Report Template

Meeting:	Audit and Governance Committee
Meeting date:	29/01/2025
Report of:	Director of Governance and Monitoring Officer
Portfolio of:	Cllr Claire Douglas Leader including Policy, Strategy and Partnerships

Audit and Governance Committee Report: Corporate Governance Team Report

Subject of Report

1. This report provides Members with updates in respect of:

· corporate governance team performance report

· Information Commissioners Office (ICO) cases

· Local Government and Social Care Ombudsman (LGSCO) and Housing Ombudsman Service (HOS) cases

· HOS complaint handling code assessment

· Investigatory Powers Commissioner (IPCO) inspection including Audit and Governance Committee’s “fit for purpose” review of the covert surveillance policy and procedures and data report. This will be discussed and conducted with the exclusion of the press and public.

Policy Basis

2. Having appropriate processes and procedures in place to ensure the council

· investigates and responds to complaints (corporate, adults social care and children social care), comments, compliments and concerns, and Ombudsmen cases

· manages and monitors valid and in time responses to all FOI and EIR requests and other requests for information or information disclosure

· provides support, advice and guidance for data protection and privacy compliance

· provides support, advice and guidance for covert surveillance undertaken by the council

· provides assurance to customers, employees, contractors, partners, and other stakeholders that all information, including confidential and personal information, is dealt with in accordance with legislation and regulations and its confidentiality, integrity and availability is appropriately protected.

3. Compliance is aligned to the current and draft Council Plan which is part of the council’s corporate code of governance. This also then aligns with the 10-year Plan (York 2032) such as performance management and service planning.

Recommendation and Reasons

4. Members are asked:

(i) To note the performance details contained in this report and provide any comments or feedback.

Reason: So that Members are provided with details and current performance from the Corporate Governance Team.

(ii) To note the details from the updates contained in this report and provide any comments or feedback.

Reason: So that Members are provided with updates from the areas of responsibility from the Corporate Governance Team.

(iii) To note the outcomes of the IPCO inspection and conduct the required the “fit for purpose” review of the covert surveillance policy and procedures and data report.

Reason: So that Members are provided with the IPCO inspection report and findings and can conduct their “fit for purpose” review

Background

5. Corporate Governance Team performance report

6. The full performance indicators are available on York Open Data at https://data.yorkopendata.org/group/transparency

7. Due to the timescales for drafting and publishing reports for this Audit and Governance Committee and validating data in our KPI scorecards, the scorecard for Q3 is not available for this report. Therefore, I have provided collated information into the tables shown in Annex 1 covering 1 October 2024 to 27 December 2024.

Requests for information

8. I can confirm the performance data published for FOI/EIR request does meet the legislative requirements set out in part 8.5 of the section 45 code of practice as well as the additional ICO guidance How to report on your performance on handling requests for information under FOIA 2000 | ICO such as the number of requests subject to FOIA or EIR, the time period that the data is split into and performance against statutory timescales for FOI/EIR.

9. The council received a total of 550 requests for information from

1 October 2024 to 27 December 2024. These include FOI, EIR, SARs and other requests for information such as requests from the police for information that we may hold for an investigation.

10. A snapshot % of in time performance for FOI, EIR and SAR requests is shown in the table below with the same information for the same reporting period in 2023/2024 for comparison.

	1/10/24 to 27/12/24 - % in time	Q3 - 2023/2024
	1/10/24 to 27/12/24 - % in time	% in time
FOI	93%	87%
EIR	97%	94%
SAR	79%	79%

11. Whilst we are achieving a high % of responses being completed within the statutory timescales for FOI and EIR requests, we remain vigilant about this, given that the ICO enforcement notice for FOI/EIRs ended in March 2024.

12. We are continuing the work with service areas and managers to embed the improvements in the number and percentage of SARs being responded to in time and identify opportunities for further improvements. This includes where it may be appropriate to extend the response timescale, being considered in a timely way. It is important to note that the ICO provides clear guidance for when extending the timescale may be appropriate and that this cannot be solely because the individual requests a large amount of information.

13. We are also continuing to look into whether the ICO allows in SAR performance reporting, to record as in time, a SAR response that has been sent out in an extended timescale. If this is permitted, then there is likely to be a higher % of in time responses going forward.

ICO cases

14. There has been one published decision notice by the ICO about the council’s handling and responding to FOI/EIRs on their website since the last report to this Committee. The complaint to the ICO was not upheld and the ICO did not require us to take any further steps or actions.

15. The request was for information about the management structure at the council and in the response we relied on section 40 of FOIA to withhold some information, as it was considered to be personal data, and refused the remaining information requested under section 21 of FOIA as it was information already reasonably accessible to the requester and provided links to the information. The requester did not dispute the exemptions we relied on when raising this with the ICO but that the council holds further information. After providing the details and evidence the ICO asked for, they found that, on the balance of probabilities, we do not hold further information falling within the scope of the request. The full published decision notice is on the ICO’s website at Basic templates and at Annex 2.

Complaints

16. Between 1/10/24 and 27/12/24, there were a total of 272 cases complaints received and dealt with under the procedures for adult social care complaints, children social care complaints, corporate complaints and corporate complaints not Housing. This is a small decrease from the number received in Q2.

