Scottish Forestry - Software based data destruction assurance information: FOI release

Information requested

To avoid any misunderstanding, I would like to clarify the distinction I am drawing. I am not questioning the adequacy of your processes or suggesting anything is being done incorrectly. My enquiry relates solely to the type of recorded assurance held by your organisation.

A certificate or record confirming that an erasure process was applied demonstrates that a recognised method was used. What I am seeking to understand is whether your organisation holds any recorded evidence of the outcome, namely evidence that the data on a specific storage device is irrecoverable following erasure, rather than confirmation that the erasure process was executed.

With that distinction in mind, please confirm:

1. Do the IT asset disposal certificates or related contractual terms relied upon by Forestry and Land Scotland (FLS) under the Service Level Agreement constitute an explicit outcome based warranty or guarantee that the personal data on each specific storage device has been rendered irrecoverable as a final data state, or do they primarily confirm that a certified erasure process was followed?

2. Beyond reliance on supplier accreditation, recognised standards including but not limited to ADISA certification, ISO accreditation, HMG IA standards, or confirmation that an erasure process was completed, does Scottish Forestry hold any recorded, device specific documentation evidencing independent verification, testing, or validation that the data on the particular storage media processed has been rendered irrecoverable in practice?

For clarity, this request relates specifically to recorded outcome evidence demonstrating irrecoverability of data on the individual storage device, not documentation confirming that an accredited or certified method was applied.

If no explicit outcome based warranty or device specific outcome evidence is held beyond certification, accreditation, or confirmation of process completion, please confirm accordingly.

I am not seeking technical configuration detail, only clarification of the recorded assurance basis relied upon when concluding irrecoverability of the final data state.

Response

1. Do the IT asset disposal certificates or related contractual terms relied upon by Forestry and Land Scotland (FLS) under the Service Level Agreement constitute an explicit outcome based warranty or guarantee that the personal data on each specific storage device has been rendered irrecoverable as a final data state, or do they primarily confirm that a certified erasure process was followed?

Under the Service Level Agreement (SLA) Scottish Forestry have with Forestry and Land Scotland (FLS), the IT asset disposal certificates and associated contractual provisions relied upon under the SLA do not constitute an explicit, outcome based warranty or guarantee that data on each individual storage device has been rendered irrecoverable. These certificates confirm that:•

• a recognised, certified data erasure or destruction process has been applied to the asset, and•
• the supplier has carried out this process in line with their accredited procedures and applicable industry standards.

Scottish Forestry does not hold device specific outcome evidence, and we understand this is standard within Scottish Government shared service arrangements.

While our aim is to provide information whenever possible, in this instance Scottish Forestry does not have some of the information you have requested.

This is a formal notice under section 17(1) of FOISA that Scottish Forestry does not have all the information you have requested. The reasons why we don't have the information are explained below/in the Annex to this letter.

2. Beyond reliance on supplier accreditation, recognised standards including but not limited to ADISA certification, ISO accreditation, HMG IA standards, or confirmation that an erasure process was completed, does Scottish Forestry hold any recorded, device specific documentation evidencing independent verification, testing, or validation that the data on the particular storage media processed has been rendered irrecoverable in practi

For clarity, this request relates specifically to recorded outcome evidence demonstrating irrecoverability of data on the individual storage device, not documentation confirming that an accredited or certified method was applied.

If no explicit outcome based warranty or device specific outcome evidence is held beyond certification, accreditation, or confirmation of process completion, please confirm accordingly.

I am not seeking technical configuration detail, only clarification of the recorded assurance basis relied upon when concluding irrecoverability of the final data state.

Scottish Forestry does not hold any additional device specific recorded evidence demonstrating independent verification, testing, or validation that data on a particular storage device has been rendered irrecoverable.

Beyond reliance on Scottish Government assurance from the SLA of the Supplier accreditation compliance with recognised standards (e.g. ADISA, ISO, HMG IA standards) no further outcome based or device specific documentation is held.

While our aim is to provide information whenever possible, in this instance Scottish Forestry does not have some of the information you have requested.

This is a formal notice under section 17(1) of FOISA that Scottish Forestry does not have all the information you have requested. The reasons why we don't have the information are explained below/in the Annex to this letter.

ANNEX A

REQUEST UNDER THE FREEDOM OF INFORMATION (SCOTLAND) ACT 2002 (FOISA)

REASONS FOR NOT PROVIDING INFORMATION

Section 17 (a) of FOISA (information not held)

An exemption under section 17 (a) of FOISA applies to the information requested. Scottish Forestry is not required to provide information which it does not have. Scottish Forestry does not have the information you have requested because due to the Service Level Agreement (SLA) with Forestry and Land Scotland (FLS), software based data destruction is not performed internally within Scottish Forestry.

This exception is subject to the 'public interest test'. Despite not holding this information, we have a statutory obligation to apply this test. Therefore, taking account of all the circumstances of this case, we have considered if the public interest in disclosing the information outweighs the public interest in applying the exemption. We have found that, on balance, the public interest lies in favour of upholding the exemption.

While we recognise that there may be some public interest in information about whether Scottish Forestry can provide clarification of the recorded assurance basis relied upon when concluding irrecoverability of the final data state of the software-based data destruction for Scottish Forestry’s end-of-life IT equipment, due to the Service Level Agreement (SLA) Scottish Forestry have with Forestry and Land Scotland (FLS) of the Scottish Government, software based data destruction, reporting, and assurance is not performed within Scottish Forestry, we therefore cannot provide information on this that we do not hold.

About FOI

The Scottish Government is committed to publishing all information released in response to Freedom of Information requests. View all FOI responses at https://www.gov.scot/foi-responses.