Decision Notice 081/2024: Signed agreement relating to due diligence on the Lochaber Guarantee and Reimbursement Agreement
Authority: Scottish Ministers
Case Ref: 202101238
Summary
The Applicant asked the Authority for the signed legal agreement relating to the due diligence on the Lochaber Guarantee and Reimbursement Agreement. The Authority disclosed some information to the Applicant, and explained that other information was otherwise accessible. The Authority also withheld certain information because it considered it to be exempt from disclosure.
The Commissioner investigated and found the Authority had been entitled to withhold some information, but he required it to disclose other information which he found was not exempt from disclosure. The Commissioner also required the Authority to provide advice and assistance to enable the Applicant to locate specific information.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1)(b) (Effect of exemptions); 15(1) (Duty to provide advice and assistance); 25(1) (Information otherwise accessible); 33(1)(b)
(Commercial interests and the economy); 38(1)(b), (2A)(a), (5) (Definitions of “data protection principles”, “data subject”, “personal data”, “processing” and “UK GDPR”) and 5(A) (Personal information) 47(1) and (2) (Application for decision by Commissioner)
United Kingdom General Data Protection Regulation (the UK GDPR) articles 5(1)(a) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness of processing)
Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d) and (10) (Terms relating to the processing of personal data)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 4 August 2021, the Applicant made a request for information to the Authority. They asked for a copy of the signed legal agreement between the Authority and Ernst & Young regarding due diligence on the Lochaber Guarantee &
Reimbursement Agreement. They also asked, that if it was not included within the agreement, that the Authority supply the contract value and the scope of work (including any limitations).
2. The Authority responded on 1 September 2021. The Authority disclosed some information to the Applicant and provided them with a link to enable them to access information on its website which would show the value of the contract
(for which it relied on the exemption in section 25(1)). The Authority refused to disclose other information falling within scope of the request on the basis that it was exempt under sections 33(1)(b) and 38(1)(b) of FOISA.
3. On 2 September 2021, the Applicant wrote to the Authority requesting a review of its decision. The Applicant stated that they were dissatisfied with the decision because:
- The exemptions claimed do not apply.
- The uses of exemptions have not been properly explained in accordance with FOISA.
- The public interest test has not been properly carried out.
- The public interest favours disclosure.
4. The Authority notified the Applicant of the outcome of its review on 30 September 2021, and upheld its original response – with modifications. The Authority explained that having reconsidered the application of the public interest test, it considered that more information could be disclosed to the requestor. The Authority also removed its application of the exemption in section 33(1)(b) of FOISA to certain of the information previously withheld. As a consequence, new versions of the information previously released were provided to the requester.
5. The Authority continued to rely on the exemption in sections 33(1)(b) and 38(1)(b) for withholding some information from the Applicant.
6. On 1 October 2021, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Applicant stated they were dissatisfied with the outcome of the Authority’s review because they did not believe the exemptions applied. The Applicant also considered that the public interest lay in favour of disclosure.
Investigation
7. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
8. On 1 November 2021, the Authority was notified in writing that the Applicant had made a valid application. The Authority was asked to send the Commissioner the information withheld from the Applicant. The Authority provided the information and the case was allocated to an investigating officer.
9. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Authority was invited to comment on this application and to answer specific questions.
These related to why the Authority considered the exemptions in sections 33(1)(b) and 38(1)(b) of FOISA to apply to the withheld information. Submissions were also requested around the Authority’s consideration of the application of the public interest test. The Authority was also asked to explain why information relating to the value of the contract was otherwise accessible to the Applicant, in line with section 25(1) of FOISA.
Commissioner’s analysis and findings
10. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.
Background – Lochaber Smelter Guarantee
11. In its submissions the Authority provided detailed background, the following parts of which may be helpful in explaining the background of the Lochaber Smelter Guarantee.
- The Lochaber aluminium complex in Fort William is the UK’s last remaining aluminium smelter; the operation is a key component of Scotland’s industrial capability and a major source of employment in the West Highlands.
