Arrangements for Freedom of Information.

Comptroller and Auditor General Arrangements for Freedom of Information 17 March 2016

R.25/2016

Arrangements for Freedom of Information

Introduction

1. Freedom of Information (FoI) legislation has been introduced by many governments to:

• increase transparency and openness;
• make public authorities more accountable;
• improve decision making; and
• enable people to get involved in decisions that may affect them.

2. The Freedom of Information (Jersey) Law 2011 (the Law) came into force on 1 January 2015 replacing the previous Code of Practice on Public Access to Official Information.
3. The Law:

• grants a general right of access to information recorded and held by a scheduled public authority in any form, subject to certain conditions and exemptions;
• grants absolute exemptions (such as information available by other means, personal information and court information) and qualified exemptions (relating, for example, to trade secrets and information intended for publication); and
• imposes a requirement for requests to be acknowledged within five working days and information to be provided as soon as practicable and in any event within 20 working days.

4. The Law extends to scheduled public authorities', a term that includes the States Assembly, States departments, the States of Jersey Police and Andium Homes but does not extend to the other strategic investments of the States. From September 2015, Jersey's parishes were also subject to the requirements of the Law.
5. Up to the end of December 2015:

• 691 valid FoI requests had been received;
• over 60% of requests have been granted in full;
• the average time to respond to requests has generally fallen;
• the number of requests to which a response was not provided within the 20 day target had progressively fallen although performance slipped in November and December 2015; and
• less than 4% were subject to the internal review process following a request by a dissatisfied applicant.

6. Compliance with FoI legislation is one aspect of information governance and effective arrangements for FoI build upon effective arrangements for information governance overall (see Exhibit 1). Where there are effective information governance arrangements the administrative burden of the introduction of FoI legislation should be comparatively small.

Exhibit 1: FoI within information governance

Freedom of Information  

Public access to non-exempt information held by public authorities upon written

request

reliance  or unafusorcuthersesoris ed  recanMordsanagd Records elec fementromtrontheic electronic and Information

MDatvanala uaagMblinganage rdaesementta ouasrce a PDatrotea cStiecngudaritta y  Overseeing

Delivery

that allows for  from destructive  Maintaining paper  information delivery reuse, sharing and  channels – paper,

cevreatienmtedtuae theupl diyto sare pothesalir  human interaction

Scope and objectives of this review

7. The review covers arrangements for departments and non-ministerial bodies of the States of Jersey.
8. The objectives of the review were to assess:

• the structure and roles and responsibilities in place to support the FoI process;
• the arrangements for FoI request handling, including appropriate policies and procedures;
• records management standards;
• whether staff have had appropriate training and hence awareness to meet their obligations before and after implementation of the Law;
• the efficiency and effectiveness of request handling within departments; and
• the adequacy of arrangements for mainstreaming FoI across the States.

Each of these areas are considered in turn below.

Structure, roles and responsibilities

1. Effective implementation of any legislative change requires appropriate structures, roles and responsibilities.
2. The States of Jersey includes FoI as part of its integrated Information Governance framework that also covers data management, data security, records management and information delivery. The ultimate legal responsibility for the FoI process within the States lies with the Chief Executive who is responsible for ensuring the legally compliant enactment of FoI legislation within the States, request handling and any appeals.
3. The States put in place a structure that combines a centralised FoI unit with decentralised departmental arrangements (see Exhibit 2).

Exhibit 2: FoI arrangements

Central FoI Unit  Departments  CoInmfomrmissiatioonner

•development of corporate  •designation of a member of  •encouraging public

policies and guidance  staff responsible for  authorities to follow good •guidance on the Law  handling FoI requests (in  practice

•support on handling  practice also Public Record  •supplying the public with

complex FoI requests, fees  Officers under the Public  information about FoI

and exemptions  Records (Jersey) Law 2002)  •issuing a Code of Practice •issue of refusal letters  •answering individual  which covers:

•monitoring compliance with  requests  •the provision of advice and

the timescales  assistance to persons •maintenance of records for  making requests for

recording requests  information

•management programmes  •responding to an FoI

for training, awareness and  request and time limits

cultural change  •transferring requests for •monitoring of FoI  information

implementation project  •consultation with third •liaison with Information  parties

Commissioner's Office  •FoI and confidentiality •production of statistics  obligations

relating to request handling  •complaints procedures •maintenance of the  •appeals to the Information

publication scheme,  Commissioner

including liaison with

Communications Unit and

operational functions

4. The majority of funding for FoI ceased from December 2015 with the functions of the central FoI unit transferred to the Communications Unit of the Chief Minister's Department. This includes two members of staff dedicated to FoI. At the time of the audit a detailed plan had not been developed that set out where roles and responsibilities will lie in the future. This increases the risk of non-compliance with the requirements of the Law.

5. The initial budget for implementing FoI was £4.7m and the outturn is £2.68m. The variance arose mainly as a result of delays to project initiation, recruitment delays and a desire to reduce costs. As a result, a total of approximately £2.0 million was available to return to contingencies (see Exhibit 3).

