Northern Ireland Affairs Committee
Oral evidence: PSNI data breaches, HC 47
Wednesday 13 December 2023
Ordered by the House of Commons to be published on 13 December 2023.
Members present: Sir Robert Buckland (Chair); Stephen Farry; Sir Robert Goodwill; Claire Hanna; Tony Lloyd; Carla Lockhart; Jim Shannon; Bob Stewart.
Questions 299 - 315
Witnesses
I: Sinead Simpson, Chief Executive, Northern Ireland Policing Board; Deirdre Toner, Chair, Northern Ireland Policing Board; Edgar Jardine, Vice-Chair, Northern Ireland Policing Board.
Witnesses: Sinead Simpson, Deirdre Toner and Edgar Jardine.
Q299 Chair: This is a meeting of the Northern Ireland Affairs Committee. I am delighted to be joined for our first evidence session on the data breach issue relating to the PSNI by members of the Northern Ireland Policing Board. We have Deirdre Toner, the chair of the board, Edgar Jardine, vice‑chair, and Sinead Simpson, the chief executive of the Northern Ireland Policing Board, who are all together, online with us. Welcome. May I begin by asking each of you for your initial reaction to the findings of the independent review that I think we are still all digesting?
Deirdre Toner: Our initial reactions are that we welcome the report. It is a large body of work, which we appreciate. It was a critical incident, which we were always going to acknowledge, and the impact cannot be underestimated. In an organisation that protects physical and personal security, we needed to prioritise data information security.
We commissioned the joint report to see how it happened and how it could not happen again. The report is clear that there were numerous contributing factors and not one sole area of accountability and a series of systems failures with individual actions across a number of parts of PSNI. Fundamentally, as the author notes, the PSNI is basically not seizing opportunities to better proactively secure data and identify it in a modern way. Clear visibility on the data, equal to people and money, was top of the agenda.
Although the responsibility lies with senior information holders in the PSNI, this is about learning, future proofing and not apportioning blame. The report found, as we say, that PSNI does not possess the appropriate skills at a tactical level to drive the data security in the organisation. Investment in people and technology will be needed.
There are lessons here for all police services and the wider public sector, given the issues identified around audit and information governance. This really is a roadmap for the future and was commissioned to provide future assurance on best practice. There is learning here for everyone in terms of serious questions in terms of internal processes and audit provision within PSNI from which the board takes assurance.
Looking forward, we will consider the findings, the principles that are fair and need to be teased out to produce an action plan, through our committees and board, in partnership with PSNI and continuing contact with the author. It is key that we continue engagement with staff, officers and the associations, rebuilding confidence internally and externally.
Q300 Chair: Vice-chair, what are your observations?
Edgar Jardine: I echo what the chair has already said. I would add that the report identified significant threads in terms of the work and focus on external threats and the need to balance that with additional work on the internal threats to the organisation. That is probably a lesson not only for PSNI but indeed for all our police services and any organisation that holds personal data.
There was a significant point for me in terms of the learning and training. There were a couple of points around that. First, there seemed to be an emphasis on generic training, whereas much more targeted training around use of Microsoft and Excel spreadsheets and so on would have been called for. The second thing that struck me was the need for specialisms around this area. Traditionally, it would seem that people were promoted or moved into posts to deal with FoI, data protection and so on. The message I took from the report in relation to that is the need for much more focused training and more specific professionalism around data management, data science and so on.
Sinead Simpson: Good morning. The chair and the vice-chair have covered the key issues for us as a board. In terms of my initial response to it, as has been said, it definitely came across as a wake‑up call not just for Police Service of Northern Ireland but for policing generally. The one thing I would add is that, when we met with the staff who were affected by the breach, the Police Federation, the superintendents and NIPSA, we were very struck by the impact that this had had on their members.
A big issue that came across in that early meeting with them was their desire to make sure that the page was not turned too quickly on this event and that everybody moved on. I was comforted by the fact that, in some ways, the report represents a large body of work that we will all now need to take time to think about how we are going to deliver, by PSNI, and how we are going to monitor and oversee at the board. For them, there should be some comfort that there will now be a focus on this issue and on getting it right. That would be the one thing that I would add.
