Copy of report produced by Calligo (FOI)

​​​​​​Request

Please provide a full copy of the report (including any annexes, appendices or similar thereto) produced by Calligo as part of the "Information Governance Operating Model" project, referred to in Table 1 of "CONSULTANTS: REPORTING ON THEIR USE BY THE GOVERNMENT OF JERSEY (P.59/2019) – REPORT OF THE CHIEF MINISTER – JUNE TO DECEMBER 2022", available at: 

R.30-2024.pdf (statesassembly.gov.je)​

The accountable officer is stated as being the "COO".

To the extent relevant, there is a clear public interest in this report being disclosed, not least because it appears that £175,000 to £200,00 of public funds was spent on this report.

Response

The entry detailed in the "CONSULTANTS: REPORTING ON THEIR USE BY THE GOVERNMENT OF JERSEY (P.59/2019) – REPORT OF THE CHIEF MINISTER – JUNE TO DECEMBER 2022" available at: 

R.30-2024.pdf (statesassembly.gov.je)​

and referred to in Table 1 of that report was marked “yes” because the production of certain documents / artefacts as part of the Information Governance Operating Model project, had been drafted. 

However, no specific report or therefore appendices to such report has been drafted.

The terms of the engagement with the Contractor prevent the disclosure of Confidential Information which includes the documents / artefacts produced.

It is noted that the preservation of confidentiality was and is considered appropriate and in the public interest given a number of the processes, templates, guide, and toolkits produced were and are to be adapted to varying degrees by different Government Departments.

Article 26 of the Freedom of Information (Jersey) Law 2011 has been applied. The terms of the engagement effectively mean the artefacts produced are confidential – IPR of Consultants can be used but not disclosed. 

Artefacts produced are an addendum of the privacy framework.  The privacy framework is an internal toolkit which supports Data Governance Officers and Accountable Officers in the discharge of their duties under the Data Protection (Jersey) Law 2018 and there is no requirement to use the same and some may be adapted or amended by some Departments. Releasing these artefacts could result in an inaccurate expectation by the public as to the way our obligations under the Data Protection (Jersey) Law 2018 are discharged and could impact any request under that law.

Articles 33 (Commercial Interests) and 35 (Formulation and development of policies were also considered.

Article applied

Article 26 - Information supplied in confidence

Information is absolutely exempt information if –

(a) it was obtained by the scheduled public authority from another person (including another public authority); and

(b) the disclosure of the information to the public by the scheduled public authority holding it would constitute a breach of confidence actionable by that or any other person.​

Internal Review Request

I am writing to formally complain about the response (the “Response”) of the scheduled public authority (the “Authority”) to FOI Request 590910567 (the “Request”) and request that an internal review of the Response be carried out, without delay.  

As you are aware, in accordance with the Office of the Information Commissioner - Code of Practice on the discharge of Scheduled Public Authorities’ functions under the Freedom of Information (Jersey) Law 2011 (the “FOIL”), issued in accordance with Article 44 of the FOIL, amongst other things, the review:

• must be a fair, thorough and independent review of the process adopted and decisions taken by the scheduled public authority pursuant to the FOIL;
• should enable a fresh decision to be taken on reconsideration of all the factors relevant to the request;
• must be undertaken by someone senior to the original decision maker where this is reasonably practicable; and
• should take into account any further matters raised during the investigation of the complaint.

I should be grateful if this email could be presented to the members of the Internal Review Panel appointed, in order that the matters set out herein may be given full and careful consideration as part of the Internal Review Panel's independent review of the Response. 

Introduction 

The Request sought a full copy of the report (including any annexes, appendices or similar thereto) produced by Calligo as part of the “Information Governance Operating Model” project. 

In the Response, the Authority confirms that a number of documents and artefacts (referred to hereinafter as the “Project Materials”) were produced as part of the project, although the Response does not provide further specifics of the Project Materials. 

The Authority has withheld the Project Materials on the basis of Article 26 (Information supplied in confidence) of the FOIL. The Response notes that Article 33 (Commercial Interests) and Article 35 (Formulation and development of policies were considered), although ultimately neither of these articles were applied. 

For the reasons set out below, is submitted that Article 26 has been incorrectly applied and the Project Materials should therefore have been produced in response to the Request. 

Project Materials (and the information contained therein) must be considered individually 

In considering whether or not the Project Materials are exempt from disclosure (whether under Article 26 or otherwise), each of the Project Materials must be considered individually. Furthermore, the constituent parts of the Project Materials should be considered separately; it may be (for example) that only a certain part of a particular document could rightly be considered confidential information. 

