Common use of INFORMATION MANAGEMENT AND CONFIDENTIALITY Clause in Contracts

INFORMATION MANAGEMENT AND CONFIDENTIALITY. 17.1 Each Chief Constable and Local Policing Body will be responsible for ensuring compliance with the Data Protection Act 1998 (DPA) with regard to the processing of data. This includes the provision and sharing of data for use for the Agreement and for data which is created through the Agreement. 17.2 For the purposes of the DPA and until such time where an agreement may be reached in respect of a joint Data Controller (if applicable) each Chief Constable remains the Data Controller for any personal data recorded on the information systems (electronic and paper) under his/her control, i.e. within the relevant Force's electronic network or in structured and unstructured filing systems operated and stored on the relevant Force's premises. 17.3 Data created by the Agreement will be shared equally by the Parties where this is required and necessary and subject to any limitations imposed by the DPA. This data will be retained in accordance with each Party's data management policies, which have been assessed to ensure broad compatibility and which will show due regard to the principles of The Management of Police Information (‘MOPI'). 17.4 The activities of an officer serving within a particular Force or a staff member employed by a particular Local Policing Body and under the direction and control of the relevant Chief Constable in respect of access to and use of any data controlled by any Party will be governed by the policies of the employing Force or Local Policing Body, which will be assessed to ensure broad compatibility as soon as this is practically possible. 17.5 In respect of all issues relating to data management, the relevant head of service will be consulted and the Parties will procure that the head of service will provide direction on operational issues on behalf of the Parties. 17.6 The Parties each undertake to the other Parties that they shall not, save in the proper performance of their respective obligations under this Agreement or in accordance with their legal obligations, without the prior consent of the other disclose to any person any confidential information. This Section 17.6 shall not apply to any information which is in or enters into the public domain otherwise in breach of any undertaking of confidentiality or which any Party is obliged to disclose for the purpose of discharging police or Local Policing Body functions or pursuant to any legal obligation. 17.7 The Parties undertake to make the relevant head of service aware of the confidentiality of the confidential information belonging to the other Parties and the provisions of the Agreements. 17.8 The Parties shall comply with any operating protocols as may be agreed between the Parties in respect of sharing of data and will work towards developing Data Security and Sharing Protocol as soon as this is practically possible. 17.9 The Parties shall agree with the statement of compliance below regarding the specific use of West Midlands Police (WMP) systems through the WMP Secure Citrix portal: The application of this Agreement will be covered under the periodic review of Firearms and Explosives Licensing. The reason for access to the WMP systems is outlined in section 3.2. WMP systems within 17.9 i, ii and iii refer to FLINTS, OASIS, CYCLOPS, Property and the WMP portal of the National Firearms Licensing Management System. The Chief Constable of Staffordshire Police and the Local Policing Body for Staffordshire accepts: i. the requirements and statements as defined by WMP’s Code of Connection and will adhere to these standards at all times, and maintain appropriate documented evidence of compliance which will be made available to the Chief Constable of West Midlands Police and/or the Local Policing Body for West Midlands upon request. ii. responsibility for the security of all aspects and elements which comprise of WMP’s local implementation of systems accessed by Staffordshire Police through the WMP Secure Citrix Portal. Staffordshire Police will certify that appropriate, accredited capabilities exist to support the usage WMP systems up to and including Impact Level 3 for Confidentiality and Integrity. iii. Staffordshire Police’s connection to the WMP systems may be subject to disconnection by WMP if WMP are not satisfied that Staffordshire Police is adhering to this Code of Connection.

