Freedom of Information Consultation

Summary

The requester sought evidence regarding Cabinet Office decisions on FOI policy, administrative burdens, and specific meeting minutes, while the authority partially upheld the request by providing 2023 statistics on Data Subject Access Requests (DSARs) and Freedom of Information (FOI) volumes across government departments.

Key Facts

• The Office of Cybersecurity and Information Assurance (OCSIA) reported cross-government statistics for 2023.
• Manx Care (MxC) received the highest volume of DSARs with 668 requests in 2023.
• The Cabinet Office (CabO) recorded 50 DSARs in 2023.
• Time spent processing DSARs is not systematically monitored or recorded across the government.
• The response included raw figures and a chart illustrating DSAR distribution by department.

Data Disclosed

• 2023
• 668
• 285
• 90
• 50
• 37
• 12
• 9
• 7
• 6
• 5
• 2
• 1
• 0
• 1185

Original Request

It's pleasing to see that the consultation states - The Isle of Man Government's ongoing commitment to openness and transparency is resolute. The policy proposals outlined in this consultation are in no way intended as a barrier to access; The evidence I require is - *1. A copy of or copies of the meeting(s) of 'The Isle of Man Government' at which it decided its ongoing commitment and that the policy proposals are in no way a barrier to access. Of course they are. *2. Whatever evidence you have which confirms when the Cabinet Office, on behalf of the Council of Ministers, decided that it looked forward to receiving comments from the public and interested parties and that it would encourage feedback on this consultation? *3 Whatever evidence you have that the time expended by teams and staff making enquiries and co-ordinating large requests can have a real and significant impact on officers providing essential and / or front-line services including details of which essential and/or from line services have been directly impacted, and when such impacts occurred, by having to process FOIA requests ? *4 Who decided that that 'the time is right to revisit consulting on possible policy options to address the issue and provide better value for money for the taxpayer? *5 Where the consultation states 'we can observe that of the 300 requesters….', who are 'we'? *6 Where the consultation states 'We can further observe that the top three requesters….' Who are 'We'? *7 Where the consultation states 'This highlights the need to address this issue and bring forward policy options to reduce the administrative burden that is being placed upon Public Authorities' , the evidence you have from all Departments and local authorities that an administrative burden is being placed on them in processing FOI Requests and that they say that there is a need to reduce such burden. *8 Where the consultation states 'The introduction of a charge is being considered by Government', the evidence which you have which from each Department of Government which states that they are considering introducing a charge. *9 Where the consultation states 'Council is……seeking views on the introduction of a modest sum so as not to inhibit anyone's right to public information', copies of or extracts from a meeting(s) of COMIN at which it made such decision - which I note precludes not introducing a sum at all. *10 Who decided on the cost limits?. If this was decided by COMIN I require copies of or a extracts from a meeting or meetings of COMIN at which such cost limits were decided by it.

Data Tables (6)

Full Response Text

Isle of Man Government – FOI and DSAR Statistics

The Office of Cybersecurity and Information Assurance (OCSIA) have been asked to report on the cross-government statistics relating to Freedom of Information Requests (FOIs) and Data Subject Access Requests (DSARs), DSARs being the most frequent form of data subject right exercised.

1

DSAR and FOI Statistics DSARs Raw figures for the 2023 calendar year

Department/ Board/Office Jan Feb Mar April May Jun Jul Aug Sep Oct Nov Dec Total Notes CoT

N/A

GSC

0 No DSARS received
IOMPO

0 No DSARS received
MIRS

0 No DSARS received
CURA

1

1

GenReg

1

1

PSPA

1

1

AGCs

1

1

2

MNH 1

1

2

DfE 1 1

1

1

1

5

DEFA 1

1 1

1* 2

6 *RTLC FSA 2 2 1

1 1

7

DHSC

2

1

1

5

9

DoI

1

1 2 2 1 2

9

Treasury
2

2

1 1

2

3 1 12

DESC 1 4 5 1 2 3 6 4 7 1 2 1 37

CabO 3 3 2 6 4 3 3 8 2 2 8 6 50

DHA

90 DHA 15 + Prison 75 IOMC 17 39 22 16 35 28 18 17 24 26 26 17 285

MxC 56 48 78 52 52 52 56 65 51 61 64 33 668

Total DSARs Recorded 1185

2

DSAR and FOI Statistics Raw figures for the 2023 calendar year – illustrated

0 0 0 0 1 1 1 2 2 5 6 7 9 9 12 37 50 90 285 668 0 100 200 300 400 500 600 700 800 CoT GSC IOMPO MIRS CURA GenReg PSPA AGCs MNH DfE DEFA FSA DHSC DoI Treasury DESC CabO DHA IOMC MxC

