Decision 052/2006 | Scottish Information Commissioner

Home Decisions

Decision 052/2006

Decision 052/2006 Mr K and the University of Aberdeen

Request for access to internal audit reports on Travel, Review of the Business School, Contract Management & Tendering, and the Medical Practice & Dental Unit – partial disclosure – Section 30(b)(i) and (ii) Prejudice to effective conduct of public affairs: disclosure would be likely to inhibit substantially the free and frank provision of advice or the free and frank exchange of views for the purposes of deliberation

Applicant: Mr K
Authority: University of Aberdeen
Case No: 200502364
Decision Date: 11/04/2006
Kevin Dunion
Scottish Information Commissioner

Facts

Mr K asked the University of Aberdeen to provide him with copies of its internal audit reports relating to Travel, Review of the Business School, Contract Management & Tendering, and the Medical Practice & Dental Unit.

The University provided the executive summaries and appendices of each report, but withheld the detailed findings and recommendations of the auditors, along with the rationales and management responses. Its main reason for this action was that disclosure of these sections would substantially inhibit the auditors’ future ability to provide advice to the University freely and frankly, and also inhibit the University management’s ability to express its views as openly in future when responding to that advice. Therefore, it was exempt from disclosure under section 30 of the Freedom of Information (Scotland) Act 2002 (FOISA).

The University also stated that section 38(1)(b) of FOISA applied to the management response to the report of the Dental Unit since it contained information relating to 3 individuals.

The University upheld its decision on review, adding that it considered section 33(1)(b) applied to the report on Travel as disclosure would harm the commercial interests of the University and its appointed travel agents. Mr K was dissatisfied with this and appealed to the Commissioner for a decision.

Outcome

The Commissioner found that the University of Aberdeen did not handle Mr K’s request for information in accordance with Part 1 of the Freedom of Information (Scotland) Act 2002, through its incorrect application of sections 30(b)(i) and (ii), 33(1)(b) and 38(1)(b) of the Act.

He ordered the University to release the detailed findings, recommendations, rationales and management responses to the reports that Mr K had requested.

Appeal

Should either the University of Aberdeen or Mr K wish to appeal against this decision, there is a right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days of receipt of this notice.

Background

1. On 1 June 2005, Mr K wrote to the University of Aberdeen (the University) requesting electronic copies of the following internal audit reports:

Report 1 – Medical Practice and Dental Unit
Report 4 – Contract Management & Tendering
Report 7 – Review of Business School
Report 10 – Travel

2. The University replied on 29 June, releasing the executive summaries and Appendices of these reports, which included the auditors’ overall assessments and conclusions.

3. However, it withheld the detailed findings and recommendations, the rationales for these and the initial management response to each report. In doing so it stated its opinion that to disclose these would be prejudicial to the conduct of its public affairs, as this would be likely to substantially inhibit the full and frank provision of advice, and the full and frank exchange of views for the purposes of deliberation, under section 30 of FOISA. Further, it considered the management response to the report on the Dental Unit (Report 1) would impinge on the contractual position of identifiable individuals and would also be exempt under section 38 of FOISA. It did not explicitly state which subsections of the exemptions applied.

4. In using section 30 of FOISA, the University also stated that it had considered whether the public interest in withholding the information outweighed that in releasing it. Its conclusion was that release would have the potential to seriously inhibit its internal auditors from providing advice as fully and frankly in future, and in a similar manner, potentially inhibit management from responding and making its views known as openly as it did at present. In its view, the public interest lay in ensuring the good governance and value for money which the internal auditing process aimed to provide, and disclosure of the detailed findings and recommendations of the reports would potentially result in the inhibitions described, with no countervailing value-added benefit to the public.

5. Mr K requested a review of the University’s decision to withhold the information on 29 June 2005. In this request, Mr K stated his view that whilst there may be a case for redacting parts of the auditors’ detailed findings and management responses to these, withholding all of these could not be defended under the Act. Even if it could, using a blanket interpretation of section 30 of FOISA was not compatible with the Commissioner’s guidance on the public interest test, where he had stated that information must be disclosed when there was doubt about where the public interest lay. In this respect, he doubted that the application of the public interest could produce a result so unambiguous as to justify the redaction of all the detailed findings, recommendations, rationales and management responses of these reports.