Exhibit 3: Expenditure on FoI implementation

2000 1800 1600 1400

1200 1000 800 600 400

200 0

2012 2013 2014 2015

Budget £000 Actual £000

6. 76% of of the original budget for 2015 related to staff costs, including staffing within the FoI unit, Information Commissioner's office and departments. The largest component of non-staff expenditure has been a contract with Jersey Heritage Trust to clear a backlog of archiving (see Exhibit 4).

Exhibit 4: Analysis of FoI budgeted costs in 2015

Jersey Heritage contract £219k  

Contingency  £100k  

Other non-staff  costs £55k  

Departmental Legal advisors  staff £795k

£120k

Information  Commissioner  £66k  

Central FoI unit  £219k  

7. There has been limited investment in Information Technology (IT) solutions for storage of electronic records or for securing a means by which archived electronic material will remain accessible in the future. Such investment might reduce the cost of responding to FoI requests in the future and provide wider internal operational benefits.

Recommendations

R1  Clearly document responsibilities for FoI following the transfer of

functions to the Chief Minister's Department.

R2  Within the context of the overall information governance strategy,

undertake a cost benefit analysis to identify whether an IT solution is needed for electronic records management.

Arrangements for request handling

1. Effective arrangements for request handling are dependent on appropriate guidance and procedures for the staff involved.

Guidance

2. The central FoI unit has developed guidance for staff on FoI that is available on the States' intranet, MyStates'. Areas covered in the guidance include:

• Preparations for FoI;
• Types of FoI request;
• FoI points of contact;
• What is FoI?;
• FoI and Data Protection: What's the difference?;
• Frequently Asked Questions; and
• FoI operating manual.

3. In addition an operating manual and mailbox protocol were distributed to FoI contacts. The manual has, however, not been updated to reflect some changes in handling FoI enquiries relating to receipt of requests, logging enquiries, appeals, how to deal with multi-department requests, and what to do when an exemption applies.

Procedures

4. The States uses two systems for FoI handling, SharePoint and Livelink, a case handling system. Neither system is capable of supporting end to end FoI case handling. The use of the two systems results in inefficiency and increased risk of error: information is input into the two different systems.
5. The SharePoint system assists in management of the FoI process: a unique identifier is allocated to each request and, at set intervals, standard reminders are generated setting out the time remaining for request handling.
6. The initial FoI implementation project included consideration of a comprehensive IT solution. However, the Project Board took the decision not to invest in such a solution.
7. Management reporting from the system is not generated automatically and labour-intensive manual extraction is needed to produce reports for management.
8. A disclosure log containing details of all the FoI queries submitted and responses provided is maintained and available on the gov.je website. In addition the FoI queries relating to the police are available on the States of Jersey Police website.

R3 Update the operating manual to reflect the changes to handling FoI

enquiries that cover receipt of requests, logging enquiries, appeals, how to deal with multi-department requests, and what to do when an exemption applies.

R4 In the context of wider decisions on information management

investment, review the information systems used for managing FoI and undertake a cost benefit analysis to consider whether investment in an IT solution for managing FoI workflows is justified.

Records management standards

0. FoI is one component of information management. Efficient FoI handling relies upon effective records management, another dimension of information governance. The States recognised the importance of records management in supporting the implementation of FoI legislation. Key activities undertaken have been:

• Jersey Archive and information management programme of work: a significant programme of activity undertaken between the Jersey Archive and States departments is now nearing completion. This has included:

• an appraisal and audit of files held by the States (including advice on records management and file plans);
• review and creation of retention schedules (over 140 have now been signed off, with others nearing completion);
• transfer and cataloguing of archival records to the Jersey Archive; and
• drafting a generic retention schedule covering records of Ministers and senior officials to facilitate continuity of government.

• the Information Management intranet sub-site: different information management pages on MyStates have been co- ordinated into a single resource for Information Managers. This directly supports the delivery of FoI as the content relates to information management activity and policy; and
• the appointment of a Corporate Records Manager: in September 2014 a Corporate Records Manager was appointed to develop States-wide records management strategy and related policy.

1. Although significant progress has been made on updating records management schedules and cataloguing and archiving of information to the Jersey Archive, records management arrangements are in their infancy and progress on implementation is slow:

• even though a records management policy was approved in April 2015, supporting policies on information classification and email records management remained in draft;
• a draft records management strategy has been developed but is in the early stages of implementation;
• a delivery plan, with clearly identified actions, responsibilities and timescales is being developed; and
• a programme of work for some aspects of records management is in place, particularly focusing on the development of retention schedules.

R5 Ensure that the records management delivery plan contains clearly

identified actions, responsibilities and timescales and that there is effective monitoring of its implementation and corrective action is taken where necessary.

0. Effective implementation of arrangements for FoI requires not just provision of appropriate guidance and procedures but also training of the staff involved.
1. The types of training provided to staff have included:

• Introduction to FoI and Data Protection (118 attendees);
• Introduction to Records Management (72 attendees);
• Data security (55 attendees);
• FoI legal workshops based on Q & A case studies tailored to departments and one Applying Exemptions open' workshop (482 attendees);
• FoI and minute taking (124 attendees);
• FoI briefing by a UK journalist (164 attendees).