Chair: Thank you very much indeed for those openers. The themes that we want to warm to are not so much individual responsibility but the overall culture in relation to freedom of information and how preventative work is going to need to be carried out here. There is then your role as a board and your responsibilities as well.
Q301 Sir Robert Goodwill: This question follows on neatly from the point that Sinead Simpson has just made about the impact on staff. We heard yesterday from representatives of serving officers and ancillary staff. I was particularly struck by the evidence we heard from Superintendent Gerry Murray for the Catholic officers and how some officers who are forward-facing have not had so much impact, but a lot of the officers were living within communities without people necessarily knowing what they were doing. You are obviously aware of that. What could we do more to address some of those problems? We heard that some were even going to leave the force. It would be a great shame to lose that experience.
Sinead Simpson: For us as a board, we were very keen in the early days after the breach to have early engagement with the staff associations to hear their views. Yes, we would have heard first-hand some of what you would have heard yesterday from the staff association representatives. The board was extremely concerned about the impact that this was going to have on staff.
We know, and indeed I think that the federation said yesterday, that there is a broad spectrum of reactions to this. Some people are already in front‑facing roles and it might not have had such an impact on them, but there are a lot of others, including on the police staff side, who maybe did not sign up for such a level of visibility and were impacted. As a board, we intend to continue with that engagement. We reached out in the hours after the report was published and we hope to get direct engagement with the staff associations over the coming days.
In terms of the work that has been done, the response from PSNI immediately after the data breach covered a number of angles. There was a criminal investigation. There was work to take information down and to devalue the information. A large body of work was done by PSNI, which members were impressed with, around reaching out to staff, the referrals into an emergency response threat group, the opportunity to avail of an employee assistance programme and referrals into occupational health, as well as supports on the security side. We might touch on it later but the news in the last couple of days that money has been made available for the universal offering is obviously welcome.
I do not think that we on the board would say that all of that makes the impact go away. It absolutely does not. We will want to focus over the coming months on how we can help ensure that this does not happen again. Those things certainly go some way to addressing the impact on staff.
Edgar Jardine: Building confidence in the PSNI is an issue for the whole of society. I was very taken by comments made by Archbishop Eamon Martin after the breach. He was interviewed on Radio Ulster and offered unequivocal support for the families of police officers from his community. He went on to say that policing “is considered across the world a noble vocation, something that should be natural for our young people to consider and we all need to play our part in making that a reality”. Going forward, that broader, unequivocal community support for policing and the PSNI is going to be critical.
Deirdre Toner: From my perspective, I agree with my colleagues. It is about keeping it up high on top of the agenda, in terms of not letting it slip. It is very important to realise that public servants who work as police officers and staff are exceptional in their approach to their jobs and what they do. We cannot underestimate their involvement. We keep in contact. We work with them and find out what the impact is on a range of different areas on the particular job that they do in a very difficult environment.
Q302 Jim Shannon: It is nice to see you, Deirdre, and Edgar and Sinead as well. I am sure that you have watched the Police Federation at the meeting yesterday. You will have heard what it said. It is quite incredible, is it not? This left hand here does not know what this right hand here is doing. In relation to the Policing Board, if we are going to move forward in a positive fashion, if that is possible, the arrangements on data between the Policing Board and the PSNI have to be a wee bit more hand in hand perhaps. The upgrade role of our deputy chief constable also has to be part of that. Also, I believe that the need to prioritise data, information and cybersecurity is not recognised at a strategic level. What plans does the Policing Board intend to make to improve, and improve greatly, what has happened?
Deirdre Toner: A bit of context is that the Policing Board is not an operational board. We work as an accountability body to oversee the policing plan and make sure that the assurances that we seek are within the PSNI’s strategic management board and its risk registers. That is an area where, as big public bodies, the same as every other one, we must seek assurances, because we are a small organisation overseeing quite a big organisation. That is an area where we need to highlight that that is our role. I do not underestimate the impact on that.
We have a series of different issues where we have resources that have been cut over a long time. DoJ has not had an uplift in nearly 10 years. We have police officers who have stretched responsibilities and jobs, and policing staff as well.
