of Intent — 4
3. Roles and Responsibilities — 4
   • Chief Executive and Executive Directors — 4
   • Head of Legal Services — 4
   • Information Governance Officer — 5
   • FOI Coordinator — 5
   • FOI Service Contacts — 5
   • All Staff — 5
4. Identifying a Request for Information — 5
   • Requests for Council Services — 6
   • Requests for Recorded Council Information — 6
   • Requests for Personal Information — 6
   • Requests for Environmental Information — 6
   • Access to Health Records Act 1990 — 7
5. Making a FOISA Request — 7
6. Handling Requests for Information — 8
7. Timescales for Responding to a Request for Information — 9
8. Publication Scheme — 9
9. Charging — 10
10. Exemptions — 11
11. Applying Exemptions/Refusing Requests — 11
12. Format of Response — 12
13. Copyright — 12
14. Request for a Review of the Council’s Decision — 12
    • Request for a Review — 12
    • Review Obligations — 13
    • Review Procedures — 13
15. Records Management — 14
16. Contact — 14
    • Appendix 1: Environmental Information (Scotland) Regulations 2004 (EIR) — 15
    • Appendix 2: Data Protection legislation — 17
    • Appendix 3: Summary of FOISA Exemptions — 18
    • Document Control Sheet — 19
    • Review/Approval History — 19
    • Change Record Table — 19
    • Status Description — 19

1. Purpose of Report

1.1. On the 1 January 2005 the Freedom of Information (Scotland) Act 2002 (FOISA) gave citizens from across the globe the right to request and receive information from any Scottish Public Authority unless the information was subject to an exemption.

1.2. This document provides advice and guidance for Orkney Islands Council and staff on handling these requests. This policy takes into account the Scottish Ministers Code of Practice on the Discharge of Functions by Public Authorities under the Freedom of Information (Scotland) Act 2002.

1.3. You can get further advice from the Scottish Information Commissioner’s website: www.itspublicknowlege.info.

2. Statement of Intent

2.1. Orkney Islands Council is committed to transparency and will favour disclosure of information whenever possible.

2.2. The Council will ensure that the public will have a general right of access to the information it holds, subject to certain conditions and exemptions as outlined in this policy.

2.3. The Council will adopt and maintain a publication scheme, approved by the Scottish Information Commissioner.

2.4. The Council will ensure that training is given to relevant officers and ensure that these officers are familiar with the requirements of FOISA.

2.5. This policy applies only to information covered by FOISA and the Environmental Information (Scotland) Regulations 2004 (EIR).

3. Roles and Responsibilities

Chief Executive and Executive Directors

3.1. Overall responsibility and accountability for compliance with information legislation lies with the local authority’s Chief Executive and Executive Directors. The Chief Executive and Executive Directors may also be involved in considering complex information requests.

Head of Legal Services

3.2. The Head of Legal Services will monitor compliance with information legislation and this Policy across the Council.

3.3. S/he will act as the reviewing officer where any applicant is dissatisfied with the way in which the Council has dealt with a request for information under FOISA or EIR.

Information Governance Officer

3.4. The Information Governance Officer reports directly to the Head of Legal Services.

3.5. S/he is responsible for ensuring compliance with FOISA and EIR and provides expert advice, guidance, training and support on all areas of information governance. The Information Governance Officer will approve all responses to information requests under FOISA or EIR and the responses will go out in his/her name.

3.6. The Information Governance Officer is also responsible for compiling statistics on the Council’s performance under FOISA and EIR. The statistics are reported to the Council annually and to the Council’s Senior Management Team on a quarterly basis. Quarterly reports will also be submitted to the Scottish Information Commissioner.

FOI Coordinator

3.7. The FOI Coordinator is a member of the Corporate Services team. S/he is responsible for coordinating responses to information requests in liaison with the Council’s FOI Service Contacts. The FOI Coordinator will monitor the foi@orkney.gov.uk mailbox and will ensure that responses to information requests are drafted in and orderly and structured way.

3.8. S/he will give the response to the applicant. The Council’s Communications team will be copied in to all responses under FOISA and EIR.

FOI Service Contacts

3.9. All Council services have designated FOI Service Contacts. The Service Contacts are supported by Deputy Service Contacts. The Service Contacts are trained in FOISA and will be able to provide guidance to staff in their service. The Service Contacts are also responsible for coordinating responses to information requests that are relevant to their services with the FOI Coordinator.

