Request for information - Ref No: FOI20951
Thank you for your email of 19 March 2020 requesting information from Ordnance Survey in accordance with the Freedom of Information Act (FOIA) 2000, as set out in the extract below:
- Can you please confirm if you are using the Microsoft Office 365 solution in your IT environment?
- If so, how you currently back up your Office 365 data? If it is backed up please confirm which software or service solution you currently have in place.
- If a system or service is in place to backup Ordnance Survey's Office 365 environment can you confirm the retention period the data is stored for?
- Who in Ordnance Survey is responsible for the protection of your critical data?”
I confirm that Ordnance Survey does hold some of the information you have requested. Where the information is not held or exempt from disclosure this is stated. Taking each request in turn, I confirm the following:
1. Can you please confirm if you are using the Microsoft Office 365 solution in your IT environment?
I confirm we use the Microsoft Office 365 solution in our IT environment.
2. If so, how you currently back up your Office 365 data? If it is backed up please confirm which software or service solution you currently have in place.
We consider section 31(3) of the FOIA is applicable to the above request and neither confirm nor deny that we hold any information falling within the above request.
Under section 3(3) the duty to confirm or deny does not arise if, or to the extent that compliance with section 1(1)(a) of the Act would, or would likely, prejudice any of the matters mentioned in section 31(1), as explained below: -
We consider the information to be exempt from disclosure under section 31(1)(a) of the FOIA. This exempts information if its disclosure would or would be likely to prejudice the prevention or detection of crime. In this case, we consider that disclosure of the information would be likely to make OS more vulnerable to crime; namely a malicious attack on our computer systems. This is a qualified exemption and we are required to consider the public interest.
Public interest test
OS recognises the need for transparency; however, release of this information would mean our computer systems would be more vulnerable to hacking therefore jeopardising our IT security, and facilitating the possibility of crime.
Section 31(1)(a) is a prejudice-based exemption, and there is a public interest inherent in avoiding the harm specified. OS considers that the prejudice would be likely to occur, and we are satisfied there is a greater public interest in protecting our systems by withholding the information under this exemption.
3. If a system or service is in place to backup Ordnance Survey's Office 365 environment can you confirm the retention period the data is stored for?
Please see our response to question 2 above.
4. Who in Ordnance Survey is responsible for the protection of your critical data?
Jo Shannon, Director of Engineering.
Your enquiry has been processed according to the Freedom of Information Act (FOIA) 2000. If you are unhappy with our response, you may request an internal review with our Internal Review Officer by contacting them, within two months of receipt of our final response to your Freedom of Information (FOI) request, as follows:
Internal Review Officer
Customer Service Centre
Please include the reference number above. You may request an internal review where you believe Ordnance Survey has:
- Failed to respond to your request within the time limits (normally 20 working days)
- Failed to tell you whether or not we hold the information
- Failed to provide the information you have requested
- Failed to explain the reasons for refusing a request
- Failed to correctly apply an exemption or exception
The Internal Review Officer will not have been involved in the original decision. They will conduct an independent internal review and will inform you of the outcome of the review normally within 20 working days, but exceptionally within 40 working days, in line with the Information Commissioner’s guidance.
The Internal Review Officer will either: uphold the original decision, provide an additional explanation of the exemption/s applied or release further information, if it is considered appropriate to do so.
Appeal to Information Commissioner’s Office (ICO)
If, following the outcome of the internal review you remain unhappy with our response, you may raise an appeal, within three months of receiving our response, with the Information Commissioner’s Office.
Further information can be found on the ICO website (ico.org.uk) under ‘Report a concern’ or you may wish to call the ICO helpline on 0303 123 1113.