Meeting:	Audit and Governance Committee
Meeting date:	01/07/2026
Report of:	Director of Governance and Monitoring Officer
Portfolio of:	Cllr Claire Douglas Leader including Policy, Strategy and Partnerships

Audit and Governance Committee Report:

Information Governance Team (IGT) Report

Subject of Report

1. This report is to provide a briefing to Members

· covering performance for April 2025 to March 2026 for the different types of requests for information and data protection requests received.

· on other relevant areas relating to information governance and data protection

Policy Basis

2. Having appropriate processes and procedures in place to ensure the council

· manages and monitors valid and in time responses to all FOIA and EIR requests and other requests for information or information disclosure

· provides support, advice and guidance for data protection and privacy compliance

· provides support, advice and guidance for covert surveillance undertaken by the council

· provides assurance to customers, employees, contractors, partners, and other stakeholders that all information, including confidential and personal information, is dealt with in accordance with legislation and regulations and its confidentiality, integrity and availability is appropriately protected.

3. Regular performance reporting aligns with both the current and draft Council Plan, forming part of the council’s corporate code of governance. This also supports the 10-year Plan (York 2032) for performance management and service planning.

Recommendation and Reasons

4. Members are asked:

(i) To note the details contained in this report and provide any comments or feedback.

Reason: So that Members are provided with details about current performance and other areas of information governance and data protection from the IGT.

Background

Performance – information governance

5. Annex 1 presents the Information Governance performance scorecard for full reporting year April 2025 to March 2026 (Quarters 1,2,3,4) alongside comparative data from 2024/2025 and 2023/2024.

6. A total of 2633 requests were received in full year 2025/2026. These included FOIA, EIR, DSARs, and other information requests such as those from the police for investigative purposes.

7. This is an increase on previous years (2334 in 2024/2025, and 2193 in 2023/2024; an increase of approximately 20% from 2023/2024 figures) and should be understood as a positive indicator of public awareness, engagement, and the exercise of statutory rights, rather than a reflection of reduced openness or gaps in transparency by the council. The council continues to meet its legal obligations by:

· publishing information proactively

· maintaining transparency through established channels such as on York Open Data

· responding to requests in line with statutory requirements

8. The council has successfully sustained improvements in the percentage of FOIA and EIR responses completed within statutory timescales. Notably, we achieved the ICO’s 95% timeliness target for combined FOIA and EIR responses for the full year.

9. There has been a slight improvement in the percentage of DSARs responded to in time in full year 2025/2026 compared to previous year 2024/2025 and it is significantly improved compared to 2023/2024. This is alongside the increase in complexity of requests, particularly those involving children’s or adults’ social care records, care leavers, and staff-related cases.

10. A snapshot of FOIA, EIR, and DSAR requests (not including other information requests such as those from the police for investigative purposes) for full year is shown below

Request type	Total requests 2025/26	% responded in time 2025/26
FOIA and EIR	1822	95%
DSAR	225	85%

11. The sustained improvement in FOIA and EIR response times is a significant achievement, reflecting the ongoing commitment and collaboration between the IGT and service areas across the council.

12. To support the ongoing improvements already made in performance, IGT are working with Business Intelligence to identify recurring themes from FOIA/EIR requests such as regular requests for the same datasets which may potentially be proactively published.

13. Since the last report to Committee in November 2025, and up to the preparation of this report, there has been no regulatory or escalated actions taken by the ICO in relation to FOIA/EIR. There have been two ICO decision notices were published regarding the council’s handling of FOIA/EIR requests.

14. Details of these two decision notices are set out in Annex 2 and the outcomes are shown below which shows the decision for each exemption the council relied on.

· 23 April 2026, the decision was FOI 1(1): Not upheld

· 7 May 2026, the decision was FOI 1: Partly upheld, FOI 10: Upheld, FOI 16: Upheld, FOI 21: Not upheld, FOI 36: Not upheld, FOI 40: Upheld

15. The full published decision notices are available on the below links.

ic-414605-c7l5.pdf

ic-404418-p4l6.pdf

16. Following the completed transfer of complaints, IGT continues to work with Business Intelligence to enhance reporting. This includes responding to feedback from Corporate Management Team (CMT) and the Audit and Governance Committee, and expanding reporting to cover additional areas of IGT’s work, such as:

· FOIA and EIR case themes

· Data Protection Impact Assessments (DPIAs)

· Privacy Notices

· Internal and external data sharing arrangements and data processing schedules for contracts

· Records Management

· Covert Surveillance

· CCTV (public spaces, buildings, body-worn cameras, etc.)

Local Government Transparency Code 2015 (LGTC)

17. The council maintains compliance with the Local Government Transparency Code 2015, ensuring that required information is published in a timely and accessible manner to support openness, accountability, and public transparency. This includes the regular publication of datasets and information in line with statutory requirements of the Code. These can be found at

Open Data on public services in the City of York

NHS Data Security and Protection Toolkit (NHS DSPT)

18. Maintaining the required assessment and assurance level for the NHS DSPT is essential for the council’s ability to continue to access and use NHS data safely and lawfully. Compliance is becoming progressively more rigorous, requiring more effort, engagement, and staff resource, alongside ongoing CMT and senior leadership support.