3

DSAR and FOI Statistics Estimated Effort Time spent processing Data Subject Access Requests (DSARs) is not systematically monitored or recorded and time spent will vary heavily depending on:
 The scope of the request (for example, a data subject may request all personal data that a controller holds relating to them, or they may state the specific documents or nature of information they would like to access);
 The records management practices and efficiencies of the Controller (e.g. there will be a difference in time spent if the records of a particular organisation lacks structure or organisation vs. an organisation that has mature information management practices and is therefore able to conduct reliable, targeted searches for personal data);
 The size of the organisation (e.g. the likes of Manx Care vs. a smaller statutory board which might receive one or two DSARs per year and have less records to search against);
 The nature and identity of the Data Subject (for example, a DSAR from a member of staff who has had a longstanding engagement with the controller as their employer vs. a member of the public who may have little to no engagement with a controller aside from a one-off incident or use of the controller’s service);
 The Information Governance Personnel structure within a particular organisation may vary. For example, there may be co-ordinators who co-ordinate and supervise the handling of DSARs who delegate search and review tasks to divisional administrators, while other organisations may have one or two people conducting the entire coordination, search and response stages. Each instance will involve varying levels of support from officers who hold or who have access to the information requested.
It is therefore difficult to produce reliable estimates or figures outside of what is summarised in the spreadsheet in terms of volumes received.
The DHA have taken a sample of 5 DSARs received and responded to in the first calendar quarter of 2024, the estimated time spent per request (including co-ordination, searches, review and response) are as follows:
- DHASARXX – estimated officer time 5 hours
- DHASARXX – estimated officer time 7 hours
- DHASARXX – estimated officer time 32 hours
- DHASARXX – estimated officer time 2 hours
- DHASARXX – estimated officer time 9 hours The above must be read in the context that DHA’s DSARs are co-ordinated centrally by OCSIA and while the above includes an estimate of officer time spent outside of the co- ordination role, may not be fully appreciating the amount of work on the part of officers conducting searches or time for senior members of staff to review and sign-off.

Average amount of officer time spent per DSAR from the above sample: 11 hours. Total DSARs recorded as received in the 2023 calendar year by all Departments, Offices and Boards: 1185. 1185 x 11 hours (average) = 13,035 officer hours in 2023.

4

DSAR and FOI Statistics FTE Resource

Total DSARs Received Avg. Hours to Respond 1185 11 Hours in a Working Day Working Days 2023 (inc. minimum A/L) 7.4 228 Officer Hours Available (per year) Hours to Respond to all DSARs 7.4 x 228 = 1687.2 11 x 1185 = 13035 FTE Required 13035 / 1687.2 = 4.8

5

DSAR and FOI Statistics FOIs Raw figures for the 2023 calendar year (cases received)

Department/Board/Office Jan Feb Mar April May Jun Jul Aug Sep Oct Nov Dec Total DoI 11 11 13 18 18 22 20 18 14 13 16 7 181 MxC 6 11 20 8 18 9 13 13 7 12 9 6 132 CabO 20 9 4 6 13 6 9 9 4 11 23 15 129 DHSC 7 11 13 10 10 3 9 12 5 6 5 5 96 DESC 7 7 14 6 10 10 10 7 4 8 4 6 93 Treasury 12 3 7 2 3 7 8 10 4 2 8 7 73 DfE 7 2 7 7 3 7 8 4 4 12 5 3 69 DHA 9 6 7 2 11 6 5 5 6 6 4

67 DEFA 9 7 2 2 6 1 12 12 1 6 3 4 65 MUA 1 1 1 2 2 2 16 11 10 2 6 2 56 IOMC 10 1 2 2 3 7 3 4 3 9 6 1 51 AGCs 2 1

1

2 5 4 2 2 2

21 CoT

2 1

4 1 1 1

1 11 GenReg 1 2

1 5 2

11 OFT 2

1 2

1

6 CURA

1 1 1 1

1

5 IOMPO

2

1

3 GSC 1

1 1

3 FSA 1

1

2 MNH

1

1 Total 106 74 91 69 100 88 127 114 65 92 92 57 1075

6

DSAR and FOI Statistics Raw figures for the 2023 calendar year (cases received) – illustrated