6. The University replied to Mr K on 27 July 2005 upholding its original decision to release the reports in the redacted form outlined in paragraphs 2 and 3. It reiterated its reliance on section 38 and added to its arguments in relation to section 30. In particular, it argued that section 30(b)(i) and (ii) allowed “more generally” for the exemption of information, since the UK Information Commissioner’s Guidance Note No 25 on the application of section 36 of the Freedom of Information Act 2000 (FOIA) (which makes broadly similar provision to section 30 of FOISA) stated that information could be withheld “if its disclosure would be likely to inhibit the ability of public authority staff and others, when deliberating or providing advice to express themselves openly, honestly and completely”, where “advice” might include “advice from external sources”.

7. In addition, the University stated its opinion that disclosure of certain of the detailed information and advice contained in the reports on Contract Management and Tendering (Report 4) and Travel (Report 10) would be substantially prejudicial to the commercial interests of the University and its appointed Travel Agents and therefore would be exempt under section 33 of FOISA. Again, the relevant subsection of this exemption was not explicitly stated.

8. In the Reviewer’s opinion, however, all of the detailed advice given to the University was covered by section 30(b)(i) and (ii) of FOISA, especially where the advice was part of input into deliberations on possible changes in policy or practice which are ongoing. If disclosure had the inhibiting effects described in paragraphs 3 to 6, he was of the opinion that there would be a real prospect of substantial prejudice to the effective governance of the University, resulting from a reduction in the degree of rigour with which the internal audit function was exercised. Accordingly, he believed this risk posed a potential threat to the public interest which exceeded any increased benefit to that interest in disclosing the information withheld.

9. On 30 July 2005 Mr K applied to me for a decision regarding the way in which the University had handled his request, on the grounds that he did not accept the arguments of the University and could not see any way in which the disclosure of the detailed findings, recommendations, rationales and management responses of the reports would inhibit the provision of advice by auditors. He argued that the overwhelming public interest in improving accountability and participation favoured disclosure.

10. The case was then allocated to an investigating officer.

Investigation

11. Mr K’s appeal was validated by establishing that he had made a request for information to a Scottish public authority, and had appealed to me only after asking the authority to review its original decision.

12. I invited comments from the University as I am required to do under section 49(3)(a) of FOISA.

13. I also requested copies of the reports, along with further information about the University’s application of the exemptions and the specific harm that it believed would be caused to the commercial interests of the University and its appointed travel agents from disclosing the full contents of the report on contracts and tendering (Report 4) and the report on Travel (Report 10). These were provided by the University, excluding an explanation of the harm that it believed could be caused to its appointed travel agents from disclosure.

The Commissioner’s Analysis and Findings

Application of section 30(b)(i) and (ii)

14. The University stated in its response to me that the principal reason for withholding the auditors’ detailed findings, recommendations, rationales and management responses to the reports was the possible effect on the future full and frank provision of advice (section 30 (b)(i) of FOISA), and on the future full and frank exchange of views for the purpose of deliberation (section 30 (b)(ii) of FOISA) within the University. I will therefore consider the application of these exemptions first.

15. It is my view that the standard to be met in applying the tests in sections 30(b)(i) and (ii) is high. In applying these exemptions the chief consideration is not whether the information constitutes advice or opinion, but whether the release of the information would inhibit substantially the provision of advice or the exchange of views.

16. In response to me in relation to these exemptions, the University did not cite any specific parts of the detailed findings, recommendations, rationales and management responses for coverage by these exemptions. Instead, it cited potential damage to the rigour of the internal audit process as its justification for a blanket application of the exemptions to the information concerned. In its initial response to Mr K’s request for information, it appears to have considered the auditors’ findings, recommendations, rationales and management responses to qualify for exemption under section 30(b)(i) (free and frank provision of advice) and the management responses to qualify under section 30(b)(ii) (free and frank exchange of views for the purposes of deliberation). Taking this position as a starting point, I will consider the application of section 30(b)(ii) (in respect of which the University’s position is rather more fully argued) first.

17. Specifically, the University has stated to me that submission of an internal audit report, including the initial management response, represented only the start of a continuing process. This would be monitored through subsequent follow up audits: initial management responses might be identified as impractical or not necessarily the best way forward and therefore not all of them would be implemented. In this respect, the University was of the view that premature disclosure of detailed findings, recommendations, rationales and management responses within internal audit reports would inhibit this process and might result in the mechanistic implementation of practices which did not in the event deliver value for money or benefit for the public.

18. The University also expressed its opinion that the term ‘inhibit substantially’, as used in section 30 (b) represented a less stringent legal test than‘substantial prejudice’, and that this, combined with the use of the words “or would be likely to” in section 30(b), allowed it to take into account possible consequences of disclosure for the future rigour of the internal audit process, as well as the actual content of the reports requested. It cited the UK Information Commissioner’s Guidance Note No 25 in support of this proposition.

