Information management - Information management and assurance policy (W01)

1.  Summary of Changes

1.1. This policy has been reviewed on 18 August 2023 - reference to Code of Practice on the Management of Police Information (MoPI) amended to Police Information and Records Management Code of Practice within paragraph 2.4.

 

2. What this Policy is About

2.1 Policing is increasingly dependent upon high quality information processes which are secure.  In order that our staff, partners and the public can have confidence in the integrity and availability of policing information and its secure storage, processing and disposal, robust Information Management procedures must be in place.  Without such there is a significant and foreseeable risk of compromise potentially leading to the facilitation of crime, public safety issues, hindrance to investigations, financial loss, and reputational damage and consequently a loss in public and partner confidence.

2.2 Essex Police and Kent Police recognise that Information Security and Data Protection functions have become increasingly important over recent years in terms of information compliance and risk management, driven by the substantial growth around information held, system developments and multi-agency working.

2.3 This policy supports the Information Assurance Strategies of both forces and is underpinned by more detailed supporting procedures.  The objective being to identify vulnerabilities and subsequent risk and ensure security arrangements remain effective with identified risks managed effectively, collectively and proportionately.  It underpins all areas of policing in support of the strategic policing requirement and our other statutory responsibilities.

2.4 The policy also affirms the commitment of both forces to comply with relevant legal requirements, national guidance and standards, existing and forthcoming, relating to:

• Police Information and Records Management Code of Practice and the Authorised Professional Practice (APP) for Information Management;
• Data Protection Act 2018 (DPA 2018) and the UK General Data Protection Regulation (UK GDPR);
• Criminal Proceedings and Investigations Act 1996
• Human Rights Act 1998;
• Freedom of Information Act 2000;
• Official Secrets Acts 1989;
• Computer Misuse Act 1990;
• National Institute of Standards and Technology (Cyber Security Framework);
• ISO27001 Security Standards;
• ICO codes of practice and guidance - Information Commissioner's Office (ICO).

2.5 Police officers, police staff, Special Constabulary officers, PCSOs, contractors, volunteers and members of other agencies and partnerships working with Essex Police and Kent Police and having access to police information must comply with this policy and supporting procedures.

Compliance with this policy and any linked procedures is mandatory.

3. Statement of Policy

3.1 Both Essex Police and Kent Police utilise innovative and agile technology to access, share, retain and process data via increasingly transparent means whilst maintaining and developing trust and confidence with the public, partnerships, stakeholders and employees.

3.2 In accordance with the ‘National Decision Model’ we will use discretion, professional judgement and common sense to guide us and will be accountable for our decisions and actions.  In identifying and managing risk we will seek to achieve successful outcomes and to reduce the risk of harm to individuals and communities.

3.3 Our Information Security procedures will seek to utilise:

Physical controls – creating physically limits to prevent access to IT systems, i.e. fences, guards, dogs, and CCTV system, etc.

Technical controls – effective use of hardware or software to protect systems and resources, i.e. disk encryption, fingerprint readers and Windows Active Directory.

Administrative controls - policies and procedures which ensure proper guidance is available for security and regulatory compliance, i.e.  data handling procedures and security requirements.

3.4 This Information Management Policy and detailed procedures will enable Essex Police and Kent Police to:

• Apply effective, efficient and legally compliant procedures for the creation, use, maintenance, retention and disposal of all information assets;
• Provide an audit trail of activities to demonstrate compliance and accountability;
• Manage information in such a way as to ensure that, subject to appropriate security consideration, information is readily available to those that need to use and share it;
• Achieve the earliest possible disposal of information commensurate with the business need and statutory retention requirements.

3.5      Governance

3.5.1 The governance structure in relation to information management includes forces, national systems, national policing, government departments and delivery partners.

3.5.2 The Chief Constable in each force is the Data Controller, as defined in the Data Protection Act 2018.  A specific Data Controller from each force takes primacy in relation to particular collaborative activity.  Each controller will implement appropriate technical and organisational measures to ensure, and to be able to demonstrate, that information assets are secure and the processing of personal data complies with the requirements of the Data Protection Act.

3.5.3 The National Senior Information Risk Owner (NSIRO) is responsible for information risk associated with the national capability.

3.5.4 A Senior Information Risk Owner (SIRO) at Chief Officer level will be maintained in each force.  Each individual SIRO has responsibility for information governance and risk ownership, including shared risks with other organisations, partnerships and third party suppliers on behalf of their Chief Constable.

3.5.5 The SIRO in each force is supported by Information Asset Owners (IAOs) at a senior level across all aspects of the policing business.  IAOs are in turn supported by Information Asset Assistants (IAA) and where necessary Information Asset Co-ordinators (IACs).

