Agreement between Calligo and Government of Jersey (FOI)

Original Request

Please provide a copy of any agreements between Calligo and the Government of Jersey and or any Departments of the Government of Jersey relating to the provision of Data Protection Officer as a service.

Original Response 

The requested information is exempt under Article 33(b) (Commercial Interests) of the Freedom of Information (Jersey) Law 2011. 

Article applied

Article 33 - Commercial interests

Information is qualified exempt information if –

(a) it constitutes a trade secret; or

(b) its disclosure would, or would be likely to, prejudice the commercial interests of a person (including the scheduled public authority holding the information).

Public Interest Test 

Article 33 (b) is a prejudice-based exemption. That means that in order to engage this exemption there must be a likelihood that disclosure would cause prejudice to the interest that the exemption protects. In addition, this is a qualified exemption and consideration must be given to the public interest in maintaining the exemption.

The Scheduled Public Authority (SPA) considers that providing information could prejudice the commercial interests of the Government of Jersey and / or third parties. There may be public interest in the commercial information, however it was considered that this is outweighed by the potential for commercial and or financial damage.

Internal Review Request

This is a complaint in respect of the Scheduled Public of Authority's response (the "Response") to the Request. It is hereby requested that an internal review of the Response be carried out, without delay. Copies of the Response and the Request are attached to this email, for ease of reference.

As you are aware, in accordance with the Office of the Information Commissioner - Code of Practice on the discharge of Scheduled Public Authorities’ functions under the Freedom of Information (Jersey) Law 2011, issued in accordance with Article 44 of the Law (the "Code of Practice"), amongst other things, the review:

• must be a fair, thorough and independent review of the process adopted and decisions taken by the Scheduled Public Authority (the "SPA") pursuant to the Freedom of Information (Jersey) Law 2011 (the "Law");
• should enable a fresh decision to be taken on reconsideration of all the factors relevant to the request; 
• must be undertaken by someone senior to the original decision maker where this is reasonably practicable; and
• should take into account any further matters raised during the investigation of the complaint. 

The Request was: "Please provide a copy of any agreements between Calligo and the Government of Jersey and/or any Department(s) of the Government of Jersey relating to the provision of Data Protection Officer as a service."

The SPA's Response was: "The requested information is exempt under Article 33(b) (Commercial Interests) of the Freedom of Information (Jersey) Law 2011."

It appears the SPA has applied the Article 33(b) exemption to all agreements, and all parts of those agreement, on a blanket basis. In determining whether or not information is exempt under Article 33(b), the constituent clauses of each agreement must be considered on a case-by-case basis. As the Jersey Office of the Information Commissioner has previously noted (see Decision Notice OIC Reference 202-03-14180, dated 16 November 2018), the UK Information Commissioner's Office (ICO) has issued guidance on the application of Section 43 of the UK's Freedom of Information Act 2000 ("FOIA"), which is the equivalent to Article 33 of the Law. See:

Section 43 – Commercial Interests (ico.org.uk) 

The ICO guidance notes: "Where the information requested is a contract, rather than applying section 43 in a ‘blanket’ fashion and viewing the contract as a whole, you need to consider each clause within the contract individually, with a view to identifying whether it may be disclosed."

The ICO guidance makes reference to the case of Channel 4 v the Information Commissioner EA/2010/0134, (22 February 2011), where the Tribunal explained that “…there is a clear distinction between a document and the information in it” and that “a document may well contain many pieces of information some of which must be disclosed under the Act and others which need not be disclosed”. 

Accordingly, each clause of each agreement responsive to the Request should be considered individually, with a view to identifying whether or not the information in that clause is exempt under Article 33(b). It is submitted that if the SPA had properly considered each clause of each agreement, it cannot have reasonably determined that each and every such clause is exempt under Article 33(b).

The Jersey Information Commissioner (the "Commissioner") has previously stated that in order for a prejudice based exemption, such as those provided by Article 33, to be engaged, the Commissioner considers that three criteria must be met:

"a. Firstly, the actual harm which the SPA alleges would, or would be likely, to occur if the withheld information was disclosed has to relate to the applicable interests within the relevant exemption;

b. Secondly, the SPA must be able to demonstrate that some causal relationship exists between the potential disclosure of the withheld information and the prejudice which the exemption is designed to protect. Furthermore, the resultant prejudice which is alleged must be real, actual or of substance; and

c. Thirdly, it is necessary to establish whether the level of likelihood of prejudice being relied upon by the SPA is met – i.e., disclosure ‘would be likely’ to result in prejudice, or disclosure ‘would’ result in prejudice. In relation to the lower threshold the Commissioner takes the view that the chance of prejudice occurring must be more than a hypothetical possibility; rather there must be a real and significant risk. With regard to the higher threshold, in the Commissioner’s view this places a stronger evidential burden on the SPA."

