Decision 127/2024: Business Purchase Agreement and due diligence relating to purchase of Dalzell and Clydebridge Steel Works
Authority: Scottish Ministers
Case Ref: 202101551
Summary
The Applicant asked the Authority for the purchase agreement with TATA Steel for the purchase of the Dalzell and Clydebridge steelworks, as well as a copy of the due diligence performed on the acquisition. The Authority disclosed some information (subject to redaction) and informed the Applicant that other information was not held by it.
The Commissioner investigated and found that the Authority was entitled to notify the Applicant, in line with section 17, that no recorded information was held which would fulfil part of their request. The Commissioner also found that the Authority had been entitled to withhold certain information from the Applicant. He required the Authority to disclose other information to them.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1)(a), 2(1)(b) and 2(e)(ii) (Effect of exemptions); 17 (Notice that information is not held); 33(1)(b) (Commercial interests and the economy), 38(1)(b), (2A), (5) (definitions of “the data protection principles”, “data subject”, “personal
data” and “processing”, “the UK GDPR”) and (5A) (Personal information), 47(1) and (2) (Application for decision by Commissioner)
United Kingdom General Data Protection Regulation (the UK GDPR) articles 5(1)(a) (Principles relating to the processing of personal data); 6(1)(f) (Lawfulness of processing)
Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 19 May 2021, the Applicant made a request for information to the Authority. They asked for the purchase agreement with TATA Steel for the purchase of the Dalzell and Clydebridge steelworks, as well as a copy of the due diligence performed on the acquisition.
2. The Authority responded on 11 June 2021. In response, the Authority disclosed information in the Business Purchase Agreement, subject to redaction, for which it relied on the exemptions in sections 33(1)(b) and 38(1)(b) of FOISA. The Authority informed the Applicant, in line with section 17 of FOISA that it did not hold any
information regarding due diligence on the acquisition.
3. On the same date, the Applicant wrote to the Authority requesting a review of its decision. The Applicant stated that they were dissatisfied with the decision because they did not consider that the exemptions claimed by the Authority applied to the redacted information. They also asked the Authority to check whether due diligence was carried out on the transaction, as that would be expected. The Applicant expressed dissatisfaction that the public interest test had not been properly carried out and commented that this favours disclosure.
4. The Authority notified the Applicant of the outcome of its review on 8 July 2021. In doing so, the Authority confirmed its original decision, with modifications.
5. The Authority explained that due to the passage of time it was no longer seeking to rely on the exemption in section 33(1)(b) of FOISA for some of the information previously withheld. As a consequence, the Authority disclosed a new version of the Business Purchase Agreement to the Applicant. The Authority was continuing to rely on the exemption in section 33(1)(b) of FOISA for other withheld information in the Business Purchase Agreement, and it explained, with reasons why it considered the exemption to apply. It also set out its application of the public interest test. The Authority upheld its position that it did not hold information relating to due diligence, but confirmed that due diligence was carried out and provided the Applicant with an email address to facilitate contact with Scottish Enterprise should they wish to make an information request to them.
6. On 21 December 2021, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Applicant stated they were dissatisfied with the outcome of the Authority’s review because they did not agree that the exemptions claimed by the Authority applied to the withheld information. They were not satisfied that the public interest test had been properly carried out as they believed the public interest to favour disclosure. The Applicant also believed it reasonable to expect that due diligence would be performed on an acquisition and so believed the information to be held.
Investigation
7. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
8. On 21 December 2021, the Authority was notified in writing that the Applicant had made a valid application. The Authority was asked to send the Commissioner the information withheld from the Applicant. The Authority provided the information and the case was allocated to an investigating officer.
9. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Authority was invited to comment on this application and to answer specific questions. These related to;
- why the Authority considered disclosure of information in the Business Purchase Agreement would substantially prejudice the commercial interests of TATA Steel.
- why it considered some of the withheld information to be personal data, which, if disclosed would breach the Data Protection Act 2018.
- the nature of searches carried out by the Authority to determine whether it held any information relating to due diligence on the acquisition.
