Agenda item

Luke Sayers, Service Director, Customer, Information and Digital Services, to report

Consideration was given to the annual report presented by Sam Ulyatt, Service Manager Information Management, which set out the detail of Council’s compliance with Data Protection and Freedom of Information Act 2000 legislation (for the purpose of the report included the Environmental Information Regulations 2004).

The report, therefore, set out in detail performance for Freedom of Information, Right of Access Requests and any Data Incidents/Breaches.

In terms of responses to Freedom of Information (FOI) Requests (within the statutory time limits) overall performance was at 97% with the number of requests received during Year 2025/26 up to 1,423 compared to 1,347 in 2024/2025.  Overall 97% of FOI requests were responded to within the statutory time limits (1,380 of the 1,423).

This was a slight decrease in performance compared to the previous year but a further numerical increase in the number of requests received.  Whilst performance for 2025/26 was 1% lower than in the previous year (98%), analysis of the data did not raise any concerns on the year’s performance.  In 2025/26 there were no requests formally refused as invalid.

With regards to Right of Access Requests (RoARS) during 2025/26 there was a substantial step-change increase to the numerical volume received in 2024/25 (235). This continued the trend of the volume of RoARS increasing year-on-year.

However, despite the volume increase, performance had improved by 4% compared with the previous year with 264 (67%) requests processed within the statutory timeframe for 2025/26 compared to 149 (63%) in 2024/25.

Performance would continue to be closely monitored with regard to FOI and RoAR with the focus on improving time to completion and keeping customers informed.

In terms of Data Incidents and Breaches, the Council actively encouraged Services to report any suspected data incidents and all reported cases were investigated. Attached to the report was an Appendix which provided a breakdown of the number and classification of incidents.

In 2025/26 the Council had logged and investigated 223 reports of incidents of which 167 (75%) were recorded as breaches.  Disclosed in error breaches accounted for 134 of the 167 (80%).  In the previous year the equivalent figures were 129 out of 142 breaches (91%).

All the breaches investigated were non-reportable to the regulatory body (ICO).

Discussion ensued with the following issues raised/clarified:-

·        The information provided by Directorates with regard to information data incidents was accurate but reliant upon the reporting thereof

·        If a FOI request was refused, the customer would receive a formal response to that effect and also include some advice/guidance on narrowing the parameters of their question so they could, if they wanted to, refine their request and resubmit

·        There had been continued growth in the number of RoARs being received a large number of which were within Social Care and, by nature, frequently quite complicated.  On average it would take an officer a day to review 250 pages with a Social Care file being anything from 5,000-10,000 pages.  There was potential for a piece of redaction software which would assist the process but would still not remove the need for the human element and the requirements of the Data Protection Act

·        Numerous discussions had taken place as to how the management could be reorganised to improve performance without being unfair to individuals as requests should be dealt with in the order of receipt

·        The internal target for response to RoARs was 62%.  This was monitored throughout the year with monthly statistics produced and submitted to the Service Directors Group.  Statistics did vary dependent upon the number of Social Care requests received

·        Discussions were taking place on the breakdown of disclosing data protection incidents/breaches in more detail.  Recording took place as to whether it was an internal disclosure or external.  This would be reported on in the future

Resolved:- (1)  That the Data Protection/FOI Annual Report 2025/26 be received and the contents noted.

(2)  That the Council continues its maintenance of its Information Governance practices and processes as a requirement and in compliance with legislation.

(3)  That future reports include:-

-        comparisons with previous year’s information security incident statistics

-        the number of FOI requests refused and the reasons for refusal

-        Public Health figures for the past 2 years to ascertain if there was a trend

-        the number of exceptions made

(4)  That, in order to meet the Council’s obligation to annually publish its FOI performance statistics, the report will be published online.