Oral evidence: PSNI data breaches, HC 1791

Oral evidence, 19 September 2023.

Witnesses

Deirdre Toner, Sinead Simpson, Edgar Jardine.

Chair

Good afternoon, colleagues and witnesses. Those of you who study the architecture will realise that we are not in the House of Commons but the Senate Chamber at Stormont. Our thanks to Stormont authorities and the Speaker’s Office for hosting us here today. We are joined this afternoon by Deirdre Toner, the chair of the Policing Board; Edgar Jardine, the vice chair; and Sinead Simpson, the chief executive. The three of you are very welcome. At least two of us have travel arrangements with aeroplanes etc that we cannot hold up, so we are aiming to finish at about 3.50 pm. That is my cri de coeur for short questions and short answers. I have reminded colleagues of the sub judice rules, so that is at the forefront of our minds. Witnesses, if, in response to any questions, you would prefer to go into private session to answer, we can do so, but, given the public interest in this, I am keen that we hold as much as possible if not all of our session this afternoon in public on the basis that sunlight is the best disinfectant and transparency helps that process. I will kick off the questions, but I understand that you would like to make an opening statement beforehand. I invite you to do that now.

Deirdre Toner

Thank you very much, Chair and members. Thank you for the invitation to give evidence to the Committee today. I am joined by my vice chair, Edgar Jardine, and chief executive, Sinead Simpson. Between us, we hope to address your issues. We are pleased to be here today to give evidence to the Committee and answer your questions on resourcing pressures in policing, the recent data breach and more recent issues around the leadership of the Police Service of Northern Ireland. With your indulgence, Chair, I will provide some detailed opening remarks that, we hope, will benefit the Committee in understanding the actions taken by the board about the issues that were subject to your inquiry. The Committee was provided with a written submission on behalf of the Northern Ireland Policing Board (NIPB) that outlines the concerns unanimously shared by board members in respect of the day-to-day impact of funding reductions on the Police Service of Northern Ireland, the impact of reduced officer and staff numbers on delivery of the policing service that the community deserves and the consequent impact on confidence in policing. Those concerns remain, albeit there is now a substantial new pressure arising from costs associated with the data breach. In relation to the data breach, the board was extremely worried about the significant breach that had occurred on 8 August and called an extraordinary meeting to hear from the Chief Constable and his senior team about what had happened that had led to the details of 9,483 officers and staff being placed in the public domain and to discuss the immediate pressing concerns and the steps being taken by the PSNI in the immediate aftermath of the incident. That meeting took place on 10 August. Before engaging with the PSNI’s senior team, board members met representatives of the PSNI’s staff associations that represent the vast majority of those affected—the Police Federation and NIPSA—to hear at first hand their concerns. The board issued a statement after the 10 August meeting with the PSNI outlining how we had impressed on the senior team the need to ensure that every step would be taken to reassure and protect affected staff and to put safeguards in place to ensure that such a breach could not happen again. We also outlined the need for an end-to-end review of information security. Management at the time were primarily concerned with the immediate safeguards needed for officers and staff. As a board, we committed to keeping the breach as a focal point of our meetings with the PSNI for many months to come until we are reassured that the recommendations from the review are fully implemented. The board had a further meeting with the Chief Constable and his senior team on 22 August. At that time, before engaging with them, we met representatives of Your Voice, a gathering of representatives from a wide range of staff associations. The 8 August breach, along with subsequent breaches, had damaged the reputation of the service and had clearly impacted on the confidence of officers, staff and others in the ability of the service to protect personal information. It was important that steps were taken to begin to rebuild confidence in the service, and so, at our meeting on 22 August, we agreed the steps that the board considered to be essential in helping to rebuild trust and confidence in the PSNI and provide assurance on the efficacy of the PSNI policies and practices that are in place for handling personal data across the organisation. In the statement issued after the meeting, we outlined that an independent end-to-end process would commence, led by experts in information security, and that we expected an initial report back within one month. The terms of reference for the review were subsequently published, and the review team began its work on 29 August. The board received an initial report from the team on 14 September. Board members were reassured that the team was making good progress in reviewing the relevant processes, protocols, policies and systems, as well as people issues, including culture, practice and behaviours. It is too early to draw any conclusions from that work. The final report is expected by November. Turning to more recent issues on the leadership of the PSNI, the board accepted the Chief Constable’s resignation with immediate effect on 4 September. In order to ensure the leadership of the organisation and following legal advice on the matter, we asked the Deputy Chief Constable to assume the powers and functions of the Chief Constable as provided in section 34 of the Police (Northern Ireland) Act 2000. The board held further meetings on 7 September and 14 September to consider further legal and human resources advice around the arrangements that we had put in place, the options open to us and the further steps necessary to ensure the operational effectiveness of the service. The legislative framework that the board has been working with does not provide for the current environment, where we do not have an Assembly and a Minister of Justice. It is fair to say that the matters that we have been grappling with are far from straightforward. However, I reassure the Committee that the board takes very seriously its duties as the main accountability body for policing in Northern Ireland, as we do our employer duties for the senior team. As I said, the board considered legal advice on the range of options, including the appointment of an interim Chief Constable from within or outside the service. In spite of the significant commentary in that regard, that option was simply not open to us. The office of Chief Constable is one with significant powers and responsibilities. The legal framework for appointing a person into that office is clear, and we simply did not have the power to do it. Had we chosen to do so, we would have left any decisions taken by that person open to significant challenge. The board considers that it would be reckless to place the PSNI in a position where the hard work undertaken by officers and staff across the service could be lost because an authority given by a temporary CC who had not been legally appointed is open to significant challenge. We, of course, could not have anticipated that the DCC would have to undergo an unplanned medical procedure. In light of the situation and the need for resilience in the leadership team, we have, in recent days, advised the service that the current DCC could be asked to exercise his powers under section 34 to temporarily promote an existing Assistant Chief Constable (ACC) to the role of DCC but with that person taking on the role only if the current DCC is incapacitated. Discussions continue in relation to those arrangements. The board is not complacent about its role in securing an effective and resilient leadership team. We recognise the pressures that the current arrangements place on the senior team. We are working at pace to expedite a permanent Chief Constable recruitment process, as members believe that that will begin to bring the longer-term stability that is needed. The board continues to explore other options, including a temporary appointment to coincide with the Secretary of State having the power to ratify such an appointment. Such options will continue to be discussed by the board over the coming weeks. We fully acknowledge that the arrangements that we have put in place are not perfect. We will continue to keep the situation under review. As a board that has survived the political instability in Northern Ireland, we are making decisions against a difficult legal backdrop and in the absence of Ministers to ensure that the Police Service can continue to function in a robust and legal manner. We expect, Chair, that you and Committee members will have a lot of questions for us. Thank you very much for your time.

Chair

Thank you very much for that, Ms Toner. With 1 being “Not at all” and 10 being “Absolutely massive”, what is your assessment of the hole that the PSNI finds itself in today?

Deirdre Toner

It is very difficult. I think that it is unprecedented. We are in a difficult legal and political situation with a community that is vulnerable and staff and officers who are vulnerable. It is unprecedented, and it would be difficult—

Chair

Is that a 10?

Deirdre Toner

I could say that it is a 10, if I am going to be fair. It is very difficult. What I am concerned about is how the board has dealt with that in the meantime.

Chair

You mentioned in your opening remarks that the abstract but absolutely key thing when it comes to the delivery of public service is confidence.

Deirdre Toner

Yes.

Chair

Let us, as a Committee, turn to confidence.

Deirdre Toner

OK.

Chair

Can the public of Northern Ireland, whilst understanding the magnitude of the task in hand and the virtually unprecedented nature of the events, have confidence in you, as a board, to discharge your duties set almost wholly on commanding the public’s confidence?

Deirdre Toner

That is a fair question. I will break it up in terms of what we have done recently, looking at the board and then thinking about the political context. I said that we were in an unprecedented position. We have a difficult funding situation and a massive data breach. We are working to deal with that and the resignation. There is no doubt about that. It is not that we do not know exactly what has happened. The board has been working around the clock to stabilise the situation and the policing architecture to find solutions that are legal and legible. We moved quickly on the data breach. There were two special meetings’ agreement on that. The CC resigned on Monday 4 September, and, by Thursday 7 September, we had commenced the process to select a new CC. The issues that we are dealing with around the leadership of the PSNI are complex; I know that. There are HR and legal issues to navigate. The board is legally tied in what it can and cannot do. The policing structures were designated to operate in the framework of a functioning Assembly. We do not have that situation to lay the policing structure on. That has caused a huge amount of difficulty. We have a board of 19 members: 10 political and nine independent. We are not the board of Marks and Spencer; we are a very different board. We are a political board that is there to represent the community. The board is part of the peace agreement. It is not just about looking at assurances, performance, the policing plan and holding the police to account; it has much more responsibility than that. It has to be recognised that, as well as providing assurance in a range of different ways, like a normal board does, the Policing Board has the added responsibility of being representative of the community in a divided society.