17. A snapshot for this reporting period is shown in the table below and further details can be found in Annex 1.

Complaints	total received – 1/10/24 to 27/12/24	total received – Q3 23/24
Corporate	257	369
ASC	7	7
CSC	8	8

18. We continue to collaborate with managers and service areas to ensure in time performance continues to be addressed for all complaints. However, we do need to recognise that there may be potential impacts on this due to the increased demand on many service areas, the restrictions the ongoing budget and financial circumstances are placing on these services and the complexity of complaint cases.

19. The decrease in corporate complaints is likely to be from the ongoing work with waste services to identify and resolve disputes at an early stage.

20. From feedback from service areas, ongoing requests for reports and information to support assessments, inspections etc, work is ongoing with the business intelligence team, on further changes needed to the configuration of the case management system reporting capabilities to ensure appropriate and relevant information is provided.

LGSCO and HOS cases

21. During the reporting time period of 1/10/24 to 27/12/24, there were ten cases concluded by the Local Government and Social Care Ombudsman (LGSCO) and one case concluded by the Housing Ombudsman Service (HOS). The decisions are shown below, and details can be found in Annex 3.

· 9 cases were closed after initial enquiries and no further action

· 1 case was upheld with findings of fault and injustice

· 1 case was determined as maladministration with orders and recommendations

22. The CGT undertakes ongoing work with CMT, Directorate Management Teams as well as with individual service areas to ensure that we share learning opportunities across the council and to identify areas for improvement from Ombudsmen cases.

HOS complaint handling code self-assessment

22. We have completed a review and updated our self-assessment for the HOS complaint handling code, and this will be published on the council website by 31 January 2025. Housing Ombudsman Self Assessment – City of York Council

23. Section 9 - scrutiny and oversight of the Complaint Handling Code 2024 | Housing Ombudsman Service requires us to have a “Member responsible for Complaints” (MRC) and we are now working up the detailed plan for the MRC role and responsibilities.

Investigatory Powers Commissioner (IPCO) inspection including Audit and Governance Committee’s “fit for purpose”review

24. This is to be discussed and conducted with the exclusion of the press and public as it is information relating to our use of covert surveillance powers and as such it can be considered as information relating to any action taken or to be taken in connection with the prevention, investigation or prosecution of crime. The documents have been provided in Annex 4

25. We also cannot publish or disclose information originating from the IPCO, as the IPCO acts to support the Judicial Commissioners in their work (i.e. an Inspection report) and stems from targeted changes introduced by the Investigatory Powers (Amendment) Act 2024. As such, Judicial Commissioners are now listed as bodies dealing with security matters under Section 23(3)(p) of FOI. This means there is an absolute exemption from FOI in relation to information which is held by other public authorities that relates to the activities of Judicial Commissioners and IPCO. For this reason, the IPCO’s inspection report cannot be made publicly available either in part or in full. This means we also cannot publish or discuss in a public meeting our internal plans in response to the IPCO’s inspection report.

26. The council was notified in May 2024 of the three yearly inspection by the IPCO regarding our compliance with the Regulation of Investigatory Powers Act 2000 and the Investigatory Powers Act 2016.

27. Service areas and managers that use these powers, supported gathering the evidence and information to provide the written submission response to the IPCO by their deadline.

28. The onsite physical inspection was conducted on 23 September 2024. The council was informed on 25 October 2024 of the IPCO’s five observations for the council and that alongside the council’s assurances that these would receive the necessary attention, the IPCO was satisfied that our ongoing compliance with RIPA and the Investigatory Powers Act 2016 will be maintained.

29. The next inspection is due in 2027.

Consultation Analysis

30. No consultation was undertaken for the items in this report. However, feedback from reports to CMT, meetings and discussions with managers informs this report and where required, internal and/or external consultation will be conducted to progress the work and actions required to comply with the improvement plan in response to the ICO enforcement notice.

Risks and Mitigations

31. The council has a duty to comply with the various aspects of complaints, data protection, covert surveillance, and information governance related legislation. Failing to comply with these can result in Regulators and/or Ombudsmen taking actions against the council such as reprimands, enforcement action, monetary fines, financial remedies for individuals. Often these decisions and actions are published on the Regulator or Ombudsmen websites, as well as doing press releases and statements. This can lead to reputational damage, reduce the council’s overall effectiveness as well as a loss of trust in the council.

32. In some circumstances individual members of staff may be at risk of committing criminal offences for example if they knowingly or recklessly breach data protection legislation and compliance requirements or deliberately destroy, alter, or conceal a record after it has been requested.

33. Data protection impact assessments (DPIAs) are an essential part of our accountability obligations and is a legal requirement for any type of processing under UK GDPR. Failure to conduct a DPIA when required may leave the council open to enforcement action, including monetary penalties or fines. However, as there is no personal data, special categories of personal data or criminal offence data being processed for this performance report, there is no requirement to complete a DPIA.

Wards Impacted (optional section)

34. Not applicable for this report.

Contact details

35. For further information please contact the author of this Report.

Author

Name:	Lorraine Lunt
Job Title:	Information governance and feedback manager/DPO
Service Area:	Governance and Monitoring
Telephone:	01904 554145
Report approved:	Yes – 20 January 2025
Date:	17 January 2025