Practitioner Induction: Request Handling

1. Practitioner Induction: Request Handling Records Management Section

2. Objectives • To introduce new practitioners to their role • To recognise information requests • To introduce the procedures for handling information requests • Procedures for all staff • Procedures for practitioners • What the Records Management Section will do • Understand when the fee regulations or an exemption may apply • To be able to advise staff in your unit in the handling of information requests

3. Session Overview • The University’s approach and the role of practitioners • Information request rights • Recognising requests & what to do with them • Request handling procedures • Charging • Exemptions • Replying

4. The University’s approach & the role of practitioners

5. Expertise • Policy • Procedures • Guidance • Training • Quarterly returns Devolved Approach • Crucial role • Local liaison point • Local expertise • Local systems and procedures Each School/department is responsible for the information generated by their activities, for managing that information appropriately, and for answering requests for that information

6. Practitioner role Covers: • Access to information legislation • Freedom of information • Data protection • Environmental information regulations • Records management Local lead on: • Request handling, inc. • Subject access requests • Liaison point and communication channel, inc. • Cascading information to colleagues • Local awareness raising • Identifying measures necessary to comply with legislation • Implementing and maintaining systems • Maintaining publication scheme Full description at: https://www.ed.ac.uk/records-management/roles-responsibilities/information-practitioners/role

7. Support for practitioners

8. Information request rights

9. “Openness is central to a modern mature and democratic society” • Scottish Executive, An Open Scotland, 1999 Accountability – Transparency – Trust Good practice – Protects rights Good institutional governance

10. Exercise: Asking for information • Think of 2 situations in which you might want to ask for information from a public authority, e.g. your local council or the Scottish Executive. • Make a note on a post-it • Stick the post-it to the flip chart

11. Access to information regimes • Legislation giving access to information rights: • Freedom of information (Scotland) Act 2002 • Environmental Information (Scotland) Regulations 2004 • Data Protection Act 2018 • General Data Protection Regulation (GDPR) • (subject access rights)

12. Requests for personal data • Personal information about the applicant themselves • E.g. references, comments on exam scripts, records of graduation, etc. • Handle as a subject access request under data protection legislation • Personal information about a third party • E.g. contact details, salary details, etc. • Handle under the Freedom of Information (Scotland) Act, note that the personal data exemption may apply

13. Requests for environmental info • Any request for information which has a link to the environment • E.g. requests for environmental impact assessments, transport policy, asbestos reports etc. • Handle under the Environmental Information (Scotland) Regulations 2004

14. Freedom of information requests • Any recorded information, that is not personal data and is not about the environment • E.g. requests for meeting minutes, research reports, teaching materials, etc. • Handle under the Freedom of Information (Scotland) Act • N.B. The information is held, not necessarily created, by the University

15. FOI(S)A versus EI(S)R When does the difference matter? • You want to invoke the fee regulations • You want to withhold some or all of the requested information Otherwise, the University’s procedures for handling these requests are the same

16. Response deadlines • FOI(S)A & EI(S)R requests • 20 working days • Subject access requests • 1 month • Clock starts • When the University receives the request • Clock stops • When the University replies to the applicant • Providing the information, or • Explaining that the University does not hold the information, or • Explaining which exemption(s) apply

17. Exercise: Receiving requests Individually: • Think of an information request that you might receive in the course of your day to day work • Write the request on a sheet of paper. Set it out clearly as if it were a real request for information • Hold on to it for the moment, you’ll need it later!

18. Review • Dissatisfied applicants can request a review • Conducted within the University • If still dissatisfied, can appeal to the Scottish Information Commissioner • If you receive a complaint: • Let the Records Management Section know • Try to resolve the complaint within your unit • If not possible, pass • Review procedures: https://www.ed.ac.uk/records-management/freedom-of-information/guidance-policies/review-procedures

19. Recognising requests & what to do with them

20. Exercise: Checklist for recognising requests • Together we are going to write a checklist any member of staff could use to help them recognise a request for information • Volunteer to scribe? • How would someone recognise a request? What tips / warnings might you give?

21. Rights of access • Who can access information? • Anyone, regardless of who they are, where they live, where they come from, or how old they are. • What information can they access? • Any recorded information held by the University, regardless of when it was created or who created it. • How would you recognise a request for information? • Asks for information • Any format • Don’t have to specify that it is an FOI/DP/EISR request • Don’t need to prove identity (unless making a subject access request) • Don’t need to explain why they want the information

22. Exercise: Which procedures apply to these requests? • In pairs, consider each of the requests on the sheet • Tick the corresponding box to indicate how you would handle it: • Under FOI(S)A • Under EI(S)R • Under DP (subject access request) • ‘Business as usual’

23. Request handling procedures

24. Level 1: Any member of University staff Responsible for dealing with: • ‘Business as usual’ requests • Requests that should be answered by their local area, i.e. requests that: • Fall entirely within the local remit and responsibilities; all of the requested information is ‘owned’ by the local area • Are clear • Can be answered to the complete satisfaction of the applicant, without assistance from other areas • The local area can answer in full without any concern and within no more than one day’s work • Don’t require central input • Special handling procedures don’t apply Pass all other requests to local practitioner

25. Level 1:Any member of staff • Calculate the response deadline • Send an acknowledgement • Model text available • Find the requested information • Write the response • Letter template available • Send the response • Keep a record See http://www.ed.ac.uk/records-management/freedom-of-information/request-handling-procedures