- When Rio Tinto decided to review its Lochaber operations in 2016 the smelter faced the prospect of closure, endangering 170 direct jobs and over 300 jobs in total (direct, indirect and induced). The Authority’s focus at the time was to avoid the fragmentation of the Lochaber complex, to secure the long-term viability of the smelter and to realise further industrial and employment opportunities on site.
- In September 2016, as part of the wider overall objective of the Authority to preserve jobs, protect the economy and sustain the metals industry in Scotland, it indicated a willingness to support any purchaser who would retain the smelter and associated hydro-power scheme together, and make the necessary commitment to significant investment in the development of the Lochaber assets. The Authority’s offer included the potential to guarantee the power purchase obligations of the aluminium smelter and was made known on an even-handed basis to all short-listed bidders via the vendor (Rio Tinto).
- To deliver the Authority’s objective for the site, it is standing behind a portion of the power purchase obligations of the aluminium smelter operator (Alvance British Aluminium Limited – “SmelterCo”) in the event that it cannot pay for the power it is contracted to take from the hydro-electric power station operator (Simec Lochaber Hydropower 2 Limited – “HydroCo”). Both companies are part of the GFG Alliance “GFG” which is a collection of global businesses and investments.
- The commercial guarantee arrangement (the Guarantee) was entered into in December 2016 by the Authority, SmelterCo and HydroCo, and guarantees over a 25-year term that the Authority will pay for a percentage of the power that SmelterCo is contracted to purchase from HydroCo in the event that SmelterCo is unable to do so.
- The nominal value of the Authority’s contingent liability on day one of the Guarantee was £586 million (i.e. the total amount of payments guaranteed by the Authority across the 25-year agreement), and is the largest industrial guarantee ever agreed by the Authority.
- In return for the Guarantee, the Authority receives a commercial guarantee fee (the Fee) from GFG.
- In March 2021, GFG’s major providers of working capital and investment finance (Greensill Capital (UK) Limited and Greensill Capital Management Company (UK) Limited (together “Greensill”)) entered administration.
Authority’s interests
12. In addition to the background information above, the Authority explained that, as a result of its legal obligations arising from the Guarantee, it had a significant and specific financial and economic interest in the operation
of the smelter to which the information related. In addition, it had an overarching general interest in the original objectives of the proposal, namely the retention of jobs and the support of the metals industry in Scotland.
13. The Authority acknowledged that the Commissioner had previously indicated in Decision 144/2021 that he did not consider the Authority to be a commercial actor in respect of Scotland’s energy sector, but that it may have other
economic interests in relation to the smelter.
14. The Authority considered that its commercial, economic and financial interests in respect of the Guarantee were manifest and quantifiable, and information within the material remained current. It also submitted that there was
considerable uncertainty with respect to any future scenario involving the smelter, the loss of which could materially impact upon the local regional economy. It noted that, during the 18 months since the Greensill collapse, GFG and
its primary shareholder, Sanjeev Gupta, had sought to defend and engage in legal action across multiple jurisdictions in order to preserve operations.
Section 33(1)(b) of FOISA – Commercial interests and the economy
15. The Authority relied on the exemption in section 33(1)(b) for withholding certain information in document 1 from the Applicant.
16. Section 33(1)(b) of FOISA provides that information is exempt information if its disclosure under FOISA would, or would be likely to, prejudice substantially the commercial interests of any person (including a Scottish public
authority). This is a qualified exemption and is therefore subject to the public interest test in section 2(1)(b) of FOISA.
17. There are certain elements which an authority needs to demonstrate are present when relying on this exemption. In particular, it needs to indicate:
(i) whose commercial interests would (or would be likely to) be prejudiced by disclosure;
(ii) the nature of those commercial interests; and
(iii) how those interests would (or would be likely to) be prejudiced substantially by disclosure.
18. The prejudice must be substantial, in other words of real and demonstrable significance. Where the authority considers that the commercial interests of a third party would (or would be likely to be) harmed, it must make this
clear.
The Authority’s submissions about the exemption
19. The Authority submitted that it is Ernst & Young’s commercial interests which would be prejudiced by disclosure.
20. In the Authority’s view release of the remaining withheld information would put at risk the products and services offered by Ernst & Young. This would, the Authority argued, risk Ernst & Young’s ability to compete effectively
in future tendering exercises. Thereby putting Ernst & Young at a significant commercial disadvantage.
