“Request and Response 1) the FULL correspondence, if any, held by the CPS concerning the deletion of [CPS lawyer’s] e- mail account. Correspondence from the 1st of January 2014 to the31st December 2014 . The Crown Prosecution Service (CPS) can confirm there is no correspondence between 1st of January 2014 to the31st December 2014 concerning the deletion of [CPS lawyer’s] email account. 2) a reply to the questions below, considering that FOIA requests can be made in the form of a question: QUESTIONS: Is it network operation policy to delete, and not disable, user accounts upon users ending their term of employment? Prior to 2015, details of staff leaving the CPS would be notified to our IT providers who would disable the relevant network account. This would remove the user’s name from the Global Address Book and prevent the user from being able to log on to the CPS network. After three months the data associated with the account would normally be deleted, unless the IT providers were notified to the contrary. Since 2015 there has been a general moratorium on destruction of Government data, owing to the Independent Inquiry into Child Sexual Abuse (IICSA). Accordingly, our current process is that accounts are suspended but not deleted. Was [CPS lawyer’s] user account deleted or disabled following his retirement? [CPS lawyer’s] account would have been deleted in accordance with the 2014 working practice set out above. Can you confirm whether it was [CPS lawyer’s] network user account (e.g. Microsoft Active Directory User Account), email account (e.g. Microsoft Exchange Email Account) or both, that was deleted (or disabled) following his retirement? The CPS can confirm both network user accounts and email would have been deleted. Do you have any event logs (such as Microsoft Windows Event Logs and relevant Event IDs) that show the date and time of [CPS lawyer’s] account deletion or disabling? If so please provide them. The CPS does not hold any event logs showing these details. What is the retention period for event logs on the network? The CPS retention period for event logs held on the CPS network is for 6 months. In line with Identity Access Management (IAM) best practice, is there any change control documented (perhaps by a network administrator) pertaining to the rationale for deleting or disabling [CPS lawyer’s] account? If so please provide that. There is no existing documentation in relation to the above. Is there a network operation policy of archiving user account data and emails prior to user deletion or disabling? The agreed practice in 2014 was for accounts to be suspended upon the departure of a member of staff and then permanently deleted three months after that date. As detailed above, this practice has changed for the time being owing to IICSA. Is the network configured to retain user mailboxes following deletion, until a retention period expires, or was [CPS lawyer’s] mailbox forcibly deleted upon his retirement? [CPS lawyer’s] mailbox was deleted in accordance with the policy in operation at the relevant time. The current policy of retaining data exists to meet the CPS’ obligations under IICSA as explained above.”
"The lawyer concerned retired from the CPS in 2014. Deleting the lawyer's email account after retirement was in line with CPS general practice. As you know, issues concerning this matter were considered at the First Tier Tribunal in 2017 (in the case of Maurizi v IC & Crown Prosecution Service) and the tribunal referred to this in the decision issued in December 2017. For example at para 41 of that decision the judge said: "
“On the deleted e-mails, I am NOT content with the CPS just quoting the Tribunal decision. I am requesting all information held by the CPS relevant to when, how and why the e-mails were deleted. None of this information was before the Tribunal. None of it was ever provided to me and to my lawyers to whom I am copying this request for an internal review by the CPS.”
“In its original and review decisions, the CPS has made reference to its general policy of deleting employees’ email accounts after they retire, but it has not confirmed whether it holds any information as to whether that was the reason for the deletion of [named lawyer’s] account specifically, or as to when or how [named lawyer’s] account was deleted. Contrary to what is implied by the CPS, those questions were not answered in the course of the proceedings relating to the 2015 Request.”
“25. Your letter states that “the CPS have assured the Commissioner, and she accepts, that the deletion of [named lawyer’s] email account was carried out in accordance with the relevant records management policy at the time.”