Chair

Let us turn to the other side of the confidence coin, which is the confidence of the PSNI officers and staff. A casual perusal of public statements from a whole variety of organisations and groups in the PSNI, and, certainly, correspondence that I, as Chairman, have received from serving officers, suggests that their confidence is not just on the floor but in negative territory. Therefore, it is about trying to square the circle of asking the public to have confidence in an organisation in which the practitioners within do not appear to have confidence themselves. It is a big ask to ask the public to have confidence in an organisation that serving officers do not have confidence in. What is the strategy for bringing those staff and officer groups into your confidence? That is absolutely pivotal.

Sinead Simpson

Our conversations with staff associations suggest that the data breach is the issue that has had the biggest impact on confidence. The board was acutely aware of the gravity of what happened; a seemingly simple transaction led to quite a catastrophic data breach. It was for that reason, as the chair articulated, that, within days, we convened an extraordinary meeting. The board was completely seized of the fact that we needed to grip that and to be seen to do so. That was a large part of the reason why we agreed to commission an independent review of what happened. Board members placed a great deal of importance on the impact that that had on staff, so, before we got in a room with the Chief Constable and the rest of the senior team on 10 August, we had a meeting with the two leads of the main staff associations—the Police Federation and NIPSA—to hear at first hand from them. We wanted to go into the room with the Chief Constable and the senior team armed with knowing about the impact that it had had. We, as a board, have ongoing contact and regular meetings. That was stepped up because of the financial crisis, and, because of the data breach, that has been stepped up even more. We had that meeting with the federation and NIPSA, and, about 10 or 11 days later, we had a meeting with the wider group of Your Voice, which has representatives of a wider group of staff associations, including the Catholic Police Guild, black and ethnic minority police associations, and a range of others. The past few days have been busy, but, at some point in the past week, we also had a conversation with the Police Superintendents’ Association and, again, NIPSA. The federation would have been there, except that that was the day on which its executive committee was meeting. The board members, particularly the political members, bring a knowledge of the impact that that has had on their constituency. We support the policing and community safety partnerships. That is a way of gauging the impact on the community. We have held the staff associations close and will continue to do so as we navigate our way through this. One of the things that I took from our engagement with the superintendents’ association and NIPSA—I am sure that the federation would have felt the same, had it been in the room—is that, in spite of everything that is going on, an awful lot of good work continues to be done by policing on the ground. Look at social media and Twitter feeds. The folk with whom we met want to be a part of rebuilding. They joined the service. It is a vocation. In spite of what is going on, they get up and go to work. We were at the Police Federation bravery awards last week and heard about some of the wonderful work that is being done. They want to work with us and be part of the restoration and rebuilding of confidence. We will be keeping them close.

Chair

I have certainly received submissions. We heard in public session the week before last, when we met initially to discuss this, of an organisation that stated that Assistant Chief Constable Hamilton and former Chief Constable Byrne provided some management but no leadership, and difficult issues, whether misogyny, homophobia or race relations, were seen as being secondary issues and concerns and were left somewhere in the weeds. From your assessment as a scrutinising and overviewing board, is that a fair or partially accurate assessment?

Edgar Jardine

The data breach was a watershed moment for the PSNI. However, as a board, I think that we were conscious for some time that, because of the downward pressure on resources, people were working very hard, and more was required of them than, perhaps, before. That was reflected in an upward trend in absence levels. As the chief executive said, through our regular contacts with the federation chair, we have been aware of morale issues in the PSNI. There was anecdotal evidence from various sources. We were very encouraging and supportive of the PSNI’s undertaking what is called a culture audit to try to move beyond anecdote to get some hard data on how things were. That was commissioned independently, and the Chief Constable had recorded in his annual report that just short of 50% of the workforce responded to that. I understand that the headline findings have been shared within the PSNI, and we anticipate a briefing to the board on those at our October board meeting. They will provide a baseline for action going forward, and I suspect that the incoming Chief Constable will take those on board and run with them.

Chair

Can you share those with this Committee?

Sinead Simpson

The findings of the culture audit?

Chair

Yes.

Sinead Simpson

When we have them, yes.

Chair

This is the final one from me at this juncture. You more than alluded to it, but I just want to drill into this for a moment. We have talked about confidence of the public, we have talked about stability, and we have talked about confidence of staff and officers. There is a Chief Constable who resigns and who, retrospectively, it transpires, did not command massive levels of confidence and support from his officers. There is a recent vote of no confidence in Mark Hamilton. Pausing there, of course, we as a Committee wish him well and a full recovery. Given the severity of the security threat and the history of policing in Northern Ireland, to which you, Deirdre Toner, referred in your opening remarks, it strikes me that the PSNI is at the most critical juncture in its time and that this breach is almost the straw that breaks the camel’s back. It appears to be being run by something that could at best be described as a hybrid of the College of Cardinals and The Magic Circle. The PSNI seems to be entirely dependent on the health of ACC Mark Hamilton and a number of other people involved in running it. This is not a time for governance by committee or cabal. This is a time for firm action and clear, steady leadership, is it not? I accept the constraints that statute places upon you, but the current circumstances could not be described as ideal or as fully meeting the challenges that you face, could they?

Edgar Jardine

We absolutely accept that. As we said in our opening remarks, we took a decision on 4 September, following Simon’s resignation, to enact section 34, as we are required to do. That gives the DCC the authority to take on the functions—

Chair

Forgive me, I think that I referred to him as the ACC. I meant DCC. Edgar Jardine:—of the Chief Constable. Obviously, we looked broadly at what our options might be. In effect, because of the circumstances that we find ourselves in, the only option available to us was to invite the DCC to take on those functions. We fully recognise that there are issues around that. There is an issue of resilience, which came to the fore quite quickly. There are also issues, which we are in continuing discussions with the PSNI about, around authority gaps, as the functions reside with one person. That is an ongoing issue. As you are probably aware, we expect the Northern Ireland Office to take through legislation—

Chair

Yes. Edgar Jardine:—next month, which would give the power of appointment to the Secretary of State. The lack of that power of appointment is a very constraining factor. In fact, when an Assistant Chief Constable retired at the end of July, we had all the systems ready to move to a permanent appointment. However, because we were unable to ratify that appointment through a Minister, we have had to put that on ice until we can get those arrangements in place.

Chair

I am not necessarily asking you to vote for Christmas in answer to this question, but you are right to mention the fact that the Secretary of State will have to take legislation through to give him the powers to appoint a Chief Constable in the absence of Stormont. You will be aware that, in the absence of Stormont, the Secretary of State, as and when the board’s term of office concludes, appoints a new board that has no politicians on it. It is a board of laity, in essence. This is the turkeys-voting-for-Christmas question, so I am not asking you to dramatically fall on your sword in this session: do you think that there would be any merit in the Secretary of State, within that review of the legislation, dismissing you as a board and appointing a new one, maybe with some existing board members on it, and taking the local politicians out as Stormont is not sitting, in order to provide a new Chief Constable, a new board and a new set of eyes?

Sinead Simpson

Would it be safer for the chief executive to answer that one?

Deirdre Toner

Yes, and then I have a comment, too.

Chair

Possibly, because—

Sinead Simpson

Maybe I should lead on it.

Chair

—you will be there come what may, if one presupposes the situation.

Sinead Simpson

Come what may, hopefully.

Chair

I was not suggesting that it should be done. I was merely asking for an observation upon it as an option.

Sinead Simpson

I worked at the Policing Board in the very early days, in 2001. I was at the Police Authority and then the Policing Board for seven years. I went away and came back again. The chair has alluded to it: I know that we are going through unprecedented times and are dealing with complex issues, but the Policing Board has been a resounding part of the policing architecture that Patten put in place.

Chair

Has it been successful? Given what we have been hearing, have you, as a board, discharged the robust overview and scrutiny function? It seems to me that the data breach could be described as the straw that broke the camel’s back, but the camel was being asked to carry a hell of a lot of straws before the data breach.

Sinead Simpson

Edgar can cover the assurances around the data breach. If you set aside the data breach and the leadership issue, which, of course, we are happy to talk about more, there is an awful lot of scrutiny. I do not have an agenda with me, but, as some of our members who are here listening know, our performance committee has a large folder to get through once a month. Our resources committee has a folder of the same size to deal with once a month, and the size of our partnership committee’s folder is not far off that. The board does a ton of scrutiny regularly. We are a small organisation. We have 19 members and just under 50 staff. A fifth of those staff are dedicated to an operational bit of business that does not sit neatly with the rest of the board’s work. There have been many times, in my current role and when I was here previously, when the democratic accountability that comes from having politicians on the board has been its strength. Under the first chair of the board, a lot of business was done by consensus, as it is under our current chair, Deirdre. Politicians bring a lot of on-the-ground knowledge to the table, and we navigate our way through what are, sometimes, very difficult issues, as we are currently doing. The current architecture has stood up to scrutiny over 20-plus years.

