Cloud hosting contracts with third party suppliers

FOI request reference: F0062904
Publication date: September 2020

Outcome
Successful.

Request and response
For the different types of hosting services, can you provide me with the following information:

1. Type of hosting Dedicated, Co-Location, Cloud Hosting, Other?

The National Archives currently has four hosting contracts with third party suppliers. Two suppliers provide cloud hosting services and two provide managed cloud hosting services.

2. Who is the supplier of the contract? If possible can you also provide me with the name of the vendor, if applicable?

Amazon Web Services (AWS) and MongoDB provide cloud hosting services.
MirrorWeb provides managed cloud hosting services.
The Stationery Office (TSO) provides managed cloud hosting services using an existing AWS account which TSO procured.

3. What is the annual contract value for each contract?

Information about all contracts with a value over £10,000 are published in the public domain, and can be found at https://www.contractsfinder.service.gov.uk/.

This information for all four of the contracts is therefore available online. As such section 21 of the Freedom of Information Act (FOIA) applies. Section 21 of the FOIA exempts information where Information is reasonably accessible to the applicant by other means. We are however happy to advise you on where you can find this information. Details of the contracts can be found at the following links:
AWS: https://www.contractsfinder.service.gov.uk/Notice/c98970a9-3cc0-4338-b990-1c5f2e10e63a
MongoDB: https://www.contractsfinder.service.gov.uk/Notice/1ada7345-5d74-4bda-89b1-ec87ae5213ad
MirrorWeb: https://www.contractsfinder.service.gov.uk/Notice/905e575d-aa69-45c5-b2cb-d731f083ead5
TSO: https://www.contractsfinder.service.gov.uk/Notice/57be116d-7aea-4da5-bdd4-46157b758b12

4. What type of cloud environment?
Private Cloud – a distinct and secure cloud based environment in which only the specified client can operate.
Public Cloud – where cloud services are provided in a virtualised environment, constructed using pooled shared physical resources, and accessible over a public network such as the internet.
Hybrid – integrated cloud service utilising both private and public clouds to perform distinct functions within the same organisation.

AWS and MongoDB provide public cloud services.
MirrorWeb and TSO provide hybrid cloud services.

5. What is the original start date of the contract agreement? If there are more than one contract please provide me with the start date for each contract.

This information is covered by the exemption at section 21 of the FOIA. Please see the links provided at question 3.

6. What is the actual expiry date of the contract agreement? If there are more than one contract please provide me with the expiry date for each contract.

This information is covered by the exemption at section 21 of the FOIA. Please see the links provided at question 3.

7. When will the organisation plan to review this contract? If there are more than one contract please provide me with the review date for each contract.

Contracts are typically reviewed leading up to their expiration date. We do not hold review dates for the contracts with AWS, MirrorWeb and TSO.
The contract with MongoDB is currently under review.

8. What is the contract period in years? Please include whether the agreement has any extension periods?

This information is covered by the exemption at section 21 of the FOIA. Please see the links provided at question 3.

9. What services are provided under the contract? Please do not put hosting, information such as web hosting, file storage, hosted application. The more information the better.

This information for the AWS, MirrorWeb and TSO contracts is available online and is therefore covered by the exemption at section 21 of the FOIA. Please see the links provided at question 3.
MongoDB provides cloud software and cloud support services.

10. Can you please provide me with the contract officer responsible for this contract? Complete contact details if possible name, title, contact email and number.

We are unable to provide you with this information because it would identify a junior member of staff and as such is exempt from release under section 40(2) of the FOIA. However, we have applied the general principle that members of staff at Head of Department level and above are sufficiently senior for their names and/or job titles to already be in the public domain and are therefore not exempt from release. For further information about why this exemption has been applied, please see the explanatory Annex at the end of this letter.

The Head of Digital Services is Catherine Elliott; Legislation Services is Matthew Bell; and UK Government Web Archive is Tom Storrar.
The National Archives’ full contact options can be found on our website here: http://apps.nationalarchives.gov.uk/contact/

EXPLANATORY ANNEX
Exemptions applied.

Section 21: Information readily available to the applicant by other means
Section 21 of the Freedom of Information Act 2000 (FOIA) does not oblige a public authority to provide information if it is already reasonably accessible by other means.
In this case the exemption applies because the information is already available Details of the contracts can be found at the following links:
AWS: https://www.contractsfinder.service.gov.uk/Notice/c98970a9-3cc0-4338-b990-1c5f2e10e63a
MongoDB: https://www.contractsfinder.service.gov.uk/Notice/1ada7345-5d74-4bda-89b1-ec87ae5213ad
MirrorWeb: https://www.contractsfinder.service.gov.uk/Notice/905e575d-aa69-45c5-b2cb-d731f083ead5
TSO: https://www.contractsfinder.service.gov.uk/Notice/57be116d-7aea-4da5-bdd4-46157b758b12

Further guidance can be found at:
http://ico.org.uk/~/media/documents/library/Freedom_of_Information/Detailed_specialist_guides/information-reasonably-accessible-to-the-applicant-by-other-means-sec21.pdf

Section 40(2): Personal Information where the applicant is not the data subject
The Data Protection Legislation prevents personal information from release if it would be unfair or at odds with the reason why it was collected, or where the subject had officially served notice that releasing it would cause them damage or distress.

In this case the exemption applies because this information represents the personal information of a junior member of staff at The National Archives.

Publishing the names and contact details of junior members of staff is considered an unfair use of personal data. Junior members of staff would have no expectation that information about their positions would be made available in the public domain; to do so would be unfair and contravene Art. 5 of the General Data Protection Regulation. As such, the names, positions and contact details of junior officials are withheld under section 40 (2) of the FOI Act.

Further guidance can be found at:
http://ico.org.uk/for_organisations/guidance_index/~/media/documents/library/Freedom_of_Information/Detailed_specialist_guides/personal-information-section-40-and-regulation-13-foia-and-eir-guidance.pdf