“77. CPS said that a named former CPS officer, whose email account was of interest to the complainant, had retired from CPS, and his email account had been deleted in line with CPS general practice of the day. At the time of his retirement in 2014, his relevant network account had been disabled to prevent its use on the CPS network. After three months, the data associated with the officer’s email account had been deleted. 78. CPS added that deletion of the officer’s email account had been carried out in accordance with the then CPS records management policy. This had been in line with CPS general practice and was undertaken before the complainant's 2015 first FOIA request had been received. CPS said that CPS had previously disclosed such relevant information as it held in relation to the deletion of the officer’s email account. 79. The Commissioner accepted the CPS evidence and decided he therefore had no concerns in respect of the deletion of the officer’s email account.”
“175. In our conclusion, the CPS were required to, but did not, inform the appellant in the 2020 Refusal whether or not it holds the information requested in the final part of the 2019 Request. To this extent we find that the 2020 Refusal is not in accordance with section 1(1)(a) of Part I of FOIA. 176. The CPS could, for example, have said that it does not hold any such information, or stated that it holds such information but that this has already been disclosed, or stated that it holds such information but that it is exempt pursuant to a provision in Part II of FOIA. The 2020 Refusal takes none of these approaches in relation to the final part of the 2019 Request. … 178. The ICO’s 2022 Decision lacks clarity in its consideration of the final part of the 2019 Request. The respective paragraphs of the 2022 Decision do not address the CPS’s consideration of this issue but rather, on our reading, reach an independent conclusion not communicated to the appellant in the 2020 Refusal, that the CPS had “previously disclosed such relevant information as it held in relation to the deletion of the officer’s email account” i.e. that it held no information in this regard that had not already been disclosed.”
“182. Moving on, in his oral evidence Mr Sheehan indicated that “very detailed enquiries” had been made by the CPS, and that he “understood from those who made the enquiries” that there is a document “which is described as desk instructions in relation to the deletion of material within 30 days” which was “the practice at the time”
“... The information below contains vital information for Managers, which details the changes that have taken place and the implications of the new process and information for managers on how to safeguard data stored on an individuals personal account should it be required by the business following their departure Following the submission a PU4 Leavers form by a line manager/Area, Pay & Benefits will still continue to input the details of the leaver on i-Trent which triggers an email to the line manager along with a checklist of things the line manager needs complete. In addition to this BIS have now negotiated and implemented a separate automated process whereby the CPS ICT Service Desk will now automatically receive details of the leaver, their line manager and the scheduled leaving date of the member of staff. Upon receipt of this notification, the CPS ICT Service Desk will also contact the manager and named leaver via email, to inform them arrangements will be made to disable the individuals ICT account on the specified leaving date. Both the manager and user will be advised that if any of the information is incorrect, especially if there is a change to the leaving date that they must notify the Service Desk immediately, as 30 days after the date of disablement, the users account and email data will be automatically deleted and no longer accessible. It is vitally important that managers are aware that if any of the individuals data needs to be retained for business purposes, that they ensure it is moved to an alternative location such as network drive prior to the date when the account data will be finally deleted and irrecoverable. Further assistance is available from the Service Desk on 0800 692 6996 option 1 (or short dial 7997) who should be contacted at the earliest opportunity to be advised of the options available.”
“The Leavers Process Document was the general working practice in existence for disabling and deleting the personal email accounts of CPS staff after they had left the service. It was introduced in 2012 and was applicable when the lawyer concerned left the service of the CPS in 2014. That document explains what the process was for the deletion of a leaver’s personal email account, namely that the leaver’s ICT account would be disabled on the day of their departure and, 30 days after the date of disablement, the users account and email data would be automatically deleted and no long accessible (page 2, paragraphs 6 and 7). The process would have been carried out by the IT providers for the CPS at the time. The CPS’ Leavers Process Document announced in 2012 is distinct from the policy for deleting cases from the CPS’ case management system (CMS). The Records Management Manual (RMM) from the time concerned, a copy of which was provided to you in 2017, mentions that “Information providing evidence of the functions, policies procedures, decisions, actions and other key activities in HQ and the Areas is recorded.”
“In other words, the CPS has confirmed that it does not hold information from the relevant email account and has provided all of the documentation to the Appellant confirming the process in operation at the relevant time.”
