The Information and Digital Technologies Department has been ordered to hand over details of a controversial contract with a technology company by the Information Commissioner.

Gitanjali Gutierrez has ruled that the government department must provide details of its dealings with Cyberdine, which was awarded a $179,000 consultancy contract in August 2022 without a process of competitive bids.

Government rules require all contracts of $100,000 or more to go through a competitive procurement process unless a waiver is granted by the Office of Project Management and Procurement and approved by Cabinet.

In a ruling released last Thursday, Ms Gutierrez noted that a Pati application was made requesting records related to Cyberdine — including the department’s service agreement with the company, relevant invoices and records on the rationale for extension of the agreement.

According to Ms Gutierrez, the department did disclose some records but withheld others on the grounds that they “could reasonably have had a significant adverse effect on its functions relating to management and/or could have prejudiced Bermuda’s national security”.

A statement from the Information Commissioner’s Office said: “Additionally, the department refused access to records containing information on the amount and length of its agreement with Cyberdine, because it believed that information was already available in the public domain.

“In response, the applicant requested an independent review from the Information Commissioner to challenge the department’s reliance on these exemptions, while also questioning the reasonableness of its search to locate responsive records.

“During the Information Commissioner’s review, the applicant agreed not to challenge the department’s decision to withhold parts of the responsive records that would identify the actual deliverables of the agreement.

“This resulted in the removal of parts of the withheld records from the Information Commissioner’s review.

“In her decision, the Information Commissioner found that the department did not conduct a reasonable search to locate records on the rationale for extension of the service agreement with Cyberdine. She also concluded that the department’s reliance on the exemptions to withhold parts of the records that were still at issue, was not justified.

“But she found that certain information in the withheld records was exempt under the personal information exemption and that the public interest test required disclosure of limited personal information only.”

Ms Gutierrez ordered the department to hand over the disclosed records and conduct a more thorough search of other documents by September 6.

In a separate ruling, the Bermuda Police Service will not have to provide information relating to allegations of medical fraud against physicians at the Bermuda Healthcare Services and the Brown-Darrell Clinic — because to obtain the information would be “an unreasonable burden”.

In a statement, the ICO said: “Initially, the BPS refused public access to the records because they either contained information that was personal, commercial or received in confidence, pertained to the deliberations or operations of the BPS, or pertained to law enforcement.

“In her decision, the Information Commissioner found that the BPS was not justified in denying access based on these exemptions because the BPS had not located and assessed the requested records.

“However, the Information Commissioner varied the BPS’s internal review decision to instead administratively deny the Pati request, because further processing the request would have created a substantial and unreasonable burden.”