FOI 451/25

REQUEST 

Please supply me with any information, documentation, contract clause change or emails, etc. that you have received in the past two years which identify any countries where Microsoft can or actually do process any data you have uploaded to the following services:

1 - Any service operated by or on the Microsoft Azure cloud platform by any of your processors or contracted service providers (including a direct contract with Microsoft)

2 - Any Microsoft M365 service

For the purposes of this request you should consider any offshored administration or direct system support as being ‘processing’, whether this relates to personal data or not - this is not a GDPR specific request.

RESPONSE

Your request for information has now been considered and I am not obliged to supply the information you have requested.    

Section 17(5) of the Freedom of Information Act 2000 requires South Wales Police, when refusing to provide such information (because the information is exempt) to provide you the applicant with a notice which: 

(a) states that fact,

(b) specifies the exemption in question and

(c) states (if that would not otherwise be apparent) why the exemption applies.

In relation to your particular request, the following exemption applies:

Section 12 – Exemption where cost of compliance exceeds appropriate limit.

Upon consulting with a number of colleagues, across various departments, it has been established that we would not be able to collate the information relating to this request within the 18-hour timeframe. The use of Microsoft Azure and Microsoft 365 services would span across numerous departments and areas, numerous supplier contracts, as well as ongoing direct dialogue regarding our Microsoft contract. Therefore, to attempt to get all departments to go back through supplier contracts, emails, documentation, and information from the past two years would take a substantial amount of time.

Whilst I am unable to quantify how long this would take, it would most certainly exceed the 18 hours stipulated by the regulations.

It is estimated that the cost of providing you with the information is above the amount to which we are legally required to respond i.e. the cost of locating and retrieving the information exceeds the "appropriate level" as stated in the Freedom of Information (Fees and Appropriate Limit) Regulations 2004.

In the case of the police service, the appropriate limit is £450 which has been calculated to equate to a total of 18 hours of work.

If any part of the request exceeds the fees limit then Section 12 applies to the whole request.

In accordance with the Freedom of Information Act 2000, this letter acts as a refusal notice.

Excess cost removes the forces obligation under the Freedom of Information Act, however under Section 16 – Duty to provide advice and assistance, an authority is required to offer an applicant the opportunity to redefine their request within the cost limit. If you were to refine the scope of this request then we may be able to assist.