ISO14001 Accreditation (EIR241276)

Thank you for your email of 09 October 2024, requesting information from Ordnance Survey.  We have handled your request under the Environmental Information Regulations (EIR) 2004.  Your request is set out in the extract below: 

“Please provide two documents: 

1. The document defining the scope of ISO14001 accreditation of OS.  
2. The most recent ISO14001 auditors report.” 

I confirm that Ordnance Survey does hold the information you have requested.  Where there is an exception to the disclosure of information this is stated.  Taking each request in turn, I confirm the following:   

1. I enclose a copy of OS’s Certificate of Registration (pdf) for Environmental Management System – ISO 14001, which defines the scope of the accreditation.  It has been redacted to remove information that is excepted from disclosure under Regulations 12(3) and 13.
2. I enclose a copy of the Auditors report (pdf), which has been redacted to remove information that is excepted from disclosure under Regulations 12(3) and 13.  Please note that there is a misspelling of the Health & Safety Contractor’s name on page 8: it should read Kesron MacDonald. 

Regulations 12(3) and 13

Regulation 12(3) provides that third party personal data shall not be disclosed otherwise than in accordance with Regulation 13.

Regulation 13(1) provides personal data shall not be disclosed if disclosure of this information would breach any of the data protection principles contained in the UK General Data Protection Regulation (GDPR) and Data Protection Act (DPA) 2018.

In this case, disclosure of 1) the signature, name and job title of the person signing the certificate and 2) the names and job titles of the Assessment participants would contravene the first data protection principle, which provides that personal data must be processed lawfully and fairly. Regulations 12(3) and 13(1) of the EIR therefore apply.

In reaching this decision, we have considered Article 6(1) of the GDPR which sets out the lawful bases under which we can process the data. Specifically, we considered Article 6(1)(f): the legitimate interest assessment.  While we accept a legitimate interest in seeking access to the information, we do not believe processing the redacted information is necessary as the content of the certificate and report remains clear without it.

This exception to disclosure in EIR is absolute and does not require us to conduct a public interest test.