All Staff

3.10. All staff must be aware of the Council’s obligations under FOISA and EIR. Where a member of staff is unsure as to whether or not they have received an information request within the scope of FOISA or EIR they should contact the relevant FOI Service Contact.

4. Identifying a Request for Information

4.1. Access to information is principally governed by:

• 4.1.1. Freedom of Information (Scotland) Act 2002.
• 4.1.2. Environmental Information Regulations 2004.
• 4.1.3. Data Protection legislation.

4.2. The information outlined below will help staff to identify which access regime(s) should be followed for particular requests. Some requests may be subject to more than one regime.

4.3. Further information and guidance can be sought from the FOI Coordinator and the Information Governance Officer.

Requests for Council Services

4.4. A request for a service provided by the Council, for example, a request for housing or the uplift of waste, is not dealt with under FOISA. Instead it should be passed to the appropriate service for attention.

Requests for Recorded Council Information

4.5. A request made in a permanent and recorded format for photographs, policies, correspondence (including emails) or any other information held by the Council and recorded in any permanent format is likely to fall within the remit of FOISA. Such requests must be answered within 20 Working Days. It is a criminal offence to destroy information that is subject to a FOI request.

Requests for Personal Information

4.6. You may receive a request for personal information. If the applicant is requesting personal information about themselves or about another individual (and can prove they are acting as that person’s representative) then the application should not be handled under FOISA. This is a Subject Access Request and must be dealt with under Data Protection legislation. In most cases, third party information must not be released without the third party’s consent.

4.7. The FOI Coordinator coordinates the response to Subject Access Requests with the FOI Service Contacts.

4.8. Further information about the Data Protection legislation and Subject Access Requests can be obtained from the FOI Coordinator and the Information Governance Officer.

Requests for Environmental Information

4.9. Requests for information about the environment (for example, earth, air, water, living organisms, or any force or activity that could affect the environment or human health) is dealt with under the Environmental Information (Scotland) Regulations 2004 (EIR). Such a request can be in a permanent or oral form and will usually be answered within 20 working days.

4.10. The FOI Coordinator coordinates responses to information requests under EIR.

4.11. Further information is given in Appendix 1.

Access to Health Records Act 1990

4.12. The Access to Health Records Act 1990 grants rights to certain individuals to see what has been written about a deceased person in a hospital and other health records. Access is available to the deceased patient’s personal representative or to any person having a claim arising out of a patient’s death.

4.13. Any requests for information which may fall within the terms of this Act should be sent to the FOI Coordinator in the first instance.

5. Making a FOISA Request

5.1. A valid FOISA application must:

• 5.1.1. Be in a permanent form that can be referred back to (for example, letter, email, voicemail, cassette or video recording).
• 5.1.2. Include a real name, with an address/email address to which a reply can be sent.
• 5.1.3. Include a description of the information requested.

5.2. Please note that applicants do not have to refer to FOISA within the terms of their request.

5.3. Telephone requests are not subject to FOISA. However many requests can be easily dealt with over the telephone and staff should continue to deal with these accordingly.

5.4. All staff have a statutory duty to provide advice and assistance to persons wishing to make an information request, even if the request is likely to be refused. If requests cannot easily be dealt with in a non-recorded format, such as a telephone call or face-to-face, staff should advise applicants to put the request in a permanent form, such as letter or e-mail, and to send this to the FOI Coordinator. If the enquirer is unable to put their request into a permanent form, staff should consider recording the request themselves and sending it to the applicant for confirmation of the request.

5.5. If it is unclear from a request what information is actually being requested, then staff should contact the FOI Coordinator who can ask the applicant to be more specific. This may mean politely phoning, emailing or writing back to the applicant asking them for further information. This needs to be done as soon as possible after receiving the request. The 20 working day clock will restart when an applicant responds with sufficient information to make the request.

5.6. The applicant does not have to tell the Council why they want the requested information.

5.7. The applicant can request a preference as to the format in which the information is provided such as particular file formats, on tape, large print or braille (see section 12 below). The Council should as far as reasonable possible, respect this request. Otherwise the information can be provided as:

• 5.7.1. Photocopies of information, with exempt information redacted (blacked out).
• 5.7.2. A written digest of the information requested.
• 5.7.3. An invitation to come and view the documents in person (if practical).

