Transport Scotland software based data destruction assurance information: FOI release

Information requested

1. Do the certificates of erasure or related contractual terms held by Transport Scotland constitute an explicit outcome based warranty or guarantee that the personal data on each specific storage device has been rendered irrecoverable as a final data state, or do they primarily confirm that a certified erasure process was followed?

2. Beyond reliance on supplier certification, recognised standards including but not limited to HMG Infosec Standard 5, NIST 800-88 alignment, or confirmation that an erasure process was completed, does Transport Scotland hold any recorded, device specific documentation evidencing independent verification, testing, or validation that the data on the particular storage media processed has been rendered irrecoverable in practice?

Response

1. They confirm that a certified erasure process was followed;

2. No. Transport Scotland does not hold any documentation of the nature you describe. Therefore this is a formal notice under S17 of FOISA that the information you have requested is not held.

About FOI

The Scottish Government is committed to publishing all information released in response to Freedom of Information requests. View all FOI responses at https://www.gov.scot/foi-responses.