Information rights governance

FOI request reference: CAS-85343-P3Z9M9
Publication date: May 2022

Request

1.      For the current financial year 2021/22 what is the budget for:
1a.     Your organisation as a whole
1b.     Your information rights functions i.e. FOIA, subject access requests (SAR), EIR
1c.     Your press office or equivalent department?

2.      For the last 5 calendar years (i.e. from January 2017 to December 2021) please provide an annual breakdown of the volume of the following in relation to your organisation:
2a.     FOIA appeals to the ICO
2b.     EIR appeals to the ICO
2c.     Subject access requests received
2d.     Subject access requests closed
2e.     Subject access requests closed in time
2f.     Complaints relating to subject access requests
2g.     First-tier (information rights) Tribunals
2h.     Upper Tribunals or higher

3.      In relation to your current open casework please provide the number of open:
3a.     FOIA requests
3b.     FOIA requests overdue
3c.     FOIA requests older than 6 months (measured from the received date)
3d.     FOIA requests older than 1 year (measured from the received date)
3e.     FOIA Internal reviews
3f.     FOIA Internal reviews overdue
3g.     FOIA Appeals
3h.     EIR requests
3i.     EIR requests overdue
3j.     EIR Internal Reviews
3k.     EIR internal reviews overdue
3l.     Subject access requests
For the purposes of this question, any snapshot in time between the date you receive this request and the date of your response is acceptable. However, it would assist me if you could indicate the date upon which the snapshot was taken.

4.      For your information rights functions relating to FOIA, SAR and EIR, please provide:
4a.     An organisational chart for your information rights unit or department(s) responsible for responding to information rights requests
For each role within your information rights unit/department please provide:
4b.     A current job description
4c.     Number of full-time equivalent (FTE) staff performing the role
4d.     Pay grade/banding including the salary range
4e.     Number of direct reports i.e. number of individual staff managed
If not already answered please:
4f.     indicate if these roles perform additional core functions or casework.
4g.     include the role of your Data Protection Officer in relation to questions 4a-4e
4h.     advise where your information rights function sits within the overall structure of your organisation (e.g. Legal, Information Governance, Communications etc.)
4i.     Advise whether your organisation operates a centralised or devolved approach to answering FOIA, EIR and SAR requests
4j.     Advise what role and banding has primary responsibility in your organisation for managing and drafting responses to casework relating to:
4j i.   1st stage FOIA/EIR requests
4j ii.  FOIA/EIR internal reviews
4j iii. FOI and EIR Appeals to the ICO
4j iv.  Tribunals (information rights)
4j v.   Subject Access requests
4j vi.  Complaints relating to subject access requests

5.      For the roles with core responsibility for managing and updating your FOI publication scheme, please provide
5a.     Job description(s)
5b.     Pay grade/banding including the salary range
5c.     Number of direct reports i.e. number of individual staff managed
5d.     The name(s) of the unit(s)/department(s) the roles come under

6.      What case management software and version do you currently use to manage FOIA, EIR and SAR casework?

7.      What redaction software do you use to redact information for the purposes of FOIA, EIR and SAR case work?

8.      What, if any, external FOIA, EIR or data protection training or certifications has your organisation funded since 2017 for staff with core responsibilities for FOIA, EIR or Data protection compliance?

Outcome

Some information provided.

Response

1) For the current financial year 2021/22 what is the budget for:
1a. Your organisation as a whole

We are unable to provide you with the information you have requested because it is covered by the exemption at section 22 of the FOI Act.

1b. Your information rights functions i.e. FOIA, subject access requests (SAR), EIR

The total budget for our Information Rights Department for the 2021/22 financial year was £942, 923. This department is primarily responsible for The National Archives’ information rights functions and includes our FOI Centre, MoD Access Service Team, Copyright team and Data Protection Team.

1c. Your press office or equivalent department?

The total budget for our Press Office for the 2021/22 financial year was £228,620.

