National My Police Portal

Your request details and response

 

Please provide the following recorded information held by South Yorkshire Police in relation to the National My Police Portal (NMPP).

 

1. Data Protection Impact Assessments (DPIAs) Please provide copies of:
   a) Any Data Protection Impact Assessment (DPIA) completed for:
   – the implementation, pilot, or live deployment of NMPP by South Yorkshire Police – any phased rollout, expansion, or change in functionality
   b) Any DPIA screening, threshold, or initial risk assessment documents relating to NMPP.
   c) Any updated, revised, or post-implementation DPIAs, including change-control DPIAs.
   d) Any documentation identifying whether:
   – a national DPIA exists for NMPP, and
   – how South Yorkshire Police relies upon, contributes to, or aligns with any national DPIA.
   If no DPIA is held for any element above, please confirm this explicitly.
2. 
   National and Local Governance Arrangements Please provide documents setting out:
   a) Whether South Yorkshire Police acts as:
   – a sole data controller
   – a joint controller
   – or a participant in a nationally governed system
   b) Any governance frameworks, agreements, or correspondence describing:
   – accountability arrangements between South Yorkshire Police and national policing bodies – approval, assurance, or sign-off processes for NMPP
   c) Any documentation identifying oversight, escalation, or review mechanisms for the system.
   
   3. Records of Processing & Information Asset Management Please provide:
   a) The Record of Processing Activities (ROPA) or equivalent record covering NMPP.
   b) The Information Asset Register entry or entries relating to NMPP.
   c) Any internal documentation describing how NMPP data is categorised, including whether it is treated as:
   – intelligence
   – evidential material
   – correspondence
   – safeguarding data
   – or another classification.
   
   4. Data Flow, Sharing & Downstream Reliance Please provide documents setting out:
   a) Data flow diagrams or descriptions showing:
   – how data enters the portal
   – how it is stored and processed
   – how it is shared internally and externally
   b) Data-sharing agreements, information-sharing protocols, or memoranda of understanding relating to NMPP data, including sharing with:
   – local authorities
   – safeguarding partnerships / MARAC
   – the Crown Prosecution Service
   – courts or other criminal justice bodies
   c) Any guidance, policy, or training material describing how data captured via NMPP may be relied upon in:
   – safeguarding decisions
   – risk assessments
   – criminal investigations
   – civil or family court proceedings.
   
   5. Record Integrity, Retention & Audit Controls Please provide documentation covering:
   a) Retention schedules for:
   – messages
   – attachments or uploads
   – metadata
   – audit logs
   b) Policies or technical documentation addressing:
   – whether portal records are immutable once created – whether messages can be edited or deleted – how edits, deletions, and access events are logged and audited
   c) Any assurance documentation concerning record integrity and evidential reliability.
   
   6. Equality, Safeguarding & Vulnerability Considerations Please provide copies of any:
   a) Equality Impact Assessment (EIA), accessibility assessment, or equivalent analysis conducted in relation to NMPP.
   b) Safeguarding-specific risk assessments addressing:
   – victims of domestic abuse
   – trauma-impacted individuals
   – neurodivergent users
   – digitally excluded users
   c) Documentation explaining:
   – eligibility criteria
   – exclusions
   – or limitations applied to particular categories of victims.
   
   7. Security, Assurance & Incident Management (High-Level) Please provide:
   a) High-level security assurance documentation held, including:
   – accreditation or assurance summaries
   – security risk assessments
   – penetration testing summaries (where held)
   b) Any documentation describing:
   – incident response
   – data breach management
   – escalation routes specific to NMPP.
   (Technical details that would compromise security may be redacted.)
   
   8. Transparency, Publication & Public Accountability Please provide:
   a) Any documentation setting out whether:
   – DPIAs or governance documents relating to NMPP are intended to be published – redacted versions are available or planned
   b) Any internal correspondence or policy relating to transparency obligations for high-risk law-enforcement processing systems.