See:

16 November 2018 – Decision Notice – Department of the Environment.pdf (jerseyoic.org) 

The Response provides no indication that the SPA has properly determined that each of these three criteria are met in respect of each clause of the agreements responsive to the Request.

The Response uses generic wording: "The Scheduled Public Authority (SPA) considers that providing information could prejudice the commercial interests of the Government of Jersey and / or third parties." It is notable that the generic wording used by the SPA: 

(a) does not properly identify the SPA, referring to it simply as "the Scheduled Public Authority"; 

(b) uses the wording "and / or" which creates ambiguity as to whose commercial interests the SPA contends "could" be prejudiced by providing information - is it the Government of Jersey's commercial interests or a third party's? If it is the commercial interests of a third party, which third party? It is necessary for this to be clearly stated, in order to assess whether or not the relevant exemption has been correctly applied;

(c)  states that the information "could prejudice the commercial interests" (emphasis added), which suggests that the SPA has applied the wrong legal test; the test is whether its disclosure "would, or would be likely to, prejudice the commercial interests" (emphasis added) and the Response should have been clear which of these tests the SPA believes is met and why;

(d) uses identical language as other responses that have been issued, in relation to wholly unrelated freedom of information requests - see for example, 

Amalgamated Facilities Management financial support (FOI)

- which further suggests that the SPA has just "copy and pasted" a generic response, rather than properly considered whether the information is properly exempt under Article 33(b).

It is submitted that the Commissioner's three criteria cannot have been satisfied for all of the withheld information. Proper consideration must be given again to whether the withheld information relates to "commercial interests". To the extent any information does relate to "commercial interests", careful consideration must then be given to other the Commissioner's three criteria have been satisfied, on a case by case basis, and this must be satisfactory explained and evidenced for each piece of information that the SPA contends is exempt.

Article 33 is a qualified exemption and therefore the SPA must also consider the public interest test in relation to any information which it contends is exempt. The test is whether, in all the circumstances, the public interest in maintaining the exemption outweighs the public interest in disclosing the information. Again, this test must be applied on a case by case basis, for each clause of responsive agreements; it cannot be properly applied on a blanket basis.

In respect of the applicable public interest test, the Response contained the following generic wording: "There may be public interest in the commercial information, however it was considered that this is outweighed by the potential for commercial and or [sic] financial damage."

It is noted that identical language has been used in other responses that have been issued, in relation to wholly unrelated freedom of information requests. Again, this suggest that the SPA has just "copy and pasted" a generic response, rather than properly consider the applicable public test, on a case by case basis.

The SPA has not provided any particular detail as to the balance of the public interest. It is submitted, however, that the public interest cannot have been properly applied, as there is a very strong public interest favouring disclosure of the responsive agreements in their entirety or, in the alternative, at least the majority of the clauses of the responsive agreements. 

The Government of Jersey processes personal data in respect of every individual resident in Jersey. How the Government of Jersey is processing individuals' data, and handles complaints by them in respect of that processing, and whether the Government of Jersey's arrangements for handling such complaints are compliant with applicable law, is therefore of potential interest to every resident of Jersey, as well as a substantial number of non-residents whose data is also being processed.

The Data Protection Act (Jersey) 2018 requires the Government of Jersey to appoint a Data Protection Officer and it has purported to have done so. There is a strong public interest in understanding how the Government of Jersey looks after individuals' personal data rights. This is clearly acknowledged by the Government of Jersey itself, which has multiple sections of its own website dealing with data protection – see

Data Protection (gov.je)

Further, it is clear from the Government of Jersey's website that it believes that the appointment of a Data Protection Office is a matter of clear public interest. That website states, amongst other things: "The States of Jersey takes the security and privacy of your information very seriously and has implemented various measures to ensure best standards are met, including: ... appointment of Corporate Data Protection Officer (CDPO": see

About Data Protection 2018 in Jersey and your personal data rights (gov.je) 

That the public interest in how the Government of Jersey handles subject access requests is real, as opposed to merely hypothetical, is further demonstrated by the significant number of complaints made annually in respect of subject access requests submitted to public authorities. See the Jersey Office of Information Commissioner's Annual Report for 2022: 

Jersey Office of the Information Commissioner 2022 Annual Report.pdf (jerseyoic.org) 

Not only is there a public interest in being able to review on what basis the Government of Jersey has appointed its Data Protection Officer in order for individuals be able to verify the Government of Jersey's compliance with the Data Protection Act (Jersey) 2018, there is also significant public interest because of the Government's key role in setting examples for best practice that other organisations in Jersey can follow. If the Government's own arrangements remain non-transparent, other organisations are denied the opportunity to learn from the Government's own example. There is a clear public interest in enabling organisations in Jersey to adopt best practice and comply with their obligations under the Data Protection Act (Jersey) 2018.