10. During the course of the investigation the Authority disclosed the purchase price recorded in the Business Purchase Agreement that it had previously withheld from the Applicant. This was released as a consequence of the information being shared publicly during a Parliamentary statement. As a consequence of the Authority’s decision to disclose this information during the investigation without providing any submissions as to why it was exempt from disclosure, the Commissioner must find that the Authority was not entitled to rely on the exemption in section 33(1)(b) of FOISA for this information.
11. The Authority also disclosed details of the assumed liabilities recorded at paragraph 8 of the Business Purchase Agreement to the Applicant during the course of the investigation. The Commissioner will consider, later on in the Decision Notice, whether the Authority was entitled to rely on the exemption in section 33(1)(b) of FOISA for withholding this information in response to the Applicant’s request and requirement for review.
Commissioner’s analysis and findings
12. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.
13. Although the Authority has now disclosed some previously withheld information to the Applicant, the Commissioner’s decision focuses (as it is required to do) on the circumstances at the time the Authority responded to the Applicant’s requirement for review.
Background and context
14. The information request in this case relates to a Business Purchase Agreement entered into for the purchase, by the Authority, of the Dalzell and Clydebridge Steel Works from TATA Steel in 2016. These steel works were subsequently sold to Liberty House (part of the GFG Alliance) by the Authority in a back to back sale transaction.
Section 17 – Information not held
15. In the second part of their request, the Applicant asked for a copy of the due diligence performed on the acquisition.
16. Section 1(1) of FOISA provides that a person who requests information from a Scottish public authority which holds it is entitled to be given that information by the authority, subject to qualifications which, by virtue of section 1(6) of FOISA, allow Scottish public authorities to withhold information or charge a fee for it. The
qualifications in section 1(6) are not applicable in this case.
17. The information to be given is that held by the authority at the time the request is received, as defined in section 1(4). This is not necessarily to be equated with information an applicant believes the authority should hold, although an applicant’s reasons may be relevant to the investigation of what is actually held. If no such
information is held by the authority, section 17(1) of FOISA requires it to give the applicant a notice in writing to that effect.
18. The standard of proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities. In determining where the balance of probabilities lies, the Commissioner considers the scope, quality, thoroughness and results of the searches carried out by the public authority. He also considers, where appropriate, any reason offered by the public authority to explain why it does not hold the information. While it may be relevant as part of this exercise to explore expectations about what information the authority should hold, ultimately the Commissioner’s role is to determine what relevant recorded information is (or was, at the time the request was received) actually held by the public authority.
19. As part of the investigation, the Authority was asked to explain what searches had been undertaken to determine whether it held recorded information relating to the due diligence performed on the acquisition.
The Authority’s submissions
20. The Authority submitted that its corporate records are held in its electronic filing system, eRDM, and it carried out searches of two specific files held in that system using the key words “Due Diligence”. The searches focussed on two named files as it is within these files that all documentation and information is stored about the
purchase, by the Authority, of the Dalzell and Clydebridge steelworks in 2016.
21. The Authority argued that due to the age of the requested information (dating back to 2016), information on the transaction would no longer be likely to be found in email inboxes or personal drives. The Authority also explained why this would be the case.
22. The use of the key words “Due Diligence” were, the Authority argued reasonable, as these were taken from the information request and are also used as standard terminology by officials working in this area. As such, the Authority considered use of these words would have located any information held within the specific files
covering the subject of the request.
23. Information identified as part of the searches was reviewed by staff working within the Manufacturing and Industries Division, alongside staff in the Rapid Response Unit, who had been involved in contingency work on Liberty Steel Dalzell. The Authority submitted that each item was reviewed individually and screened for duplication. The outcome of this review was that no information relevant to the information request was identified.
24. Because of the nature of the transaction carried out to transfer the Dalzell and Clydebridge steelworks from the Authority to Liberty House, the Authority asserted that there was no objectively identifiable form of due diligence which the Authority would have been expected to create or hold in the circumstances.
25. The Authority did not consider itself to be under any legal duty to hold any information relating to due diligence in regard to this purchase.
26. The Authority also concluded that the guidance included in the Scottish Public Finance Manual did not create an expectation that it would hold a particular form of due diligence in this case, due to the nature of the purchase and sale agreement. The Authority recognised that further guidance does exist around due diligence and human rights, but as this was not published at the time of the transaction in question, they concluded that it did not create any expectation upon it.