 

 

 

Response

 

Regarding questions where the attached local and national NMPP DPIAs and NMPP FCB Guide are referred, and Question 3:

 

Section 17 of the Freedom of Information Act 2000 requires South Yorkshire Police (SYP), when refusing to provide such information (because the information is exempt), to provide you the applicant with a notice which:

1. states that fact,
2. specifies the exemption in question and
3. states (if that would not otherwise be apparent) why the exemption applies.

The following exemption(s) apply to the disclosure of the information:

 

Section 40(2) Personal Information

Section 31(1) Law Enforcement

 

Exemption applied - Section 40(2) Personal Information

This is an absolute exemption and therefore a Public Interest Test is not relevant.

 

Reasons for applying exemption 40(2)

Section 40(2) of the Freedom of Information Act exempts information if it constitutes the personal data of any individual and disclosure would breach Data Protection principles. The term 'personal data' refers to information relating to a living individual who can be identified, either directly or indirectly. This can include obvious identifiers such as a name, or information which, when combined with other data, could enable an individual to be identified.

Internal documents, such as DPIAs, do hold names of employees who, under reasonable circumstances, would not expect their personal details to be shared into the public domain. To do so would constitute a breach of the data protection principles and is therefore exempt under Section 40(2).

 

Exemption applied - Section 31(1) Law Enforcement

Section 31(1)(a)(b) Law Enforcement states that information is exempt information if its disclosure under the Act would, or would likely to prejudice:

1. a) The prevention or detection of crime;
2. b) The apprehension or prosecution of offenders.

 

Reasons for applying exemption 31(1)

This exemption is a qualified and prejudice-based exemption and therefore the legislators accept that there may be harm if released. The authority must consider and describe the harm that would occur if a full disclosure of information were released.

 

Harm

When a disclosure is made under the Freedom of Information Act, it is a disclosure to the world via a force’s publication scheme and not to a single individual. In view of this, we may publish all information released under the Freedom of Information Act on our website in order that any member of the public who may wish to view the information can have access to it.

 

Modern policing is technology led. The police service is charged with enforcing the law and does so by evolving its’ tactics and methodology in detecting and preventing crime and apprehending and prosecuting offenders. As criminals use technology to develop digital- and web-based crimes, so, too, do the police service enhance their own technology systems and cyber securities.

 

Internal processes used via in-house systems, including nationally designed systems, would likely hold valuable insight for organised Crime Gangs (OCGs) and those with criminal intent, allowing those with sophisticated understanding of technology to breach security defences. This would potentially release personal data into the public domain or cause the deletion of important personal data and intelligence gathered.

 

 

Public Interest Test for Section 31(1)

Factors favouring disclosure

• Full disclosure demonstrates openness and transparency between the police service and the public • It would allow the public to discuss the NMPP in real time • The public would better understand how budget, time and resource allocation is managed when a new system/process is introduced

Factors favouring non-disclosure

• Full disclosure of internal methodology detailing data storage and processing would likely provide OCGs and those with criminal intent with a means to bypass security defences and access personal data and intelligence • Release of such detail would likely endanger held information, either by leaks into the public, editing, or deletion. This would negatively impact South Yorkshire Police’s ability to prevent crime and prosecute offenders

Balancing Test

I have carefully considered your request for information. The key test when considering the public interest is to establish whether in all the circumstances of the request, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

 

South Yorkshire Police is committed to improving our efforts to detect and prevent crime, and apprehend and prosecute offenders. Where full disclosure would inhibit our ability to do so, likely increasing risk of data breach, edit, and/or deletion with the public’s personal data, we will always opt to protect individuals’ and communities by withholding this information.

 

While the NMPP has been publicly announced and is live for use by victims in the South Yorkshire jurisdiction, there is still inherent harm in fully disclosing a complete detail of the system’s inner workings in combination with SYP systems. Our security is paramount; we would not release information which provides increased threat to in-house and/or third-party systems, where appropriate, which would likely put the public (and their personal data) at risk.