6. Handling Requests for Information

6.1. The 20 working day timescale to respond to a FOISA request means that it is vital that the application is dealt with immediately. It is the responsibility of the member of staff who receives the request to send the request to the foi@orkney.gov.uk mailbox. The FOI Coordinator will log the request and coordinate the response with the relevant FOI Service Contact(s).

6.2. The FOI Service Contacts must provide the FOI Coordinator with the draft response no later than the timescale set using the foi@orkney.gov.uk mailbox. FOI Service Contacts must contact the FOI Coordinator as soon as possible if:

• 6.2.1. They do not hold the information requested.
• 6.2.2. They require clarification or further assistance.
• 6.2.3. They are unlikely to meet the deadline.
• 6.2.4. They intend to apply an exemption.

6.3. Where a Service Contact does not respond to the FOI Coordinator within the set timeframe the relevant Head of Service/Executive Director will be copied into a reminder for the information requested.

6.4. Members of staff asked to provide a draft response to an information request must deal with the request as soon as possible. Members of staff may wish to contact their FOI Service Contact and/or the FOI Coordinator where:

• 6.4.1. A request is asking for particularly sensitive information including:
  • 6.4.1.1. Information relating to staff disciplinary matters.
  • 6.4.1.2. Information about a controversial council policy or decision.
  • 6.4.1.3. Requests for personal information.
  • 6.4.1.4. Requests for information that contains personal data about a third party.
• 6.4.2. A request where staff time and photocopying will exceed £100.
• 6.4.3. A request that you are likely to apply an exemption, except in cases where you are sure the council does not hold the information requested.
• 6.4.4. If you are interested in receiving FOI training.

6.5. Where the Information Governance Officer changes the draft response produced by the Service Contact, s/he will notify the relevant Executive Director or Head of Service as well as the FOI Service Contact.

7. Timescales for Responding to a Request for Information

7.1 All requests considered under FOISA must be answered in full within 20 working days. The 20 working day period begins at the time the request is received by the council and not from the point it reaches the correct service/person. Therefore it is essential that all staff:

• 7.1.1. Are aware of FOISA procedures.
• 7.1.2. That responsibility for a request is determined immediately.
• 7.1.3. That all requests are logged in the FOISA database by the FOI Coordinator.
• 7.1.4. That post/email is checked daily.
• 7.1.5. That requests for information are dealt with by colleagues in an absence.
• 7.1.6. That all staff take advantage of the automated ‘out of office’ email message to ensure applicants are redirected to the most appropriate person.

7.2. In cases of unexpected absence, line managers should consider informing the IT helpdesk to ensure that an appropriate ‘out of office’ message can be applied to staff email accounts.

7.3. Services should put reasonable procedures in place to ensure that information requests are being dealt with as early as possible.

7.4. Post should be date stamped/marked on receipt by the Council. This will help calculate the 20 day deadline and ensure a response is issued within the appropriate time.

7.5. A working day is Monday to Friday, 09:00 – 17:00 excluding bank holidays and weekends. All FOISA requests must be answered within 20 working days, regardless of staff absence, flexible working, job-sharing, part-time working or school holidays.

7.6. The 20 working day clock stops when:

• 7.6.1. The information is sent to the applicant.
• 7.6.2. A fees notification/refusal notice is issued.
• 7.6.3. Clarity is sought from the applicant on the terms of their request.

7.7. The clock will then restart when the further information or payment is received.

8. Publication Scheme

8.1. FOISA requires all public authorities to produce and maintain a publication scheme.

8.2. The scheme sets out:

• 8.2.1. The classes of information already available to the public.
• 8.2.2. Details of how the information can be obtained.
• 8.2.3. Its location.
• 8.2.4. Whether there is a charge for providing the information.

8.3. All information available through the publication scheme is exempt under FOISA. The scheme is regularly reviewed so that any new classes of information to be made available to the public are included in the scheme.

9. Charging

9.1. The majority of requests under FOI will be dealt with free of charge. However, if the cost of answering a request will be between £100 and £600, including staff time and photocopying, then charges can be levied in line with the fees regulations set down by the Scottish Government.

