Investigatory Powers Commissioner’s Annual Report 2019
Processes
5.5
We have a complex IT structure to meet the varied needs of the requesting agencies
we work with. The majority of applications are submitted to us by individual authorities
through their own workflow systems and received into our bespoke Case Management
System (CMS). Applications are safeguarded within systems accredited to handle material
classified as Official Sensitive, Secret, and Top Secret.
5.6
One of the greatest challenges when setting up OCDA was anticipating the number of
applications that we would receive. This was essential to enable us effectively to prioritise
and manage our workload so we could review and approve the greatest proportion of
applications within routine processes. The Home Office analysed information from previous
IPCO inspections of relevant authorities to predict the volumes that would be submitted
to OCDA. Overall these estimates were helpful and we received 97% of anticipated
applications at the end of the transition phase. Whilst numbers submitted by individual
authorities varied from predictions at times, the overall number of applications we dealt
with has been broadly as expected. One notable exception was the MPS, one of the
largest requesting authorities; the MPS submitted 124% of anticipated applications and
has exceeded the anticipated weekly number 90% of the time since transition. However,
the work we had conducted to model and prepare processes meant that we were able to
deal with this increase without compromising our service to the MPS or other applicants
in any way.
5.7
Before starting live operations, we set out anticipated service level expectations, to guide
requesting authorities, based on three categories of priority. We met these expectations
throughout the year, except for four applications for which the returned decisions
missed their deadlines. These delays occurred due to an oversight in regularly checking
the relevant discrete IT system that was used to submit the four applications. We have
made process alterations as a result and there have been no further incidents. We have
been pleased to note that many authorities have commented that the speed of service
provided by OCDA is superior to that previously in place when applications were authorised
under RIPA.
Communications data request prioritisation structure
The Priority levels are determined by the requesting authority and reflect the relative
urgency of the application. OCDA’s prioritisation model includes priorities 2, 3 and 4:
Priority 1 (urgent) applications: dealt with by the authorities themselves
Priority 2 applications: dealt with within 6 working hours
Priority 3 applications: dealt with within 1 working day
Priority 4 applications: dealt with within 4 working days
5.8
When we receive an application, the Authorising Individual makes one of three decisions:
to authorise, to reject or to return the application for rework. An application is only
rejected when it is thought to be sufficiently flawed that it is considered unlawful; as a
result, very few applications are rejected. Most applications that we refuse to authorise are
sent back to the authority for reconsideration, referred to by OCDA as ‘returned for rework’.
This can be for several reasons, but frequently it is to seek clarification on the specific data
requested or more detail relating to the justification or proportionality of the request.
29