21. The Authority argued that the significant prejudice to Ernst & Young would manifest itself in two ways.
22. Firstly, competitors would be able to draw up bids with a level of knowledge about Ernst & Young’s business model and pricing mechanisms which goes significantly beyond that which would normally be expected in a functioning marketplace.
23. Secondly, Ernst & Young would find itself in a position of relative weakness in negotiations with other potential clients, who will find themselves equipped with an unusual level of knowledge of Ernst & Young’s agreement with another client.
The Applicant's submissions about the exemption
24. The Applicant submitted that they did not believe that the exemption in section 33(1)(b) of FOISA applied to the withheld information.
The Commissioner's view about the exemption
25. Having considered all of the submissions from both the Applicant and the Authority, together with the withheld information, the Commissioner is satisfied that Ernst & Young have commercial interests.
26. The Commissioner is aware that the agreement that was entered into between the Authority and Ernst & Young commenced on 4 October 2016, with outputs from the scope of work required by 14 October 2016, and agreed outputs of the whole study needed by 24 October 2016.
27. Whilst the Commissioner recognises that the withheld information on page 12 of document 1 details the daily rates charged by Ernst & Young for specified employees, these were the rates applicable when the agreement commenced.
It is highly likely, in the Commissioner’s view, that at the time at which the Applicant made his request (some 5 years later) these daily rates would have changed, and been more reflective of what the market for this type of work would sustain. As a consequence, the Commissioner does not accept that the likely harm anticipated, to the business or market for the type of work undertaken by Ernst & Young, by the Authority from disclosure would occur in relation to this information.
28. Furthermore, the Commissioner is aware that the Authority has not provided any submissions as to why disclosure of other information (that redacted on pages 6 and 7 of document 1) it has relied on section 33(1)(b) for would prejudice substantially Ernst & Young’s commercial interests.
29. Indeed, it is evident from reading document 1 that certain information withheld on one page of this document has been disclosed further down the same page. As a result, in the absence of specific submissions as to why disclosure of that instance of the information would, or would be likely to cause substantial prejudice, the Commissioner cannot accept that the exemption in section 33(1)(b) is engaged.
30. With regard to the information that has been redacted on page 6, the Commissioner is aware that this particular information is included on page 50 of the ‘Project Golf II report’ which was published, by the Authority on 7 July 2021. As a consequence of this, and in the absence of specific submissions from the Authority as to why disclosure of this specific information would, or would be likely to, prejudice substantially the commercial interests of Ernst & Young, the Commissioner does not accept that the exemption in section 33(1)(b) applies.
31. For the reasons outlined above, the Commissioner finds that the Authority was not entitled to rely on the exemption in section 33(1)(b) of FOISA for withholding certain of the information in document 1.
32. As the Commissioner is not satisfied that the Authority was entitled to rely on the exemption in section 33(1)(b) of FOISA he is not required to go on to consider the application of the public interest test in section 2(1)(b) of FOISA.
33. The Commissioner therefore requires the Authority to disclose the information withheld on pages 6, 7 and 12 of document 1 (for which it relied on the exemption in section 33(1)(b)) to the Applicant.
Section 38(1)(b) of FOISA – Personal information
34. The Authority has relied on the exemption in section 38(1)(b) of FOISA for certain information withheld in documents 1 and 2.
35. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is “personal data” (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR.
36. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption. This means that it is not subject to the public interest test in section 2(1)(b) of FOISA.
Is the withheld information personal data?
37. The first question the Commissioner must address is whether the information withheld by the Authority under this exemption is personal data for the purposes of section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable living individual. “Identifiable living individual” is defined in section 3(3) of the DPA 2018 – see Appendix 1. (This definition reflects the definition of personal data in Article 4(1) of the UK GDPR.)
38. Information will ”relate to” a person if it is about them, is linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus.
39. The Authority submitted that the withheld information consists of names of individuals, and because these individuals can be identified from this information, it is therefore personal data as defined in section 3(2) of the DPA 2018.