9.2. The fees regulations provide that:

• 9.2.1. The first £100 cost to respond to an applicant will be free.
• 9.2.2. The Council can recover 10% of costs between £100 and £600.
• 9.2.3. A request can be refused on grounds of excessive cost if to respond to the request would cost the Council over £600.
• 9.2.4. Staff time is calculated to a maximum of £15 per hour. If a member of staff’s hourly rate is less than £15 per hour then the lower rate applies.

9.3. Fees can be charged for:

• 9.3.1. The cost of locating, retrieving and providing the information requested.
• 9.3.2. Providing the information in the requested format.

9.4. Fees cannot be charged for:

• 9.4.1. Time deciding if we hold the information in the first place.
• 9.4.2. Deciding what information should be released.
• 9.4.3. For providing information in an alternative format as per the Council’s duties under the Equality Act 2010.

9.5. The cost for responding to a request should be calculated before the request is answered and within the 20 working day deadline. A fees notice needs to be issued and the request only needs to be answered on payment of the fee. The payment must be received within 3 months.

9.6. A fee notice must include:

• 9.6.1. A breakdown of how the fee has been calculated.
• 9.6.2. A clear statement that the request will not be answered until the fee is paid and that payment must be received within 3 months.
• 9.6.3. Information on how to request a review of the Council’s decision within 40 working days (see Section 14).

9.7. Where a refusal notice or fee notice is issued, the Council should be ready to advise applicants on how to narrow their request for information and thus lower the cost of responding to the request.

9.8. IIf a fee is paid and during the completion of the request it becomes apparent that the applicant has been overcharged, the Council should consider refunding the difference.

10. Exemptions

10.1. Not all information requested must be released under FOISA. There are a total of 17 absolute and non-absolute exemptions. The Council can only exempt information within the terms of FOISA.

10.2. A summary of exemptions is included in Appendix 3. If you are unsure if an exemption applies please contact the FOI Service Contact and/or the FOI Coordinator in the first instance.

• 10.2.1. Non-Absolute Exemptions are subject to the ‘public interest’ test. The Council must consider if the public interest in maintaining the exemption outweighs the pubic interest in disclosing the information.
• 10.2.2. Absolute Exemptions may be applied without consideration of the ‘public interest’ test.

11. Applying Exemptions/Refusing Requests

11.1. If a request or part of a request is subject to an exemption and is being refused, the response should include a refusal notice.

11.2. A refusal notice should contain the following information:

• 11.2.1. Notice that the Council does or does not hold the information.
• 11.2.2. Details of the exemption being claimed, including the appropriate section of the Act.
• 11.2.3. An explanation of why the exemption applies.
• 11.2.4. Information about how to request a review or make an appeal to the Scottish Information Commissioner.

11.3. When applying an exemption where the public interest test applies, the Council must explain the reason for claiming the public interest if applying the exemption outweighs the public interest in disclosure.

11.4. If applying an exemption which requires the Council to demonstrate that disclosure will cause harm, the Council must show that the harm is real and likely.

11.5. A refusal notice can be issued if a request is considered to be vexatious or is a repeat of the same or similar request from the same individual. If you believe this is the case please contact the FOI Coordinator.

11.6. If an applicant requests information that is not held by Orkney Islands Council and it is likely that the information is held by another public authority, the Council should signpost the applicant to that other authority.

11.7. The Council may issue a refusal notice neither confirming nor denying that it holds the information requested. Such responses can be issued in relation to certain exemptions which would apply to the information (if held) and if to reveal the information existed or was held would be contrary to the public interest.

12. Format of Response

12.1. The Equality Act 2010 places a duty on public authorities to be sensitive to the requirements of applicants. For example, where reasonable, information should be provided in a format requested such as in large print, Braille, audio recording or other languages.

12.2. It is the responsibility of the service dealing with the Freedom of Information request to provide such formats and cover any costs.

13. Copyright

13.1. Where Orkney Islands Council holds the copyright in the published information, the information may be copied or reproduced without formal permission, provided that:

• 13.1.1. It is copied or reproduced accurately.
• 13.1.2. It is not used in a misleading context.
• 13.1.3. The source of the material is identified.

13.2. Where Orkney Islands Council does not hold the information we publish, we will endeavour to make this clear.

14. Request for a Review of the Council’s Decision

14.1. Any applicant who is dissatisfied with the way an authority has dealt with a request for information under FOISA or EIR may ask the authority to review its actions and decisions.