Chair

Would you suggest that the Secretary of State keep the board in place while the new Chief Constable and management team get their feet under the table and settle?

Deirdre Toner

Stability and consistency are important at this stage. We have put reviews in place. We need to find out in a variety of ways what happened, with the board and our structures and what works and what does not. It is important to do that. There is no point in second-guessing and asking hypothetical questions. I am not saying that your question is hypothetical; I am just saying that we cannot deal with that. We have to deal with the facts and move on and make sure that we have enough resources and accountability mechanisms to make sure that it works. The bottom line is that—I keep saying it—it is part of the peace agreement. You have to go right back and start looking at where it sits in that process. It has been constructive in keeping peace and keeping policing-

Chair

I was not suggesting getting rid of the board as an entity, merely changing the bums on the seats. I will turn to Claire Hanna, then Carla Lockhart and then Stephen.

Claire Hanna

One of the board’s statutory duties is to secure an effective local police service. How would you rate the board’s performance in that regard?

Deirdre Toner

Sorry, unpack that one. Say that again, Ms Hanna?

Claire Hanna

The statutory duty is to have an effective local police service and to secure that. How would you rate the board’s performance in securing that?

Deirdre Toner

We have a broad remit—there is no doubt about that—in terms of what a policing board can do and also if you look at the website or whatever, but we have a very narrow path when it comes to our responsibilities. Every Chief Constable has to have operational control and operational independence. The board is in a partnership role with accountability but looking at what works and what does not. The board has been effective in doing that. We have had a difficult time, and we have resourcing difficulties with PSNI. Resources are thin on the ground, and that has consistently been the case over a number of years. With a shortfall of £53 million for PSNI as a funding gap, there are limitations on where we can go, and there will be an impact on the ground. That impact is brought forward to the board through the policing and community safety partnerships (PCSPs), the politicians on the board and our structures for reporting to the board through the policing plan. The policing plan is effectively in negotiation with the community about what “good” would look like. Our job is to make sure that the resources are matched against that. We have a huge, ongoing challenge in resourcing the PSNI properly through the tripartite arrangements in terms of what “good money” looks like. The bottom line is that Patten has not necessarily been implemented in full. We were charged with 7,500 officers for a normal society. We are nowhere near that, and we have a big issue with looking at the PSNI and neighbourhood policing and protecting that area. That is a huge issue, and it is a big thing that takes a lot of resources. With the current funding situation, that will be pulled off the ground.

Claire Hanna

There are huge and very profound issues relating to resourcing, as you say, and to morale and everyday policing issues, as people will perceive them, but we are largely focused on governance in today’s session. Do you think that the board is operating as envisaged by Patten?

Sinead Simpson

I will jump in, if that is OK. Yes, I do. In the situation that we are dealing with, I would characterise the board as working hard and dealing with complex issues in an imperfect situation. Under our overall duty of oversight of PSNI and holding to account, the board has done a lot of work, even in the past year when, until recently, the big crisis that we have been dealing with has been the financial crisis. We set the policing plan, as you know, Ms Hanna, for the Police Service. We do regular performance assessments through our committees. We have done a professional standards review, a review of the use of strip-searching, a privacy and policing human rights review, and a review of human rights of police officers and staff. The board has discharged its statutory duties very effectively over the past year and in previous years, and there is a lot of work to point to in our annual report and summaries, which we can share. The current challenge is definitely that: a challenge. We are working our way through it, and, Chair and Members, we want to dispel any notion that we are in any way not taking our duties seriously.

Claire Hanna

Colleagues will pick up on different aspects of those duties. Do you think that the lines of demarcation between the board, the police and the DOJ are adequate and as envisaged in Patten?

Sinead Simpson

For me, the lines of demarcation are set out in a document called the “Management Statement and Financial Memorandum”—MSFM. How that works is that I, as chief executive, and the chair act on a day-to-day basis as a conduit between the board, the PSNI and DOJ. There are probably opportunities to look at those tripartite structures. Indeed, the previous Minister of Justice commissioned a stocktake of the overarching policing architecture, and we will happily re-engage in that, but, on a day-to-day basis, everybody within the structure takes their duties seriously and is working with us to try to navigate the current situation.

Claire Hanna

You have agreed a review of the board, and, in your correspondence, you have indicated that you think that that would be best led by an independent chair or an independent organisation. Do you agree that, to get the fullest level of public confidence, it would be appropriate to use an arm’s length body or a separate body or secretariat for that review?

Sinead Simpson

It is probably best to answer by explaining the board’s thoughts when we discussed that. The first point to make is that, as you know, we have asked the Department of Justice to take forward that review. We recently wrote to the Department of Justice because it came back to us and asked for our views on what exactly we envisage the scope of that review to be. We emphasised the need for independence, and we then gave some suggestions as to what we thought the review should entail. Some of our board members, when it was discussed, very clearly thought that it should be done by an arm’s length body and should be independently chaired and with an independent secretariat.

Claire Hanna

Do you think that, in order to get maximum confidence, the DOJ should be neutral in this regard?

Sinead Simpson

I think that there are organisations that could undertake the review and are sufficiently independent to be able to do that. I do not think that it needs to be done by the Department of Justice, but the ask from the board was to commission it.

Chair

What was the majority view of the board? You said that “some” on the board thought that it should be done by an arm’s length body.

Sinead Simpson

There was unanimous agreement that it should be independent, but as to what that actually meant—

Chair

All the board thought that.

Claire Hanna

That is what I am trying to clarify about that independence. You said that it should have an independent chair or be conducted by an independent body. If the principle is independence and ensuring confidence, do you not agree that you should try to achieve maximum independence, and would you advise that that should happen?

Sinead Simpson

We said in our letter to the Department—I think that this reflects the discussion among members—that we have asked the Department to lead on it, that we think that it should be independent and set out our suggestions for the scope of the review, but we also said that we want to be involved in ongoing discussions with the Department about how it takes that review forward and how it sets it up.

Claire Hanna

Do you think that the Department should be allowed to sign off the terms of reference?

Sinead Simpson

It was the agreement of the board that we should commission the Department to do it.

Claire Hanna

Do you think that the Department is neutral?

Sinead Simpson

We are not asking the Department to do it; we are asking the Department to commission it.

Claire Hanna

You are asking the Department to frame the review. Do you think that that is appropriate?

Sinead Simpson

I can only tell you that that is what board members agreed to do. It is my job to discharge what they have asked to be done.

Chair

Ms Simpson, you are the chief executive. You reminded us that, even if the board were to disappear tomorrow by the strike of the Secretary of State’s pen, you would still be in office.

Sinead Simpson

Yes. Hopefully.

Chair

Ms Hanna wanted to know your view, not the board’s.

Sinead Simpson

It is the role of the chief executive to take forward the direction of the board. That is my job, and that is what the board has asked.

Chair

Did you agree with the board?

Sinead Simpson

Yes.

Claire Hanna

I might come back in, but I am done for now.

Carla Lockhart

Thank you to the panel for your answers so far. The Chair touched on this, but I am certainly none the clearer. Can I ask a simple question: who is actually running the PSNI?

Deirdre Toner

At the minute, we have discharged the PSNI duties to the ACC team under section 34, and that is within the legislative framework that we have and within the legal status that we have.

Edgar Jardine

It is also important that there is a senior executive team, which includes the administrative side and the chief operating officer. As an example of the division of functions, the chief operating officer currently holds the role of accounting officer, which is a very critical part of any public body, and is responsible for all of that side of the house. There is collaboration across the executive team in how work is taken forward. Clearly, operational issues are taken forward by the relevant Assistant Chief Constables.

Carla Lockhart

Okay; thank you. Basically, there are five ACCs; isn’t that correct? The duties are spread out among the five.

Edgar Jardine

Yes.

Carla Lockhart

Do you think that that is a good way to govern the PSNI? Does it send out a clear message to the public that the organisation is being led efficiently and effectively? Every organisation needs a leader.

Edgar Jardine

Of course. The decision of the board on the day that we received the Chief Constable's resignation was for the DCC to take on the responsibilities of the Chief Constable. Within a day or two, the DCC had, as you know, a medical procedure to deal with. Effectively, we had to make a decision as to how we dealt with that. We can only have one DCC at a time. It was a pragmatic decision to deal with an extremely difficult situation, which we hope will be short term.