2) For the last 5 calendar years (i.e. from January 2017 to December 2021) please provide an annual breakdown of the volume of the following in relation to your organisation:
2a. FOIA appeals to the ICO
2b. EIR appeals to the ICO
2c. Subject access requests received
2d. Subject access requests closed
2e. Subject access requests closed in time
2f. Complaints relating to subject access requests
2g. First-tier (information rights) Tribunals
2h. Upper Tribunals or higher

 

ICO Cases, Subject Access Requests & Tribunal Cases
Case Type 2017 2018 2019 2020 2021
FOIA ICO Appeals 10 17 10 5 14
EIR ICO Appeals 0 1 0 2 0
SAR received 48 64 68 45 57
SAR closed 47 67 65 46 58
SAR closed on time 46 67 64 45 57
SAR complaints 0 1 1 0 0
1st Tier Tribunals 3 0 0 1 2
Upper/Higher Tribunals 0 1 0 0 0

 

3) In relation to your current open casework please provide the number of open:
3a. FOIA requests
3b. FOIA requests overdue
3c. FOIA requests older than 6 months (measured from the received date)
3d. FOIA requests older than 1 year (measured from the received date)
3e. FOIA Internal reviews
3f. FOIA Internal reviews overdue
3g. FOIA Appeals
3h. EIR requests
3i. EIR requests overdue
3j. EIR Internal Reviews
3k. EIR internal reviews overdue
3l. Subject access requests

For the purposes of this question, any snapshot in time between the date you receive this request and the date of your response is acceptable. However, it would assist me if you could indicate the date upon which the snapshot was taken.

At The National Archives the following teams are responsible for responding to information rights requests:

FOI Centre
FOI Paid Search Team
MoD Access Service Team
Data Protection Team

For ease of reference the requested information has been separated according to the each team’s current open caseload.

 

Current Open Caseloads
Request Type FOI Centre FOI Paid Search Team MoD Access Services Team Data Protection Team
FOIA requests 1002 73 209 0
FOIA requests overdue 214 2 86 0
FOIA requests older than 6 months 175 0 0 0
FOIA requests older than 1 year 28 0 0 0
FOIA Internal Reviews 8 0 0 0
FOIA Internal Reviews overdue 0 0 0 0
FOIA Appeals 10 0 0 0
EIR requests 1 0 0 0
EIR requests overdue 1 0 0 0
EIR Internal Reviews 0 0 0 0
EIR Internal Reviews overdue 0 0 0 0
Subject Access Requests 11 5 0 0

Current caseload data for the FOI Centre was gathered on the 25/03/2022
Current caseload data for the FOI Paid Search Team was gathered on the 24/03/2022
Current caseload data for the MoD Access Service Team was gathered on the 23/03/2022
Current caseload data for the Data Protection Team was gathered on the 24/03/2022

4) For your information rights functions relating to FOIA, SAR and EIR, please provide:
4a. An organisational chart for your information rights unit or department(s) responsible for responding to information rights requests
For each role within your information rights unit/department please provide:
4b. A current job description

Please see the following links to access the organisational charts of the aforementioned teams and the job descriptions for the roles within them.

Please visit the following webpage to access an organisational chart specific to senior management across The National Archives, information concerning our Information Rights department can be found on page 9: https://cdn.nationalarchives.gov.uk/documents/organisation-chart.pdf

4c. Number of full-time equivalent (FTE) staff performing the role
4d. Pay grade/banding including the salary range
4e. Number of direct reports i.e. number of individual staff managed
If not already answered please:
4f. Indicate if these roles perform additional core functions or casework.
4g. include the role of your Data Protection Officer in relation to questions 4a-4e

 

FOI Centre
Role No. of FTE Staff Pay grade Pay Band No. of direct reports Core function &/or casework
FOI Centre Service Advisor 1 EO £22,993 – £30,830 0 Core function & casework
FOI Researcher 2 EO £22,993 – £30,830 0 Casework
FOI Assessor 5 HEO £28,040 – £36,365 0 Casework
Information Access & Compliance Lead 1 HEO £28,040 – £36,365 0 Core function
FOI Manager 3 SEO £34,257 – £49,657 3-4 Core function & casework
Head of FOI Centre 1 Grade 7 £45,133 – £59,097 3 Core function
FOI Paid Search Team
Reader Advisor 2 EO £22,993 – £30,830 0 Core function & casework
Paid Search Manager 1 HEO £28,040 – £36,365 0 Core function & casework
MoD Access Service Team
Access Service Advisor 1 EO £22,993 – £30,830 0 Casework
Access Service Case Officer 1 HEO £28,040 – £36,365 0 Casework
MoD Access Service Manager 1 SEO £34,257 – £49,657 4 Core function
Data Protection Team
New Business Data Protection Coordinator 1 HEO £28,040 – £36,365 0 Core function & casework
Data Protection Officer 1 Grade 7 £45,133 – £59,097 1 Core function & casework
Head of Department
Head of Information Rights 1 Grade 6 £53,815 – £70,233 4 Core function

4h. Advise where your information rights function sits within the overall structure of your organisation (e.g. Legal, Information Governance, Communications etc.)