40. Having looked at the withheld information, the Commissioner notes that it is far more than the names of the individuals. The Authority has also relied on the exemption in section 38(1)(b) for an email address, signatures and part of a direct line telephone number for a named individual.
41. The Commissioner is satisfied that all of the information being withheld under section 38(1)(b) is personal data; the information identifies a living individual(s) and clearly relates to them.
Would disclosure contravene one of the data protection principles?
42. The Authority argued that disclosure would breach the first data protection principle in article 5(1)(a) of the UK GDPR. Article 5(1)(a) states that personal data shall be processed “lawfully, fairly and in a transparent manner in relation to the data subject.”
43. “Processing” of personal data is defined in section 3(4) of the DPA 2018. It includes (section 3(4)(d)) disclosure by transmission, dissemination or otherwise making available personal data. The definition therefore covers disclosing information into the public domain in response to a FOISA request.
44. The Commissioner must consider whether disclosure of the personal data would be lawful. In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed.
45. The Commissioner considers that condition (f) in Article 6(1) is the only condition which could potentially apply in the circumstances of this case.
Condition (f): legitimate interests
46. Condition (f) states that processing shall be lawful if it –
Is necessary for the purposes of legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
47. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in performance of their tasks, section 38(5A) of FOISA makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
48. The three tests which must be met before Article 6(1)(f) can be fulfilled are as follows (see paragraph 18 of South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55 - although this case was decided before
GDPR (and UK GDPR) came into effect, the relevant tests are almost identical):
(i) Does the Applicant have a legitimate interest in obtaining the personal data?
(ii) If so, would the disclosure of personal data be necessary to achieve that legitimate interest?
(iii) Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subject?
Does the Applicant have a legitimate interest in obtaining the personal data?
49. The Applicant explained that they were only seeking disclosure of the names of senior officials (senior civil servants, government ministers, directors of the GFG Alliance and directors/partners of Ernst & Young). They were content that all other personal data could be redacted
50. The Applicant did not believe that these individuals have an expectation of privacy.
51. In its submissions, the Authority stated that it was not aware of any legitimate interests the Applicant had in terms of the names of the individuals.
52. The Commissioner is satisfied that the Applicant, and the public as a whole would have a legitimate interest in certain of the personal data that has been withheld. The Commissioner recognises the substantial public interest that exists in relation to the agreements entered into between the Authority and the GFG Alliance around the purchase of the Lochaber Smelter, and this includes the background work carried out as part of those agreements. The Commissioner acknowledges that knowledge of who was involved in entering into this agreement, and agreeing the scope of work to be undertaken, would be in the interests of the public to ensure transparency and accountability.
Would disclosure of the personal data be necessary?
53. Having accepted that the Applicant has a legitimate interest in the personal data, the Commissioner must consider whether disclosure of the personal data would be necessary to meet the Applicant’s legitimate interests.
54. Here, “necessary” means “reasonably” rather than absolutely or strictly necessary. The Commissioner must therefore consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the Applicant’s legitimate interests can be met by means which interfere less with the privacy of the named individual.
55. The Authority did not consider it necessary for the personal data to be disclosed. The Authority submitted that it was not aware of how identifying the individuals would aid in the understanding of the information in the reports, even if the Applicant has a legitimate interest.
56. In this case, the Commissioner must consider the information requested against the legitimate interest he has identified and whether disclosure of that information is necessary to achieve the Applicant’s legitimate interest.
57. Having done this, and bearing in mind the Applicant’s indication that they are only interested in receiving the personal data of senior civil servants, government ministers, directors of the GFG Alliance and directors/partners
of Ernst & Young, the Commissioner does not consider it necessary for the personal data relating to any member of Ernst & Young staff, other than the name of the Executive Director responsible for signing the agreement, to be disclosed to the Applicant.
58. For the same reason, the Commissioner does not consider it necessary to disclose the personal data of employees of the Authority other than in the case of one data subject. While the Commissioner recognises that the individual responsible for signing the agreement on behalf of the Authority would not be considered to be a senior civil servant, he does accept that it would be necessary to disclose that individual’s name in order to satisfy the Applicant’s and wider public legitimate interest.