Request for a Review

14.2. The request for a review must be in writing or in another form which, by reason of it having some permanency, is capable of being used for subsequent reference (for example, a recording made on audio or video tape).

14.3. A request for a review must be made no later than 40 working days following receipt of the response to the original request for information.

14.4. The request must explain what issue the applicant is dissatisfied with. For example:

• 14.4.1. The application of exemptions/exceptions.
• 14.4.2. The handling of the request.
• 14.4.3. The fact that no response was received to the original request within the time limit.

14.5. The applicant does not need to specifically ask for a review. He/she does however, need to specify why he/she is dissatisfied with the original decision in order for the review request to be valid.

14.6. The request must also state the name of the applicant and an address (this can be an email address).

14.7. If a request for a review does not meet these requirements the Council has a duty to advise and assist the applicant in making a valid review request.

14.8. Orkney Islands Council does not have to conduct a review if the review request or the original request is deemed to be vexatious. However, the Council must explain this to the applicant and include information on their rights of appeal to the Scottish Information Commissioner.

Review Obligations

14.9. Orkney Islands Council has 20 working days to respond to the request for a review from the date the request was received by the Council.

14.10. The review process must be:

• 14.10.1. Fair and impartial.
• 14.10.2. Able to reach a different decision if appropriate.
• 14.10.3. Straightforward and capable of reaching an outcome promptly.
• 14.10.4. Handled by staff who were not involved in the original decision.
• 14.10.5. Wherever possible, undertaken by someone senior to the person who took the original decision.

14.11. If information is held by the Keeper of the Registers of Scotland then the Keeper has 30 working days to respond to the request for review.

Review Procedures

14.12. The FOI Coordinator will inform the Head of Legal Services (the reviewing officer) as soon as a request for a review is received. The FOI Coordinator will also contact the applicant acknowledging the request for a review.

14.13. In the event that the Head of Legal Services is absent or if they had a significant involvement in the original decision, the Executive Director of Corporate Services will carry out the review.

14.14. The reviewing officer will consult with the staff who dealt with the initial request to get an understanding of the rationale underpinning the Council’s initial response. Where appropriate a review of the information will be undertaken, or a fresh search for the information requested, where possible by a person not directly connected to the initial request. If required, the reviewing officer will be responsible for getting legal advice from a solicitor who was not involved in the original decision.

14.15. If deemed helpful to the applicant’s request, the applicant can be approached at any point to clarify further the type of information being requested.

14.16. The review may result in:

• 14.16.1. Confirmation of the original decision.
• 14.16.2. The release of all or part of the information initially withheld.
• 14.16.3. A finding that Orkney Islands Council did not follow the correct procedures for dealing with the request for information.

14.17. The reviewing officer may make recommendations to remedy any failure to follow the correct procedures to prevent its recurrence.

14.18. A record will be kept of the process taken during the review consideration.

14.19. The reviewing officer will pass the response to the FOI Coordinator for logging. The FOI Coordinator will send the response to the applicant in the name of the reviewing officer. The applicant will be informed about their right to appeal to the Scottish Information Commissioner if they are still not satisfied.

14.20. The reviewer should highlight any practice issues which require improvement with the relevant Executive Director to address the matters.

14.21. Following a review, applicants that are dissatisfied with the Council’s decision or the way in which the Council has managed the review can appeal to the Scottish Information Commission. Applicants can appeal within six months from the date on which they received a response to their request for a review. Further information on the Commissioner’s powers can be found at http://www.itspublicknowledge.info

15. Records Management

15.1. Records created under FOISA are retained in accordance with the Council’s Records Retention and Disposal Schedule. After the end of the relevant retention period the records are destroyed by shredding.

16. Contact

For further advice or guidance on this document please contact:

FOI Coordinator, Corporate Services, Orkney Islands Council, Council Offices, School Place, Kirkwall, KW15 1NY.

E-mail: FOI@orkney.gov.uk.

Telephone: 01856873535.

