Request
I wish to submit a request to the organisation around their hosting contract(s) with 3rd party providers.
For the different types of hosting services, can you provide me with the following information:
1. Type of hosting – Dedicated, Co-Location, Cloud Hosting, Other?
2. Who is the supplier of the contract? If possible can you also provide me with the name of the vendor, if applicable?
3. What is the annual contract value for each contract?
4. What type of cloud environment?
Private Cloud- a distinct and secure cloud based environment in which only the specified client can operate.
Public Cloud – where cloud services are provided in a virtualized environment, constructed using pooled shared physical resources, and accessible over a public network such as the internet.
Hybrid- integrated cloud service utilising both private and public clouds to perform distinct functions within the same organisation.
5. What is the original start date of the contract agreement? If there are more than one contract please provide me with the start date for each contract.
6. What is the actual expiry date of the contract agreement? If there are more than one contract please provide me with the expiry date for each contract.
7. When will the organisation plan to review this contract? If there are more than one contract please provide me with the review date for each contract.
8. What is the contract period in years? Please include whether the agreement has any extension periods?
9. What services are provided under the contract? Please do not put hosting information such as web hosting, file storage, hosted application. The more information the better,
10. Can you please provide me with the contract officer responsible for this contract? Complete contact details if possible name, title, contact email and number.”
Outcome
Some information provided.
Response
1. Type of hosting – Dedicated, Co-Location, Cloud Hosting, Other?
The National Archives only holds public cloud hosting contacts. There are no Dedicated or Co-Location hosting contracts.
2. Who is the supplier of the contract? If possible can you also provide me with the name of the vendor, if applicable?
Disclosing suppliers and vendors may reveal information that would prejudice the prevention or detection of crime and is exempt under section 31 (1) (a) of the FOI Act.
3. What is the annual contract value for each contract?
Information regarding our contracts valued over £10,000 plus VAT is exempt under Section 21 of the FOI Act as it is already in the public domain. To assist you in locating some of this information, please review the links below:
https://www.contractsfinder.service.gov.uk/Notice/7fd8b1e8-e3aa-4efc-aab0-85568907f01c
https://www.contractsfinder.service.gov.uk/notice/835027d5-0b40-4343-825c-ead0e25b23dd
Tenders and contracts – The National Archives
Contracts Finder – GOV.UK
Information on any live contract valued under £10,000 plus VAT would expose commercially sensitive information, and as such is exempt under Section 43 (2) of the FOI Act.
4. What type of cloud environment?
Private Cloud and Public Cloud.
5. What is the original start date of the contract agreement? If there are more than one contract please provide me with the start date for each contract.
This information is covered by the exemption at section 21 of the FOIA. Please see the information provided at question 3.
6. What is the actual expiry date of the contract agreement? If there are more than one contract please provide me with the expiry date for each contract.
This information is covered by the exemption at section 21 of the FOIA. Please see the information provided at question 3.
7. When will the organisation plan to review this contract? If there are more than one contract please provide me with the review date for each contract.
We do not hold this information.
8. What is the contract period in years? Please include whether the agreement has any extension periods?
This information is covered by the exemption at section 21 of the FOIA. Please see the information provided at question 3.
9. What services are provided under the contract? Please do not put hosting information such as web hosting, file storage, hosted application. The more information the better.
Public cloud services and cloud support services are provided under this contract. However, further details of The National Archives’ contracts with these suppliers is covered by the exemption at section 31 of the FOIA. Please see the information provided at question 2.
10. Can you please provide me with the contract officer responsible for this contract? Complete contact details if possible name, title, contact email and number.
We are unable to provide you with this information because it would identify a junior member of staff and as such is exempt from release under section 40 (2) of the FOIA. However, we have applied the general principle that members of staff at Head of Department level and above are sufficiently senior for their names and/or job titles to already be in the public domain and are therefore not exempt from release. For further information about why this exemption has been applied, please see the explanatory Annex at the end of this letter.
The Director of our Digital Directorate is John Sheridan.