19. The IGT working with the relevant teams across the council, completed the submission requirements ahead of the 30 June 2026 deadline and confirm that the council has maintained the required assurance level for 2025-26 (version 8) - Standards met. The certificate is provided at Annex 3.

20. The next steps for IGT will be to produce the improvement action plan from NHS DSPT for the next assessment and will share this with the Caldicott Guardians (GC) to plan actions in.

Data Use and Access Act 2025 (DUAA)

21. On 19 June 2025 the DUAA became law in the UK and the changes are being phased in.

22. The DUAA focuses on updating data protection laws to enable innovation and growth while maintaining strong data protection standards, making it easier for organisations to protect people’s personal information including the opportunities and advantages of innovative technology. It amends but does not replace, the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA) and the Privacy and Electronic Communications Regulations (PECR). You can find more details at

The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations? | ICO

23. One area of the DUAA which organisations have up to 19 June 2026 to implement, was individuals now have a formal statutory right to make a data protection complaint directly to the council.

24. The council already enables individuals to raise concerns or complaints relating to their information rights, including issues such as personal data breaches. Please see

Our Privacy Notice – City of York Council.

25. However, the DUAA places additional requirements on the council to actively support individuals in exercising these rights. This includes providing accessible means to submit a complaint (such as an online form), acknowledging complaints within 30 days, and responding without undue delay.

26. The IGT working with web services team, have updated the council’s website and introduced an online data protection complaints form to ensure compliance with these new requirements and to make it easier for individuals to raise data protection complaints and concerns.

Your right to make a data protection complaint – City of York Council

Working in partnership with North Yorkshire Police (NYP)

27. IGT working with the council’s contracted CCTV services provider and in partnership with NYP is set to deliver measurable improvements in how digital evidence is accessed and used, significantly enhancing the response to crime across York.

28. The council will now provide CCTV evidence to NYP via the NICE Investigate digital evidence management platform and represents a real step‑change in how the council supports policing, by modernising, and transforming what were previously more time-intensive processes.

29. This improved approach enables faster, more efficient access to vital evidence by our police colleagues which in turn benefits our residents and communities.

Reported breach to Information Commissioner’s Office (ICO)

30. The council became aware that an email was sent in a way that meant recipients’ email addresses were visible to others who received the email, and we took immediate actions to contain it. Our established data breach procedures were put into action straight away.

31. A thorough investigation was undertaken to fully understand what happened. This included a detailed risk assessment in line with guidance from the Information Commissioner’s Office (ICO) and to continue to assess any potential impact on individuals.

32. Following an initial assessment, this incident was reported to the ICO, in line with our legal obligations.

33. We have contacted everyone identified as being directly affected by this incident, providing information about what had happened, along with advice and support

34. We have published a public notice about this breach on our website to provide reassurance to any individual who may be concerned about this incident.

Public notices of personal data breach incidents – City of York Council

35. There is an ongoing programme of work underway to review our processes, systems, and staff guidance for sending bulk communications to reduce the risk of this happening again. This also includes two further potential breaches currently under investigation, which may have arisen from similar human error. Based on the information available at the time of drafting this report, neither incident meets the threshold for notification to the ICO.

36. The ICO responded to our report and the information we submitted, on 3 June 2026. They have closed their case and determined that there is no further action necessary by them on this occasion. As with any case or investigation they undertake, they may make additional enquiries if they become aware of new information which affects the circumstances of this case.

Consultation Analysis

37. No consultation was undertaken for this report. However, feedback from reports to CMT, meetings and discussions with managers informs this report and where required, internal and/or external consultation will be conducted to support any actions arising from Committee.

Risk and Mitigations

38. The council has a duty to comply with the various aspects of data protection, covert surveillance, and information governance related legislation. Failing to comply with these can result in Regulators taking actions against the council such as reprimands, enforcement action, monetary fines, financial remedies for individuals. Often these decisions and actions are published on the Regulator websites, as well as doing press releases and statements. This can lead to reputational damage, reduce the council’s overall effectiveness as well as a loss of trust in the council.

39. In some circumstances individual members of staff may be at risk of committing criminal offences for example if they knowingly or recklessly breach data protection legislation and compliance requirements or deliberately destroy, alter, or conceal a record after it has been requested.

40. Data protection impact assessments (DPIAs) are an essential part of our accountability obligations and is a legal requirement for any type of processing under UK GDPR. Failure to conduct a DPIA when required may leave the council open to enforcement action, including monetary penalties or fines. However, as there is no personal data, special categories of personal data or criminal offence data being processed for this performance report, there is no requirement to complete a DPIA.

Wards Impacted (optional section)

41. Not applicable for this report.

Contact details

42. For further information please contact the author of this Report.

Author

Name:	Lorraine Lunt
Job Title:	DPO/Information governance manager
Service Area:	Governance and Monitoring
Telephone:	01904 555719
Report approved:	Yes
Date:	16 June 2026