The other thing is that we can see from the report that the PSNI’s focus on cybersecurity is very strong and actually a lesson to a lot of other organisations. Internally, there is work to be done across skills, capability, maybe training and gaps in understanding in terms of modern approaches to dealing with such issues in terms of data protection. All that can be accomplished in an action plan, jointly agreed, I suppose, through the Policing Board as well, coming to us to see what the practicalities are and how we measure that and keeping it high on the agenda of the operational board from the PSNI, but also in terms of our committees and resources committee and looking at what good could look like.
Q303 Jim Shannon: In the conversations that have taken place between you, the PSNI and the federation, you have agreed a platform and a way forward. I presume you have, anyway.
Edgar Jardine: On that, there are 37 recommendations. We have had the report just for about five days or so. There is a piece of work to be done to go through those recommendations and identify how they will be implemented. I would envisage then that the board would have this on the agenda going forward, so that the implementation plan, as the chair has said, will be monitored very carefully.
I know that the chief constable already invited the review team back in in a year’s time to provide its assessment of progress. Clearly, we will want to look at that very carefully and take assurance from the team in terms of how the implementation plan has worked out.
Sinead Simpson: If I could just add, in terms of our monitoring, the report makes a clear recommendation that there should be KPIs and a reporting regime between PSNI and NIPB. Part of the implementation plan and our monitoring of it will be developing, along with PSNI, what those key performance indicators should be. As the vice-chair says, we will then integrate that into our committee structure as appropriate.
The board oversees and monitors recommendations regularly. We have human rights reports. We have CJINI reports and reports from other bodies. We have mechanisms for funnelling that work through our committees. As the vice-chair said, at least for a period of time before we integrate it into business as usual, we want to continue to treat it as a critical incident and keep it on our board agenda for a number of months yet.
Jim Shannon: I have the permission of the Chair to speak in relation to police pensions. I will make the comments and expect you to come back to me. Regulation 40 of the 2006 PSNI injury benefit regulations 2006states that the pension of police officers under these regulations shall be payable in respect of each year as from the date of his retirement. It is qualified by regulation 10(2), which refers to any period before the officer becomes disabled.
What is the Northern Ireland Policing Board’s understanding of the process by which the board determines the date upon which the applicant became disabled? Secondly, by what process does the board’s resource committee arrive at decisions in relation to retrospective injury on duty awards? Thirdly, the board’s business plan outlines four key objectives. Number 4 describes the objective as to deliver independent, fair and transparent processes for former and serving officers in line with police pension, injury, benefits and appeals legislation. To what extent, and by what means, is the board achieving this? Fourthly and lastly, it has been stated that the board is facing considerable financial challenges at present. To what extent has this impacted upon the board’s approach to deciding whether to grant a retrospective injury on duty award?
I have been in touch with you over this matter for some time. I suspect that it is the last reason. You cannot hide behind financial challenges on what is right and what is wrong. My suggestion to the Policing Board is to stop messing about. Reply to the conversation. Sort out the injury benefit pensions for police officers and do it soon. I have it on record with the Northern Ireland Affairs Committee today. I wanted to do that so that you know what we are talking about. The public will have heard it as well, so we expect to have an answer and a solution to these matters.
Chair: I am not expecting there, members of the board, necessarily a detailed answer to those questions. You have come to give evidence about the data breach. They have been asked. If you were able to provide a response in writing, the Committee would be content with that. Is that alright?
Sinead Simpson: I would be happy, as chief executive, to come back. We could maybe get from the Clerk the detail of those points from Mr Shannon, and then yes, we will come back in writing.
Deirdre Toner: Yes, absolutely. That is no problem.
Chair: We will make sure that those are furnished to you.
Q304 Tony Lloyd: Good morning. The chief constable at least in part resigned as a result of the data breach. The PSNI review has now been published, as you say, not long ago, but it is now in your hands. When can we expect the review of the board to be published and its leadership and operations held to account?
