Decision 106/2016: Mr N and the Chief Constable of the Police Service of Scotland Release notes relating to an operating system manual Reference No: 201502014 Decision Date: 5 May 2016 Summary On 24 June 2015, Mr N asked the Chief Constable of Police Scotland (Police Scotland) for the "release notes" relating to upgrades of the Centurion software system used to record cases of complaints and misconduct. Police Scotland withheld the information under the exemptions in sections 33(1)(b) (Commercial interests and the economy) and 35(1)(a) and (b) (Law enforcement). The Commissioner investigated and agreed that the information was exempt from disclosure.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (4) and (6) (General entitlement); 2(1)(b) (Effect of exemptions); 33(1)(b) (Commercial interests and the economy)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 25 May 2015, Mr N asked Police Scotland for the instruction manual for the software system behind the Centurion database. He was told that Police Scotland did not hold an instruction manual, but instead received release notes for each version upgrade.

2. Mr N accepted this response. On 24 June 2015, he made an information request for the release notes.

3. Police Scotland responded on 17 July 2015, withholding the requested information under section 33(1)(b) and section 35(1)(a) and (b) of FOISA.

4. On 27 August 2015, Mr N wrote to Police Scotland requesting a review of their decision. He did not accept that the release notes should be withheld.

5. Police Scotland notified Mr N of the outcome of their review on 9 October 2015. Police Scotland upheld their original decision without modification.

6. On 30 October 2015, Mr N applied to the Commissioner for a decision in terms of section 47(1) of FOISA. He was dissatisfied with the outcome of Police Scotland's review because he did not accept the reasons given by Police Scotland for applying the exemptions to the withheld information.

Investigation

7. The application was accepted as valid. The Commissioner confirmed that Mr N made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.

8. On 16 November 2015, Police Scotland were notified in writing that Mr N had made a valid application, and were asked to send the Commissioner the information withheld from Mr N. Police Scotland provided the information and the case was allocated to an investigating officer.

9. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. Police Scotland were invited to comment on this application (and answer specific questions) including justifying their reliance on any provisions of FOISA they considered applicable to the information requested.

10. Police Scotland responded with submissions in support of their position that the information was properly withheld from Mr N in terms of section 33(1)(b) and sections 35(1)(a) and (b) of FOISA.

11. Mr N was invited to provide his views as to why the withheld information should be disclosed, and did so.

12. During the investigation, Police Scotland were asked for further comments as to why disclosure of the withheld information would result in the harm identified in the exemptions, and did so.

Commissioner's analysis and findings

13. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr N and Police Scotland. She is satisfied that no matter of relevance has been overlooked.

Section 33(1)(b) - Commercial interests and the economy

14. Section 33(1)(b) provides that information is exempt from disclosure under FOISA if disclosure would, or would be likely to, prejudice substantially the commercial interests of any person (including a Scottish public authority). This is a qualified exemption and is subject to the public interest test in section 2(1)(b) of FOISA.

15. An authority relying on this exemption must be able to show whose commercial interests would (or would be likely to) be harmed by disclosure, the nature of those commercial interests and how those interests would (or would be likely to) be prejudiced by disclosure of the information. The prejudice must be substantial, in other words of real and demonstrable significance. Where the authority considers that the commercial interests of a third party would be (or would be likely to be) harmed, it must make this clear: in this connection, consulting the third party is generally advisable.

Police Scotland's submissions

16. Police Scotland submitted that the parties whose commercial interests would be prejudice substantially by disclosure were themselves and the company which provided the software (Force Information Systems, or FIS). Police Scotland explained that FIS is a private company which specialises in the provision of solutions for Police Professional Standards Departments. While there is some information on the FIS website about the Centurion database system, Police Scotland submitted that this information does not extend to the level of detail requested by Mr N.

17. Police Scotland noted that:

? the release notes do not provide instructional user information but instead they relate to changes made in the latest version of the software.