27. During the course of the investigation further submissions were sought from the Authority around other key words that may have been used in searches and another file that may contain relevant information.
28. Additional searches carried out by the Authority failed to identify any relevant recorded information which would fall within scope of the request.
The Applicant’s submissions
29. In their submissions, the Applicant highlighted that from disclosure of some of the information covered by their request, they noted that the withheld information related to the Authority assuming known and unknown financial liabilities from the sellers on the purchase of the Dalzell and Clydebridge Steel Works.
30. Whilst the Applicant recognised the fundamental difference between what information is held and what information should be expected to be held, they considered it reasonable to assume that the Authority did carry out some form of due diligence. They considered this would have been done to assess the financial liabilities it was absorbing. The Applicant therefore considered that information covering the second part of their request would be held.
The Commissioner's conclusions
31. In reaching a decision on whether the Authority was entitled to inform the Applicant that it holds no relevant recorded information which would fulfil the second part of their request, the Commissioner can only consider whether the Authority actually held the relevant information requested, and whether it complied with Part 1 of FOISA when responding to the request. The Commissioner cannot comment on whether the Authority should hold particular recorded information.
32. Having considered all relevant submissions from both the Applicant and the Authority, together with the terms of the request, the Commissioner is satisfied that by the end of the investigation the Authority took adequate, proportionate steps to establish what information it held that fell within scope of the second part of the request. The Commissioner is satisfied that the Authority did not hold any recorded information relating to due diligence performed on the acquisition, and that if it did, it would have been held within the specific files searched.
33. The Commissioner is therefore satisfied that the Authority does not (and did not, on receipt of the request) hold recorded information relating to due diligence performed on the acquisition. As a consequence, the Commissioner finds that the Authority was correct to give the Applicant notice, in terms of section 17(1) of FOISA, that it held no information falling within the scope of the second part of the request.
Section 33(1)(b) – Commercial interests and the economy
34. The Authority has relied on the exemption in section 33(1)(b) for withholding some information from the Business Purchase Agreement covered by the first part of the Applicant’s request.
35. Section 33(1)(b) of FOISA provides that information is exempt if its disclosure under FOISA would, or would be likely to, prejudice substantially the commercial interests of any person (including a Scottish public authority). This is a qualified exemption and is subject to the public interest test in section 2(1)(b) of FOISA.
36. There are certain elements which an authority needs to demonstrate are present when relying on this exemption. In particular, it needs to identify:
(i) whose commercial interests would (or would be likely to) be harmed by disclosure;
(ii) the nature of those commercial interests; and
(iii) how those interests would (or would be likely to) be prejudiced substantially by disclosure.
37. In order to evidence that this exemption is engaged, an authority has to show that disclosure of the information would, or would be likely to, be the catalyst that would cause the substantial prejudice to a commercial interest. The prejudice must be substantial, in other words of real and demonstrable significance.
The Authority’s submissions on the exemption
38. The Commissioner is unable in this decision to discuss the precise detail of much of the submissions: he must be careful not to disclose the withheld information in his reasoning, or anything which would lead to the withheld information being confirmed or otherwise discovered. This restriction limits the level of detail he can give to justify his conclusion. (This consideration has been acknowledged by the courts. In the case of Scottish Ministers v Scottish Information Commissioner (William Alexander’s Application) [2006] CSIH 8 , the Court of Session commented that, in giving reasons, the Commissioner is necessarily restrained by the need to avoid disclosing information which ought not to be disclosed.)
39. The Authority stated that the commercial interests of concern in relation to the withheld information are those of both TATA Steel and Liberty Steel. It is the Authority’s assertion that disclosure of the withheld information would substantially prejudice the commercial interests of both TATA Steel and Liberty Steel.
40. Submissions were provided by the Authority in relation to the specific information withheld and these will be fully considered by the Commissioner. But for the reasons given in paragraph 38 above they will not be set out here.
41. The Authority explained that TATA Steel and Liberty Steel operate in a very competitive commercial environment, where any advantage can be crucial. The Authority commented that knowledge of the withheld information could be used to advantage competitors.
