Systems deployed to monitor on screen activity of Scottish Government Employees working from home: FOI release

Information requested

I would like to request the following information:

1. Since January 2024 what systems have you deployed to monitor the on-screen activity of staff working from home and at what cost?

2. Copies of reports, staff notifications or disciplinary notifications in relation to the on-screen activity of staff working from home since January 2024. Anonymise personal data if required.

Response

I enclose a copy of some of the information you requested.

In response to your request regarding the monitoring of on-screen activity of staff working from home and related cost, an exemption has been applied under section 30(c) of the Freedom of Information (Scotland) Act 2002. We do endeavour to provide information whenever possible. However, under section 18(1) of FOISA, a public authority may refuse a request where: - if the information existed and was held by the authority, it would be exempt from release under any of sections 28 to 35, 38, 39(1) or 41 of FOISA; and - the authority considers that to reveal whether the information exists, or is held by it, would be contrary to the public interest.

In this instance, if the information you request did exist or was held by us, an exemption under section 30(c) of FOISA would apply to that information. This exemption applies where disclosure would, or would be likely to, prejudice substantially the effective conduct of public affairs. Confirming or denying the existence of keystroke monitoring could enable individuals to alter their behaviour in ways that undermine the effectiveness of our IT security measures. Public knowledge of such monitoring—or the absence thereof—could expose our systems to increased risk of misuse or circumvention, thereby compromising the integrity of our digital infrastructure. We have concluded that the public interest in maintaining the security and operational effectiveness of our IT environment outweighs the public interest in disclosure.

In relation to question two, there have been no instances of staff failing to comply with the IT Code of Conduct resulting in formal disciplinary action from January 2024 to the date of the FOI. However, we can confirm nine individuals have been referred for further action in relation to the IT CoC in the past thirty days. Details of ongoing actions and personal details of these records are exempt under Section 38(1)(b).

About FOI

The Scottish Government is committed to publishing all information released in response to Freedom of Information requests. View all FOI responses at https://www.gov.scot/foi-responses.