Sinead Simpson: In the aftermath of the scoping judgment, as the Member rightly says, there were a number of issues that they wanted to focus on. Obviously in the immediate aftermath of the previous chief constable’s resignation we were focused on bringing stability to the service through the appointment of an interim and then a substantive chief constable. Then, yes, the review of the board and the review of the service executive team structure were issues that the board wanted to see focused on.
As it is a review of the board, it is obviously not appropriate for the board to take the lead on that. We have, over recent months, secured agreement from the Department of Justice, which is prepared to act as the independent commissioners, if you like, for that review. The Department has agreed to take that forward for us. We have been afforded the opportunity to feed our views into what the terms of reference might be, but the Department and the person or persons appointed by the Department will have the final say on that. That is where that is and I do not have a timetable as yet to share with the Committee.
Q305 Tony Lloyd: I take that point. An external review makes sense. However, you are in a position to be self-examining within this process. One comment that was made is that these issues around data handling and IT, etc., were not on the board’s agenda. It is a real question for you all as to whether that is an accurate description.
Also, importantly, I have been in the position myself very equivalent to the role you have. IT is extremely difficult for those of us who are not experts. Do you have the expertise in house to be able to perform the role that you have of scrutinising the operation of the PSNI? It is not just enough to say that you are a review body. You are, but have you the capacity and the people in house on the board to advise you who can make sure that you can adequately scrutinise the progress of the PSNI in this area?
Edgar Jardine: The independent review report suggested the appointment of a board member with particular expertise in this area. There is a deficit in expertise. There is no question about that. I do not know whether that is the best solution to it. Alternatives would include identifying someone who would come as a periodic adviser when this issue was on our agenda, or indeed, as is happening over the next year, where the people who undertook this review would come back and assist us in terms of reviewing progress and so on. Yes, there is a need for additional expertise. We need to discuss within the board and with the Department how best that could be acquired and procured.
Sinead Simpson: To go back to the point that you made at the very outset, the board is an accountability body. Management of information governance in PSNI, though, is for PSNI. The report is very much about a collective responsibility and the board is absolutely in that space, but just to highlight, on the point that information and data management is not on the board’s agenda, the board, as the accountability body, derives assurance from the internal mechanisms. PSNI has its own audit and risk assurance and its own internal audit programme. It would only be where those processes flag an issue up that it would make its way on to the board agenda. That is in compliance with the Treasury guidance around risk management.
I just say that by way of explanation as to why it was not on the board’s agenda at the outset. The report shows that there are issues, certainly, in terms of training, roles and responsibilities and operating procedures, but definitely issues around internal governance that I hope this report will now allow us to get right, going forward.
Q306 Tony Lloyd: Are you sure that that is a satisfactory response to say that it is only if PSNI internal processes flag something up that the board would take an interest? It does not seem to me that that is the way that the board ought to operate.
Sinead Simpson: The primary objective of the board is to hold the PSNI to account for the delivery of efficient and effective policing. We primarily do that through our policing plan. We go out, consult with the community and identify what the priorities are for the community in Northern Ireland. That drives the content of our policing plan.
In terms of the work of our committees, those are driven by our statutory functions, such as our human rights monitoring. We would also be driven by major strategic work areas within PSNI, such as financial planning and people management. There would also be a focus through committees on issues that are being flagged up through the risk process. I would not want to suggest that the only way in which things make their way on to the agenda is through that sort of risk management process. There is that range of other means by which they can come on to our agenda.
Deirdre Toner: In terms of board oversight, there are a range of different mechanisms across the different committees as well that touch on data and information governance in terms of the HRA and privacy in policing report, for example. There are a variety of human rights reports that touch on individual protection of data and protection of community data or data that is held. There are a range of areas there where we scrutinise the PSNI from its corporate plan on a couple of different reports that are reoccurring right across the committees.
Q307 Claire Hanna: I appreciate the engagement with us. Looking at the report overall, I wanted to clarify whether you are satisfied with the timeline of the incident specifically. Are there any questions that you think have not been either addressed or satisfactorily concluded on in relation to what happened in those few days in August?
Deirdre Toner: It was a critical incident that we had to react to very speedily across a range of different partners and bodies. It was appropriate that everybody was engaged, primarily the people who were affected, first and foremost. We cannot underestimate that. As soon as we could physically action responses, they were done.