Our primary information rights function sits within the Information Rights Department which in turn sits within our Public Access and Government Services Directorate. For further information on the structure of The National Archives please see our organisational chart: https://cdn.nationalarchives.gov.uk/documents/organisation-chart.pdf

4i. Advise whether your organisation operates a centralised or devolved approach to answering FOIA, EIR and SAR requests

The National Archives utilises a devolved approach to answering information requests based on the type of information which has been requested. For instance the FOI Centre focus on FOI/EIR/DPA requests for closed archival records and FOI/EIR requests for our own corporate information/records, the Paid Search Team focus on FOI/DPA requests for open archival records, the MoD Access Service Team focus specifically on FOI/DPA requests for service personnel records from the Ministry of Defence and the Data Protection Team focus on DPA requests for our own corporate information/records.

4j. Advise what role and banding has primary responsibility in your organisation for managing and drafting responses to casework relating to:
4j i. 1st stage FOIA/EIR requests
4j ii. FOIA/EIR internal reviews
4j iii. FOI and EIR Appeals to the ICO
4j iv. Tribunals (information rights)
4j v. Subject Access requests
4j vi. Complaints relating to subject access requests

FOI Centre
Role Type of casework Pay Band
FOI Researcher 1st stage FOIA/EIR requests

Subject Access requests

£22,993 – £30,830
FOI Assessor 1st stage FOIA/EIR requests

Subject Access requests

£28,040 – £36,365
FOI Manager 1st stage FOIA/EIR requests

Subject Access requests

FOIA/EIR internal reviews

FOI and EIR Appeals to the ICO

Complaints relating to subject access requests

£34,257 – £49,657
Head of FOI Centre Tribunals (information rights) £45,133 – £59,097
FOI Paid Search Team
Records Advisor 1st stage FOIA/EIR requests

Subject Access requests

£22,993 – £30,830
Paid Search Manager 1st stage FOIA/EIR requests

FOIA/EIR internal reviews

Subject Access requests

Complaints relating to subject access requests

£28,040 – £36,365
MoD Access Service Team
Access Service Advisor 1st stage FOIA/EIR requests

Subject Access requests

£22,993 – £30,830
Access Service Case Officer 1st stage FOIA/EIR requests

Subject Access requests

£28,040 – £36,365
MoD Access Service Manager 1st stage FOIA/EIR requests

Subject Access requests

FOIA/EIR internal reviews

FOI and EIR Appeals to the ICO

Complaints relating to subject access requests

£34,257 – £49,657
Data Protection Team
New Business Data Protection Coordinator Subject Access requests

 

£28,040 – £36,365
Data Protection Officer Subject Access requests

Complaints relating to subject access requests

£45,133 – £59,097

5) For the roles with core responsibility for managing and updating your FOI publication scheme, please provide

5a. Job description(s)
5b. Pay grade/banding including the salary range
5c. Number of direct reports i.e. number of individual staff managed
5d. The name(s) of the unit(s)/department(s) the roles come under

The role of FOI Manager has responsibility for managing and updating our publication scheme.

Please refer to the links above and the answers above to access the relevant job description, pay grade/band and details on direct reports associated with this role.

6) What case management software and version do you currently use to manage FOIA, EIR and SAR casework?

We are unable to provide you with the information you have requested because it is covered by the exemption at section 31(1) of the FOI Act, which exempts information if its disclosure under this Act would, prejudice (a) the prevention or detection of crime. For further information about why this exemption has been applied, please see the explanatory annex at the end of this response.

7) What redaction software do you use to redact information for the purposes of FOIA, EIR and SAR case work?

We are unable to provide you with the information you have requested because it is covered by the exemption at section 31(1) of the FOI Act, which exempts information if its disclosure under this Act would, prejudice (a) the prevention or detection of crime. For further information about why this exemption has been applied, please see the explanatory annex at the end of this response.

8) What, if any, external FOIA, EIR or data protection training or certifications has your organisation funded since 2017 for staff with core responsibilities for FOIA, EIR or Data protection compliance?