Further, it is generally recognised that there is a general public interest in the disclosure of commercial information to ensure, for example: transparency in the accountability of public funds; proper scrutiny of government action; and the effective use of public money. Such openness will reinforce the effects of wider public sector reforms in encouraging better internal management, making departments more accountable, and raising the profile of competitive tendering within government. The current Council of Ministers has recognised this strong public interesting in disclosure, with its public commitment to increased openness, transparency and accountability in government.

As it stands, the Response leaves the general public entirely unable to scrutinise the arrangements that the Government of Jersey has put in place with respect to its appointment of Calligo as Data Protection Officer, which is a critical role, mandated by law. The public is left in the dark as to important questions, including: what contractual terms (if any) ensure Calligo's independence in carrying out this crucial statutory role; and what contractual terms (if any) govern the passing of personal data to Calligo?

It is not known whether any of the responsive agreements contain confidentiality clauses. However, it is noted that having a confidentiality clause in place does not guarantee that information will not be disclosed under the Law. If a request (such as the Request) asks for a copy of a contract, the whole contract needs reviewing. If the information in it is not commercially sensitive, a confidentiality clause cannot prevent its disclosure. Further, and in any event, authorities cannot contract out of their statutory obligations under the Law.

The Government of Jersey has publicly "committed to complying with the letter and spirit of the Freedom of Information (Jersey) Law 2011" and to being "more accountable and transparent in the way we operate and make decisions under FOI legislation". The Response falls woefully short of this commitment and is not compliant with the SPA's obligations in accordance with the Law. The SPA is urged to promptly review the Response and now provide the withheld information, as such information should lawfully have been provided in response to the Request. 

If, upon careful review, the SPA genuinely believes that some of the information contained in clauses of responsive agreements is exempt from disclosure under Article 33(b) of the Law and the public interest in maintaining that exemption outweighs the public interest in disclosing the information, that information should be redacted and the balance of the agreements should be disclosed. For any such redaction, the SPA should clearly explain in detail its reasons why it believes such information is exempt and why the balance of public interest is in favour of withholding the information.

Internal Review Response

This review has been completed by two senior staff members of the Government of Jersey, independent of the original decision-making process.

The original response has been reviewed and assessed to identify whether the application of the exemption had been applied correctly and whether it was appropriate to withhold information.

The Panel’s decision is that the application of Article 33(b) (Commercial Interests) of the Freedom of Information (Jersey) Law 2011 (the “FOI Law”) had been incorrectly applied. 

However, it is considered that Articles 25 (Personal information) and 33(b) (Commercial interests) should be applied in part.

The contract held by the Scheduled Public Authority (the ‘SPA’) between the Government of Jersey and Calligo Limited is formed of several parts.

Article 8 of the FOI Law provides a general right to be supplied with information held by a scheduled public authority. 

The document located by the SPA (currently the Cabinet Office), is a word document called “DPOaaS Draft Contract Agreement_v.5. Calligo Final”.

This was the word document sent to the Minister for signing and contains the main body of the Agreement, Parts 1 – 9. There are 10 Schedules included and Schedule 7 itself contains 7 further appendices.

Whilst the Schedules are contained in the word document (save from Schedules 4 and 5 which were not applicable and not used - although not indicated as such), the appendices, which were intended to be embedded in the document, are unfortunately merely pictures of PDFs.   This was overlooked when the original response was issued.

Contract Attachment_Redacted.pdf

Appendix 1_Redacted.pdf

Appendix 2_Redacted.pdf

Appendix 3_Redacted.pdf

Appendix 4_Redacted.pdf

Appendix 5.pdf

Appendix 6_Redacted.pdf

Appendix 7_Redacted.pdf

Following further extensive searches (all key personnel involved in this procurement having now left the organisation), all but 3 of the 11 appendices have been located.