59. The Commissioner is aware from the Decision reached in Home Office v Information Commissioner EA/2011/0023 that the First Tier Tribunal took the view that the names of junior civil servants are generally protected unless they occupy a public facing role. However, in the later case of Cox v Information Commissioner and Home Office [2018] UKUT 119 (AAC) , the Upper Tribunal made it clear that each case should be considered on its merits.
60. Although the individual acting as a signatory on behalf of the Authority did not occupy a senior civil service grade, it is the Commissioner’s view that the role played by them in relation to this agreement is relevant inconsidering them to be ‘senior’ in this context.
61. Having considered the scope of the Applicant’s legitimate interests, the Commissioner accepts that disclosure of the name of the Executive Director from Ernst & Young responsible for signing the agreement, along with the name of the Senior Portfolio Manager who signed on behalf of the Authority is necessary to satisfy the legitimate interest in who was responsible for entering into the agreement. The Commissioner can see no other way in which the Applicant would be able to access this information which would interfere less with the data subject’s legitimate rights and freedoms.
62. The Commissioner will now consider whether the Applicant’s legitimate interest in obtaining the withheld information outweighs the rights and freedoms of the data subjects.
The data subject’s interests or fundamental rights and freedoms (and balancing exercise)
63. The Commissioner must balance the legitimate interests in disclosure of the information, against the data subject’s interests or fundamental rights and freedoms. In doing so, it is necessary for him to consider the impact of
such a disclosure. For example, a data subject would not reasonably expect that the information would be disclosed to the public under FOISA in response to the request, or if such disclosure would cause unjustified harm, their
interests or rights are likely to override any legitimate interest in disclosure. Only if the legitimate interests of the Applicant outweigh those of the data subject(s) could the information be disclosed without breaching the firstdata protection principle.
64. The Commissioner’s guidance on section 38 of FOISA notes factors that should be taken into account in balancing the interests of parties. He notes that Recital (47) of the General Data Protection Regulation states that much
will depend on the reasonable expectations of the data subjects. These are some of the factors public authorities should consider:
(i) Does the information relate to an individual’s public life (their work as a public official or employee) or to their private life (their home, family, social life or finances)?
(ii) Has the individual objected to the disclosure?
(iii) Would disclosure cause harm or distress?
65. In its submissions, the Authority argued that it did not believe that disclosure of personal data to fulfil the Applicant’s request would outweigh the individual’s interests in protecting their privacy.
66. The Authority did not provide any submissions around the specific interests or rights and freedoms of the data subjects it considered would be impacted by disclosure in response to the Applicant’s FOI request.
67. Having considered the information he found necessary to disclose, to fulfil the Applicant and wider public’s legitimate interest, the Commissioner notes that this personal data relates to the data subject’s public life. The
named individuals are acting in their professional role as signatories to the legal agreement. Given the seniority of the data subject acting on behalf of Ernst & Young, and in the absence of any submission to the contrary, the Commissioner considers that it would be within their reasonable expectation that their name would be disclosed in relation to an agreement entered into with a public sector organisation. The Commissioner is not aware of any harm or distress that is likely to be caused to that individual as a consequence of disclosure.
68. Given the specific role and function that the other data subject had in relation to responsibility for acting on behalf of the Authority to enter into a legal agreement with a private company, and, in the absence of any submissions to the contrary, the Commissioner considers that it would be within their reasonable expectation that their name would be disclosed in relation to this agreement. The Commissioner is not aware of any harm or distress that is likely to be caused to that individual as a consequence of disclosure.
69. After balancing the legitimate interests of the Applicant against the interests or fundamental rights or freedoms of the data subjects, the Commissioner finds that the legitimate interests served by disclosure of the names of the two data subjects would not be outweighed by any unwarranted prejudice that would result to the rights, freedoms or legitimate interests of those individuals.
70. Therefore, in all the circumstances of this particular case, the Commissioner concludes that condition (f) in Article 6(1) of the UK GDPR could be met in relation to the names of two of the data subjects which have been withheld.
71. However, in relation to the other data subjects, the Commissioner concludes that condition (f) in Article 6(1) of the UK GDPR could not be met.