3.5.6 The Force Information Asset Owners (typically Divisional Commanders and Departmental Heads) will understand what information they hold, what is added and what is removed, how information is moved, and who has access and why.  As a result they are able to understand and address risks to the information, and ensure that information is fully used within the law for the public good.

3.5.7 Equally a Data Protection Officer (DPO) is maintained by each individual force (in Kent Police the strategic responsibilities of the role are held by the Head of Information Security and Governance).  The DPO acts as the intermediary for all relevant stakeholders, identifying and mitigating risks, acting as an enabler to achieve business objectives whilst safeguarding information assets.

3.5.8 The arrangements in relation to Data Controller primacy for collaborative functions are mirrored in respect of SIRO and DPO in order to provide clear accountability.  The SIRO will ensure that their force maintains an appropriately resourced, qualified and experienced Information Security Team which in turn can provide ‘expert’ advice to both the SIRO and IAOs in furtherance of their duties.

3.5.9 The Information Management (& Assurance) Boards for Essex and Kent provide the forums for the discussion and management of Information Management and Assurance issues, and ensures that the level of risk (likelihood and potential impact) is appropriately managed, and any identified concerns are escalated as necessary.

3.5.10 The Government Security Classification Scheme is used in both forces to protect information assets according to their operational or personal sensitivities.

4.0      Implications of the Policy

4.1      Finance / Staffing / Training / Other

4.1.1 All staff are required to complete the College of Policing’s Managed Learning Environment training package in relation to Data Protection, supplemented by the, Information Security and protective marking training packages.  Information Management practitioners will also complete the Data Protection modules (Foundation, Intermediate and Advanced) once available.

4.1.2 Strategic or managerial risks in relation to Information Security will be recorded within the relevant corporate risk register for either force.  Advice and guidance relating to the assessment of risk is contained within the individual procedures.

4.2      Risk Assessment(s)

4.2.1 Advice and guidance relating to the assessment of risk is contained within the individual procedures.  The Corporate Risk Register will contain any risks in relation to Information Security

4.3      Equality Impact Assessment

4.3.1 This policy has been assessed with regard to an Equality Impact Assessment.  As a result of this assessment it has been graded as having a low potential impact as the proposals in this policy would have no potential or actual differential impact on grounds of age, sex, disability, race, religion or belief, marriage and civil partnership, sexual orientation, gender reassignment and pregnancy and maternity.

5.0      Consultation

• The Information Management (& Assurance) Boards for Essex and Kent;
• Business Services
• Unison / Federation
• Diversity / Health & Safety

6.0      Monitoring and Review

6.1 The Information Security Officer will be responsible for ensuring that the policy will remain current in line with HMG and ACPO policy.

6.2 This policy will be reviewed by or on behalf of the forces’ SIROs every 2 years.

7.0      Related force policies or related procedures (Essex) / linked standard operating procedures (Kent)

• W 1001 Procedure/SOP – ICT Acceptable Use
• W 1002 Procedure/SOP – User Account Management
• W 1004 Procedure/SOP – Incident Reporting and Management
• W 1005 Procedure/SOP – Information Asset Owners
• W 1006 Procedure/SOP – Government Security Classification Scheme (GSC)
• W 1007 Procedure/SOP – Assurance of Information Assets
• W 1008 Procedure/SOP – Physical Security
• W 1009 Procedure/SOP – Protective Monitoring
• W 1010 Procedure/SOP – Records Management (Physical and Digital)
• W 1011 Procedure/SOP – Data Protection
• W 1012 Procedure/SOP – Records Review, Retention and Disposal
• W 1014 Procedure/SOP – Information Sharing Agreements
• W 1015 Procedure/SOP – Redaction
• W 1016 Procedure/SOP – Encryption of Files and Removable Digital Media
• W 1017 Procedure/SOP – Sanitisation, Re-Use and Disposal
• W 1019 Procedure/SOP – Freedom of Information
• W 1020 Procedure/SOP – Use of Bluetooth
• W 1021 Procedure/SOP – Shared and Standalone Devices
• W 1022 Procedure/SOP – Data Protection Impact Assessments

7.1      Data Security

7.1 Essex Police have measures in place to protect the security of data in accordance with our Information Management Policy – W 1000 Policy – Information Management.

7.2      Retention & Disposal of Records

7.2.1 Essex Police will hold data in accordance with our Records Review, Retention & Disposal Policy – W 1012 Procedure/SOP - Records Review, Retention and Disposal.

7.2.2 We will only hold data for as long as necessary for the purposes for which we collected

8.0     Other source documents, e.g., Legislation, APP, partnership agreements (if applicable)

None