The Head of IT Operations is Julian Muller
The National Archives’ full contact options can be found on our website here: https://webarchive.nationalarchives.gov.uk/ukgwa/20190704111448/https://www.nationalarchives.gov.uk/contact-us/
Explanatory annexe
Exemptions applied
Section 21: Information readily available to the applicant by other means
Section 21 of the Freedom of Information Act 2000 (FOIA) does not oblige a public authority to provide information if it is already reasonably accessible by other means. In this case the exemption applies because the information is already available Details of the contracts can be found at the following links:
Contracts Finder – GOV.UK
Further guidance can be found at:
Information accessible to the applicant by other means (section 21) | ICO
Section 31: Law Enforcement
We are unable to provide you with information regarding suppliers and vendors because this information is exempt from disclosure under section 31(1) (a) of the FOI Act. Section 31(1) (a) exempts information if its disclosure would or would be likely to prejudice the prevention or detection of crime.
Section 31 is a qualified exemption and we are required to conduct a public interest test when applying any qualified exemption. This means that after it has been decided that the exemption is engaged, the public interest in releasing the information must be considered. If the public interest in disclosing the information outweighs the public interest in withholding it then the exemption does not apply and the information must be released. In the FOI Act there is a presumption that information should be released unless there are compelling reasons to withhold it.
The public interest has now been concluded and the balance of the public interest has been found to fall in favour of withholding information covered by the section 31(1)(a) exemption. Considerations in favour of the release of the information included the principle that there is a public interest in transparency and accountability in disclosing information about government cyber security. However, release of this information would make The National Archives more vulnerable to crime. The crime in question here would be a malicious attack on The National Archives’ computer systems. As such release of this information would be seen to prejudice the prevention or detection of crime by making The National Archives’ computer system more vulnerable to hacking. There is an overwhelming public interest in keeping government computer systems secure which would be served by non-disclosure. This would outweigh any benefits of release. It has therefore been decided that the balance of the public interest lies clearly in favour of withholding the material on this occasion.
Further guidance on section 31 can be found here: Law enforcement – section 31 | ICO
Section 40 (2): Personal Information where the applicant is not the data subject
The Data Protection Legislation prevents personal information from release if it would be unfair or at odds with the reason why it was collected, or where the subject had officially served notice that releasing it would cause them damage or distress. In this case the exemption applies because this information represents the personal information of a junior member of staff at The National Archives.
Publishing the names and contact details of junior members of staff is considered an unfair use of personal data. Junior members of staff would have no expectation that information about their positions would be made available in the public domain; to do so would be unfair and contravene Art. 5 of the General Data Protection Regulation. As such, the names, positions and contact details of junior officials are withheld under section 40 (2) of the FOI Act.
Further guidance can be found at: Section 40 and Regulation 13 – personal information
Section 43 (2) – Commercial Interests
This section exempts information whose disclosure would be likely to prejudice the commercial interests of any person. In this case, the exemption applies because it would be likely to harm or prejudice the commercial interests of our current and potential future suppliers.
Section 43 (2) is a qualified exemption and we are required to conduct a public interest test when applying any qualified exemption. This means that after it has been decided that the exemption is engaged, the public interest in releasing the information must be considered. If the public interest in disclosing the information outweighs the public interest in withholding it then the exemption does not apply and must be released. In the FOIA there is a presumption that information should be released unless there are compelling reasons to withhold it.
Considerations in favour of the release of the information included The National Archives’ commitment to openness and transparency in its commercial activities, to allow public scrutiny and to demonstrate that public funds are being used in an efficient and effective way. Furthermore, private sector companies engaging in commercial activities with the public sector must expect some information about those activities to be disclosed.
Considerations against disclosure included the recognition that disclosure is likely to provide information to direct competitors within the market that would create an imbalance and a commercial advantage to those competitors. Furthermore, disclosure of this information is also likely to affect The National Archives’ ability to negotiate contracts in the future and consequently generate revenue from non-public funds. It is also considered that disclosure would be likely to deter potential bidders for future contracts from competing and sharing commercially sensitive information with us. This would outweigh any benefits of release. It was therefore decided that the balance of the public interest lies clearly in favour of withholding the material on this occasion.
Further guidance can be found at: Section 43 – Commercial interests | ICO