FOI/202000040630 · FOI · clarification
Contract for Hosting Build Support with IBM: FOI release
Information requested
The Scottish Government's contract for Hosting Build Support with IBM - see here: https://www.publiccontractsscotland.gov.uk/Search/Search_Print.aspx?ID=JUN322535 Could you please provide me with the original ITT documents, any clarification Q&As, and any responses from all suppliers? If possible, it would be helpful to see the names of the suppliers, however if not, keeping the questions/answers anonymised is completely fine.
Response
I enclose a copy of some of the information you requested.
The information you have requested is attached separately in this email, however, while our aim is to provide information whenever possible, on this occasion we are unable to provide some of the information you requested as exemptions under the following sections of FOISA apply to that information: s.28(1) (relations within the UK [where disclosure would otherwise prejudice relations between the SG and another UK administration])s.33(1)(b) (Commercial interests) s.38(1)(b) (Personal data relating to third party) s.30(c) (Prejudice to the effective conduct of public affairs) The reasons why those exemptions apply are explained in the Annex A to this letter. ANNEX A REASONS FOR NOT PROVIDING INFORMATION Exemption apply, subject to the public interest test Section 28(1) – relations within the UK [where disclosure would otherwise prejudice relations between the SG and another UK administration]
An exemption under section 28(1) of FOISA (relations within the UK) applies to some of the information requested. This exemption applies because disclosure would, or would be likely to, prejudice substantially relations between the Scottish Government and the UK Government as it would reveal detail on their data and systems that could give a malicious actor insight in to their environment and leave them open to a target of attack. Disclosure of this information will mean that the Scottish Government would be likely to compromise their information and the UK Government are likely to be more reluctant to allow communication with the Scottish Government in future. This exemption is subject to the ‘public interest test’. Therefore, taking account of all the circumstances of this case, we have considered if the public interest in disclosing the information outweighs the public interest in applying the exemption. We have found that, on balance, the public interest lies in favour of upholding the exemption. We recognise that there is a public interest in disclosing information as part of open, transparent, and accountable government, and to inform public debate. However, there is a greater public interest in maintaining close working relationships between the Scottish Government and the UK Government, and in protecting their information, such as their technology, systems and data they use. There is no public interest in disclosing information when that will damage relationships and disrupt future communications.
Exemption apply, subject to the public interest test Section 30(c) – substantial prejudice to the effective conduct of public affairs An exemption under section 30(c) of FOISA (prejudice to effective conduct of public affairs) applies to some of the information requested. Disclosing this information would substantially prejudice our ability to carry out the effective conduct of public affairs. Providing details about the information you have requested could subsequently be used by threat actors, taking into consideration both the external and insider threat, to evade any controls we might or might not have in place. This could therefore enable them to target specific types of attack or and would constitute substantial prejudice to the effective conduct of public affairs in terms of the exemption.
This exemption is subject to the ‘public interest test’. Therefore, taking account of all the circumstances of this case, we have considered if the public interest in disclosing the information outweighs the public interest in applying the exemption. We have found that, on balance, the public interest lies in favour of upholding the exemption. We recognise that there is a public interest in disclosing information as part of open, transparent and accountable government. However, there is a greater public interest in protecting the process of the information being withheld due to the risk associated with revealing information that could be used to compromise Scottish Government Systems where if compromised would impact upon the Public’s confidence on conducting public affairs and ensuring that the Scottish Government is able conduct this aspect of its business effectively.
Exemption apply, subject to the public interest test Section 33(1)(b) – commercial interests An exemption under section 33(1)(b) of FOISA (commercial interests) applies to some of the information requested. This exemption applies because disclosure of this particular information would, or would be likely to, prejudice substantially the commercial interests of IBM. Disclosing this information would be likely to give IBM’s competitors an advantage in future similar tendering exercises, which would substantially prejudice IBM’s ability to submit competitive tenders and so could significantly harm their commercial business.
This exemption is subject to the ‘public interest test’. Therefore, taking account of all the circumstances of this case, we have considered if the public interest in disclosing the information outweighs the public interest in applying the exemption. We have found that, on balance, the public interest lies in favour of upholding the exemption. We recognise that there is a public interest in disclosing information as part of open and transparent government, and to help account for the expenditure of public money. However, there is a greater public interest in protecting the commercial interests of companies which tender for, or enter into, Scottish Government contracts, to ensure that we are always able to obtain the best value for public money.
An exemption applies Section 38(1)(b) –personal data of a third party An exemption under section 38(1)(b) of FOISA (personal information) applies to some of the information requested because it is personal data of a third party, ie names, contact details, work experience of individuals, and disclosing it would contravene the data protection principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act 2018. This exemption is not subject to the ‘public interest test’, so we are not required to consider if the public interest in disclosing the information outweighs the public interest in applying the exemption.
About FOI
The Scottish Government is committed to publishing all information released in response to Freedom of Information requests. View all FOI responses at http://www.gov.scot/foi-responses.
Detected exemption language
The information you have requested is attached separately in this email, however, while our aim is to provide information whenever possible, on this occasion we are unable to provide some of the information you requested as exemptions under the following sections of FOISA apply to that information: s.28(1) (relations within the UK [where disclosure would otherwise prejudice relations between the SG and another UK administration])s.33(1)(b) (Commercial interests) s.38(1)(b) (Personal data relating to third party) s.30(c) (Prejudice to the effective conduct of public affairs) The reasons why those exemptions apply are explained in the Annex A to this letter. ANNEX A REASONS FOR NOT PROVIDING INFORMATION Exemption apply, subject to the public interest test Section 28(1) – relations within the UK [where disclosure would otherwise prejudice relations between the SG and another UK administration] An exemption under section 28(1) of FOISA (relations within the UK) applies to some of the information requested. This exemption applies because disclosure would, or would be likely to, prejudice substantially relations between the Scottish Government and the UK Government as it would reveal detail on their data and systems that could give a malicious actor insight in to their environment and leave them open to a target of attack. This exemption is subject to the ‘public interest test’. Therefore, taking account of all the circumstances of this case, we have considered if the public interest in disclosing the information outweighs the public interest in applying the exemption.