? the withheld documents contain details of the fields available and the options within them, as well information regarding workflow and the outcomes of particular actions or choices within the system.

? the reporting capabilities are outlined in some detail and the nature of the changes outlined in each document provides evidence as to the type of changes requested by Police Scotland in recent times and the direction that the system development is now taking.

? the inclusion of the many screen shots within the documents provides crucial insight into the design of the system, such as its navigation, its look and feel and the overall quality of the user experience.

18. Armed with this knowledge, Police Scotland considered that competitors of FIS would be better equipped to ensure that their products compared favourably with Centurion than they would otherwise (without such information).

19. Police Scotland commented that the continual development of software is "an expensive business". They stated that it may very well be the case that the products and services provided to Police Scotland are better than those provided to FIS's other customers, in terms of the systems themselves but also in being continually developed to meet the ever changing demands of Police Scotland.

20. Police Scotland provided a copy of a letter from FIS, in which it expressly states that it does not want this information to be disclosed into the public domain, as to do so would give its competitors the information directly required to compete with the Centurion product.

21. Police Scotland considered that if the information was disclosed, FIS was likely to be reluctant to provide any further documentary information regarding their systems.

22. Police Scotland considered that they have much the same concerns as a private company when it comes to ensuring that they attract the best bids for opportunities to work with Police Scotland and the best value for money in the products and services they purchase. They stated companies would be deterred from working with them if commercially sensitive documents, crucial to the management of the relationship between the two parties, were disclosed into the public domain.

23. Police Scotland accepted that companies which work with public authorities should be mindful of FOI legislation and should expect that some information regarding that relationship may be disclosed into the public domain, for reasons of accountability. However, Police Scotland did not consider that highly technical system specification documents being withheld in this instance would ever be expected to fall into that category.

24. Police Scotland also feared that if suppliers chose to stop sending such documents to Police Scotland, for fear that these documents will be disclosed into the public domain, the likely outcome would be that increased engagement with the suppliers themselves would be necessary to undertake work of that nature, which would be likely to increase costs to Police Scotland.

Mr N's submissions

25. Mr N was concerned by the refusal to disclose the information he had asked for, and suspicious that Police Scotland had "something to hide". He stated that the advice which Police Scotland had received in relation to his request was not "technical" in nature and (given that the police department involved was Professional Standards) was "political".

The Commissioner's conclusion

26. The Commissioner accepts that FIS has commercial interests in the withheld information, as it has invested time and money in the development and enhancement of the Centurion system.

27. The withheld information is not readily accessible to FIS's competitors, and goes beyond the information about the database system which is available online. It includes details of the fields available, options within them, reporting capabilities and screen shots, and details of the "change control" events which are addressed by the new release. This convinces the Commissioner that disclosure would, or would be likely to, give competitors of FIS a commercial advantage, by making available detailed information about the structure and capabilities of the Centurion system. She accepts that FIS would be placed at a disadvantage in tendering for any similar contracts with Police Scotland in future, if competitors had more knowledge of the structure and capabilities of the Centurion system, and the ways in which it has been adapted and developed for Police Scotland.

28. Although Police Scotland stated that their own commercial interests would also be harmed by disclosure of the withheld information, they offered little substantive evidence to support this argument. They did not provide any evidence to show that FIS "are concerned regarding this FOI to the extent that they are likely to be reluctant to provide any further documentary information". Police Scotland did not provide any evidence to support or explain their statement that disclosure would result in increased engagement with their suppliers, and that this would increase their costs. Consequently, the Commissioner does not accept that Police Scotland have shown that they have commercial interests which would be substantially prejudiced by disclosure of the withheld information.

29. The Commissioner accepts that disclosure of the withheld information would, or would be likely to, prejudice substantially the commercial interests of FIS and that the exemption in section 33(1)(b) was correctly applied in relation to FIS's commercial interests.