Fairness and transparency
72. Given that the Commissioner has concluded that the condition of processing in Article 6(1)(f) of the UK GDPR would permit the processing of certain of the personal data in response to the Applicant’s request, he has concluded that disclosure of that personal data would also be fair and transparent in relation to the data subjects concerned.
73. Given that the Commissioner has concluded that the processing of the personal data of the other data subjects would be unlawful, he is not required to go on to consider whether disclosure of such personal data would otherwise be fair and transparent in relation to the data subjects.
Conclusions on the data protection principles
74. For the reasons set out above, the Commissioner is satisfied that disclosure of the personal data of two of the data subjects would not breach the data protection principle in Article 5(1)(a) of the UK GDPR. The Commissioner therefore finds that this personal data is not exempt from disclosure under section 38(1)(b) of FOISA.
75. However, also for the reasons set out above, the Commissioner is satisfied that disclosure of the personal data of the remaining data subjects whose data has been withheld would breach the data protection principle in Article
5(1)(a) of the UK GDPR. The Commissioner therefore finds that this personal data is exempt from disclosure under section 38(1)(b) of FOISA.
Section 25(1) of FOISA – Information otherwise accessible
76. Under section 25(1) of FOISA, information which a requester can reasonably obtain, other than by requesting it under section 1(1) of FOISA, is exempt information. The exemption in section 25 is absolute, in that it is not subject to the public interest test in section 2(1)(b) of FOISA.
77. The information requested by the Applicant in this case included:
A copy of the signed legal agreement between the Authority and Ernst & Young regarding due diligence on the Lochaber Guarantee & Reimbursement Agreement. They also asked, that if it was not included within the agreement, that the Authority supply the contract value and the scope of work (including any limitations)
78. In response to the part of the request where the Applicant asked for the contract value, the Authority provided them with a link to its website and informed the Applicant that as it published details of all of its expenditures over £25,000 it was relying on section 25(1) of FOISA.
79. Despite being asked to provide submissions around why the contract value was otherwise accessible to the Applicant in line with section 25(1) of FOISA, no comments or submissions were received from the Authority.
The Commissioner’s conclusions
80. Section 25(1) is one of the few provisions in FOISA that is not “applicant blind”. Whether the exemption in section 25(1) applies depends on the ability of the individual requester to be able to obtain the information other than under section 1(1) of FOISA.
81. As noted above, within their information request, the Applicant asked for the contract value.
82. Whilst the Commissioner recognises that the information can be drawn from publicly available information on the Authority’s website (accessible via the link provided), he finds that the Applicant would need to know a lot more information about how to locate the particular detail he is seeking.
83. However, in all the circumstances, the Commissioner is satisfied that part of the information sought by the Applicant (the contract value) is (and was) reasonably obtainable by them other than by making a request for it under section 1(1) of FOISA. Therefore, the Authority was entitled to apply section 25(1) of FOISA to this part of the request.
Section 15 – duty to provide advice and assistance
84. As paragraph 80 suggests, it is essential to any requester pursuing a right to information that (where the public authority is not simply providing the information, but rather is directing the requester to a place where it may
be obtained) they know enough about where to look for it to be able to pursue the right effectively. To this end, the Authority’s duty to provide advice and assistance can be vital.
85. Section 15 of FOISA requires a Scottish public authority, so far as it is reasonable to expect it to do so, to provide advice and assistance to a person who proposes to make, or has made, a request for information to it.
86. The Commissioner accepts that the Authority provided the Applicant with a link to where, on its website, information about monthly expenditures over £25,000 could be found. However, what it did not do was signpost the Applicant
to the appropriate month and year that they should be looking for, nor did they identify the relevant row on the spreadsheet concerned, which would reveal the requested information.
87. In all the circumstances, therefore, the Commissioner is not satisfied that the Authority provided the Applicant with adequate advice and assistance to meet its duty fully under section 15(1) of FOISA, in the context of the
information being considered reasonably obtainable in terms of section 25(1). The Commissioner therefore requires the Authority to clearly signpost the Applicant to the information, by informing them of the relevant year, month and the specific row on the appropriate spreadsheet.
Decision
The Commissioner finds that the Authority partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.