We have had a range of meetings between August and now, collating the board together to make decisions collectively, which it is our responsibility to do. We have had over 20 official meetings, never mind committee meetings, to be able to action a range of areas in terms of getting things done properly in the right order in the right way, so that this can be an effective process that can be measured and monitored and that decisions are made at the right time. There are 37 recommendations.
Q308 Claire Hanna: I just wanted to confirm what the report sets out happened in the run-up to the incident and the incident itself. Are you satisfied with the explanation given of the issue around closing tabs, deleting tabs and all that? Are you satisfied with the explanation and is there anything else you would have liked addressed in the report?
Deirdre Toner: In the situation from the report, and from the author as well, you can see that there were a whole range of different areas across a range of different teams and parts of the organisation that contributed to this, not necessarily one area that is at fault. There is a lot of learning across this area that can be there for a lot of other organisations as well. I would accept that no organisation is perfect and that we now know that there are a variety of areas that need to be improved for the PSNI to ensure that this does not happen again.
Q309 Claire Hanna: Sinead or Edgar, I did not know whether either of you wanted to add anything further.
Sinead Simpson: I thought that the report was comprehensive. As we have already said, there is learning in it for the organisation, for ourselves and for many others across the public sector. The board discussions that we have had on the report over the last number of days have turned very much to a focus on, “How do we get on with the job of work that needs to be done?” and developing a costed implementation plan to take that forward. I felt that the report was comprehensive.
Edgar Jardine: I would agree with that. We engaged some independent experts ourselves as a panel to provide us with additional advice. Overall, the report has been well received. No doubt it is very challenging for all of us and probably for a lot of other bodies as well. We think that we can move to a position where we have very significant confidence in how data is managed, shared and used within the PSNI.
Q310 Stephen Farry: Good morning to our witnesses. I think that it was you, Edgar, who referred to the 37 recommendations that were made. That is a lot of recommendations. I appreciate that the board is still going through these. Do you have any sense of the prioritisation that is required in terms of delivery of those, which are most important and which are probably slightly lesser in terms of their impact and significance? Secondly, just to clarify, Sinead, the board’s function in this regard, presumably at some stage the PSNI will need to put in place an action plan for implementation of the recommendations. Could you clarify the board’s role in terms of either the compilation or, perhaps more relevant, the oversight of the implementation of said action plan?
Edgar Jardine: The first point would be that the report emphasises that data protection and management should be up there with finance and HR in terms of key assets available to any organisation, including PSNI. In terms of key issues that might assist going forward, clearly the internal governance and management within PSNI is a critical issue. I know that it has already responded to that by elevating the SIRO role to deputy chief constable level.
There is a further recommendation, which is quite significant, and that is the importance of developing a standard operating procedure for dealing with FoI. There seems to be no shortage of instructions, guidance and so on, but it did not seem to have been pulled together in a way that was helpful to the staff who were managing it. That is reflected in the fact that there had been an opportunity when the National Police Chiefs’ Council had on two occasions been in contact with police services in relation to safeguarding data that was being released. That did not seem to get through or was not implemented. That whole governance issue and the standard operating procedure are two of the matters.
The third is how training is conducted and the need for more targeted and specific, rather than generic, training for people who are dealing with it. Related to that is recognising data management as a profession with very specific skills that need to be acquired and developed. In terms of the board’s function, as some of my colleagues have said already, when we develop an action plan, the board will be wanting to keep that on our agenda going forward, ensuring that actions that are due to be taken are taken and to go further and look at the impact of those.
Sinead Simpson: If I could point to the recommendation that I read out earlier, the authors ask us to develop a set of KPIs. Once we see the implementation plan, we can then work on the KPIs. That will dictate and drive how we manage it through our committees, whether we need a separate group or, depending on the content of the plan, funnel it through our existing committee structure.
The one thing I would add to what the vice-chair has said, and picking up on points that committee members have made, is that, over and above the fact that the report author is planning to come back to have a look, we will want to, as a board, collectively decide whether we want to buy in some expertise to assist us in the same way as we do in relation to HR or human rights issues. That would be the additional point I would make.