2. Although ad-hoc training on Livelink, the electronic document management system has been provided to staff, this only covers document management and does not cover records management.
3. The provision of comprehensive training for all relevant staff on records management as well as FoI would enhance understanding of responsibilities for and the tools available to support all stages of records management rather than just responding to FoI requests received.

Recommendation

R6 Develop, deliver and monitor the impact of a States-wide training

programme on corporate records management including FoI.

Efficiency and effectiveness of request handling within departments

1. No corporate information is held on the time and cost of responding to FoI requests. Such information is valuable both in assisting in the preparation of budgets and in helping to evaluate the cost effectiveness of and identify the cost drivers for FoI handling.
2. The central FoI unit is undertaking an initial costing exercise and the following departments had agreed to participate in the exercise:

• Department of the Environment;
• Treasury & Resources;
• Education, Sport and Culture; and
• Economic Development.

3. Information from such an exercise can be used to compare the cost of FoI handling between departments. It also facilitates comparisons of costs with other jurisdictions, while recognising the difficulties in obtaining comparable information on a consistent basis (see Exhibit 5).

Exhibit 5: Average cost per FoI request

USA Australia Canada Ireland Scotland UK

£0 £100 £200 £300 £400 £500 £600 £700 £800

Source: Colquhoun, Anna. The Cost of Freedom of Information, 2010, London: Constitution Unit

Recommendations

R7  Encourage departmental participation in the costing exercise to identify

the cost of FoI handling.

R8  Use the results of the costing exercise to improve the effectiveness of

FoI handling processes and identify any wider management issues.

Adequacy of arrangements for mainstreaming FoI across the States

1. Everyone who works for the States is required to manage information within a complex legal framework. There is an interplay between the legislation on securing public records (the Public Records (Jersey) Law 2002), data protection (the Data Protection (Jersey) Law 2005) and FoI (the Freedom of Information (Jersey) Law 2011). For the FoI process to run smoothly:

• records should be created, kept and managed adequately; and
• personal information needs to be protected.

2. With the transfer of the functions of the central FoI unit, it is important that there is a clear vision for:

• effective arrangements for responding to FoI requests; and
• the linkage between FoI and other elements of information governance.

Recommendation

R9 Reflect the arrangements for FoI handling and its linkage to other

elements of information governance in the information governance strategy.

Conclusion

1. The States has established arrangements that allowed substantial compliance with statutory responsibilities under the 2011 Law and has improved document archiving.
2. FoI is one element of information management and cannot be seen independently of the other elements. Essential preconditions for effective FoI handling include good data and records management. In some of these areas the States has much work to do.
3. Effective FoI handling also requires appropriate policies, procedures, systems, guidance and training. In some areas, such as information systems, training and understanding costs, there is significant work to do. The reduction in the resources for the central FoI team, and therefore the support for departmental staff, means that:

• there is a need for a clear and documented understanding of the split of responsibilities between the centre' and the departments;
• clarity in processes, good guidance and effective training are even more important; and
• there is a risk that corporate learning from FoI handling is lost.

Appendix 1: Summary of recommendations

Structure, roles and responsibilities

R1 Clearly document responsibilities for FoI following the transfer of

functions to the Chief Minister's Department.

R2 Within the context of the overall information governance strategy,

undertake a cost benefit analysis to identify whether an IT solution is needed for electronic records management.

Arrangements for request handling

R3 Update the operating manual to reflect the changes to handling FoI

enquiries that cover receipt of requests, logging enquiries, appeals, how to deal with multi-department requests, and what to do when an exemption applies.

R4 In the context of wider decisions on information management

investment, review the information systems used for managing FoI and undertake a cost benefit analysis to consider whether investment in an IT solution for managing FoI workflows is justified.

Records management standards

R5 Ensure that the records management delivery plan contains clearly

identified actions, responsibilities and timescales and that there is effective monitoring of its implementation and corrective action is taken where necessary.

Training and awareness

R6 Develop, deliver and monitor the impact of a States-wide training

programme on corporate records management including FoI.

Efficiency and effectiveness of request handling within departments

R7 Encourage departmental participation in the costing exercise to identify

the cost of FoI handling.

R8 Use the results of the costing exercise to improve the effectiveness of

FoI handling processes and identify any wider management issues.

Adequacy of arrangements for mainstreaming FoI across the States R9 Reflect the arrangements for FoI handling and its linkage to other

elements of information governance in the information governance strategy.

KAREN McCONNELL COMPTROLLER and AUDITOR GENERAL

JERSEY AUDIT OFFICE, LINCOLN CHAMBERS (1ST FLOOR), 31 BROAD STREET, ST HELIER, JE2 3RR T: 00 44 1534 716800 E: enquiries@jerseyauditoffice.je W: www.jerseyauditoffice.je