Data and information governance

The ‘Back office planning system’ (BOPS) is a prototype solution for administering and determining applications made to the council under the Planning Acts. BOPS can receive, store and allow for the processing of data and documents associated with a planning application.

The system is being developed in collaboration with central government (MHCLG). BOPS is at the forefront of meeting anticipated obligations on councils to collect, provide and publish a standard of planning data as set out in the Levelling Up and Regeneration Act 2023.

Personal data received into BOPS comes from:

(i) applicants or their authorised agents; and

(ii) persons making representations to public consultations carried out on planning applications.

Personal data will in the majority of cases involve names and contact details. As regards planning applicants, this is the same set of personal data that is required (by legislation) to be supplied in a single document (an application form) for the existing process of making planning applications.

BOPS is part of Open Digital Planning. The development of this product is aligned with the PlanX (formerly Reducing Invalid Planning Applications (RIPA) project.

What personal data will be processed?

Name (deprecated)

Home address (deprecated)

The data being processed relates to:

• citizens, service users, residents, clients

• business partners or organisations

What is the lawful basis for processing personal data?

BOPS is processing personal data as part of a public task, defined as ‘the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. Article 6 - 1(e).’

What is the specific legislation used to justify this?

• Levelling Up and Regeneration Act 2023 (and any Regulations made under powers granted by this Act)

• Town and Country Planning Act 1990

• The Town and Country Planning (Development Management Procedure) (England) Order 2015

Does the data include special category data?

Yes - health

Which of the following conditions are you relying upon to process the special category data?

Substantial public interest - Must still be proportionate to the aim the project is pursuing, respect the spirit of the right to data protection. But also must provide for suitable and specific measures to safeguard the fundamental rights and the interests of the individuals involved. Article 9 - 2(g)

What are the substantial public interest conditions?

• statutory and government purposes

• regulatory requirements

An Information Sharing Agreement is not required.

Who is the data processor?

Unboxed Consulting Ltd

Is a data processing agreement in place?

Yes - a contract is in place with the data controllers and Buckinghamshire Council, the grant-managing local authority who is sponsoring development work by Unboxed.

How will you collect the data?

For Applicants - they complete an application form using a dynamic form process (in Plan X). Payment is collected on behalf of the council by GovPay. Data from the applicant and payment references are then transmitted (‘POST’) by RIPA/PlanX through an API to BOPS.

Whilst an application is under active consideration by the authority, if there are any validation requests created by the authority, the applicant will receive an email notification with their unique link to access ‘BoPS Applicants’ which resolves (‘GET’) data from BoPS. They are able to respond to any queries that the authority has and the applicant’s response is fed back to BOPS via ‘PATCH’ requests. This data transfer can include file uploads too.

For members of the public responding to planning applications - they complete a dynamic form using BOPS Applicants and then x and y (as above).

Will you be processing data for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security?

No

Will you be sharing data within your organisation or an external service provider or third party?

No

Have the project data flows been completed?

Yes

Data Permissions

Do you have a privacy notice?

Yes

Do you need to amend your privacy notices?

No

Assess Necessity

What is the necessity of using the data?

To perform a public task - statutory duty to process and determine planning applications and maintain public records.

Does the processing achieve your purpose?

Yes

How does the processing achieve your purpose?

Provides the data required for public tasks (decision making and maintaining public records).

Is the information you are using of good enough quality for the purposes it is used?

Yes, only specific relevant details are requested.

Is there another way to achieve the same outcome using less personal data?

No

How are you ensuring data is kept up to date and checked for accuracy and completeness?

As public records, the authority is required to preserve a copy of the application/accompanying documents on the public register from the time of the application. As such, this data would not be updated when a decision has been made. Information related to the application can be updated by officers during the period where an application is under consideration, should they be made aware of changes to the application information.

What is the process (administrative & technical) that enables necessary data corrections to be made?

Administrative - case officer receives enquiry /request to amend data. Officers can take action immediately.

Technical - case officer updates relevant fields in database and saves.

Technologies and systems

Is this introducing a new IT solution, or a change to an existing IT process?

Yes

What new technology is being introduced?

Cloud based back-office for planning case management/administration. Find out more details about the specific technologies used here.

Who is the supplier of the technology?

Unboxed Consulting Ltd.

Where will the collected data be stored?

Server - off site UK based

What physical security is in place to prevent access to the data?

Secure building accessed by key/ keypad/ access card

What are the access controls for staff, third parties and data processors?

For staff - Access to the system will be gained by username/password with a second factor authentication (one time code sent to registered mobile). Third parties - There is no access to applicant data for third parties. Applicants will be able to respond to requests made through BOPS Applicant but no personal data would be shown.

Data processors - Use secure passwords, network intrusion detection technology, encryption and authentication technology, secure logon procedures and virus protection.

How long will the data be retained for?

Data is processed for the duration of a planning application and remains stored in the BOPS application indefinitely for the records of the local planning authority.

What processes are in place to ensure information can be securely deleted/ destroyed in relation to both paper and electronic files?

It is not anticipated that information would be deleted/destroyed.

Are you using a third party cloud Service Provider?

Yes

There are 14 essential security principles to consider when evaluating cloud services. Outline of how the 14 principles are met.

Principle 1: Data in transit protection

Principle 2: Asset protection and resilience

Principle 3: Separation between customers

Principle 4: Governance framework

Principle 5: Operational security

Principle 6: Personnel security

The supplier has confirmed that its personnel have been vetted in accordance with government standards.

Principle 7: Secure development

The project is delivered through an agile methodology. A live ‘production’ and testing ‘staging’ environment are maintained so that the product is developed in iterations. User acceptance testing is carried out before subsequent releases to the live ‘production’ environment that would be used for real applications.

Principle 8: Supply chain security

Principle 9. Secure user management

Principle 10: Identity and authentication

Principle 11: External interface protection

The system has been subject to security/penetration testing which identified no significant concern.

There is separation between customers, for example customers responding to queries from the planning authority would be provided with unique ‘magic’ links to BOPS applicant. Those allow the customer/applicant to respond with further information, or documents. Documents are scanned for malware and would be rejected so that they cannot be retrieved by officers. There are no other current or planned external interfaces.

Principle 12: Secure service administration

Principle 13: Audit information and alerting for customers

Principle 14: Secure use of the service

Access controls are as outlined above. Data protection, security breach monitoring and access controls are governed by the data processing agreement and by an overarching contract for the delivery of this system. The overarching contract is between Buckinghamshire Council and Crown Commercial Service (with Unboxed as supplier) and sets out the governance framework and requires government- security specifications.