Carla Lockhart

Do you genuinely believe that your credibility is still intact, given the way that this has been handled and that ultimately—it has been confirmed here today—there are more than five officers responsible and there is no figurehead? Do you not believe that the credibility of the board is in tatters?

Edgar Jardine

The credibility of the board would have been damaged more had we strayed from the constraints of the legislation within which we had to work.

Carla Lockhart

My understanding is that there is clear legal advice from the Department of Justice on the appointment of an external figurehead to the organisation. Has that been considered by the board? Has preparatory work been done so that we can get a handle on this and get leadership back into the organisation?

Sinead Simpson

We have heard a lot of commentary about how it should be easy to just slot someone in, either someone within the service who is acting up or someone from outside who has been brought in. Our legal advice is that that is not possible. Chief Constable is a high office, and you cannot just put someone in without going through the proper appointments process that is set out in section 35 of the legislation. We have not had advice shared with us that supports that we can do anything other than what we are doing. As the vice-chair articulated, we have an arrangement for the leadership of the organisation where the Deputy Chief Constable continues to give authority where needed.

Carla Lockhart

He is not there.

Sinead Simpson

He is still able to give authorities when needed.

Chair

Is he working or not?

Sinead Simpson

He is not working in the office full-time but, when it is necessary for him to invoke his section 34 powers, he gives those authorities.

Chair

In direct answer to Ms Lockhart’s question and possibly to mine, where does the buck stop?

Sinead Simpson

Currently with the Deputy Chief Constable.

Deirdre Toner

The Deputy Chief Constable.

Chair

It is with Mark Hamilton, who does not command the support of the federation.

Edgar Jardine

The support of the federation is an issue for the federation.

Chair

It is a bit wider than that, is it not?

Edgar Jardine

We, as an employer, have other obligations that we need to discharge. As far as we are concerned, we are content for the DCC to carry on that role. May I add to something that my colleagues said? There has been a huge amount of comment about the board and the decisions that it has taken, including from former senior officers. As I listened to it, it struck me a bit that they were dining from an à la carte menu, where they had a range of options to consider. We were dealing with a set lunch menu, with considerable restrictions around what we could do.

Chair

I think that what George Hamilton suggested was illegal.

Edgar Jardine

Sorry?

Chair

I think that what George Hamilton was suggesting is illegal, is it not?

Edgar Jardine

Yes.

Deirdre Toner

That is correct. It does not follow the legislation.

Edgar Jardine

We do not have legislative cover for that. As the chair said in her opening remarks, to make an appointment that was not strictly within the law could be nothing short of catastrophic. That was part of the reason—in fact, that was the reason—why we acted in the way that we did.

Chair

You have played a hand of cards; the trouble is that the cards are horrible.

Deirdre Toner

If you do not mind my interrupting on that, we were at the awards ceremony the other night with a whole range of very brave officers who were doing some amazing and difficult operations: Christmas was being cancelled; they were working 15 or 16-hour days; there were organised crime gangs on the ground; and they had covert operations. If we had followed the ex-Chief Constable’s advice, we would not be in a safe police force. It is our duty as a board to make sure that the legislation is enacted.

Chair

Let us go back to Carla Lockhart.

Carla Lockhart

Thank you. It is my understanding that the permanent secretary at the Department of Justice has questioned, in a letter to the chair, why the board has not deemed it appropriate to move forward with an external appointment to supplement the PSNI’s senior team. Do you stand by the legal advice that you have been given? What discussions are ongoing? Mr Jardine mentioned that the NIO is progressing legislation. Are you aware of that, and are you making preparatory work to ensure that we can bring someone in?

Edgar Jardine

Chair, may I respond to that? We are three different organisations: the PSNI, the DOJ and the board. We each take our independent legislative advice. As a board, we are obliged to work to the advice that we get, and that is as we have described it up to now.

Carla Lockhart

It is fairly serious when the Department of Justice’s permanent secretary says, “No, actually, our advice is”. It is important that the board members have sight of that and are able to discuss and progress it.

Deirdre Toner

We understand that.

Edgar Jardine

We are depending on our legal advisers to come together and come to a view on this. It is not something that we can override.

Carla Lockhart

We are depending on a police force that is fit for purpose and led by someone who can go out and support the officers that you mentioned today. They are all in our constituencies. They are doing absolutely sterling work, yet their morale is in their boots because of what is happening at the head of the organisation. The point was made, Mr Jardine, that there was a watershed moment with the data breach. I would go further: there have been a lot of watershed moments in recent days. There has been the handling of the Bobby Storey funeral, the Ormeau Road and the data breach—the list goes on. People’s opinions out there are low, and it is time that the board got a handle on that, came out and made it clear that it is going to get a handle on the leadership of the organisation.

Chair

I will pick up on what Ms Lockhart said. I am surprised that I am not seized by a sense of urgency when set against the magnitude of the events at hand, which you have referenced and clearly acknowledged. There is a sort of toing and froing between the board and the Department of Justice as to how an inquiry should run, whether it should be at arm’s length, who should chair it and whether it will be independent. Ms Lockhart referred to this issue as well. It was the Duke of Wellington who said, “Publish and be damned.” Sometimes, you have to be a little bit high risk: seize it to drive the agenda forward to deliver confidence and stability. I am picking up formality and process, and I am picking up statute law. As somebody who makes statute law, maybe I should not criticise that, because I empathise entirely with the legislative straitjacket into which you as a board have been placed. I am not, however, picking up—colleagues can correct me if I am wrong—a sense that anybody is bashing down somebody’s door, whether that be the Secretary of State or the permanent secretary of the Department of Justice, to say, “For the love of God, do you not understand how important this is? We cannot just let it roll over until the next meeting”. It seems to be a case of, “We will have a little report on that for the next meeting, and then we will have an exchange of letters and allow two lots of barristers to come together to see if they can find common ground on two competing opinions on a point of law.” Where is the urgency?

Sinead Simpson

I will try to answer that on a couple of fronts. The board showed urgency around working to get a permanent Chief Constable. Within a matter of days, we had started that process, and the panel met.

Chair

With respect, that is rebuilding the house. You are almost consulting architects for the rebuilding of a house whilst that house is on fire.

Sinead Simpson

On dealing with that, I was just trying to articulate that, for us, there is a longer-term goal as well, which is to have a permanent Chief Constable in place quickly. Concerning other options, we talked about the letters that have been exchanged. Our legal advisers have had conversations with the Department and with the PSNI’s legal advisers, and they remain of the opinion that the advice that they gave us stands up to scrutiny and that we cannot do anything other than what we are currently doing. If someone were to dig deep into a set of regulations and find something that tells us that we can do more than we are currently doing, the board would absolutely be open to that. On working at pace, we have had conversations with the NIO and the College of Policing to explore how quickly we could have an interim appointee in place. It is not that we would appoint them and run roughshod over the legislation, but we are exploring whether the Secretary of State could appoint them.

Chair

Yes.

Sinead Simpson

There is a lot of work going on behind the scenes. There is a lot of urgent work. We are doing what we can that is legally possible, but all the other options remain on the table, and, if we can find a legal way of navigating those, we will do.

Chair

Those are being energetically and actively investigated?

Sinead Simpson

Absolutely. I apologise if we are not giving that impression.

Chair

Carla, you wanted to come back in, and then I wanted to bring in Stephen Farry.

Carla Lockhart

Thank you for that clarity. It is important, and I think that it is important that people hear that today. I mentioned the watershed moments and gave examples of where there has, I believe, been more than one such moment. The big issue, particularly in the PUL community, is political policing and Judge Scoffield’s judgement on the Ormeau Road incident. Do you realise the magnitude of that within the community that, predominantly, I represent? Do you understand that people feel that absolutely nothing has changed within the organisation to give them confidence that that will not continue into the future?

Deirdre Toner

I can appreciate that; there is no doubt about it. I will go back to the point about urgency. That is part of a whole series of areas that we discuss day in, day out with the politicians on the board, as well as what that looks like in terms of a judgment. An appeal to that process is going on, so one would have to be careful about the legal issues around that.

Sinead Simpson

It may be worth adding to what the Chair has said. Without commenting on what is in the judgment—the judge made the statement that he made, his judgment stands, and we have to work with it―there was a considerable debate on this around the board table. I suppose that, along with other issues, that was the reason why the board asked the Department to commission the review that it did. Picking up on the points that you made, that review will look at the issues referred to in the Scoffield judgement as they relate to the operation of the board and at whether, in this instance, the board respected the respective legislative duties of the board and the Chief Constable. It will also review codes of conduct for Policing Board members and senior staff, with particular reference to working practices between them and senior PSNI staff, as well as issues of confidentiality and the corpocracy of the board. There is another aspect to the terms of reference, but the review that the board has asked the Department to commission will address some of those issues.