42. Furthermore, TATA Steel and Liberty Steel are both customers of each other, and compete in the same market place against one another. For that reason, together with the fact that they come from different market positions and adopt different strategies to achieve their objectives, the Authority submitted that knowledge of the withheld information would have an adverse impact on their business relations as well as an economic impact on the way the businesses trade.
43. It is the Authority’s view that release of the withheld information could prompt further financial analysis of the businesses, undermine customer confidence in the business, which, in effect would add to the complicated nature of the industry by putting at risk the livelihood of those employed in the businesses throughout the UK. The Authority also considered that this information could be leveraged by competitors, suppliers, customers and creditors.
44. In justifying its reliance on this exemption, the Authority clarified the nature of the transaction that took place around the purchase and sale of the Dalzell and Clydebridge steel works. Specifically, the Authority explained that having purchased both Dalzell and Clydebridge steel works from TATA Steel, the Authority then immediately
sold these to Liberty Steel.
The Applicant's submissions on the exemption
45. In their application to the Commissioner, the Applicant considered that the exemption in section 33(1)(b) of FOISA does not apply to the withheld information.
The Commissioner's view about the exemption/exception
46. The Commissioner is satisfied that both TATA Steel and Liberty Steel have commercial interests in relation to the withheld information.
47. That said, the Commissioner is not satisfied that disclosure of the withheld information in response to this information request would cause the harm anticipated by the Authority to those commercial interests.
48. With regard to the remaining information in paragraph 3 and all of the information withheld in paragraph 12.4 in the Business Purchase Agreement, the Commissioner does not accept that disclosure of this would harm the commercial interests of either party.
49. During the course of the investigation into an application which considers the same withheld information as this one, and which was investigated in tandem with this case, the Authority provided the Commissioner with a copy of the Business Sale Agreement which covered the sale of the Dalzell and Clydebridge Steel Works to Liberty Steel.
50. Having compared the information in both the Business Purchase Agreement and Business Sale Agreement (one of which would have been seen by TATA Steel and the other by Liberty Steel), the Commissioner is unable to accept the contention of the Authority that disclosure of the remaining information in paragraph 3 and all of the information in paragraph 12.4 would harm the financial or economic interests of either party when competing against each other for work in the steel market.
51. The Commissioner appreciates that TATA Steel and Liberty Steel may not be the only operators in the steel market, and that other competitors may exist, along with suppliers, customers and creditors. However, where the Authority asserted that disclosure of the information in paragraph 3 and paragraph 12.4 would substantially prejudice the commercial interests of TATA Steel and Liberty Steel if it was known to competitors, suppliers, customers and creditors, it has not said specifically how this would be the case, or when the harm anticipated from disclosure would occur. For that reason, the Commissioner does not agree that the Authority has demonstrated that disclosure of the particular information in paragraphs 3 and 12.4 of the Agreement would, or would be likely to prejudice substantially the commercial interests of either TATA Steel or Liberty Steel if it was disclosed in response to this request.
52. As mentioned above, because the Commissioner’s decision in this case must focus on the circumstances at the time the Applicant submitted their requirement for review, the Commissioner has also considered whether the Authority was entitled to rely on the exemption in section 33(1)(b) for the information withheld in section 8 of the Agreement.
53. In doing so, the Commissioner is aware of the time-bar that exists in respect of clauses of this nature included in agreements. Given the fact that the Business Purchase Agreement in this case was signed in 2016, it is evident to the Commissioner that any actions that could be taken regarding matters covered by the information in section 8 would have expired before the Applicant submitted their information request. As such, in the absence of any specific submissions from the Authority around the actual harm that would result to the commercial interests of either TATA Steel or Liberty Steel as a consequence of disclosure of this information at the time of the requirement for review, the Commissioner does not agree that the exemption in section 33(1)(b) of FOISA is (or was at the time of the requirement for review) engaged.
54. The Commissioner therefore finds that the Authority was not entitled to rely on the exemption in section 33(1)(b) of FOISA for withholding the remaining information in paragraph 3 and all of the information in paragraph 12.4 and section 8 from the Applicant.
