Audit and Governance Committee	28^th July 2021
Report of the Director of Governance

Corporate Governance Report  

1.      Summary

1.1    This report provides Members with updates in respect of:

· Information Governance and complaints performance

· List of future reporting options

· Information Commissioners Office (ICO) decision notices

· Local Government and Social Care Ombudsman (LGSCO) cases from last report in April 2021 to date of this report

· Progress and updates on questions and comments raised at last Committee on publishing Regulator decisions

· Disclosure Log

· RIPA

2.      Information Governance and Complaints Performance

2.1    The council publishes performance data on timeliness for responding to requests made under Freedom of Information Act (FOI), Environmental Information Regulations (EIR) and Data Protection Act subject access to records requests (SARs), via the York Open Data platform via the below link. 

https://data.yorkopendata.org/group/freedom-of-information

2.2    I have provided the performance figures for the period April to June 2021 – Q1 - including for complaints for corporate (from the “4Cs” implemented from April 2021), adults and children’s social care complaints. 

2.3    Internally we have reconfigured our “4Cs” recording processes and we are going through a process to create the relevant reports. The performance framework, as well as the technology and processing to produce this is currently being worked upon, and at this stage it is planned to have Q1 data available from August for the various council meeting structures and performance reporting environments.

2.4    At Annex 2, I have shown the list being worked through for future reports which will be presented in graph or chart options, with trend and comparison information when available.  

3.      ICO decision notices

3.1    If someone is unhappy with the response they receive in relation to an FOI, EIR or SAR request, or if they want to raise a complaint under data protection legislation in relation to the rights of individuals, there is an opportunity to seek an internal review and then to complain to the ICO. The ICO publishes their decision notices and full reports on their website.

3.2    At the last report to Committee in April, there had been no published ICO decision notices in that reporting period – February to 14^th April 2021.

3.3    For this reporting period, 14^th April to 30^th June 2021, there has been one published decision notice and the details are set out in Annex 3.  The ICO found that the council had correctly withheld information however we had not replied in the 20 day timescale.

3.4    From previous Committee discussions, I have now provided in the table below, details of ICO cases and their decisions from this reporting period.  These are cases where there is not yet a Decision Notice from the ICO published on their website.  These cases have all been actioned and responded to.

Outcome

ICO instruction to respond

ICO instruction to respond

ICO instruction to respond

Not upheld

4.      Ombudsmen cases

4.1    Local Government and Social Care Ombudsman (LGSCO) decisions and recommended actions, from the last report to Committee in April, to the date of this report are shown at Annex 4.  There were no Housing Ombudsman Services decisions during this time.

4.2    Of the seven cases determined by the LGSCO, three were closed after LGSCO’s initial enquiries and four were upheld with recommendations and/or remedies shown in Annex 4 in the actions column.

4.3    The Corporate Governance Team work with the Corporate Management Team, Directorate Management Teams as well as with individual service areas to identify areas for improvement or shared learning opportunities from Ombudsmen cases.

4.4    We will receive the LGSCO’s annual letter including performance information, on 21^st July 2021.  Work will be undertaken in response to the details and we will report this through to the relevant Scrutiny Committee and then to this Committee.

5.      Progress and updates on questions and comments raised at last Committee on publishing Regulator decisions

5.1    At last Committee, you asked if Regulator decisions can be published on the Council’s website.  I have worked with business intelligence and web services teams on the options for this. 

5.2    We are going to update the information about the different Regulators on our website pages which will include direct links to our cases where possible and advice for searching the Regulators websites.  This is because

· There is no maintenance for the council to do as an automated link checker would let us know if links change or become invalid in future

· It avoids duplication or need for additional resource and supports our corporate approach of not publishing on the council’s web portfolio things that are already published elsewhere.

· Accessibility of the cases is the responsibility of the host

· Dedicated search and filtering is already available via the host site

· The respective Ombudsmen’s decisions although about us, they may not be “ours” to publish and maintain.  So we are being open and transparent in ensuring that we signpost clearly to them.