As was explained in the case of Channel 4 v the Information Commissioner EA/2010/0134, (22 February 2011), “…there is a clear distinction between a document and the information in it …  a document may well contain many pieces of information some of which must be disclosed under the Act and others which need not be disclosed”.  

It appears that the Authority has incorrectly applied Article 26 to the Project Materials in a ‘blanket’ fashion. It is submitted that if the Authority had properly considered each of the Project Materials and each of the pieces of information contain therein, it could not have reasonably determined that each and every such piece of information (if any) is exempt under Article 26. 

Article 26 (Information supplied in confidence)

Information is absolutely exempt information if –

(a) it was obtained by the scheduled public authority from another person (including another public authority); and

(b) the disclosure of the information to the public by the scheduled public authority holding it would constitute a breach of confidence actionable by that or any other person. 

In order for Article 26 to be engaged, the following criteria must be fulfilled:  

• the authority must have obtained the information from another person; 
• its disclosure must constitute a breach of confidence;
• a legal person must be able to bring an action for the breach of confidence to court; and 
• that court action must be likely to succeed.  

The Response states that “the terms of the engagement with the Contractor prevent the disclosure of Confidential Information which includes the documents / artefacts produced”. The Response further states: “The terms of the engagement effectively mean the artefacts produced are confidential – IPR of Consultants can be used but not disclosed.” 

The “terms of engagement” are not disclosed in the Response. It is assumed, however, that the “terms of engagement” referred to are (or are similar to) the Agreement for the provision of Services, DPO as a Service (Data Protection Services), dated 17 November 2021, between the Government of Jersey (acting through the Minister for Modernisation and Digital) and Calligo Limited (the “Calligo Contract”). Paragraph 4.2.3 of Schedule 1 to the Calligo Contract indicates that one of the services to be provided by the Contractor is to advise on and track implementation of the Privacy Framework, which is referred to in the Response 

Clause 36.2 of the Calligo Contract provides that each Party: “shall not disclose any Confidential Information belonging to the other Party to any other person without the prior written consent of the other Party, except to such persons and to such extent as may be necessary for the performance of the Agreement or except where disclosure is otherwise expressly permitted by the provisions of the Agreement.” 

It is important to note that the Calligo Contract does not prevent the Authority from disclosing its own Confidential Information. The prohibition is only on the Authority disclosing Confidential Information belonging to the Contractor, and even that prohibition is subject to exceptions. 

It may be that some of the Project Materials constitute Confidential Information belonging to the Authority. As noted above, that would not prevent the Authority disclosing them. 

It seems, therefore, that the Authority has taken the position that the Project Materials are Confidential Information “belonging to” the Contractor. It is submitted that this is not correct. 

Clause 41.1(c) of the Calligo Contract specifically provides that all Intellectual Property Rights in any specifications, instructions, plans, data, drawings, databases, patents, patterns, models, designs or other material “prepared by or for the Contractor for use, or intended use, in relation to the performance of the Agreement shall belong to the Authority”.

​The Project Materials clearly constitute material prepared for use, or intended use, in relation to performance of the Agreement and therefore belong to the Authority. To the extent they constitute Confidential Information, therefore, they are Confidential Information belonging to the Authority. Accordingly, the Authority is not prohibited from disclosing them and their disclosure by the Authority would not constitute a breach of confidence. For this reason, Article 26 is not engaged. 

Even if (which is not accepted) some of the Project Materials do constitute Confidential Information belonging to the Contractor, the Authority is permitted to disclose such Confidential Information where disclosure is expressly permitted by the provisions of the Agreement (see Clause 36.2 of the Calligo Contract). 

Clause 36.5 of the Calligo Contract expressly provides that the provisions of Clauses 36.1 to 36.4 shall not apply to any Confidential Information which must be disclosed pursuant to a statutory, legal or parliamentary obligation placed upon the party making the disclosure, including any requirements for disclosure under the FOIL. At Clauses 37.4 and 37.6 of the Calligo Contract, it is further specifically acknowledged by the Contractor that the Authority may be obliged under the FOIL to disclose Confidential Information. It is not surprising that the Authority included provisions in the Calligo Contract permitting it to disclose the Contractor’s Confidential Information pursuant to a request under the FOIL. Public authorities (such as the Authority) are obliged to carefully consider the compatibility of confidentiality clauses with their obligations under FOIA and it appears that the Authority did so by including in the Calligo Contract a carve-out related to its disclosure obligations under the FOIL. 

Given these express provisions of the Calligo Contract, it is submitted that it cannot be reasonably concluded that disclosure of the Project Materials in response to the Request, which was made under the FOIL, would constitute a breach of confidence by the Authority.  