19. I do not accept that the use of the word “inhibit” in section 30(b) of FOISA imports a lower threshold than the use of the word “prejudice” elsewhere in section 30 and in other sections of Part 1 of FOISA. Used in their ordinary dictionary meanings (which I agree is entirely appropriate), the words describe effects which are different in timing but not in quality. In no other respects do the tests differ and I would in any event suggest that , whichever word is used, the stringency of the test derives rather from the use of the word “substantial” (which is attached to both “inhibit” and “prejudice” throughout Part 1 of FOISA but which does not appear anywhere in the equivalent provisions of FOIA).

20. While I accept that the exemption allows consideration of possible future consequences of disclosure (if the risks can be substantiated), I do not accept that there is anything in section 30(b) of FOISA to justify the blanket application of the exemption to whole classes of information, as the University also appears to suggest. It is my view that it is important for public authorities to treat each request for information on a case by case basis. Release of detailed auditors’ findings and recommendations, along with the management responses to these, in a particular case should not be taken to imply that these should be routinely released in future. The individual circumstances of each case must be taken into consideration and the public interest in each case assessed on its own merits. Now that FOISA has come into force, it is also important for officials within Scottish public authorities to recognise that previous assumptions of confidentiality may have to be re-assessed in line with the new legislation.

21. The main argument of the University appears based upon an assumption that public disclosure of internal audit reports would be interpreted as disclosure of a final decision on policy or procedure that is to be implemented, despite the changing nature of the implementation process which it outlined to me.

22. In my view, this position has no evident foundation and in any event could be avoided easily by supplying the applicant with a caveat stating that the detailed findings, recommendations, rationales and management responses represent merely the start of a continuing process to improve practices in the University, and that the actual practices that are implemented might not resemble what is discussed in the report. If there is any genuine risk of mechanistic application of findings and recommendations as a consequence of disclosure, as the University appears to believe, I cannot accept that it is beyond the powers or ability of the University’s management to prevent this from happening.

23. In view of this, I do not accept the University’s argument that release of the information would inhibit the ongoing consultation process in the manner it has described.

24. Nevertheless, it is also important to ascertain if there might be specific information in the reports which might still be covered by section 30(b) of the Act. In reading the withheld sections of the audit reports, I have considered whether the advice or opinions expressed might be in any way controversial. For instance, does it conflict with or cast doubt upon official policy on procedural matters? If so, this might strengthen the argument for withholding the information under section 30(b), subject to the public interest test.

25. In reading the withheld sections of the reports I found that the majority of the advice and opinions expressed consisted of uncontroversial material relating to internal processes and procedures and their ongoing review in the light of audit recommendations. In fact, I saw much that would prove that the University was acting responsibly in administering its internal processes and expressing views and initial corrective actions in consideration of the advice provided by the auditors.

26. However, I found that 2 subsections of the report on Travel, and 10 subsections of the report on Tendering that contained what might be deemed as controversial material relating to issues of non-compliance with procedures concerning tendering and the purchase of services and the possible consequences.

27. Nevertheless, I note that the University has not brought it to my attention that its internal auditors (an external firm of accountants) have raised any concerns of their own about the release of their findings, recommendations, rationales and management responses. That does not suggest to me that they would be inhibited substantially in their provision of future advice to the University should these reports be released, and I have no reason to believe that the position would be significantly different should another firm of accountants be in their place. I am not aware of any other player in this process whose advice might conceivably be inhibited by the release of the information.

28. Equally, it is good practice for public authorities to consider the findings and recommendations of auditors and act upon these as they see fit. Public authorities have an obligation to address areas of non-compliance transparently and without prejudice, especially where these might be in danger of being legally actionable. This ensures that an effective and efficient service continues to be maintained by them and keeps costs to the taxpayer down. Considering the obligation on the University to maintain a cost effective service to the taxpayer, I cannot see how disclosure of the information withheld from Mr K would inhibit an exchange of views for the purposes of improving or maintaining the running of an authority.

29. Having considered all of the above, I can find no information in the detailed auditors’ findings, recommendations, rationales and management responses to the reports requested by Mr K that would be exempt under section 30(b)(i) and (ii).

30. As I can find no justification for the University to apply section 30(b)(i) and (ii) to the reports, there is no need for me to consider the application of the public interest test in the context of these exemptions.