Date of Course Course Title
2017 Information Commissioner & Tribunal Decisions
2018 Excel at complying with Freedom of Information Requests
2018 GDPR: An A-Z Guide
2018 GDPR: An A-Z Guide
2018 Security Mechanisms, Human Aspects of Security
2018 Online Course – The General Data Protection Regulation
2018 Information Commissioner & Tribunal Decisions
2019 FOI Decisions Course
2019 Freedom of Information : The Exemptions
2019 Freedom of Information: The Exemptions
2019 FOI Decisions Case Law Update
2019 Excel at complying with Freedom of Information Requests
2019 Online course – Environmental Information Regulations (EIR)
2020 Freedom of Information: The Exemptions
2020 Introduction to GDPR – online
2020 Practitioner Certificate in Data Protection Distance Learning Programme
2020 Standard Data Protection Practitioner
2020 PDP Online FOI Practitioner certificate
2020 EC-Council Certified SOC Analyst
2021 Foundation Certificate in Cyber Security
2021 FOI Practitioners Course
2021 Information Commissioner and Tribunal Decisions – FOI case law update: Information Commissioner & Tribunal Decisions – what do they mean in practice?
2021 TOGAF 9.2 Foundation and Certified Level 1 & 2
2021 Information Commissioner and Tribunal Decisions
2022 Freedom of Information Act 2000 A-Z Guide
2022 Online GDPR Update

EXPLANATORY ANNEX

Exemptions applied

Section 22: Information intended for future publication
Section 22 of the Freedom of Information Act 2000 (FOIA) exempts from release information intended for future publication if (a) the information is held by the public authority with a view to its publication, by the authority or any other person, at some future date (whether determined or not), or (b) the information was already held with a view to such publication at the time when the request for information was made, and or (c) it is reasonable in all the circumstances that the information should be withheld from disclosure until the date referred to in paragraph (a).

In this instance we have applied the exemption to details of the total budget for The National Archives for the 2021/22 financial year. Such information is annually published on our website:

https://www.nationalarchives.gov.uk/about/our-role/transparency/how-we-spend-public-money/

Section 22 is a qualified exemption and we are required to conduct a public interest test when applying any qualified exemption. This means that after it has been decided that the exemption is engaged, the public interest in releasing the information must be considered. If the public interest in disclosing the information outweighs the public interest in withholding it then the exemption does not apply and the information must be released. In the FOIA there is a presumption that information should be released unless there are compelling reasons to withhold it.

We have considered whether it would be in the public interest for us to provide you with the information ahead of publication, despite the exemption being applicable. Please find below the reasoning for and against disclosure.

Arguments in favour of disclosure:
Disclosure of the requested information would demonstrate The National Archives’ commitment to being a transparent and accountable organisation and would increase public awareness of the work of the archives sector.

Releasing information at the current time would allow for contemporary discussion on budget allocation across The National Archives and would consequently enable and enrich public debate.

Arguments against disclosure:
There are public interest arguments against disclosure of this information at the present time. These arguments include that it is in the public interest to adhere to the existing publication process for budgetary information, which includes time for the information to be gathered and properly verified before being placed in the public domain.

It is also in the public interest to ensure that the information is available to all members of the public at the same time, and premature publication could undermine the principle of making the information available to all at the same time through the official publication process.

On this occasion, we have concluded that the balance of the public interest test falls in favour of withholding this information.

Further guidance on the application of this exemption can be found at:
https://ico.org.uk/media/for-organisations/documents/1172/information-intended-for-future-publication-and-research-information-sections-22-and-22a-foi.pdf

Section 31: Law Enforcement 

Section 31 is a qualified exemption and we are required to conduct a public interest test when applying any qualified exemption. This means that after it has been decided that the exemption is engaged, the public interest in releasing the information must be considered. If the public interest in disclosing the information outweighs the public interest in withholding it then the exemption does not apply and the information must be released. In the FOI Act there is a presumption that information should be released unless there are compelling reasons to withhold it.

The public interest has now been concluded and the balance of the public interest has been found to fall in favour of withholding information covered by the section 31 (1) (a) exemption. Considerations in favour of the release of the information included the principle that there is a public interest in transparency and accountability in disclosing information about government procedure and use of technology. However, release of this information would make The National Archives more vulnerable to crime. The crime in question here would be a malicious attack on The National Archives’ computer systems. As such, release of this information would be seen to prejudice the prevention or detection of crime by making The National Archives’ computer system more vulnerable to hacking. There is an overwhelming public interest in keeping government computer systems secure that would be served by non-disclosure. This would outweigh any benefits of release. It has therefore been decided that the balance of the public interest lies clearly in favour of withholding the material on this occasion.

Further guidance on section 31 can be found here:
https://ico.org.uk/media/for-organisations/documents/1207/law-enforcement-foi-section-31.pdf