INFORMATION MANAGEMENT AND CONFIDENTIALITY. 17.1 20.1 Each Chief Constable and Local Policing Body will be responsible for ensuring compliance with the Data Protection Act 1998 (DPA) DPA with regard to the processing of data. This includes the provision and sharing of data for use for the Agreement and for data which is created through the Agreement. 17.2 20.2 For the purposes of the DPA and until such time where an agreement may be reached in respect of a joint Data Controller (if applicable) each Chief Constable remains the Data Controller for any personal data recorded on the information systems (electronic and paper) under his/her control, i.e. within the relevant Force's electronic network or in structured and unstructured filing systems operated and stored on the relevant Force's premises. 17.3 20.3 Data created by the Agreement will be shared equally by the Parties where this is required and necessary and subject to any limitations imposed by the DPA. This data Data will be retained in accordance with each Party's data management policies, which have been assessed to ensure broad compatibility and which will show due regard to the principles of The Management of Police Information (‘MOPI'). 17.4 20.4 The activities of an officer serving within a particular Force or a staff member employed by a particular Local Policing Body and under the direction and control of the relevant Chief Constable in respect of access to and use of any data controlled by any Party will be governed by the policies of the employing Force or Local Policing Body, which will be assessed to ensure broad compatibility as soon as this is practically possible. 17.5 20.5 In respect of all issues relating to data management, the relevant head of service will be consulted and the Parties will procure that the head of service will provide direction on operational issues on behalf of the Parties. 17.6 20.6 The Parties each undertake to the other Parties that they shall not, save in the proper performance of their respective obligations under this Agreement or in accordance with their legal obligations, without the prior consent of the other disclose to any person any confidential information. This Section 17.6 20.6 shall not apply to any information which is in or enters into the public domain otherwise in breach of any undertaking of confidentiality or which any Party is obliged to disclose for the purpose of discharging police or Local Policing Body functions or pursuant to any legal obligation. 17.7 20.7 The Parties undertake to make the relevant head of service aware of the confidentiality of the confidential information belonging to the other Parties and the provisions of the Agreements. 17.8 20.8 The Parties shall comply with any operating protocols as may be agreed between the Parties in respect of sharing of data and will work towards developing a Data Security security and Sharing Protocol sharing protocol as soon as this is practically possible. 17.9 20.9 The Parties shall: 20.9.1 not delete or remove any proprietary notices or other notices contained within or relating to another party’s Data; 20.9.2 not alter, store, copy, disclose or use another party’s Data, except as necessary for the operation of the Collaborative Unit in accordance with this Agreement or as otherwise permitted by law; 20.9.3 use their best endeavours to preserve the integrity or the other parties’ Data and prevent any loss, disclosure, theft, manipulation or interception of other parties’ Data; and 20.9.4 immediately notify the relevant party if any of that party’s Data is lost, becomes corrupted, is damaged or is deleted accidentally. 20.10 The parties will agree the terms of an information management and data handling protocol with which all parties shall agree comply. 20.11 The protocol referred to in 20.10 and any subsequent protocols relating to information management and confidentiality shall be based on the assumption that each Force has provided suitable training in the DPA for new employees and that they will be vetted in accordance with the statement of compliance below regarding the specific use of West Midlands Police (WMP) systems through the WMP Secure Citrix portal: The application of this Agreement will be covered under the periodic review of Firearms and Explosives Licensing. The reason for access to the WMP systems is outlined in section 3.2. WMP systems within 17.9 i, ii and iii refer to FLINTS, OASIS, CYCLOPS, Property and the WMP portal of the National Firearms Licensing Management System. The Chief Constable of Staffordshire Police and the Local Policing Body for Staffordshire accepts: i. the requirements and statements as defined by WMP’s Code of Connection and will adhere to these standards at all times, and maintain appropriate documented evidence of compliance which will be made available to the Chief Constable of West Midlands Police and/or the Local Policing Body for West Midlands upon requestNPCC vetting guidelines. ii. responsibility for the security of all aspects and elements which comprise of WMP’s local implementation of systems accessed by Staffordshire Police through the WMP Secure Citrix Portal. Staffordshire Police will certify that appropriate, accredited capabilities exist to support the usage WMP systems up to and including Impact Level 3 for Confidentiality and Integrity. iii. Staffordshire Police’s connection to the WMP systems may be subject to disconnection by WMP if WMP are not satisfied that Staffordshire Police is adhering to this Code of Connection.