Carla Lockhart

Mrs Simpson, it is not just a case of, “This is what the judge has said: we’ve got to work with it.” You have got to unpick it, and you have got to clearly get to the bottom of what has been happening in the organisation and what has been going on with political influence to result in a judgement that there has been political policing and two-tier policing. This is huge. So, it is not just about how to work with that comment, because that comment absolutely undermines the entire force, unfortunately—or the leadership of the force.

Sinead Simpson

I know, and I do not underestimate that.

Chair

Somebody mentioned the word “appeal”. Is the right of appeal against that judgement still on the table?

Sinead Simpson

I understand that it is, yes.

Chair

Who would take the final decision to appeal the judgement and in what time frame?

Sinead Simpson

The PSNI senior team. The time frame is, I think, six weeks from when it came out.

Chair

That is fast approaching.

Sinead Simpson

Yes.

Chair

What is your understanding of the current thinking on that?

Sinead Simpson

We have not got any.

Chair

It is quite a big decision for a quintet of leaders to arrive at, is it not? That is a buck that nobody would want to stop with them.

Edgar Jardine

Equally, Chair, it is not one that we, as a board, should engage with.

Chair

Fair point. Thank you.

Stephen Farry

Good afternoon, everyone. In some sense, it is very useful for you to set the record straight on what is doable and not doable, within the current legal framework, in terms of the HR issues. Nonetheless, first, I want to come back to the point about the senior team. I appreciate that this is not an optimal scenario and that it is not something that you have, necessarily, fully designed. We have a situation where the DCC is, essentially, dipping in and out from his sickbed, for want of a better description. We have the ACCs covering, on a more day-to-day basis, the making of decisions. How does that system work in practice? Obviously, every ACC has their own defined role, but there will be times when they have to come together for collective decisions. There are issues around who does various rotas to provide cover. Who is in a position to arbitrate and make those decisions, especially when there may well be a dispute between the ACCs on how to go forward? They might well resolve that amicably but, nonetheless, they will have different positions. Further to that, we could see a situation over the coming days—I hope that it does not happen—where we have another crisis. Is the current system sufficiently robust to handle the fallout if something happens? It may well be something entirely external, such as a major security incident, but is the system fit for purpose? Deirdre mentioned that the DCC is considering whether to designate somebody. How quickly can that be brought to a head as part of that answer?

Sinead Simpson

To answer the latter part of your question, Dr Farry, that can be made to happen within a matter of days. Discussions are ongoing between our legal advisers and the PSNI’s legal advisers. On the broader question about the robustness and resilience of what is there, as we have said, it is not perfect, but it is the only legally possible situation that we can create at the moment. As I said in answer to other questions, we continue to explore those other options in terms of –

Stephen Farry

I fully respect that. Nonetheless, there are things that can be done to tighten the current situation up. If you were running a risk register over the current governance situation, the result would be a dark, dark red, by any stretch of the imagination. I suppose that it goes to the Chair’s point about urgency. Surely those issues need to be hammered down immediately rather than in a day or two. Something could happen today or this evening.

Edgar Jardine

Take the huge arms and explosive find last week. There you had two ACCs with different aspects of that operation standing side by side explaining the different roles in it. I suspect that that would have happened in any case, but it was an illustration of how the system works. ACC Bobby Singleton followed up and went up to Londonderry.

Stephen Farry

With respect, that is happening with the goodwill of the ACCs, who are trying to work the system, but that has not been stress-tested fully. It is an ongoing governance problem.

Edgar Jardine

I recognise that.

Sinead Simpson

For us, the bottom line is that, until the Secretary of State has the powers to ratify an appointment, the situation is that we need to hold. There are no other legal opportunities or ways in which we can change that situation.

Deirdre Toner

I will take it back a little bit on the assumption that that is the only time that they will be dealing with a crisis. They have dealt with so many other areas, and they work together very closely, from what we can see when they come to the board.

Stephen Farry

There is always a line of command or a clear line of authority. That is the point that I am making.

Deirdre Toner

The competence, capacity and capability of the current senior executive team has been tried and tested over a range of different areas. There is a governance structure that is fairly tight in how the team works together and coordinates areas and resources that they need for areas as well. When they come to the board, they state that quite clearly, and the delegated authority from the Chief Constable to the DCC. They work as a collegiate team in that way. It is not an unusual situation. Granted, it is not perfect, as my colleagues said, but we have no Assembly, we have no Minister of Justice and we have no other option.

Stephen Farry

I appreciate that, Deirdre. I will follow up with a question from a slightly different angle about the role of the board. Where do you and your colleagues see the balance between, on one hand, what could be described as oversight and scrutiny versus being almost like a friend to the PSNI and advocating for it at times? Sometimes there can be a tension, and sometimes there can be harmony. Where do you see the balance lying between those two different approaches?

Deidre Toner

That is a fair ask. We know that it is a difficult job, and I am starting from that point. We know what our role is in being able to have oversight of that in terms of our statutory role and the clinical legislative end of it. These are, however, humans dealing with very human issues on the ground. When we set up our structures to work with them across partnerships, resources, different consultations with communities and their work with communities, there is a human aspect to that. They bring that to bear in how they feed information to us about what does and does not work, what good, bad or indifferent would look like and what good quality looks like. There are separate lines when it comes to operations, no doubt, because, if we were to stray into that, we would not need a police force. We would be taking decisions, and that is not right. There is a separate operational ability, but that does not mean to say that you cannot— They can reflect the different situations that they have, and that comes forward to a board of 19 members who represent and are representative of the community across the five parties and also through their work on the ground with PCSPs as well. There is a flow across some of the areas when it comes to being able to be aware of what each other’s responsibilities are.

Edgar Jardine

I will add an illustration to that. As you know, we have a very serious financial situation at the moment. As a board, we spent virtually a full meeting in July on this issue. We saw it as our role to assess those arguments that were coming up from the PSNI and, being convinced of their validity, we took the issues up directly with the Department and, indeed, the Secretary of State and the NIO. That was a case where it was not just a blanket agreement with what the PSNI said. We talked through with it the various implications of the resources. I am not sure whether we will get on to that.

Stephen Farry

Absolutely. We are only on question 1, for the record. We will pick up the pace now.

Edgar Jardine

Yes. There was a funding crisis before there was a data breach crisis. There is still a funding crisis, and there will still be a funding crisis when this is finished. There are areas, and I suspect that if you talk—

Chair

Given that we are undertaking work on the financing of public services, we appreciate the pressures that existed and that those have been exacerbated as a result of the potential compensatory nature that flows from the data breach. However, the purpose of today’s session is to focus on the board, the breach and what will happen going forward, not to delve deep into that legitimately pressing issue of pounds, shillings and pence.

Stephen Farry

Before moving on to the detail of the breach, Chair, I want to go back quickly to Sinead. Just remind me of what you said, Sinead, about the terms of reference for the review that the board has sought from the Department?

Sinead Simpson

We can get copies of that—

Stephen Farry

That would be helpful.

Sinead Simpson

—and indeed, copies of the chair’s opening remarks, which I brought and which, apologies, I should have given to you.

Chair

I remind everyone, whilst you are finding that, to restrict themselves to titles and surnames, rather than Christian names.

Stephen Farry

My fault. I apologise.

Sinead Simpson

Just to check, Dr Farry, do you mean the review of the board?

Stephen Farry

Yes.

Sinead Simpson

The suggestions that we have put forward to the Department are: review how the Policing Board carries out its legislative duties in holding the PSNI to account and in ensuring an efficient and effective policing service; review issues referred to in the Scoffield judgment as they relate to the operation of the Policing Board and whether, in this instance, the board respected the respective legislative duties of the board and of the Chief Constable; and, finally, review the codes of conduct for Policing Board members and senior staff, with particular reference to working practices between them and senior PSNI staff, as well as issues of confidentiality and the corpocracy of the board.

Stephen Farry

That is all very helpful in so far as it goes, but, as the Chair alluded to earlier—this is not quite as dramatic as what he said about reappointing the full board—issues have been raised about the board, 25 years on from Patten. It was set up as a hybrid quite deliberately, which is slightly at odds with other arm’s length bodies and how they fulfil roles. Has the board considered the terms of reference being wider than what you have set out, Mrs Simpson? That is all very internally focused. Are there issues around the make-up of the board—the composition and the balance of skills? If we are going to go for a review of the board at this stage, surely all those issues should be on the table, rather than dealing with only some of the issues?

Edgar Jardine

In the absence of political institutions operating, Dr Farry, that is probably not where we want to go. In the context in which we are working at the moment, the terms of reference are more specific deliberately.

Stephen Farry

In that sense, Mr Jardine, would you welcome a wider review at a time when we do have political stability here?