Application of section 33(1)(b)

31. The University also stated that the release of certain sections of the Review of Travel report would have potential legal consequences for it. This would, in its opinion, substantially prejudice its commercial interests and the relevant information would therefore be exempt from release under section 33(1)(b) of FOISA.

32. In considering this exemption, I take “commercial interests” to mean a person's ability to successfully participate in a commercial activity, e.g. the sale and purchase of goods or services. There is no requirement that these activities are profit making before this exemption can be engaged, although it would be normal. It should also be noted that this is substantially different from financial interests, which relates purely to financial profit and loss. In this respect, section 33(1)(b) cannot be applied simply because an authority fears it will suffer financial loss as a result of disclosure.

33. However, I regard the test of this to be far higher than just proving a possible jeopardy to the ability to purchase something, since this ability may not represent a commercial interest at all, but rather, an isolated engagement with commercial activity. The public authority must be able to prove that its actions in this area extend beyond that kind of limited (albeit necessary) contact with commercial activity.

34. In this respect, the University does not have a department specifically dedicated to the purchase or provision of travel services. By negotiating a contract with external travel agents to purchase travel services, it has, however, recognised and provided for an occasional requirement for its staff to be able to travel elsewhere on business. The University, therefore, has only an occasional interest in travel services, that of purchasing them for the purposes of its own business as an academic institution. In my view, this cannot be said to count as a commercial interest, since it is clearly not a primary function that is carried out by the University, nor does it involve itself in other aspects of travel services.

35. Rather, in purchasing travel services it can be said that the University is only engaging with commercial activities to the extent that such engagement is necessary to carry out its core functions. I therefore do not regard the University’s purchase of travel as a commercial interest and consequently cannot accept the University’s application of section 33(1)(b) to its own interests.

36. In its response to Mr K’s request for a review of the University’s decision, it also raised a possibility of substantial prejudice to the commercial interests of its appointed travel agents. The University was asked to expand upon this point in its submission to my office, but it did not do so. In view of this and the fact that the information contained in the report would only affect the University’s appointed travel agents if it chose to take action over the content of the report (assuming it were in a position to do so), I have decided not to consider this matter further.

37. As I can find no justification for the University to apply section 33(1)(b) to the Report on Travel, there is no need for me to consider the application of the public interest test in the context of these exemptions.

Application of section 38(1)(b)

38. The University argued to me that this section of FOISA applied to the management response to the report on the Dental Unit, being section 4 of the report on the Dental Unit and the Service Level Agreement with the University Medical Practice. Its reason for applying this section was that the response related to the contractual positions of three identifiable members of staff whose continued employment within the University at that time was undecided.

39. The management response outlines the auditors’ recommendations and proposes the closure of the Dental Unit. At no point does it name the individuals running the Unit, or make any direct reference to their contractual position. The reference to the Dental Practice may however allow the public to identify the names of the dentists and support staff involved by the closure. Therefore, I accept that the information about the staff, might constitute their personal data and therefore bring it within the ambit of section 38(1)(b). Nevertheless, this would only allow an identification of the individuals at a professional level, not a personal one, where their names would in any event normally be made public as part of their work.

40. The University has inferred that the reference to the closure of the Dental Unit would unduly publicise the contractual positions of 3 members of its staff. Since the Unit closed in April 2005 and Mr K made his request on 1 June 2005, the fate of the Unit was already public knowledge. Therefore, any reference to the closure in the management response cannot be seen as remotely sensitive information about the future employment status of the individuals at the Practice.

41. As such, I am not persuaded that release of the management response would breach any of the Data Protection Principles in Schedule 1 of the Data Protection Act (1998) and I can therefore find no justification for the application of section 38(1)(b) to the Report on the Dental Unit and Service Level Agreement with the University Medical Practice.

Decision

I find that the University of Aberdeen has not dealt with Mr K’s request for information in accordance with Part 1 of the Freedom of Information (Scotland) Act 2002, in that it misapplied the exemptions in sections 30(b)(i), 30(b)(ii), 33(1)(b) and 38(1)(b) of FOISA and consequently failed to comply with section 1(1) of FOISA.

I require the University to release the detailed findings, recommendations, rationales and management responses to the reports requested by Mr K in his request of 1 June 2005.

I cannot require the University to take any action until the time allowed for an appeal to be made to the Court of Session has elapsed. I therefore require the University of Aberdeen to release the information to Mr K within 2 months of the date of this decision notice.

Kevin Dunion
Scottish Information Commissioner
11 April 2006

PDF Icon Link to PDF file of decision 052/2006 (74.8 kb)