NPCC report into Data breach 2023

Request Number: FOI/13988

Category: Human Resources - Recruitment

Subject: NPCC report into Data breach 2023

Request and Answer: 

Your request for information below has now been considered. In respect of Section 1(1)(a) of the Freedom of Information Act 2000 (FOIA) We can confirm that the Police Service of Northern Ireland does hold the information you have requested however it is estimated that the cost of complying with your request for information would exceed the “appropriate costs limit” under Section 12(1) of the Freedom of Information Act 2000 and this will be further explained below. PSNI have followed the Information Commissioner’s Office guidance ‘Requests where the cost of compliance exceeds the appropriate limit’ in relation to this request, which also provides further detail on the application of Section 12 (1) of the FOIA. This guidance is available on the ICO website at the following link:
https://ico.org.uk/media/for-organisations/documents/1199/costs_of_compliance_exceeds_appropriate_limit.pdf

Request 1
I’m writing to you to request information under the Freedom of Information Act 2000 all of the questions to which I seek answers relate to the National Police Chiefs’ Council’s review of the PSNI data breach in 2023.
The link to that review is here https//news.npcc.police.uk/releases/review-into-psni-data-breach 

The first piece of information I'm looking for is Following the NPCC’s review and not including those already mentioned in the review, how many more resignations from PSNI officers and civilian staff members have been recorded specifically citing the data breach as a reason for leaving the PSNI? The data here should include resignations made between and including 12 December 2023 to 18 February 2025

Request 2
For the same time period as above, how many more PSNI officers and civilian staff members claimed sick leave citing the data breach as the reason? Again, the number should exclude the data already recorded in the NPCC’s review.

Request 3
For the same period and excluding the data in the NPCC’s review, how many PSNI officers and civilian staff members requested to be relocated, citing the data breach as the reason? Please supply the number of requests and also how many were accepted.

Request 4
Please supply the total annual number of recruits to the PSNI – both officers and civilian staff members – for the following years 2020; 2021; 2022; 2023; 2024

Request 5
What is the total cost of the operational impact the data breach has had on the PSNI so far?

Answer
Section 17(5) of the Freedom of Information Act 2000 requires the Police Service of Northern Ireland, when refusing to provide such information (because the cost of compliance exceeds the appropriate limit) to provide you the applicant with a notice which states that fact.

It is estimated that the cost of complying with your request for information would exceed the “appropriate costs limit” under Section 12(1) of the Freedom of Information Act 2000. Section 12 of FOIA allows a public authority to refuse to deal with a request where it estimates that it would exceed the appropriate limit to either comply with the request in its entirety or confirm or deny whether the requested information is held. The estimate must be reasonable in the circumstances of the case. The ‘appropriate limit’ is currently £600 for central government and £450 for all other public authorities including PSNI. The relevant Regulations which define the appropriate limit for section 12 purposes are The Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulation 2004 SI 2004 No 3244. These are known as the ‘Fees Regulations’ for brevity.

Regulation 4(3) of the Fees Regulations states that a public authority can take into account the costs it reasonably expects to incur in carrying out the following permitted activities in complying with the request:

(i) determining whether the information is held;
(ii) locating the information, or a document containing it;
(iii) retrieving the information, or a document containing it; and
(iv) extracting the information from a document containing it.

Under those regulations PSNI can calculate the time spent on each of these permitted activities at £25 per hour (thus if the activity(s) takes more than 18 hours PSNI will be in excess of the ‘appropriate limit’).

When a public authority is estimating whether the appropriate limit is likely to be exceeded, it can include the costs of complying with two or more requests if the conditions laid out in Regulation 5 of the Fees Regulations can be satisfied. Those conditions require the requests to be:

• made by one person, or by different persons who appear to the public authority to be acting in concert or in pursuance of a campaign;
• made for the same or similar information; and
• received by the public authority within any period of 60 consecutive working days.

Regulation 5(2) of the Fees Regulations requires that the requests which are to be aggregated relate “to any extent” to the same or similar information. This is quite a wide test but public authorities should still ensure that the requests meet this requirement.

Enquiries made in relation to your request has identified that retrieval of information to respond to your request would exceed the FOI legislative cost of 18 hours as set by the Secretary of State.

With regards to Request 1 PSNI can confirm, whilst the information is held electronically on the PSNI's central database, it is not held in a retrievable format. In order to retrieve this information we would need to conduct a manual trawl of each resignation recorded between 12/12/2023 and 13/02/2025. There were 191 resignations within this time period, at a conservative 15 minutes per record this would take approximately 47 hours, exceeding the legislative timeframe of 18 hours.

In accordance with the Freedom of Information Act 2000, this letter should be considered as a Refusal Notice, and the request has therefore been closed. 

Advice and assistance
You may wish to submit a refined request in order that the cost of complying with your request may be facilitated within the ‘appropriate limit’. In compliance with Section 16 of the Act, we have considered how your request may be refined to bring it under the appropriate limit. 

PSNI can advise that we can answer Requests 3, 4 and 5 within cost, if a new request is submitted. However, regarding Request 3 you would need to clarify if you are referring to relocations from home or from their work location or another relocation. Unfortunately no information is held regarding Request 2.

Submission of a refined request would be treated as a new request, and considered in accordance with the Freedom of Information Act 2000, including consideration of relevant Part II exemptions.