Edgar Jardine

Not only that. As was alluded to earlier, prior to the Minister leaving post, work had commenced in the Department of Justice. There is a board; there is the Criminal Justice Inspection Northern Ireland; there is an ombudsman; and there is a whole range of regulatory institutions, so it makes perfect sense, after 25 years, to ask the question: is that still the best architecture going forward?

Stephen Farry

That is fine. Thank you for that. I want to move on, Chair, to my next line of questioning. I want to get into some of the detail around the data breach, which, on the surface, seems to have involved some fairly basic errors in the use of Excel. I appreciate that there is a review under way that will report soon, but, from the initial discussions, does the board have a basic understanding at this stage of how that state of affairs was allowed to happen?

Sinead Simpson

I will take that one. Our understanding to date, Dr Farry, is pretty much that which was outlined by ACC Todd to the Committee. I want to emphasise that the board will look to the final report of the independent review for its conclusions on how it happened. Apologies for repeating evidence that has been given to the Committee. Our understanding is that a straightforward FOI request was responded to, and attached to that answer was an Excel spreadsheet that should not have been there. It was quite a straightforward request and a straightforward answer, but there were huge consequences when that information was placed wrongly in the public domain. As for how, why or whether that should have happened, we hope to get those answers from the review. I want to emphasise that the gravity with which the board held that when it happened was shown in our subsequent review.

Stephen Farry

We have heard comments about the format. There are different means of providing data that can be manipulated, which do not necessarily require Excel. Is that essentially part of this?

Sinead Simpson

We have asked the review team to look at how this request was handled and, indeed, how they handle a lot of requests. Excel sheets are used widely across the public sector and the Police Service, but we need to look at whether they should be, going forward, and whether that complies with best practice. Those are aspects that we expect the review to report on.

Stephen Farry

Sure.

Chair

Sorry, Stephen. Before we move on, the Committee has taken some helpful external advice on this issue following Mr Todd’s appearance before us. You have referred to the straitjackets of statute that the board is in. Section 11(1A)(b) of the Freedom of Information Act states that, when a database is provided electronically, it must be provided in a reusable form “so far as reasonably practicable”. We are advised: “Excel is proprietary, commercial software that is not a re-usable format.” So, Excel should never have been used in a response to a FOI request, should it?

Sinead Simpson

It has been widely used.

Chair

It may very well have been widely used, but my question is that it should not have been used, should it?

Sinead Simpson

The board will look to the conclusions of the review team on whether it should have been used and how we go forward.

Chair

Maybe there is a reason why Excel should not be used. The note that we have received states: “any requested datasets should be converted from Excel to the open-source .CSV format for the purpose of fulfilling obligations under the FOIA. This format also has the added advantage” and this speaks to your best practice point “of ‘unhiding’ any hidden rows and columns and, because only one page can be converted at a time, it forces the user to manually separate multiple sheets before conversion. If the user tries to save a spreadsheet with multiple sheets into the .CSV format they get” an error message.

Sinead Simpson

Yes. If I am correct, all that comes from the Information Commissioner’s Office website: there is a guide there on how to disclose information safely; that text sounds familiar. We are expecting the review to look at the extent to which that was complied with and, if not, why not.

Chair

It was not complied with, was it?

Sinead Simpson

And why not.

Stephen Farry

Has the board looked at the interim situation? If the board has looked at it, is it happy with the interim measures that the police have put in place to try to manage their FOIs?

Sinead Simpson

The board has certainly been briefed on the interim measures. On 10 August, 22 August and, more recently, 7 September, we got updates from ACC Todd and the chief operating officer on the recovery. We have certainly been briefed on those. However, we have asked the review team to advise us on their efficacy and the enduring nature of some of the immediate steps that they have taken. We will look to them to advise us on that.

Chair

What is the time frame for that advice?

Sinead Simpson

November; we expect that report to come in in early November.

Chair

Should I go back to my word, which was echoed by Ms Lockhart, I think, and others? It is a word that begins with “u” and sounds a bit like “urgency”. You say that you expect it some time in November. Again, given the scale of confidence and stability, that does not sound urgent.

Sinead Simpson

The data breach occurred on 8 August. The board met on 10 August and had commissioned an independent review by 22 August. We had a hot debrief from the team last week.

Chair

I take all of that. As I understand it, the review that you are expecting in November is a review of the efficacy, appropriateness and potential permanence of the new arrangements, inter alia, for handling FOI requests received by the PSNI. We are about halfway through September, and we are talking about the management of data—probably, one of the most sensitive, possibly most sensitive, issues that your officers and people in the field are concerned about—and a review of the efficacy of the arrangements put in by Mr Todd is expected in November. I make the point again, as politely, gently and kindly as I can: I am not picking up a sense of the urgent here. Surely one of the key things that PSNI staff would love to hear is, “We as a board have confidence that how the PSNI is handling your data is now robust, watertight and safe”. It is not closing the stable door after the horse has bolted, nor is it able to undo the error of the data breach, but that has to surely be the No. 1 way of restoring confidence amongst officers.

Edgar Jardine

Chair, it is perhaps worth pointing out that action was taken very urgently afterwards to change the format in which data was released. In addition to that, ACC Todd told us that they had gone through all the data that had been released in the past couple of years and checked that there were no other possible breaches. In addition, as the chief executive said, we had our first hot debrief last week. There will be a continual flow back into the PSNI of the findings, so, if there are urgent issues, I would fully expect the PSNI to pick up on those and deal with them. We are talking about a final report in November.

Stephen Farry

Ms Simpson also referred to the Information Commissioner’s Office. It is our understanding that, in the spring of this year, the ICO did an audit of the PSNI’s data governance and found only limited assurance of data protection compliance and considerable scope for improvement. Was the board aware of that at the time? What communication was there to the police about those limited findings?

Edgar Jardine

We certainly were aware that the ICO had been with the PSNI, a couple of years ago, looking at the management of FOIs. The report went on its website relatively recently. That will be a critical report for the review team, because we will need to find out from it what action needs to be taken to address the ICO’s recommendations.

Stephen Farry

It does rather beg this question about the timeline: could the data breach have been prevented if the systemic problems had been highlighted in advance but not yet acted on before the human error kicked in?

Edgar Jardine

In these data breaches, there are usually three components: a human component, a systems component and a technology component. The role of the review will be to explore all three of those and to make recommendations. It is quite interesting that the leader of the review said that, when they do this type of review, they find recommendations that not only are relevant to the organisation that they are working in but are learning that can be used by other police services. This will be a very valuable piece of work for police services across the UK.

Chair

Ms Hanna wants to come in, but on that point, Dr Farry referenced that the Information Commissioner identified weaknesses in how data was handled in the spring of this year. Is there an audit trail of how that commissioner’s report was submitted to the PSNI, how it was reported to you, as a board, and how the board asked to be updated on and would monitor the PSNI’s operational response to that concerning critique by the commissioner?

Sinead Simpson

I cannot answer on the notification from the ICO to the PSNI, but, on the notification to the board, the normal procedure for reports like that is for us to seek an update for one of our relevant committees—in this case, probably the performance committee—on what the PSNI planned to do to respond to the report. That has been commissioned, and we will schedule that for one of our performance committee’s meetings in the coming months.

Chair

The commissioner’s report comes in in the spring.

Edgar Jardine

It was commissioned in the spring. It just reported, literally in the last—

Sinead Simpson

Couple of weeks?

Edgar Jardine

—couple of weeks.

Chair

That was the first time that you were aware that the Information Commissioner had concerns about the handling of data.

Sinead Simpson

Yes.

Chair

A few weeks ago, but prior to the data breach itself?

Sinead Simpson

No.

Chair

Subsequent?

Edgar Jardine

Subsequent.

Chair

Subsequent to. Okay; thank you.

Sinead Simpson

It might be worth saying that in the governance arrangements of which we are a part, certain assurances are made by the police to us. We get a statement of assurance through the Chief Constable in the annual report, which goes to our resources committee. There are extensive internal audit arrangements in place from which the board derives an assurance. As the vice-chair said, there has been scrutiny and assurance of this area. Up until the most recent report to which you are referring, there have been clean bills of health that we have relied upon. Obviously, this has led all of us to question that. One aspect of the terms of reference of the review will be whether the governance arrangements and assurance provisions are adequate.

