Public Sector Insights: Information Governance - Blake Morgan 
Sharpe Minds Webinar: AI & Data Protection in Employment – Pitfalls & How To Avoid Them - Sharpe Pritchard 
The Information Commissioner's Office (ICO) has given Derbyshire Constabulary a "limited" assurance rating for governance and accountability following a consensual data protection audit, finding that the force does not hold a comprehensive record of processing activities and is not yet meeting the logging requirements for law enforcement processing under section 62 of the Data Protection Act 2018.
The executive summary of the audit report, published this month, rates the force's records management as "reasonable". The ICO said limited assurance meant it had identified considerable scope for improvement in existing arrangements to reduce the risk of non-compliance, while reasonable assurance indicated some scope for improvement.
The audit, carried out under section 129 of the DPA 2018 with the force's agreement, focused on two scope areas selected following a risk-based analysis of its processing. Governance and accountability covered the policies, procedures, performance measurement and reporting mechanisms in place to monitor compliance with Part 3 of the DPA 2018, which governs processing by competent authorities for law enforcement purposes.
Records management covered the controls on the creation, maintenance, storage, movement, retention and destruction of electronic and paper records containing personal data.
Across the individual control measures tested, 31% of governance and accountability controls received a high assurance rating, 4% reasonable, 40% limited and 25% very limited. For records management, 58% of controls were rated high, 6% reasonable, 26% limited and 10% very limited.
On governance, the ICO found that the force does not have a complete record of processing activities and therefore cannot be assured that it fully understands the data it is processing. It is not currently meeting the section 62 requirement to keep logs of collection, alteration, consultation, disclosure, combination and erasure in automated processing systems, although the ICO noted a project is under way to achieve this. The force also does not proactively make privacy information available to individuals beyond the privacy notice on its website.
On records management, the ICO found there is no records manager in post, leaving aspects of records management without sufficient senior oversight. Not all staff were aware of the retention schedules applying to data within their responsibility, creating a risk of over-retention, and the force does not have a robust programme of audits for its physical records storage, raising the risk that paper records may be lost or inadvertently destroyed.
The auditors also identified areas where controls were operating effectively. The force has a clear management framework with a delegated process of accountability involving the Senior Information Risk Owner and Data Protection Officer, and has assigned operational roles to support day-to-day information governance. It has an effective process for the secure destruction of physical records, and records management staff were found to be proactive in reviewing data quality.
Recommendations in the full report are graded as "must", "should" or "could" according to whether they reflect a legal requirement, the ICO's expectation of what is needed to comply effectively, or good practice, and each is assigned a priority rating based on the ICO's assessment of the risks involved. The ICO said the report is an exception report tailored to Derbyshire Constabulary and is not intended to be compared with other ICO audit reports.