One further critical issue for me in the report picks up on the point that the vice-chair has made around the visibility. There is a recommendation for a data board. It would seem to me that that would be pretty central to making sure that the rest of the recommendations that the vice-chair has mentioned get driven forward. Whether it has an existing governance mechanism that could be morphed into a data board or whether it needs a fresh set-up is something we wish to discuss with the leadership team in the coming days.
Deirdre Toner: To add to that on the human side, our colleagues yesterday spoke about the capacity and capability of staff and the workloads that staff and police officers have. We have to be very aware of building capability and understanding and support across all those teams and work with the PSNI to make sure that that capability and support is there.
Q311 Stephen Farry: That is a very good segue into my next question. I wanted to get a sense in terms of resourcing, first in terms of delivery of the recommendations. Do you see a potential impact in terms of either additional human resources or financial implications for any of the recommendations as such?
Edgar Jardine: You touch on a very significant point. The Northern Ireland Fiscal Council last year reported on the justice budget in Northern Ireland. Between 2018-19 and 2024-25, it was scheduled to increase by 3.6%. The equivalent functions in GB will increase by over 33%, so there is a real issue. There has been a financial crisis with PSNI long before there was a data breach crisis.
Also, as you are aware, through the Barnett consequentials, when money comes to Northern Ireland it is allocated by the Department of Finance, not necessarily from where those consequentials came from but in terms of assessed need there. In respect of that as well, justice has had a very difficult number of years in terms of budgets. Resourcing will definitely be an issue going forward, but the priority that the review team ascribed to getting this right will be very influential in terms of how resources are allocated.
Q312 Stephen Farry: There are two elements to the very particular financial implications from the data breaches themselves. One is the implementation of the action plan in terms of any particular changes that need to be made. Probably the wider issue, which has been well articulated previously, is around the wider costs to the PSNI of mitigating the impact of the data breach in terms of managing people’s potential security requirements and the wider issue about potential compensation. You are all aware of potential legal challenge in that regard.
Without discussing the merits of that, can you maybe update us on your understanding of where things are with highlighting this within the Northern Ireland Office and Treasury around any particular bespoke funding to try to address those pressures? Some of them may well be in-year. Some may well have a tail over several years.
Can I echo the point that has been made previously? A lot of these issues are not purely a Northern Ireland responsibility, given that there is a residual UK responsibility around policing and some of the implications here are national security implications. There is a very ready lead-in for the UK Government to take on some of this responsibility.
Sinead Simpson: As you are aware, that bid has been made to the Treasury. As a board, we very much welcomed the support of colleagues in DoJ, DoF and Treasury. The bid, as was articulated last time that we were with the Committee, is between £27 million and £32 million. That is to deal with the data breach. That is not any potential fine. That is not litigation.
We welcome the fact that that money has recently been made available for the universal offering. PSNI had to take some measures for a particular cadre of staff in the early days afterwards, but this universal offering will now allow them to deal with the more general issues that people have. In terms of further funding, my understanding is that PSNI will need to work out the implementation plan and then have further conversations with Treasury around funding of those. I suppose that we are heartened by the support that there has been already and by the release of the £5 million for the universal offering. On the point that you make, Mr Farry, we are not involved in the conversations but our understanding of the discussions is that people are very mindful of their responsibilities and the impact that this has had more generally.
Q313 Carla Lockhart: Thank you to the panel for your comments this morning. I would want to be associated with the comments of my colleague, Mr Shannon, in relation to the retired injuries payment. It is important that the board grasps this. I know that you have said that you want the information on it, but you already have the information because this has been raised in Parliament on a number of occasions. I would go further and ask that you meet with some of these officers who are so badly impacted by this ongoing lack of action by the Policing Board.
In relation to the report, I have a very quick question. In my mind, one big thing is that the issue with the PSNI’s handling of data has been that it has not transformed its systems or its estates. In your mind, as the Policing Board, what can you do to help facilitate that transformation of systems? Ultimately, we are still dealing with policing that was 20 years ago.