Chair

Mr Jardine gave us the triangle of reasons why these data breaches could occur. It is probably fair to say that we have heard from the PSNI, in media performances and elsewhere, the data breach being attributed to all of them, but not at the same time. Arguably, it could be all three. It could be a cataclysmic sort of failure. I just wonder whether the board has looked at this? I preface that remark by saying that I am not a conspiracy theorist—I do not think that anybody on this Committee is―but four pairs of eyes within the PSNI respond to and publish a response to an FOI request within two days of its receipt. That follows a complaint from the commissioner that requests were not being dealt with in a particularly timely way. Mr Todd told us that the quick response was in part because it was an easy request to answer. As we understand it, it was merely how many people hold each rank in the PSNI. The commissioner does not triage and measure success on the speed by which an organisation responds to easy, difficult or moderate requests. It is merely the order in which they are received, so we remain to be convinced about why this one had to be answered within two days. We also have concerns―we would be interested to know whether the board has these concerns as well―that four pairs of professional eyes do not notice the breach. Yet within 20 minutes of publication, a recipient of the information, who, as we understand from the testimony of Mr Todd, was also within the organisation, notices that the data breach has taken place. However, in two days of preparing this response, none of those involved in its preparation did. Now, you can take a cock-up and you can take conspiracy, and you can probably find a hybrid of the two, but that is a very peculiar set of circumstances. If you were taking that to the producer of a political drama on the telly, I am not sure that they would say that it rings true.

Edgar Jardine

On the first point about the timing, I am not surprised that it was turned around quite quickly, because it was the most basic of basic requests, really. On the second―

Chair

The PSNI could have found itself at fault by taking the view, “I’m going to deal with an easy one, but I’m leaving three really difficult ones in the in-tray,” and then not dealing with those in a timely fashion. Simplicity of request is not a KPI against which the respondent on the FOI is marked.

Edgar Jardine

The KPI is 90%, I think, within the allotted period. That is what we achieve at the moment. On the other issue, we certainly have no evidence to suggest a conspiracy theory.

Deirdre Toner

It is fair that we let the review that we have set up run its course. I am not trying to insult the Committee in that regard at all.

Chair

It takes a lot to insult us; do not worry.

Deirdre Toner

It is appropriate. From the assurances in a verbal briefing that we got, we are comfortable that that was not the case. Secondly, when that draft―

Chair

Sorry, when what was not the case?

Deirdre Toner

Conspiracy issues. We are getting that feedback from our debrief. We have tasked them to do x, y and z, so we need to let them do it so that we can find out about the triangle of different areas, but there is a whole load of learning right across the organisation, I am sure.

Chair

With respect, which usually means that I am going to ask something offensive—

Deirdre Toner

I know; I was waiting on that.

Chair

—but I am not, Mr Todd told us that he was absolutely convinced that it was not a conspiracy; that it was human or technological error. However, he gave no evidence of an audit trail as to how he arrived at that view. It seems that, in a rather complex mosaic, he arrived at that position in a rather timely way. One could argue that, if other things had been arrived at in such a timely way, we might not have been in this mess in the first place. Not only does it seem that Mr Todd arrived at that at a speedy pace; it also seems that the board, again, has been quite speedy in accepting his assurances that there is nothing to see and that it was human or technological error. Maybe I have misunderstood what you have said.

Edgar Jardine

It is fair to say that the board has not discussed whether it was a conspiracy or otherwise. Like you, we are—

Chair

That is not what we have just heard.

Deirdre Toner

We commissioned the review. We then had a hot debrief from the lead, Pete O’Doherty, on that, with feedback, to find out what was happening in the interim and what lessons are being learned as they go along. That is where we are at. We have not accepted one person’s view of it.

Chair

Maybe we could have a note on the chronology from your chief executive. I do not want to detain us on this point—

Deirdre Toner

Okay.

Chair

—but I am—it might just be me; it probably is—a little confused about how the assessment was made in the PSNI, and by whom; how, when and in what format it was reported to you, as a board; and how you, as a board, reviewed that, scrutinised it and came to a similar conclusion as the person who authored that submission to the board. A detailed note on that would be of help to us.

Sinead Simpson

To clarify, is that a note in relation to our assessment of whether it was a cock-up or a conspiracy, or, more generally, about the data breach? The former?

Chair

You, as a board, and the PSNI have arrived at the position that it was human and/or technological error. That is a perfectly legitimate position to arrive at, but we would quite like a note on the processes by which that was arrived at in the PSNI; how it was communicated to you, as a board; and the internal processes that you, as a board, undertook to review that and accept it in full or in part, to raise questions, or to commission an independent review or whatever else may exist within your powers as a board under statute.

Sinead Simpson

We can certainly provide that. The contention was made to us by the PSNI at the early meetings that it was initially a human error, after which there was an element of system failing, when more than one person was involved. The board has not concluded as to where exactly that is at. We have asked for the review so that it can tell us, and then we will receive the final report. The board has also agreed that, when that report comes in, we will put around us a small group of experts who will help us to analyse that so that we make sure that we get the absolute best outcome from it. We can certainly come back with that.

Chair

That would be helpful to the Committee.

Claire Hanna

In the timeline that the Chair has requested, can we interrogate slightly the idea that it was a very straightforward request and that all that information exists? There are hundreds of officers and people at various ranks who are acting up, so the information on where staff are is not static. Surely that would be an almost constantly changing picture. We are advised that it was answered quickly, because, “A cohort of staff” is an easy answer, but it contained the up-to-date elevations of people, which is not the type of information that you would have expected to be sitting compiled. Secondly, we asked ACC Todd about a piece of advice that had come from the National Police Chiefs' Council earlier in the summer. I understand that it advised specifically against the use of Excel in this scenario. Have you asked whether or not that was communicated to the appropriate data handlers?

Sinead Simpson

We did have a conversation with PSNI about that. It was at the meeting of either 22 August or 7 September. Apologies; I will put that in the note. Apologies for keeping referring to it. As to who received it, how it was communicated and what was done with that information, again, that will form part of the review. It is quite a fundamental part of it.

Claire Hanna

Can you explain why your predecessors as chair and chief executive viewed the bodycam footage from the Ormeau Road incident?

Deirdre Toner

That is the former chair and chief executive, to put that in context. At the time, I suppose it was fair to say that there were political tensions around policing. There is no doubt about that, and there were definitely pressures on policing following Covid, Bobby Storey and Black Lives Matter. Sometimes, there needs to be discussion of operational issues to understand the context and the complexities around some areas. We know that people are contacted, and the chair and chief executive sometimes are a conduit between the Chief Constable and the board, respectfully knowing everybody’s boundaries. We accept that there were real-time operations. There was no doubt about that at the time, and it is not appropriate for the board to be involved or engaged in those.

Claire Hanna

So it was not an appropriate thing to do?

Deirdre Toner

There are real-time operational decisions, and the board should not be involved in operational decisions.

Claire Hanna

Have you in your capacity as chief executive and chair ever viewed, been asked to view or asked to view footage in a similar context?

Sinead Simpson

No.

Deirdre Toner

No, not in my current role.

Claire Hanna

Mr Justice Scoffield addressed this issue and wider issues around operational impartiality in his judgement. Do you recognise the criticism of those actions in his judgement?

Deirdre Toner

We accept the judgement as it is. Circumstances are different at different times, but we accept the judgement as it is.

Claire Hanna

Has the board taken any action or contacted the former chair and chief executive or in any way pursued accountability or an explanation for that incident and for the viewing of the footage and what may be seen as crossing the wires?

Sinead Simpson

We have not. As they are former employees of the board, we cannot go there and demand an account. I do know that they did not feed into the judgement. I honestly do not know whether they would—

Claire Hanna

Is the board considering or has the board considered any actions or any exploration of that?

Sinead Simpson

The discussion that board members had about this issue over a number of meetings was to make sure that, whatever the rights or wrongs of what has gone before, we get it right going forward. As the chair has said, as chief executive, I need to have daily contact with the senior team and DOJ and lots of others. Making sure that you do not cross the line is an important part of that. That is why the board has commissioned that that will be part of the review, but it is very much looking at it from the point of view of going forward as opposed to going back.

Chair

Have any of the three of you been asked by a member of the PSNI senior management team, either serving or past, to give a comment or a prediction on how the board might respond to an operation before it took place?

Deirdre Toner

I have no record of that.

Chair

Mr Jardine?

Edgar Jardine

Not that I can think of. It would be a bit unusual.

Chair

It would certainly be a bit unusual, which is why I asked the question. I am surprised that nobody can answer either yes or no. Let me ask the question again.

Deirdre Toner

I am just thinking. You can ask again.

Chair

Have either of you been sounded out in a quiet corner of a meeting room or whatever about how the board might respond to an operation before the operation took place?

Deirdre Toner

No.

Sinead Simpson

Not before.

Edgar Jardine

No.

Deirdre Toner

I can say, categorically, no.

Chair

That was the answer that I was hoping to hear, which was why I was slightly surprised—

Deirdre Toner

It was not clear. I hope that you do not mind.

Chair

—as to why there was an element of—

Deirdre Toner

No. Absolutely not.

Chair

You would not expect to be.

Deirdre Toner

No.

Chair

If somebody did, you would remind them of the clear blue water that exists between operational and scrutiny issues, and show them the door.

Deirdre Toner

Absolutely.

