DPIA for Cloud based Control Room Services
Freedom of information request reference no: 01.FOI.23.028500
I note you seek access to the following information:
I note that MPS have procured and now presumably deployed a Cloud Based control room capability.
1 - A copy of the Data Protection Impact Assessment(s) conducted under the terms of the Data Protection Act 2018 Part 3, for the cloud based control room solution, including details of the processors and any sub-processors.
Please note:
A DPIA should not in general contain any specific information of security measures requiring redaction before release, but I am aware that some Policing organisations do include this information in their DPIA products.
Reasonable redaction of such information strictly and only to the extent necessary to maintain the security of Police operations (if this is included in the DPIA) is acceptable.
General redaction of core information relating to relevant DPIA content required to evidence achievement against statutory obligations would however be unacceptable and should be unnecessary since its release is obviously and materially in the public interest and is the core function of a DPIA.
2 - A copy of the specific terms of service applied within the contracts for the above services between any product vendors, processors or sub-processors and the MPS.
Please note:
The Terms of Service applied do not need to include any financial information - I am not seeking that or any other commercially sensitive information at this time.
3 - Copies of any communications between the Constabulary and the ICO, with other Forces or national policing bodies and/or other professional advisors, which informed the creation of the DPIA's above, and/or supported decisions around the procurement and subsequent use of these products.
This should specifically include details of funding or approval submissions to MOPAC and any supporting materials for their approval for the procurement that are not already in the public domain.
Decision
I have today decided to disclose the located information to you in full.
Please find below information pursuant to your request above.
Q1 - A copy of the Data Protection Impact Assessment(s) conducted under the terms of the Data Protection Act 2018 Part 3, for the cloud based control room solution, including details of the processors and any sub-processors.
No information held as the project has yet to complete its implementation phase.
Q2 - A copy of the specific terms of service applied within the contracts for the above services between any product vendors, processors or sub-processors and the MPS.
Please note:
The Terms of Service applied do not need to include any financial information - I am not seeking that or any other commercially sensitive information at this time.
There is not a Data Processing Contract between product vendors, processors or sub-processors and the MPS.
Q3 - Copies of any communications between the Constabulary and the ICO, with other Forces or national policing bodies and/or other professional advisors, which informed the creation of the DPIA's above, and/or supported decisions around the procurement and subsequent use of these products.
This should specifically include details of funding or approval submissions to MOPAC and any supporting materials for their approval for the procurement that are not already in the public domain.
No communication with external Metropolitan Police Service partners informed the creation of the Command and Control system DPIAs, nor informed the procurement of the solution. The Metropolitan Police Service followed a competitive tender process independent of outside influences.