Public interest test

30. As the Commissioner has found that the exemption in section 33(1)(b) was correctly applied to the withheld information, she has gone on to consider the public interest test in section 2(1)(b) of FOISA. This requires consideration of whether, in all the circumstances of the case, the public interest in disclosing the withheld information is outweighed by the public interest in maintaining the exemption in section 33(1)(b).

Police Scotland's submissions

31. Police Scotland considered that, as a public authority, they are accountable for the management of their finances and the decisions made with regard to the IT systems they purchase and continue to maintain and develop. Disclosure of the information requested by Mr N would inform the public (to an extent) as to the fitness for purpose of the system currently in use.

32. In terms of the public interest in enabling public debate, Police Scotland considered that disclosure of the information would inform the public as to the type of system in place for the management of Professional Standards cases.

33. However, on balance, Police Scotland considered that factors favouring non-disclosure were stronger. Their arguments focused on the commercial harm which they believed would follow disclosure; these arguments have been described and considered in relation to section 33(1)(b) and are not repeated here. Police Scotland also offered the following arguments, to show why disclosure would not be in the public interest.

? In times of budgetary constraints, Police Scotland has to be commercially efficient and take steps to ensure that the products and services it purchases are the best available in terms of quality and cost effectiveness. Disclosure of the information sought would in be detrimental in this regard.

? There is a strict governance process exists around the tender process and awarding of contracts and it is inappropriate for this process to be prejudiced by disclosures under FOISA.

Mr Ns submissions on the public interest test

34. Mr N argued that potential vulnerabilities in the Centurion database system could only be exposed and addressed by allowing public access to the detailed information in the release notes. He commented that many versions of database languages are vulnerable to attacks, so the police would be expected to maintain and insist upon the highest level of database security. Successive versions of the software could be expected to be more and more secure, in terms of countermeasures to all the different types of cyber attack. He believed that only the release notes would make reference to this. Mr N argued that full disclosure would ensure that, if potential vulnerabilities exist, they will be addressed.

The Commissioner's conclusions

35. In considering the public interest in favour of disclosure, the Commissioner recognises the general public interest in disclosing information held by Scottish public authorities.

36. Overall, however, the Commissioner finds that there is only limited public interest in the disclosure of the information requested by Mr N, which is highly technical and specific to the Centurion system.

37. The Commissioner has accepted the risk of substantial prejudice to commercial interests in this case, if the withheld information is disclosed, as disclosure would be likely to give commercial competitors an unfair advantage in any future tendering exercise. She accepts that this would not be in the public interest, in terms of ensuring a fair tendering process.

38. The Commissioner has considered all the factors set out above and all submissions from both parties. While there will be circumstances in which the public interest requires the disclosure of information even if this may cause substantial prejudice to commercial interests, she does not believe that this to be such a case. Mr N's arguments for disclosure in the public interest are not sufficiently strong enough to justify disclosure of the release notes, or to outweigh the public interest in withholding the information.

39. In conclusion, the Commissioner is satisfied that, on balance, the public interest in this case favours maintaining the exemption, as the public interest in disclosure is outweighed by the public interest in avoiding substantial prejudice to commercial interests.

40. The Commissioner therefore finds that Police Scotland were correct to withhold information under section 33(1)(b) of FOISA. As she has found that all the withheld information is exempt from disclosure under section 33(1)(b) of FOISA, the Commissioner is not required to consider whether the exemption in section 35(1)(a) and (b) also applies to some of the information.

Decision The Commissioner finds that the Chief Constable of the Police Service of Scotland complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr N.

Appeal

Should either Mr N or Police Scotland wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement

5 May 2016

 Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

?

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

?

33 Commercial interests and the economy

(1) Information is exempt information if-

?

(b) its disclosure under this Act would, or would be likely to, prejudice substantially the commercial interests of any person (including, without prejudice to that generality, a Scottish public authority).

?