1 2 3 3 5 6 11 11 21 51 56 65 67 69 73 93 96 129 132 181 0 20 40 60 80 100 120 140 160 180 200 MNH FSA IOMPO GSC CURA OFT CoT GenReg AGCs IOMC MUA DEFA DHA DfE Treasury DESC DHSC CabO MxC DoI

7

DSAR and FOI Statistics Raw figures for the 2023 calendar year (time recorded in System)

Department/Board/Office Jan Feb Mar April May Jun Jul Aug Sep Oct Nov Dec Total CabO 148.92 27.6 86.75 57.42 99.31 43.11 85.5 55.06 35.62 124.66 118.99 83.8 966.74 DESC 70.03 29.62 46.72 30.61 49.79 30.73 43.28 23.1 22.39 47.32 47.3 20.72 461.61 Treasury 29.51 19.54 15.63 3.17 12.97 48.95 48.37 35.66 59.09 10.83 66.91 88.89 439.52 DHSC 34.55 48.11 26.12 57.12 46.73 1.29 74.11 46.26 15.69 27.39 19.22 9.21 405.8 DEFA 48.32 26.14 30.11 21 20.36 4.73 29.4 52.14 3.61 54.96 28.81 49.24 368.82 DHA 31.56 19.24 48.46 15.73 51.75 23.06 26.41 40.17 16.62 31.54 40.58 345.12 DoI 14.95 10.51 12.7 18.59 13.13 37.67 18.72 19.71 9.59 23.98 69.08 60.39 309.02 DfE 16.02 0.54 7.77 11.54 17.45 23.9 14.5 7.94 7.76 153.42 20.21 20.25 301.3 MxC 11.15 16.62 44.67 16.1 38.9 24.57 18.06 27.67 24.59 31.7 17.32 13.25 284.6 MUA 4.9 2.46 0.74 8.1 7.29 5.42 43.27 26.39 26.22 10.52 18.93 5.68 159.92 AGCs 26.98 9.33 3.59 15.58 40.26 23.85 7.76 11.77 5.09 144.21 IOMC 8.39 0.6 8.21 2.62 3.69 13.69 5.11 3.4 2.32 17.04 9.6 3.98 78.65 OFT 12.26 2.62 29.88 4.03 48.79 CoT

19.06 4.46 2.09 1.46 2.34 1.38 1.39 32.18 CURA

9 1.25 10.58 2.77 6.95 30.55 GenReg 0.43 1.57 0.18 10.68 0.88 13.74 GSC 0.97 5.52 5.16 11.65 IOMPO

2.56 1.36 3.92 FSA 1.13 0.51 1.64 MNH

1.38 1.38 Total 460.07 214.44 328.39 266.01 375.01 284.63 468.68 400.62 233.6 557.49 463.42 356.8 4409.16

8

DSAR and FOI Statistics Raw figures for the 2023 calendar year (time recorded in System) – illustrated

1.4 1.6 3.9 11.7 13.7 30.6 32.2 48.8 78.7 144.2 159.9 284.6 301.3 309.0 345.1 368.8 405.8 439.5 461.6 966.7 0 200 400 600 800 1000 1200 MNH FSA IOMPO GSC GenReg CURA CoT OFT IOMC AGCs MUA MxC DfE DoI DHA DEFA DHSC Treasury DESC CabO

9

DSAR and FOI Statistics Effort Spent Unlike DSARs, we have a system which is used to assist in the processing of Freedom of Information (FOI) requests, so the data is more readily available.

One of the metrics available from these reports is the time spent processing FOI requests captured by the iCasework system.

To provide some context to these metrics; when an Officer with an account on the system (“User”) has a case open in their browser, the system’s internal clock is running in the background and that User’s time spent in that case is logged and reportable – any time spent outside the system is not captured by the system, but can be logged manually at two given intervals.
 When an Officer who was assigned a search request by a User, is returning those search results via the system, or;
 When the User is closing the case.