“I have taken the following actions: I have asked a range of people in my team to check if they had anything that confirms that in 2014 deletions of email accounts occurred after 3 months. My research has shown that the documented timeframe was 30 days, i.e. deletions occurred after 30 days. I can only assume [name redacted] stated 3 months to cover off an exceptional circumstances? I can confirm that since 2017 no emails accounts have been deleted; where someone has left, their account is suspended, the licence has been retrieved and we have left the data in situ due to the moratorium requirements.”
“28. When, as in this case, the Commissioner receives a complaint that a public authority has not disclosed some or all of the information that a complainant believes it holds, it is seldom possible to prove with absolute certainty that it holds no relevant information. However, as set out in the paragraphs, above, the Commissioner is required to make a finding on the balance of probabilities. 29. When dealing with a complaint to him under FOIA, it is not the Commissioner’s role to make a ruling on how a public authority deploys its resources, on how it chooses to hold its information, or the decisions it makes to hold some, but not other, information. Rather, in a case such as this, the Commissioner’s role is simply to decide whether or not, on the balance of probabilities, the public authority holds the requested information. 30. The Commissioner considers that the CPS contacted the relevant party to consider whether or not any further information was held in respect of the request. He is also satisfied that the source of the ‘three month’ comment was not available for further consultation. 31. While appreciating the complainant’s frustration that the CPS does not hold information to explain why it changed its position regarding the length of time email accounts were retained, the Commissioner is mindful of the comments made by the Information Tribunal in the case of Johnson / MoJ (EA2006/0085)2 which explained that FOIA: “… does not extend to what information the public authority should be collecting nor how they should be using the technical tools at their disposal, but rather it is concerned with the disclosure of the information they do hold”. 32. Based on the information provided, the Commissioner is satisfied that, on the balance of probabilities, no further recorded information within the scope of the request is held. He is therefore satisfied that the CPS has complied with the requirements of section 1 of FOIA in this case.” “… does not extend to what information the public authority should be collecting nor how they should be using the technical tools at their disposal, but rather it is concerned with the disclosure of the information they do hold”
“23. ... First, the Digital and Information Directorate Manager whose email is cited at DN §26 refers to “research” that the individual undertook in 2023. Information pertaining to that research must be held and would fall within the request. 24. Second, the CPS’s witness in EA/2022/0088, Mr Sheehan, stated to the Tribunal that “very detailed inquiries” has been made by the CPS – again, information pertaining to those very detailed inquiries must be held and would fall within the request.” 25. Third, the CPS has on at least three occasions discovered that it held further information, despite previously after having stated that it had conducted thorough searches: in October 2017 (when two potentially relevant further physical files were found and additional emails); in December 2022 (when over 150 further pages were identified) and in response to the order of the Tribunal in EA/2022/0088. This last discovery, in particular of the Leavers Process Document, which is described as the standard operating procedure for deletion of accounts when a CPS employee retired, is notable. The Appellant had been requesting disclosure of this policy since 2017. It was only disclosed in June 2023, without explanation as to why it was never previously identified or disclosed. 26. Accordingly, the Tribunal is asked to consider afresh whether information is held by the CPS falling within the terms of the request, and, if necessary, to hear oral evidence on the question. If the Tribunal determines that the CPS should conduct further searches, the Tribunal is asked to require the CPS to disclose the information.”
“Nowhere within the12 December 2019 request is there a request for the relevant metadata, nor can it be said to be within the scope of the request when considered objectively. Unless specified it is not reasonable, objective or proportionate to interpret a request to include a requirement for a public authority to provide metadata, and a public authority is not obliged to provide such data under s.11 FOIA unless it is specifically requested when making the request.”