The Commissioner finds that by relying on section 38(1)(b) for withholding some information, the Authority complied with Part 1
The Commissioner also found that the Authority had been entitled to apply section 25(1) in respect of some information. However, by failing to provide reasonable advice and assistance to help the Applicant locate the information, the Authority failed to comply with section 15(1) of FOISA. The Commissioner also found that the Authority had not been entitled to rely on section 33(1)(b) for withholding some information from the Applicant and that the same was true in relation to certain of the information it had relied on the exemption in section 38(1)(b) for.
The Commissioner therefore requires the Authority to disclose the information detailed in the attached Appendix, by 20 June 2024.
Appeal
Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Enforcement
If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply. The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.
David Hamilton
Scottish Information Commissioner
6 May 2024
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
(2) The person who makes such a request is in this Part and in Parts 2 and 7 referred to as the “applicant.”
…
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that –
(a) the provision does not confer absolute exemption; and
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
…
15 Duty to provide advice and assistance
(1) A Scottish public authority must, so far as it is reasonable to expect it to do so, provide advice and assistance to a person who proposes to make, or has made, a request for information to it.
…
25 Information otherwise accessible
(1) Information which the applicant can reasonably obtain other than by requesting it under section 1(1) is exempt information.
(2) For the purposes of subsection (1), information-
(a) may be reasonably obtainable even if payment is required for access to it;
(b) is to be taken to be reasonably obtainable if-
(i) the Scottish public authority which holds it, or any other person, is obliged by or under any enactment to communicate it (otherwise than by making it available for inspection) to; or
(ii) the Keeper of the Records of Scotland holds it and makes it available for inspection and (in so far as practicable) copying by,
members of the public on request, whether free of charge or on payment.
(3) For the purposes of subsection (1), information which does not fall within paragraph (b) of subsection (2) is not, merely because it is available on request from the Scottish public authority which holds it, reasonably
obtainable unless it is made available in accordance with the authority's publication scheme and any payment required is specified in, or determined in accordance with, the scheme.
…
33 Commercial interests and the economy
(1) Information is exempt information if-
…
(b) its disclosure under this Act would, or would be likely to, prejudice substantially the commercial interests of any person (including, without prejudice to that generality, a Scottish public authority).
…
38 Personal information
(1) Information is exempt information if it constitutes-
…
(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);
…
(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act -
(a) would contravene any of the data protection principles, or
…
(5) In this section-
"the data protection principles" means the principles set out in –
(a) Article 5(1) of the UK GDPR, and
(b) section 34(1) of the Data Protection Act 2018;
"data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
…
“personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act);
“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).
(5A) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information, Article 6(1) of the UK GDPR (lawfulness) is to be read as
if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.
…
47 Application for decision by Commissioner
(1) A person who is dissatisfied with -
(a) a notice under section 21(5) or (9); or
(b) the failure of a Scottish public authority to which a requirement for review was made to give such a notice.
may make application to the Commissioner for a decision whether, in any respect specified in that application, the request for information to which the requirement relates has been dealt with in accordance with Part 1 of this Act.
(2) An application under subsection (1) must -
(a) be in writing or in another form which, by reason of its having some permanency, is capable of being used for subsequent reference (as, for example, a recording made on audio or video tape);
(b) state the name of the applicant and an address for correspondence; and
(c) specify –
(i) the request for information to which the requirement for review relates;
(ii) the matter which was specified under sub-paragraph (ii) of section 20(3)(c); and
(iii) the matter which gives rise to the dissatisfaction mentioned in subsection (1).
UK General Data Protection Regulation
Article 5 Principles relating to processing of personal data
1 Personal data shall be:
a. processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”)
…
Article 6 Lawfulness of processing
1 Processing shall be lawful only if and to the extent that at least one of the following applies:
…
f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or
fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.
…
Data Protection Act 2018
3 Terms relating to the processing of personal data
…
(2) “Personal data” means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).
(3) “Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to –
(a) an identifier such as a name, an identification number, location data or an online identifier, or
(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
(4) “Processing”, in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as –
…
(d) disclosure by transmission, dissemination or otherwise making available,
…
(10) “The UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4)).
…