As some Officers opt to respond to the email received requesting the information, or where a User skips the “record effort spent” task when closing the case, the figures reported are inconsistent and not wholly reliable, and have therefore been discounted from our calculations. As we cannot accurately account for the time or effort spent outside the system to process a FOI request, an estimate has been applied on the basis of common working practices by Users in the Cabinet Office. The rationale for the use of this estimation is CabO’s volume of FOIs received vs. the total time logged in the system. CabO Users have confirmed that, where possible, they will keep a case open on their browser when carrying out any work related to the management of that case.

Much the same as DSARs, the time taken to process an FOI request will vary greatly, depending on similar factors, such as;
- The scope and complexity of the request, e.g. requesters may submit a request with multiple queries, occasionally relating to multiple service areas in a given Department/ Board/Office;
- The records management practices and efficiencies of the Controller (e.g. there will be a difference in time spent if the records of a particular organisation lacks structure or organisation vs. an organisation that has mature information management practices and is therefore able to conduct reliable searches for the information requested);
- The size of the organisation (e.g. the likes of Manx Care vs. a smaller statutory board which might receive one or two FOIs per year and have less records to search against);
- The Information Governance Personnel structure within a particular organisation may vary (e.g. there may be co-ordinators who co-ordinate and supervise the handling of FOIs who can delegate search and review tasks to divisional administrators, while some organisations may have one or two people conducting the entire coordination, search and response stages with varying levels of support from officers who hold or who have access to the information requested).
- Staff attrition is also a major impacting factor, and is compounded by records management practices. The FOI Act 2015 covers information from 11 October 2011. Requests for information which relate to Government initiatives in the earlier periods covered by the Act can be more complex, due to staff attrition, and the knowledge of such information becoming lost over time.

In the 2023 calendar year, CabO received 129 FOI requests, and logged 966.74 hours in the system.

966.74 / 129 = 7.5 hours per case.

The total amount of FOIs recorded as received in the 2023 calendar year by all Departments, Offices and Board was 1075.

Using the above estimation, 7.5 x 1075 = 8062.5 officer hours in 2023.

10

DSAR and FOI Statistics

FTE Resource

Total FOIs Received Avg. Hours to Respond 1075 7.5 Hours in a Working Day Working Days 2023 (inc. minimum A/L) 7.4 228 Officer Hours Available (per year) Hours to Respond to all FOIs 7.4 x 228 = 1687.2 7.5 x 1075 = 8026.5 FTE Required 8026.5 / 1687.2 = 4.8

11

DSAR and FOI Statistics Conclusion

The number of FTE required to respond to a Freedom of Information (FoI) or Data Subject Access Request (DSAR) based on the calculations in this report, will, we expect, surprise those who deal with this on a daily basis.

We recognise that we have made some assumptions when calculating the effort required that could be challenged. However, our calculations show the average effort required across all Government Departments, Boards and Offices. The figures in the report highlight that the volume of requests are not equally distributed, those areas that receive the majority of the requests may feel that they devote more officer time than these figures would indicate.

What is OCSIA doing to support responses to FOI and DSAR requests?

Provide a central point of advice and guidance on compliance with FOI and Data Protection legislation.

Practical examples of this is in practice include the following:

Training provided for FOI co-ordinators and their colleagues in how to use the iCasework system and a separate course in how to apply exemptions. Currently working on a refresh of the eLearn Vannin FOI training course. Tailored training courses on how to respond to a DSAR have been delivered and all these training courses are available via OCSIA.

Promotion of best practice guidance in how to conduct searches for both FOI and DSAR’s, including how to store the results and tools for applying redactions.

Creation of Data Protection policy and associated standards for use across Government.

Individual support for Government on queries related to Freedom of Information and Data Protection compliance. This can range from an interpretation of relevant legislation, practical applications, such as support and training in completing Data Protection Impact Assessments or Data Processing Agreements.

Government Office Douglas Isle of Man IM1 3PN Telephone: (+44) 01624 686244
Website: www.gov.im/co

Our ref: 4548591 29 April 2025

Dear ###

We write further to your request, received 1 April 2025, which states:

"The evidence I require is - *1. A copy of or copies of the meeting(s) of 'The Isle of Man Government' at which it

[Response truncated — full text is 26,308 characters]