The missing appendices are:

Goj-2021-594-DPOaaS (SVR) – Calligo Ltd

Goj-2021-594-DPOaaS (NPR) – Calligo Ltd

Goj-2021-594-DPOaaS (MQR) – Calligo Ltd

These documents form part of the ‘Contractor’s Response’ documentation and whilst they would have all been uploaded onto the Secure Web Portal at the time, those with access to that portal have all since left the Government of Jersey. Despite best efforts to locate these documents outside of the portal, they have not been found. This work has been a contributory factor in the delay enabling the Review Panel to meet.

Therefore, no decision can be taken as to whether to release these documents or apply exemptions. To that end, they are not considered to be held for the purposes of the FOI Law. 

In any event, it is worth pointing out that whilst the Agreement has been defined in clause 1.1 as being:

                    “…between the Authority and the Contractor consisting of these clauses and any attached Schedules, the Invitation to                             Tender, the Contractor’s Tender and any other documents (or parts thereof) specified by the Authority.” 

under the heading “Entire Agreement”, at clause 5(2), the order of precedence is set out should there be any conflict between the body of the Agreement, Specification, Invitation to Tender, Contractor’s Tender and other documents attached to the Agreement.

The Invitation to Tender (ITT) and the Contractor’s Tender and any other document referred to in the Agreement rank 3rd, 4th and 5th and do not take precedence over the Agreement, which itself prevails over the Schedules.  Therefore, the missing documents which relate to the Invitation to Tender and the Contract’s response would not take precedence over the terms of the Agreement in any event. Though it is accepted it is unfortunate they remain unlocated.

However, should these documents be located the SPA reserves its position as to whether it is in the public interest to disclose a parties initial contractual negotiating position – there being a very real potential for commercial prejudice – the Government need to be able to offer counterparties an ability to provide early views on contract terms on a confidential basis.

It is noted that the copy of the Agreement held is not dated. Although it states the 17 November 2021 and it is to take effect from the Commencement Date being defined as 4 December 2021. It was signed by Deputy Wickenden on Friday 3 December 2021 and countersigned by Calligo on Monday 6 December 2021.

Details of the articles applied and relevant Public Interest Test are shown below.

Articles applied

Article 3  -  Information not held

Whilst Article 3 is not an exemption as such, it applies to the extent certain information cannot be located and is therefore not held for the purposes of the FOI Law.  

Article 3 - Meaning of “information held by a public authority”

For the purposes of this Law, information is held by a public authority if –

(a)     it is held by the authority, otherwise than on behalf of another person; or

(b)     it is held by another person on behalf of the authority.

Article 25 - Personal information

(1)     Information is absolutely exempt information if it constitutes personal data of which the applicant is the data subject as defined in the Data Protection (Jersey) Law 2018.

(2)     Information is absolutely exempt information if –

(a)     it constitutes personal data of which the applicant is not the data subject as defined in the Data Protection (Jersey) Law 2018; and

(b)     its supply to a member of the public would contravene any of the data protection principles, as defined in that Law.

3)      In determining for the purposes of this Article whether the lawfulness principle in Article 8(1)(a) of the Data Protection (Jersey) Law 2018 would be contravened by the disclosure of information, paragraph 5(1) of Schedule 2 to that Law (legitimate interests) is to be read as if sub-paragraph (b) (which disapplies the provision where the controller is a public authority) were omitted.

This exemption has been applied only in respect of Schedule 6 which lists the Contractor’s Key Personnel, Appendix 1, 2, 4 and 6 (again where names have appeared).  If you believe you ought to have these names, we can write to Calligo and ask for their views on whether to disclose the names of their personnel.

Article 33 - Commercial interests

Information is qualified exempt information if –

(a)     it constitutes a trade secret; or

(b)     its disclosure would, or would be likely to, prejudice the commercial interests of a person (including the scheduled public authority holding the information).

This exemption has been applied to clause 523(a) and (b) and clause 53.1 of the contract; Schedules 2 and 3 and Appendix 3 and 4.

Prejudice / Public Interest Test

The release of the exact costs, insurance and indemnity costs or contract values are commercially sensitive. The release of this data could affect any future negotiations as well as potentially disadvantaging Calligo by disclosing their pricing schedules. This could result in the Government’s inability to retain a commercial advantage and secure the best value for the taxpayer in any future tender process. Therefore, there is considered to be an actual prejudice to both the Government of Jersey and Calligo were this information to be disclosed and therefore the information is to be withheld. For these reasons the public interest in disclosure is not outweighed by the commercial prejudice that would arise if disclosed.