6.      Disclosure Log

6.1 The format and style of the disclosure log on the council’s website was introduced after ongoing complaints regarding the previous format and style being difficult to use, navigate and search. 

6.2    The current format and style complies with the obligations of the FOI Act and Publication Scheme, to show requests we have received and responded to, that we feel may be of a wider public interest.  This can be searched by individuals to see if the information they are looking for has already been asked for and responded to, and then they can either ask us for a copy of the response or make a new request.

6.3    It also complies with the website Accessibility Regulations.

6.4    There is no set timescale in legislation on how long to keep a disclosure log and so as information requested may be superseded or change over time.  From previous questions and comments from this Committee, we now publish the previous 12 months disclosure logs on the council’s website, rather than 3.

6.5    I will be bringing a report on the use of, and feedback from, the Disclosure Log to this Committee in my next report.  This was to be September but will now be in

7.       Regulation of Investigatory Powers Act 2000 (RIPA)

7.1    As previously reported to Committee, we are reviewing the policy and procedures for RIPA to ensure we have effective and efficient processes (including the provision of training) in place for the operation of the council’s actions with regard to covert surveillance and Covert Human Intelligence Sources (CHIS) and that we meet the Investigatory Powers Commissioner’s Office (IPCO) requirements for these. This will also include a review of the current policy and procedure for the use of Use of Social Media in Investigations as the IPCO expects the use of social media to be specifically included in all up to date policies.

7.2      Local authorities must have an up to date policy in place that is approved and regularly reviewed by Members.  It is anticipated that the policy will be reviewed annually, alongside the reporting of the Council’s use or otherwise, of RIPA on a regular basis.

7.3      Up to date training has now been provided to relevant council staff and this will be regularly updated.

7.4    The IPCO has informed the Council they will be carrying out their next programmed inspection of our use of directed surveillance and covert human intelligence sources (CHIS) and the acquisition of communications data in accordance with the provisions of the Investigatory Powers Act 2016.  The last inspection was undertaken by way of a questionnaire in December 2018.

7.5    As the Investigatory Powers Commissioner, the Rt Hon. Sir Brian Leveson, is reviewing the long-term inspection regime for public authorities, it has been decided that in the short term a more flexible approach to the arrangements for inspections should be taken so this inspection is being carried out using a virtual platform and not a physical visit.

7.6    A report on the findings and recommendations will be provided to Committee.

8.      Consultation

Not relevant for the purpose of this report.

9.      Options    

Not relevant for the purpose of this report.

10.    Analysis

Not relevant for the purpose of this report.

11.    Council Plan

11.1  The council’s corporate governance service offers assurance to its customers, employees, contractors, partners and other stakeholders that all information, including confidential and personal information, is dealt with in accordance with legislation and regulations and its confidentiality, integrity and availability is appropriately protected.

12.    Legal Implications

The Council has a duty to comply with the various aspects of complaints, data protection, privacy and information governance related legislation.

13.    Risk Management

The council may face financial and reputational risks if the information it holds is not managed and protected effectively or if it does not respond to complaints effectively.  For example, the ICO can currently impose civil monetary penalties up to 20million euros for serious data security breaches and Ombudsmen can impose financial remedies.  The failure to identify and manage information risks or respond to complaints effectively, may diminish the council’s overall effectiveness and damage its reputation.  Individual(s) may be at risk of committing criminal offences.

14.    Recommendations

Members are asked:

· To note the details contained in this report.

· To provide feedback on the options for future reporting

Contact Details

Author: Lorraine Lunt Information Governance & Feedback Team Manager Telephone: 01904 554145 Chief Officer Responsible for the report: Janie Berry, Director of Governance
Report Approved	√	Date	13^th July 2021
Wards Affected:  List wards or tick box to indicate all					All	√
For further information please contact the author of the report

Annexes

Annex 1 – Information Governance and Complaints report

Annex 2 – List of future reporting options

Annex 3 – ICO decision notices

Annex 4 – LGSCO cases

Background Information

Not applicable