Request
1. How many times have ICRs been accessed since the power became available?
2. How many individual people have had their ICRs analysed since the power became available?
3. How long is ICR data retained? Please supply copies of any policies or Standard Operating Procedures which govern the internal use, access, and storage of ICR data.
Response
While our aim is to provide information whenever possible, in this instance Food Standards Scotland does not hold some of the information you have requested and some of the information is already accessible. Please see the explanation below.
Questions 1 & 2
We do not hold this information.
The Investigatory Powers Act 2016 (IPA) received Royal Assent on 29 November 2016. The Act makes provision for public authorities listed in Schedule 4 to acquire communications data (including internet connection records), where necessary and proportionate, for the statutory purposes set out in section 61(7) of the IPA. However, Part 3 of the Act, which concerns authorisations for obtaining communications data, has yet to be commenced. Therefore, powers to acquire communications data under the IPA have not been used. You may wish to note that, once powers under the IPA are commenced, the Investigatory Powers Commissioner will publicly report on the use of powers by relevant authorities.
Question 3
Under section 25(1) of FOISA, we do not have to give you information which is already reasonably accessible to you.
The draft Communications Data Code of Practice, published for consideration alongside the Investigatory Powers Bill, sets out guidance for the retention and acquisition of communications data. The draft Code can be viewed here.