Further, even if there were not express provisions permitting disclosure, if the requested information is commercial in nature then the disclosure will only constitute a breach of confidence if (amongst other things) it would have a detrimental impact on the confider – see the test of confidence set out by Judge Megarry at the High Court of Justice in Coco v A N Clark (Engineers) Limited [1968] FSR 415.  

The UK’s ICO has noted that, for commercial information, the authority will be expected to put forward an explicit case for detriment – see the UK ICO’s guidance on the equivalent provision (Section 41) of the UK’s Freedom of Information Act. In the Response, the Authority has not put forward any case for detriment from disclosure. 

Any breach of confidence must be also actionable, for Section 26 to apply. The UK’s ICO has noted (in the context of its guidance on Section 41 of the UK’s Freedom of Information Act) that “actionable” means that the action for breach of confidence must be likely to succeed, referring to statements made by Lord Falconer (the promoter of the legislation), during a debate on the UK’s Freedom of Information Bill.  

70. "Actionable', means that one can go to court and vindicate a right in confidence in relation to that document or information. It means being able to go to court and win." (Hansard HL (Series 5), Vol.618, col.416)  

“... the word "actionable" does not mean arguable … It means something that would be upheld by the courts; for example, an action that is taken and won. Plainly, it would not be enough to say, "I have an arguable breach of confidence claim at common law and, therefore, that is enough to prevent disclosure". That is not the position. The word used in the Bill is "actionable" which means that one can take action and win." (Hansard Vol.619, col. 175-176). 

It is submitted that “actionable”, as used in Section 26 of the FOIL, should be interpreted similarly. Given the specific provisions of the Calligo Contract, it cannot reasonably be concluded that disclosing the Project Materials would constitute a breach of confidence actionable by the Contractor. 

For completeness, it is noted that, although the exemption at Section 26 of the FOIL is absolute, there is still a requirement to consider the public interest in disclosure, because the law of confidence recognises that a breach of confidence may not be actionable when there is an overriding public interest in disclosure. As noted further below, there are strong arguments that disclosing the Project Materials is in the public interest. 

Furthermore, the exemption at Section 26 does not cover information the Authority has generated itself. If any of the requested material contains a mixture of both information created by the Authority and information given to the authority by another person (such as the Contractor), then the exemption can only cover (at most) the information that has been given to the Authority.  

Article 33 (Commercial Interests) 

The Response states that Article 33 (Commercial Interests) was “considered”. Given that it was not ultimately applied, it is to be inferred that the Authority concluded that this exemption did not apply.

​It is noted that the Calligo Contract does envisage that there may be “Commercially Sensitive Information” provided by the Contractor, but to the extent that is was provided to the Contractor to the Authority, it was required to be listed in a specific schedule. The Response does not state that any of the Project Materials were listed in the “Commercially Sensitive Information Schedule”. To the extent that any material was not listed in the schedule, it can rightly be concluded that it was not considered by the Contractor to be commercially sensitive. 

Even if information was listed in the “Commercially Sensitive Information Schedule”, in order for a prejudice based exemption such as Article 33 to be properly engaged, the Jersey Information Commissioner has previously stated that the following three criteria would have to be met: 

“a. Firstly, the actual harm which the SPA alleges would, or would be likely, to occur if the withheld information was disclosed has to relate to the applicable interests within the relevant exemption; 

b. Secondly, the SPA must be able to demonstrate that some causal relationship exists between the potential disclosure of the withheld information and the prejudice which the exemption is designed to protect. Furthermore, the resultant prejudice which is alleged must be real, actual or of substance; and

c. Thirdly, it is necessary to establish whether the level of likelihood of prejudice being relied upon by the SPA is met – i.e., disclosure ‘would be likely’ to result in prejudice, or disclosure ‘would’ result in prejudice. In relation to the lower threshold the Commissioner takes the view that the chance of prejudice occurring must be more than a hypothetical possibility; rather there must be a real and significant risk. With regard to the higher threshold, in the Commissioner’s view this places a stronger evidential burden on the SPA." 

Furthermore, Article 33 is a qualified exemption and therefore the Authority would also need consider the public interest test in relation to any information which it contended was exempt. The test is whether, in all the circumstances, the public interest in maintaining the exemption outweighs the public interest in disclosing the information. Again, this test must be applied on a case by case basis, for each piece of information; it cannot be properly applied on a 'blanket' basis. 

There is undoubtedly a strong public interest in disclosing the Project Materials.  

