Handling of Personal Data

 

Freedom of information request reference no: 118/25

REQUEST

1. Can I have your records about sales of personal data from 2023 (01.01.2023) to 2024 (31.12.2024), including trading partners and money earned from transactions?
2. Do you use tracking cookies on your website, and can I have a list of third parties that you share personal data with?
3. Have you received any complaints about how you handle personal data? This includes collecting, storing, sharing or selling, as well as wider processing practices. Please can I view records about these complaints for 2023 and 2024?
4. How many subject access requests did you receive in the period 2023-2024, broken down by year? What types of personal data did they typically receive? For example email addresses, home addresses and telephone numbers?
5. How many data breaches have you experienced for the past 5 years (broken down by each year)?

 

RESPONSE

 

We consulted with out Information & Communications department and our Data Protection Unit who have provided the following information regarding your request.

 

Question 1

 

South Wales Police does not sell personal data.

 

Question 2

 

As this is available in the public domain, we are therefore not obliged to provide this information as the following exemption applies:

 

Section 21 – Information Accessible by Other Means.

 

This is an absolute, class based exemption which means that a public authority is not required to consider the public interest in disclosure.

 

Under Section 16, the duty to provide advice and assistance, please see the below link:

 

Cookies | South Wales Police

 

Question 3

 

Please note the above figures are the number of complaints received by our Information Governance team.

 

Question 4

 

YEAR	TOTAL
2023	1,048
2024	1,032

 

Please note, not all requests were valid. For example, they may not have provided ID and/or proof of current address and these would not be processed until applicant returned with appropriate documents.

 

Applicants don’t usually ask for email addresses, home addresses or telephone numbers, however they may be included as part of their disclosure.  Disclosure is split into Law Enforcement Data & GDPR both of which are requested regularly. 

 

Question 5

 

YEAR	TOTAL
2020	272
2021	200
2022	249
2023	377
2024	490

 

Please note that these are the total number of data incidents or suspected breaches that were reported to Information Governance in South Wales Police during the periods listed.  Investigations into each matter may have determined that some were not personal data incidents

 

South Wales Police can neither confirm nor deny whether any other information is held relevant to any cyber-related Data Breaches. In this case, the duty to confirm or deny under S1(1)(a) does not apply, by virtue of the following exemptions.

 

Section 24(2) National Security

Section 31(3) Law Enforcement

 

Section 24 and Section 31 are both qualified exemptions and as such there is a requirement to evidence any harm in confirmation or denial that any information is held as well as consider the public interest.

 

Harm in Confirming or Denying that Information is held

 

To confirm or deny whether any further information is held in respect of successful cyber-attacks resulting in Data Breaches would provide actual knowledge that where an attempt has been made, it has or has not been successful. Confirming that such information is not held may assist potential attackers by indicating that an attack had gone undetected. Equally, confirming information is held would enable understanding of where attacks have been successful, and possible weaknesses exist. Attackers may then be able to tailor their methods to increase their chances of success.

 

To confirm or deny whether information is held in respect of any leaked data as a result of an attack would, in effect, confirm that there had been successful cyber-attacks made against the force, which would present harm as detailed above.

 

Furthermore, in order to counter criminal and terrorist behaviour it is vital that the police and other agencies have the ability to work together, where necessary covertly, in order to obtain intelligence within current legislative frameworks to ensure the arrest and prosecution of offenders who commit or plan to commit acts of terrorism, whereby their modus operandi may involve cyber-attacks on secure databases. In order to achieve this goal, it is vitally important that information sharing takes place with other police forces and security bodies within the United Kingdom in order to support counter-terrorism measures in the fight to deprive terrorist networks of their ability to commit crime. To confirm or deny specific details of any breaches of information technology and security would be extremely useful to those involved in terrorist activity as it would enable them to map vulnerable information security databases.

 

Public Interest Considerations

 

Section 24(2) National Security

 

Factors in favour of confirming or denying that information is held

 

The public are entitled to know how public funds are spent and how resources are distributed within an area of policing.  To confirm information is held regarding successful cyber-attacks causing Data Breaches would enable the general public to hold the police to account ensuring all such breaches are recorded and investigated appropriately.  With the call for transparency of public spending this would enable improved public debate.

 

Factors against confirming or denying that information is held

 

Security measures are put in place to protect the community we serve.  As evidenced within the harm to confirm whether any cyber-attacks have been successful would highlight to terrorists and individuals intent on carrying out criminal activity vulnerabilities within the police which could be further exploited.

 

Taking into account the current security climate within the United Kingdom, no information (such as the citing of an exemption which confirms information pertinent to this request is held, or conversely, stating ‘no information is held’) which may aid a terrorist should be disclosed.  To what extent this information may aid a terrorist is unknown, but it is clear that it will have an impact on a force’s ability to monitor terrorist activity.

 

Irrespective of what information is or isn’t held, the public entrust the Police Service to make appropriate decisions with regard to their safety and protection and the only way of reducing risk is to be cautious with what is placed into the public domain.

 

The cumulative effect of terrorists gathering information from various sources would be even more impactive when linked to other information gathered from various sources about terrorism.  The more information disclosed over time will give a more detailed account of the tactical infrastructure of not only a force area but also the country as a whole.

 

Any incident that results from such a disclosure would, by default, affect National Security.

 

Section 31 – Law Enforcement

 

Factors favouring confirming or denying that information is held

 

Confirmation that information exists relevant to this request would lead to a better informed public which may encourage individuals to provide intelligence in order to reduce such security breaches.

 

Factors against confirming nor denying that information is held.

 

Confirmation or denial that information is held in this case would suggest the police take their responsibility to protect information and information systems from unauthorised access, destruction, etc., dismissively and inappropriately. 

 

Balancing Test    

 

The points above highlight the merits of confirming or denying the requested information exists. The Police Service is charged with enforcing the law, preventing and detecting crime and protecting the communities we serve.  As part of that policing purpose, information is gathered which can be highly sensitive relating to high profile investigative activity. Weakening the mechanisms used to monitor any type of criminal activity, and specifically terrorist activity would place the security of the country at an increased level of danger. 

 

In addition anything that places that confidence at risk, no matter how generic, would undermine any trust or confidence individuals have in the Police Service.  Therefore, at this moment in time, it is our opinion that for these issues the balance test favours neither confirming nor denying that information is held.