26. Level 2: Practitioners Responsible for dealing with: • Requests requiring special handling • Requests requiring central input You could receive requests: • Directly from the applicant • From staff in your local area • From the Records Management Section Notify RMS ASAP if you foresee a problem

27. Level 3: Records Management Section Responsible for: • The bulk of request handling work • Co-ordinating requests that require special handling • Co-ordinating requests that ask for information held by more than one area of the University • Applying exemptions • Reviews and appeals • Logging and statistical reporting

28. Special handling procedures Requests • Involving more than one area • From particular groups • MPs, MSPs etc.; Journalists; NUS; Trades Unions etc. • On particular subjects • Admissions; Animal research; Contracts; Embryology; GM; E&D issues; Royal household; Security services; UCEA information; VIPs • Involving external third parties • Involving personal information • Where you want to withhold some /all information

29. What are the first things you should do when you receive a request? • Is the date clearly marked? • Who is the appropriate person to deal with the request? • Does the University hold the information? • Which information regime applies? • Calculate the due date for response

30. FOISA / EISR Procedures

31. Anatomy of an information request

32. Exercise: Request handling • Split into groups of 3 or 4 • Pass the request you prepared earlier to the group on your left • How would you process these requests? What would you need to think about?

33. Request charging

34. Fee regimes • Subject access requests (under DP): • No fee from 25 May 2018 • FOI(S)A requests: • A small proportion of some (chargeable) costs can be recovered • EI(S)R requests: • Actual cost of some (chargeable) costs can be recovered over the threshold • Publication scheme requests: • The fee stated in the publication scheme Charging is optional Most FOI(S)A and EI(S)R requests are free of charge to the applicant The clock stops when we issue a fee notice and restarts where it left off

35. Chargeable costs • Staff time locating, retrieving and providing information • £15 per hour cap for FOI(S)A requests • Reasonably attributable overheads (e.g. managerial / supervisory costs) • Direct outlays (e.g. postage, paper) • At cost price • Cannot charge for: • Staff time spent establishing whether the information is held, or applying exemptions • Any special format required by an applicant with a disability

36. Charging bands If you estimate a request will take more than 7 hours work; contact RMS ASAP

37. Example estimate for a FOI(S)A request

38. Refunds • If the projected cost is lower than the actual cost • No action • So it is important that our cost estimates are as accurate as reasonably possible • If the projected cost is higher than the actual cost by £5 or more • Issue a refund to the applicant

39. exemptions

40. FOISA: Main Exemptions • Information otherwise accessible • Information intended for future publication (12 weeks, research exemption) • Commercial interests • Actionable breach of confidence • Breach of the data protection principles • Effective conduct of public affairs • Health & safety Guidance at:https://www.ed.ac.uk/records-management/freedom-of-information/guidance-policies/exemptions • Other refusals: • Repeated • ‘Vexatious’

41. FOISA Exemptions: Points to note • Narrow, and apply on case by case basis • Apply to information, not whole documents • Some subject to further tests • Substantial prejudice • Public interest test • Time related • If refusing information, must tell the applicant which exemption applies • Presumption is to release We must justify all refusals in detail, word-by-word, cost-by-cost

42. SAR screening • Check that the information about the applicant and not a different person • Remove duplicate records (e.g. from email trails) • Remove information created solely in a personal capacity • Remove information about other individuals • If information about the applicant is intertwined with information about others and redaction is not possible, contact the others for their views on disclosure • Only disclose information about others when it is reasonable to do so

43. SAR screening: exemptions • Remove: • Confidential references received by the University, unless the referee has consented to disclosure • Legal advice, and information prepared as part of obtaining legal advice • Remove information that if disclosed to the applicant: • Would weaken the University’s negotiating position with them • would damage the University’s management planning activities

44. replying

45. Case Study:Handling an FOI request • In groups of 3 or 4 • Consider the case study request • How should the University handle it? • Here’s how the University responded… • And here’s the resulting press coverage… • Is there anything we could have done differently?

46. Preparing the response • The importance of context • Letter template • Paragraphs that we are legally required to include • If applicant has a disability, you must supply the requested format • In other cases, try to comply

47. Disclosing information safely • Beware ‘hidden data’ • Always ‘inspect document’ • Remove information that should not be disclosed • ICO guidance: How to disclose information safely • Beware low numbers • ‘Fewer than 5’ approach and standard paragraph • Secure transmission of SAR responses • Encrypt electronic responses, see encryption guidance • ‘Double envelope’ and registered delivery for postal responses

48. Record keeping Create a file for each information request which contains: • All of your correspondence relating to the handling of the request with: • The applicant (including a complete copy of the final response) • Colleagues • Any third parties you consult • A record of your decisions and how you came to those decisions, e.g. • If you removed/redacted any information Keep each case file securely for five years after the case is closed and then securely destroy it

49. Review of objectives • To introduce new practitioners to their role • To recognise information requests • To introduce the procedures for handling information requests • Procedures for all staff • Procedures for practitioners • What the Records Management Section will do • Understand when the fee regulations or an exemption may apply • To be able to advise staff in your unit in the handling of information requests

50. Thank you Records Management Section Telephone: 514099 recordsmanagement@ed.ac.uk http://www.recordsmanagement.ed.ac.uk