We all know that things have moved on. I know that, even in my own constituency, as an elected representative the way that people contact me and use technology is so different. If you take a constituency office, 20 years ago it would have been a drop-in. It would have been a walk-in. Now it is through Facebook and social media. It is instant, overnight and all the time. What do you feel should be done more between the Policing Board and policing to try to transform our services?
Edgar Jardine: While there is a lot of work to be done, we need to recognise that significant change and transformation has taken place over recent years. Currently, as you say, the contact is different than it was 20 years ago, but our contact centres are dealing with something like 500,000 calls every year. They are dealing with about 20,000 999 calls every year. They take a domestic abuse call every 17 minutes. Technology has been really very important in assisting them. There has been a roll-out of secure laptops, which allow officers to report directly, rather than having to go back into the station again.
A lot has happened, but there is a lot to happen yet. One area that the report focused on particularly was the HR system, the SAP system. That has been patched, changed and modified over the years to a point where it is beyond its normal lifecycle. We need to acknowledge that that is one area that will need to get priority and that the board will be wanting to keep on top of as things go forward.
I would stress a point that has been made by the chair and others. The operational responsibility for all this lies with the PSNI and the chief constable. I would just mention of the importance of ensuring that our police service is resourced properly going forward.
Sinead Simpson: I will add just two points. The parts of the report that are probably transformational include some that the vice-chair is referring to—the replacement of SAP and the use of the data warehouse, the building foundations section of the report. There is probably also a large price tag attached to them. The board would want to be understanding PSNI’s business case to change and transform and to then, when we are satisfied, be supportive of those business cases.
The other point might not be quite in the transformational space, but is in terms of helping to improve anyway. There is a lot of work going on nationally through the NPCC. You can see, smattered throughout the report, a number of references to PSNI engaging and utilising some of those networks that are there. I have heard others in policing refer to it as almost free consultancy. We would want to make sure that that is tapped into.
Q314 Chair: I want to ask a final question. I appreciate the difference between strategic oversight and operational responsibilities, but sometimes there is an overlap. Sometimes, the operational matters are reputational for the entire force. There is a big question underlying all of this, not about the process by which people understand Microsoft but why in the first place there are so many FoI requests and so many FoI requests from members of the very same force. As a board, have you asked questions about that? If not, why not? Here is a suggestion. Could that not be a theme for you to explore proactively with the PSNI, with an aim to reducing the overall number of FoIs in the first place and, frankly, dealing with the question of trust between officers and the senior police that we hear so much from the evidence that has come before us thus far?
Deirdre Toner: Your point is well made. In terms of the policing plan, there are a lot of areas there that can touch on support. In terms of why those FoIs are coming forward, it is a very legitimate question. They have been discussed across committees and I welcome that. I welcome that thought.
On another area, if you are talking about the actual report itself, talking about the culture, data, skills and talent, there is a link there in terms of how the board scrutinises that across HR, skills and abilities, the different cultural audits and the different areas that we examine across the work that we do. That will support and enable this.
Edgar Jardine: The federation people yesterday were very helpful in this regard. A lot of the FoIs seem to arise almost as a precursor to an industrial tribunal or whatever. Part of the answer to that is a more aggressive publication scheme, where you do not need it.
The caution I would put in there is that, very often, in compensations you are dealing with relatively small numbers. The risk of disclosure of individuals is something that is taken into consideration normally in FoIs, but particularly around small compensations.
Sinead Simpson: In a conversation that we had with the members of the senior team last week, they already take on board the fact that 20% of FoIs are from their own people about their own processes. Notwithstanding the point that the vice-chair has made, they very much are on the page of wanting to find a way of getting some of this information out. It would be good practice in an open, transparent organisation. It is already on their radar. When we are looking at the KPIs, we will absolutely take on board your suggestion, Chair, of a reduction in FoI numbers overall.
Q315 Chair: Yes. You could have a really constructive, proactive role in holding the PSNI to account in year-on-year reduction in FoIs because of the publication of information that, by dint of it being answered by FoI, is in the public domain anyway, or should be.
Sinead Simpson: That is very true.
Chair: Thank you very much indeed to board members for the evidence. We are grateful to panel 1. We will say farewell and compliments of the season to you. We wish you well in your work in the year ahead.