Appendix 1: Environmental Information (Scotland) Regulations 2004 (EIR)

1. Requests for Information about the environment will be accessed under EIR.

2. Environmental information has a broad definition. It covers information relating to:

• 2.1. The state of the elements including the air, water, soil, landscape, flora, fauna, crops, genetically modified organisms and biodiversity.
• 2.2. Factors such as noise, energy, radiation, waste, emissions and discharges.
• 2.3. Measures and activities affecting or likely to affect the state of the elements or environment including administrative papers, policies, plans, programmes and agreements.
• 2.4. Environmental legislation.
• 2.5. The state of human health and safety, the food chain, cultural sites and structures likely to be affected by the state of the elements or environment.

3. Obligations

3.1. The Council’s obligations under EIR are very similar to those under FOISA including the review and enforcement processes. However, there are some key differences:

• 3.1.1. Requests can be made orally as well as in a permanent format.
• 3.1.2. A 20 working day extension to the time period in which to make a response can be applied where the request is particularly “complex or voluminous” (before application this must be explained to the applicant).
• 3.1.3. EIR exceptions are different to FOISA exemptions.
• 3.1.4. The charging rules are different.

4. Exceptions

4.1. The following broad exceptions (as opposed to FOISA exemptions) can be applied. All exceptions are subject to the “public interest” test and some the “substantial prejudice” test. These are applied, and responded to, in the same way as FOI exemptions. Broadly, the exceptions are:

• 4.1.1. The Council does not hold the information.
• 4.1.2. The request is “manifestly unreasonable” or too general to formulate a response.
• 4.1.3. Incomplete data. For example, interim reports prior to completion of a final report or unfinished research.
• 4.1.4. Internal communications of a confidential nature.
• 4.1.5. Disclosure would prejudice international relations.
• 4.1.6. Disclosure would prejudice defence/national security.
• 4.1.7. Disclosure would prejudice the administration of justice.
• 4.1.8. Disclosure would prejudice intellectual property rights or breach copyright.
• 4.1.9. Disclosure would prejudice commercial interests/commercial confidentiality.
• 4.1.10. Personal data as per Data Protection legislation.
• 4.1.11. Disclosure would harm the environment.

5. Relationship with FOISA

5.1. All applications for information will be treated as requests under FOISA unless the request is for information about the environment.

5.2. The Information Governance Officer will decide whether a request will be dealt with under FOISA or EIR. The decision will be made clear in the reference number given to the request (for example, EIR2014 – 1 as opposed to FOI2014 – 1).

5.3. It is not possible to “mix and match” the exemptions of FOISA and exceptions of EIR for a single piece of information.

5.4. A request may ask for several pieces of information, some of which would be governed by FOISA and others EIR. In such a circumstance each piece of information requested can be dealt with under the most appropriate regime.

Appendix 2: Data Protection legislation

1. A request by an individual to access personal data about themselves in such files is dealt with under Data Protection. Such requests are known as Subject Access Requests and are automatically exempt from FOISA.

2. Requests for information about another living individual who is not the applicant is dealt with under FOISA but may be refused under Section 38 of FOISA on the basis that disclosure would breach the Data Protection principles given below.

3. The Council must comply with the 6 data protection principles. These provide that personal data must be:

• 3.1 Processed lawfully, fairly and in a transparent manner in relation to the data subject.
• 3.2 Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes.
• 3.3 Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
• 3.4 Accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay.
• 3.5 Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the General Data Protection Regulation in order to safeguard the rights and freedoms of the data subject.
• 3.6 Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

4. Enforcement

4.1. The UK Information Commissioner is responsible for enforcing Data Protection legislation. In the event of a data protection breach the Council can be sued for unlimited damages if a breach of the legislation causes unwarranted damage or distress to an individual. The Information Commissioner can also impose a civil monetary penalty of up to £17,000,000.

4.2. Further help and guidance is available from the FOI Coordinator and the Information Governance Officer.

4.3. The Information Commissioner’s website is also a helpful resource: https://ico.org.uk/

Appendix 3: Summary of FOISA Exemptions

IMAGE: The table headed “Appendix 3: Summary of FOISA Exemptions” lists 19 exemptions and identifies whether each is absolute, subject to the public interest test, subject to sustainable prejudice, and the relevant section of FOISA.

Document Control Sheet

Review/Approval History

Change Record Table

Status Description

Final – The document is complete and is not expected to change significantly. All changes will be listed in the change record table.

IMAGE: The document control page contains the Review/Approval History table, the Change Record Table, and the status statement. It also displays the document page number 19.