“Weneed to know what written policy/guidance existed in 2014 in relation to deleting the email accounts of leavers. We know that the general working practice in 2014 was as follows and this has been quoted in official replies to the Appellant in an earlier/separate FOI response provided in 2018. Prior to 2015, details of staff leaving the CPS would be notified to our IT providers who would disable the relevant network account. This would remove the user’s name from the Global Address Book and prevent the user from being able to log on to the CPS network. After three months the data associated with the account would normally be deleted, unless the IT providers were notified to the contrary. Since 2015 there has been a general moratorium on destruction of Government data, owing to the Independent Inquiry into Child Sexual Abuse (IICSA). Accordingly, our current process is that accounts are suspended but not deleted. In addition to the 2014 policy/guidance we also need to know what the policy is today (2023) regarding the disablement/deletion of email accounts in relation to leavers. We hope you can send us two policies therefore – one from 2014 and the other as of now.”
“If a CPS prosecutor left the organisation in 2014, after their account was suspended, at one point would their account have been deleted. Do you have any documents in your files from 2014?At that point you were providing services to CPS under a PFI contract. I am actually looking for the Policy document, which I do not expect [name of third party supplier] to hold as CPS should have any policy document, but you may have an operational document. At this stage I am looking for information that confirms that the approach at that time in 2014 was that account were deleted after 3 months. {I am aware that after8/5/2015 there was a moratorium on deleting records which is still in place and currently email accounts are not deleted} If you could reply by COP today I would be grateful. e.g the records and documents from 2014 are from a totally different contract and one might expect that those documents were deleted due to subsequent changes to process – if you could confirm that. However if you do have documents could you please forward.”
“Is your request in relation to Case Data, CPS Domain Accounts or CMS Application Accounts of any combination of these?”
“5. At the end of the users leaving date Service Desk disable the users CPS network account. 6. The Service Desk and Logica Apps support disable CMS/WMS accounts as necessary (CMS account must be disabled within 30 days of leave date as there will be no dummy AD account to access CMS account after this time) 7. 30 days after the user leaves their data and email is deleted, the users account is moved to deleted users OU and the users account is renamed z1username.”
“...it seems to me that as per this document attached that the deletion period was 30 days. (However it then states in the attached which is from 2011, that the user emailbox was moved to the OU called Deleted and given a prefix of z1, which sounds recoverable & therefore not actually deleted) I can confirm that the account involved was deleted when checked in 2017. Does is seem right to say that at this time in 2014, the deleted account email box and data was removed within 30 days, but could only be guaranteed to have been removed after 3 months due to when the actual leaving date fell and to cover instances where the line manager had missed informing us as per the process?”
“I do recall the change detailed in CR3357 being implemented. This amended the [entity name redacted] leavers process so that it was triggered by the user’s line manager completing the leavers form on the HR iTrent system. Unfortunately, other than that I do not recall any detail about the timescales for the various account management processes in place as at 2014, and I do not have any records going back this far. However, assuming that the attached CCR was the version accepted then I think it reasonable to assume that if the leaver’s line manager had filled in the HR iTrent leavers form that [entity name redacted] should have disabled the account on the date that the person left the CPS and 30 days after this date they should have taken action to delete the user account and associated e mail data. If the line manager didn’t fill in the leavers form on iTrent then the account should have been picked up and disabled via CPS account management procedures looking at unused accounts. However, the internal process document [name redacted] located dated 2014/15 (attached) only talks about requesting [entity name redacted] to disable the accounts – they do not mention any subsequent requests to then delete a subset of the accounts (some would need to be retained as the user might not have permanently left CPS). I am therefore unable to say with any confidence whether these disabled accounts were deleted after 3 months – albeit someone obviously told [name redacted] that thiswas the case at the time so may well be correct.”
“The process on the Extradition Unit is that all emails sent electronically to individual lawyers are printed off and put on a physical file or sent to the electronic case file and then deleted from that lawyer’s inbox. Nothing is deleted permanently without being retained in one way or another. [The CPS lawyer’s] account would have been closed when he retired from the CPS.”
“I would be grateful if you would clarify whether all emails are sent to the electronic case file (even if they are all printed off and put on the physical file) in which case, I wondered whether it was possible to carry out a straightforward search of the electronic case file of all emails sent from the SPA.”
“... I have been informed that we searched electronic records and found that all the data associated with [the CPS lawyer’s] account was deleted when he retired and cannot be recovered. ...”