There is a general public interest in ensuring that public authorities (such as the Authority) remain transparent, accountable and open to scrutiny, where disclosure would (amongst other things): enable individuals to understand decisions made by public authorities affecting their lives and, in some cases, assist individuals in challenging those decisions; and facilitate accountability and transparency in the spending of public money. The Government of Jersey has recognised this strong public interesting in disclosure, with its stated public commitment to increased openness, transparency and accountability in government. 

The Project Materials are the product of a project that cost at least £175,000-£200,000 of public money; the public should be afforded to review what the Authority obtained for this money, in order to evaluate whether public money was well spent. Such openness will reinforce the effects of wider public sector reforms in encouraging better internal management, making departments more accountable, and raising the profile of competitive tendering within government.  

There is also specific public interest in understanding how the Authority is fulfilling its requirements under the Data Protection Act (Jersey) 2018. The Government of Jersey processes personal data in respect of every individual resident in Jersey. How the Government of Jersey is processing individuals' data, and handles requests by them in respect of that processing, is therefore of potential interest to every resident of Jersey. 

The strong public interest in understanding how the Government of Jersey looks after individuals' personal data rights is clearly acknowledged by the Government of Jersey itself, which has multiple sections of its own website dealing with data protection. 

That the public interest in how the Government of Jersey handles subject access requests is real, as opposed to merely hypothetical, is further demonstrated by the significant number of complaints made annually in respect of subject access requests submitted to public authorities. See the Jersey Office of Information Commissioner's Annual Report for 2022: 

Annual Report 2022.pdf (jerseyoic.org) ​

The Response states that “Releasing these artefacts could result in an inaccurate expectation by the public as to the way our obligations under the Data Protection (Jersey) Law 2018 are discharged”. However, to the extent this is a genuine concern, if Project Materials are disclosed, the Authority can make clear (as it has in the Response) the circumstances and reason why such Project Materials were produced. There is no reason to believe that the public would be incapable of understanding such an explanation. 

Article 35 (Formulation and development of policies) 

The Response states that Article 35 (Formulation and development of policies) was “considered”. Given that it was not ultimately applied, it is to be inferred that the Authority concluded that this exemption did not apply. 

It is not clear what, if any, “proposed policy” the Authority may have considered the Project Materials relate to. It seems likely that the Authority may have concluded that Article 35 does not apply because, to the extent the Project Materials relate to any policy (which is not accepted), they relate to its implementation, not formulation or development. 

Article 35 is a qualified exemption. For the reasons noted above, it is submitted that there is a strong public interest in producing the Project Materials and this would not be outweighed by any public interest (if any) in maintaining the exemption.  

Generally speaking, there is no inherent or automatic public interest in withholding information just because it falls within a class-based exemption (such as Article 35). The Authority would need to consider the content and sensitivity of the particular information and the effect its release would have in all the circumstances of the case before it could justify withholding the information on the basis of Article 35. 

Conclusion 

For the reasons stated above, it is submitted that the Project Materials should not have been withheld on the basis of Article 26 or otherwise. Alternatively, only part (and not the whole) of the Project Materials should have been withheld. Accordingly, the Internal Review Panel is requested to disclose Project Materials in whole or, alternatively (if the Internal Review Panel determines that the exemptions properly apply to some of the information in the Project Materials) in part.​ 

Should the Internal Review Panel believe that any of the above requires clarification, or if there is any other information that the Internal Review Panel believes that it would be helpful for me to provide to assist with its review, please do let me know. 

Should the Internal Review Panel, having concluded its internal review, determine to withhold any part of the requested information, I should be grateful if the Internal Review Panel could please provide in writing the reasons for its determination.  

Internal Review Response

This review has been completed by two senior staff members of the Government of Jersey, independent of the original decision-making process. The original response has been reviewed and assessed to identify whether the application of the exemption had been applied correctly and whether it was appropriate to withhold information.

As referred to in the Internal Review request, for Article 26 to be engaged, the following criteria must be fulfilled:  

• the authority must have obtained the information from another person; 
• its disclosure must constitute a breach of confidence;
• a legal person must be able to bring an action for the breach of confidence to court; and 
• that court action must be likely to succeed. 

The requested information remains the intellectual property of Calligo, and therefore the disclosure of the information would be a breach of the terms of the agreement the Government of Jersey has with Calligo and therefore the criteria for the correct application of Article 26 has been duly met.

The Panel also considered that - in the alternative - Article 33(b) would apply in the alternative and that the public interest supported the proprietary information of Calligo and/or the Government of Jersey being withheld rather than being disclosed.

After careful consideration, the panel concluded that the exemption was correctly applied and that an additional exemption would also apply in these circumstances.