Correspondence between FOI & NPCC CRU 1102/2025
FOI Reference: 1102/2025
Request:
I previously contacted your force with the below request:
"I am writing to request all written digital correspondence between (1) your force's team responsible for addressing and responding to freedom of information requests and (2) the National Police Chiefs' Council's (NPCC) central referral unit (CRU) in September 2025.
I appreciate that parts of the correspondence will need to be redacted, but would remind that redaction does not count towards the time/cost limits under s12 of the FOIA. The possibility that parts of the correspondence will need to be redacted also does not justify withholding the correspondence in its entirety."
Please now inform me of the following:
- Whether the CRU advised you on how to respond to the above request. If so, please provide me with a copy of the full correspondence relating to that request. That includes emails sent by your force to the CRU and from the CRU to your force in relation to the above request.
- If the CRU did not provide you with advice, but you built your response to the above request based on the following extract, please clarify where you got that extract.
Extract:
"Our force FOI teams contact the NPCC Central Referral Unit (CRU) for a wide variety of reasons in the course of their work. In aiming to ensure we provide the most accurate response to your request, please can you confirm whether you seek digital correspondence to and from the CRU in relation only to FOI requests the force FOI team have referred to the CRU, or if you are requesting every piece of digital correspondence between the force and the CRU, including wider emails?"
Response:
I can confirm that Dyfed-Powys Police does hold the information requested, however, we are withholding some of that information by virtue of Section 31(1)(a)(b) Law enforcement and Section 40(2) Personal Information. Please see the end of the document for an explanation of the applied exemptions.
Please see the attachments to your email named:
Explanation of the applied exemptions:
Section 1 of the Freedom of Information Act 2000 places two duties on public authorities. Unless exemptions apply, the first duty at Section 1(1) (a) is to confirm or deny whether the information specified in a request is held. The second duty at Section 1(1) (b) is to disclose information that has been confirmed as being held.
Where exemptions are relied upon section 17 of FOIA requires that we provide the applicant with a notice which:
a) States that fact
b) Specifies the exemption(s) in question and
c) State (if that would not otherwise be apparent) why the exemption applies
Section 31(1)(a)(b) Law Enforcement:
(1) Information which is not exempt information by virtue of section 30 is exempt information if its disclosure under this Act would, or would be likely to prejudice -
(a) the prevention or detection of crime
(b) the apprehension or prosecution of offenders
Section 31 is a prejudice based qualified exemption and as such there is a requirement to provide details of the harm as well as the public interest test.
Harm in disclosure
The Freedom of Information Act plays an important role in preventing crime, particularly through its impact on transparency, accountability and public oversight. FOI legislation allows members of the public and watchdog organisations to access records related to matters including police conduct and judicial decisions. This transparency helps expose misconduct, bias, or systematic failures, which can lead to reforms that prevent future crimes. Accordingly, the NPFDU acts as a national coordination body in providing professional advice and support for forces and stakeholders in all matters relating to both freedom of information (FOI) and data protection (DP) within the UK police service. In order to do this, there are established internal processes and channels by which the forces and the NPFDU maintain contact so that information, advice and support can be given without disruption. Accordingly, some of the information requested contains contact details that would, if released, provide persons intent on disrupting the work of the NPFDU with information that would assist them in this endeavour.
An example of this would be; releasing a specific email address for the NPFDU could lead to spam attacks and individuals/members of the public sending an unmanageable volume of emails/correspondence to this address that are wide ranging in nature and may not even be relevant to work undertaken within the NPFDU. Additionally, the sending of an unmanageable amount of emails/correspondence could negatively affect the systems utilised by the NPFDU.
Public Interest Test Factors favouring disclosure under Section 31(1)(a)(b)
Dyfed Powys Police is a public authority and is ultimately accountable to the general public. When any request for information is made to the police, it is important that Dyfed Powys Police is transparent, where possible, in responding to that request for information. Disclosing all information held without redaction, would reinforce the forces commitment to transparency with the general public.
Factors favouring non-disclosure under Section 31(1)(a)(b)
The release of the internal contact details for the NPFDU would provide persons intent on disrupting the work of the NPFDU, Dyfed Powys Police and the Police Service more generally, with information that would assist them to do so. By disclosing information which has the potential to result in vast amounts of correspondence being received would impede upon the resources of these members of staff and cause disruption to the work of Dyfed Powys Police and the NPFDU.
Balance test
Whilst there is a public interest in better informing the public as to the internal mechanisms used within the force, this must be balanced with the need to ensure that the appropriate channels are used for contact and that internal mailboxes are not compromised in any way which would ultimately affect the core function of law enforcement. Therefore, in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.
Section 40(2) – Personal Information
Section 40(2) applies to third party personal data and is exempt from disclosure under the Freedom of Information Act 2000 if disclosure, in relation to data subject to law enforcement processing, would breach any of the data protection principles contained within Part 3 - Chapter 2 of the Data Protection Act 2018.
Under Section 34 within Chapter 2 “The Controller in relation to personal data is responsible for and must be able to demonstrate, compliance with” Chapter 2. Such information would not be released under the Freedom of Information Act 2000 unless there is a strong public interest. One of the main differences between the Freedom of Information Act 2000 and the Data Protection Act 2018 is that any information released under FOI is released into the public domain, not just the individuals requesting the information and disclosure under the Act must be made with that in mind. As such, any release that identifies any individuals through releasing their personal data, even third party personal data is exempt.
Personal data is defined under Section 3 of the Data Protection Act 2018 as:
“(2) ‘Personal data’ means any information relating to an identified or identifiable living individuals (subject to subsection (14)(c)).
(3) ‘Identifiable living individuals’ means a living individuals who can be identified, directly or indirectly, in particular by reference to—
(a) An identifier such as a name, an identification number, location data or an online identifier, or
(b) One or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individuals.”
All members of the public including those employed by the force have an intrinsic right to privacy and these rights are protected by virtue of the Human Rights Act, the Data Protection Act 2018 and the UK General Data Protection Regulation (UK-GDPR) and a public authority must not interfere with that right. Any release of the information subject to the exemption is likely to compromise those rights.
Data Protection Act 2018
Part 3 – Law Enforcement – Chapter 2 Principles Section 35
The first data protection principle:
“(1) The first data protection principle is that the processing of personal data for any of the law enforcement purposes must be lawful and fair.”
UK - General Data Protection Regulation
Article 5 of the UK-GDPR – ‘Principles relating to processing of personal data’ provides:
“1. ‘Personal data’ shall be
(a) Processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency);
(b) Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest…
2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).”
Dyfed-Powys Police would not want to disclose any information that could potentially identify any individuals. In this particular case, to release the information requested could lead to the identification of individual(s). To release such information would be a direct breach of Data Protection legislation and as a consequence I am satisfied that Section 40(2) Personal Information exemption is applicable to the release of the information. The Section 40 exemption is in part qualified and in part absolute, in the present case it would be absolute as to release the information would breach Data Protection legislation and therefore there is no requirement to carry out a public interest test.
(This is a response under the Freedom of Information Act 2000 and disclosed on 16/12/2025)
|
Os oes angen y wybodaeth yma arnoch yn Gymraeg, cysylltwch â: If you require this information in Welsh, please contact: |