Chair

To the best of your knowledge, have any political board members been put in a position by their party leadership to do anything on the board or withdraw their support from the board or policing?

Sinead Simpson

I am not aware.

Deirdre Toner

I am not aware. I cannot comment on that.

Chair

Whilst we are on the subject of political responses to this, Mr Todd confirmed that information from the data breach was probably in the hands of dissident republicans and paramilitary loyalists. Have the political leaders of the parties of Northern Ireland, from the top, done enough to send a clear message that, irrespective of what might have happened in the past—when, how or by whom—that the police are not fair game today? We saw it after what happened to John Caldwell, when they stood shoulder to shoulder with Simon Byrne, but we have not seen it since the data breach. Are you disappointed by that?

Edgar Jardine

I think that strong leadership has actually been shown by all the political parties in deploring, first, the fact that the data was out, and, secondly, that it could potentially be used. I think that there has been consistency on that right across the piece.

Deirdre Toner

As well as that, with regard to how we have reacted as a board with our parties in the room, I have to say that every single one of them has been committed to the process and made themselves available completely and utterly. They have been able to bring information on their views to bear and have met quickly and thoroughly to deal with what needed to be done.

Chair

Thank you. Carla, you had a quick supplementary question.

Carla Lockhart

Yes. It is on the conflict of interest, and, maybe, expands slightly on your last question, Chair. What checks and balances are in place to prevent inappropriate engagement between political representatives, or, indeed, any board representative, with the PSNI on operations?

Sinead Simpson

The role of the board is to hold PSNI to account after the fact. There is nothing wrong with having a conversation in the aftermath of an incident around what happened, how it was policed and what the impact on the community was. However, we have always been clear with board members that the Chief Constable has operational responsibility and it is not our role to get involved in advance. I do not know whether that answers your question.

Carla Lockhart

It certainly answers the question, but I suppose that what I am poking at is conflict of interest. It is clearly in the judgment. I believe that there is a clear conflict of interest where a member of the board from a political perspective is referenced in the judgement as having made phone calls to the DCC on 5 February 2021 about the arrest of the suspect and made a public statement calling for their immediate release before the suspect had even arrived in custody. That was Mr Kelly. It is clear that he got involved in operations. With regard to conflict of interest and all that came afterwards, what does the board do about that?

Sinead Simpson

My understanding of it is that Mr Kelly was not acting on behalf of the board on that occasion. He made those representations on behalf of his party. We would get involved only—

Chair

Is he a member of the board?

Sinead Simpson

Yes, he is, undoubtedly, but he was not acting on behalf of the board.

Carla Lockhart

Surely we never have the luxury of not wearing two hats. You cannot just take a hat off and leave it at the door.

Sinead Simpson

Yes. That point was made by Mr Justice Scoffield.

Chair

On that, there are many members of Mr Kelly’s party. It seems to be courting trouble for any member of the Policing Board to say, “Well, I have taken my Policing Board hat off and have come to have a conversation with you as a party member”. Common sense might have said, “Well, one can never take one’s hat off in those circumstances, because you will be scrutinising the PSNI’s work at your next board meeting”. If it was a party submission—party advocacy—it seems strange that it was a member of the party who also happened to be a member of the Policing Board who made those representations, rather than a lay member of the party who had nothing to do with the board.

Sinead Simpson

I point again to the terms of reference of the review. One of them is to review the issues referred to in the Scoffield judgement as they relate to the operation of the board and whether, in this instance, the board respected the respective legislative duties of the board and the Chief Constable.

Carla Lockhart

I assume that you have a conflict of interest policy.

Edgar Jardine

Yes.

Sinead Simpson

Yes.

Carla Lockhart

Do you run checks on that, or do members make declarations when you discuss this in the aftermath?

Deirdre Toner

I have been the chair since January, so I can only tell you what I have done and where I sit with this. I am very firm about what the situation is when we make decisions in the room and crucial things have to happen. It is clear that your job is to be a member of board and that you are here as one of a group of 19 people who are making a decision. There are five parties, and every party has a different political view, but the person in the room is making a decision on the issues that are in front of them. I am categorically clear about the governance responsibility in that. Granted, it has been very difficult during these times, because there is a difference between parties and where they sit on information. I am categorical about the information that is there and that the decision that we are making is absolutely to do with the board and that your responsibility is there.

Carla Lockhart

How can you make a decision on something that you have had direct involvement in? Surely there is a direct conflict—

Deirdre Toner

There is a conflict of interest policy.

Carla Lockhart

How is this conflict of interest being managed? How has it been managed throughout the process?

Edgar Jardine

The board was not asked to, nor did it, take decisions on Ormeau Road in particular, so I am not sure how relevant that is to the board’s business.

Chair

Should Mr Kelly be a member of the board?

Edgar Jardine

Mr Kelly was nominated by his party leader.

Chair

I am aware of that. Maybe it is a question for the chief executive. Irrespective of hats—wearing them, taking them off, locking them in the cupboard or whatever—somebody who sits on the board made, as explained in the judgment, inappropriate and, if you will, ultra vires, communication with senior police officers with regard to an operational issue. That must reflect on the robustness of the board and its independence. In light of the judgment, should his membership of the board be suspended while an inquiry is going on? What is the board’s process for internal suspension or removal, notwithstanding the party nomination? It has brought the board into disrepute.

Sinead Simpson

I am getting into hypotheticals. Ultimately, if it were judged that a political member had breached the code of conduct, the vice chair—he may not know it—has a role in adjudicating on those matters and making a proposal to the Minister. At this point, though, that would go nowhere.

Chair

In the absence of a Minister, to whom would that be made?

Sinead Simpson

It could not be dealt with. The Minister of Justice is the only person who can remove—

Chair

Does any member of the board effectively have a free hand to operate as he or she wishes, in the absence of a Minister to whom a report and the view of your vice chair could be referred?

Sinead Simpson

Yes.

Chair

That is a recipe for disaster, is it not?

Edgar Jardine

It reflects how the Police (Northern Ireland) Act 2000 sits within structures of—

Chair

All the legislation is predicated on a functioning Stormont.

Edgar Jardine

That is it exactly.

Chair

There is no reference to it, other than where it says that, if Stormont is not sitting, the Secretary of State will appoint a board that has no party representatives. Maybe the whole Act should be reviewed because, when we have these prolonged interregnums of non-existence, in terms of value to the taxpayer, underscoring and underpinning transparency, accountability and stability, the lacunas are so massive. It is not the fault of the board; it is the fault of the drafters. By definition, the number of open own goals that can be created by that is legion. It is a very unsatisfactory position for you to be in. You arrive at a position on a colleague of yours on the board, and you have nobody to whom you can submit the report to adjudicate on that.

Edgar Jardine

As you say, that is the fallout from not having our institutions.

Chair

Something tells me that the legislation that the Secretary of State may bring to the House may be subject to some amendment, or at least probing amendments. Carla, had you concluded?

Carla Lockhart

Yes.

Sir Robert Goodwill

The Chairman described the data breach as the straw that broke the camel’s back, and, for that situation to occur, that camel has to be fairly heavily laden already. From what I have heard this afternoon, I might describe it in a different way in that the board was asleep at the wheel and was woken with a jolt by the data breach. There was possibly a degree of complacency or an attitude of business as usual permeating it. Those who might make that allegation might use as evidence the fact that, as recently as May this year, the former Chief Constable’s contract was extended for three years. That does not necessarily sound like an organisation that has a lot of outstanding issues that it needs to address, and we have heard that urgency has not been applied in those cases. How do you respond to those allegations?

Deirdre Toner

I will take you back to the suggestion that we were asleep at the wheel. I refute that. We have a very tight responsibility to hold the Chief Constable and his team to account. There is no doubt about that. We are set in a difficult legislative environment. The PSNI has x amount of resources, and we have a populated policing plan to make that happen. The Chief Constable was assessed on his achievements against the policing plan, and the performance was more than satisfactory based on the indicators in that plan. I will put that aside. We have scrutiny across a range of areas. I am not saying that it is death by committee. The committees are set up deliberately to look at information and to request and put pressure on the PSNI to give us the right information to make sure that it knows that what it is doing is working or what the gaps are in an area. We have set powers to make requests, and we do not want to dip into operational matters. This is an operational matter, but it is a big issue for us all. We do not underestimate the consequences of that. We have that scrutiny role, but we are also conscious of the fact that we consult, look at legislation and work with different sorts of organisations to make sure that we have enough information to examine what is appropriate to come to the board and what we can report back on.

Sir Robert Goodwill

Are you saying, in effect, that, although we have heard about the lack of urgency in addressing data management, the Ormeau Road situation and a number of other issues, the main policing objectives were being delivered and that that underlined the need for continuity in the appointment of the man at the top?