 

Therefore, I am of the opinion that full disclosure is not appropriate at this time, and the public interest test is upheld by exemption under Section 31(1)(a)(b).

 

With this in mind, I am prepared to disclose the following details without triggering any of the above exemptions:

I have approached our Data Protection team, Force Control management, Audit team, Data Security, and the Information Asset Owner and Assistant with your request. Please see the responses as follows:

 

Question 1

1. Please see the local SYP DPIA attached - SYP DPIA
2. We believe this is covered by the DPIAs attached
3. None held at this time
4. Please see the national DPIA attached, which stipulates this can be used in a local DPIA’s stead, based on local assessment. Our local DPIA states we align to this - National NMPP DPIA

 

Question 2

1. Yes, we are the sole data controller for SYP data, as indicated in the DPIA attached
2. No Information Held
3. No Information Held

 

Question 3

1. South Yorkshire Police’s Record of Processing Activities has not yet been updated to include NMPP following completion of the DPIA.
2. Subject to exemption – Section 31(1)(a)(b). However, I can disclose:

 

    Information Asset Owner:       Chief Superintendent Cherie Buttle

    Information Asset assistant:   Superintendent Richard Hammond

 

1. None of the above.

 

    The NMPP is an intermediary system which provides 2-way chat function between a victim of crime and the Office in Charge (OIC) of their case. Any information given by a victim is stored in Connect (soon to become NICHE) - our case management system for investigations. Data will largely be generic – updates on a case, etc – though, if a user does provide disclosure via the portal, this will be stored in the case management system and handled appropriately under the Data Protection Act 2018 and that system’s user guidance.

 

Question 4

1. Please see the NMPP FCB Guide and DPIA attached. Note that data is not stored or processed within the Portal, this is done in the case management system it links to - NMPP SYP FCB Guide

    The national DPIA also refers in detail. 

1. No Information Held. As Q3c, data is not held, processed, or shared from the Portal directly, this is done from the case management system it links to.
2. No Information Held. As above.

 

Question 5

1. Data is not held within the Portal itself, but in the case management system it links to. Retention schedules for messages, metadata and audit logs will be in line with the case management system.

    The portal does not allow for attachments or uploads.

1. Messages feed into the case management system via the Portal and cannot be edited/deleted by the user. An officer can edit messages within the Connect, but any inputs and edits are timestamped by the system. Case management actions are audited appropriately.
2. No information held for the Portal as explained above.

 

Question 6

1. No Information Held. The National DPIA for the NMPP refers to this on Page 21 - Do they include children or other vulnerable groups?
2. No Information Held.

 

    Domestic abuse cases are not dealt with via the NMPP.

 

The NMPP does not replace other methods of communication with the force, rather, it enhances the options available to the victim. Victims have the choice to use the Portal to review their crime, status, contact the OIC, etc. Individuals with additional needs or preferences may still contact the force via 101, or 999 in an emergency, state a home visit is needed/preferred, or visit their local police station. This is supplement to the contact expected from OICs.

1. Limitations of the portal, and Pros and Cons for the public user, can be found in the attached DPIA, though these are not necessarily specific to any category of individual.

 

Question 7

1. A Security Requirements Questionnaire was completed as part of the DPIA process. The document is exempt under Section 31(1)(a)(b) as above.
2. No Information Held. As any data breach and associated escalation would be handled from the case management system, there is no documentation specific to the NMPP.

 

Question 8

1. No formal publication had been planned; however, this disclosure will be published on our website and as a response on What Do They Know (WDTK).
2. No Information Held. The portal, itself, is not a law enforcement system, but does carry security risks to law enforcement as it links to the case management system, explained in the above exemption Section 31(1)(a)(b).

 

 

Note: the national NMPP DPIA is held on the basis of local assessment. Referenced material would not be held by a local force. Any further questions on the Portal, which do not concern local forces, should be directed to the Host Force – the Metropolitan Police Service.