55. Because the Commissioner finds that the Authority was not entitled to rely on the exemption in section 33(1)(b) of FOISA he is not required to go on to consider the application of the public interest test in section 2(1)(b).
Section 38(1)(b) – Personal information
56. The Authority has relied on the exemption in section 38(1)(b) of FOISA for withholding some information contained in the Business Purchase Agreement.
57. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if its is “personal data” (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or (where relevant) in the DPA 2018.
58. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption. This means that it is not subject to the public interest test in section 2(1)(b) of FOISA.
59. To rely on this exemption, the Authority must show that the withheld information is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles found in Article 5(1) of the UK GDPR.
60. The Commissioner must decide whether the Authority was correct to withhold some of the information covered by the request under section 38(1)(b).
Is the withheld information personal data?
61. The first question the Commissioner must address is whether the specific information withheld in the Business Purchase Agreement is personal data for the purposes of section 3(2) of the DPA 2018.
62. “Personal data” is defined in section 3(2) of the DPA 2018 as “any information relating to an identified or identifiable living individual”. Section 3(2) of the DPA 2018 defines “identifiable living individual” as a living individual who can be identified, directly or indirectly, in particular by reference to-
(i) an identifier, such as a name, an identification number, location data, or an online identifier, or
(ii) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
63. The Authority submitted that as individuals can be identified from the withheld information it is personal data as defined by section 3(2) of the DPA 2018.
64. The two main elements of personal data are that the information must “relate” to a living person, and that person must be identified – or identifiable – from the data, or from the data and other accessible information.
65. Information will “relate to” a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus.
66. An individual is “identified” or “identifiable” if it is possible to distinguish them from other individuals.
67. Having considered the submissions received, the Commissioner accepts that the withheld information covering names and signatures relate to identifiable individuals. The Commissioner is therefore satisfied that the withheld information is the personal data of identifiable individuals and, as such, is personal data in terms of section 3(2) of the DPA 2018.
Would disclosure contravene one of the data protection principles?
68. Article 5(1)(a) of the UK GDPR, which the Authority considered applicable in this case, requires personal data to be processed “lawfully, fairly and in a transparent manner in relation to the data subject.”
69. The definition of “processing” is wide and includes (section 3(4)(d) of the DPA 2018) “disclosure by transmission, dissemination or otherwise making available”. In the case of FOISA, personal data are processed when disclosed in response to a request. Personal data can only be disclosed if disclosure would be both lawful (i.e. if it would meet one of the conditions of lawful processing listed in Article 6(1) of the UK GDPR) and fair.
70. The Authority considered that the only condition of lawful processing which may apply would be that in Article 6(1)(f) of the UK GDPR.
71. The Commissioner must now consider whether disclosure of the information would contravene Article 5(1)(a) of the UK GDPR. As mentioned above, personal data can only be disclosed if disclosure would be both lawful (i.e. it would meet one of the conditions for lawful processing in Article 6(1) of the UK GDPR) and fair.
Lawful processing: Article 6(1)(f) of the UK GDPR
72. The Commissioner must consider if disclosure of the personal data would be lawful. In considering lawfulness, he must consider whether any of the conditions in Article 6(1) of the UK GDPR would allow the personal data to be disclosed. The Authority considered whether 6(1)(f) would apply in this case. (The Commissioner accepts that this is the only condition which could potentially apply in this case).
Condition (f): legitimate interest
73. Condition (f) states that processing will be lawful if it “…is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in
particular where the data subject is a child”.
74. Although Article 6 states that this condition cannot apply to processing carried out by public authorities in performance of their tasks, section 38(5A) of FOISA (see Appendix 1) makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
75. The tests which must be met before Article 6(1)(f) can be met are as follows:
(a) Does the Applicant have a legitimate interest in obtaining the personal data?
(b) If so, would disclosure of the personal data be necessary to achieve that legitimate interest?
(c) Even if processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data
subject?
76. There is no presumption in favour of the disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. Accordingly, the legitimate interests of the Applicant must outweigh the rights and freedoms or legitimate interests of the data subject(s) before condition (f) will permit the personal data to be
disclosed. If the two are evenly balanced, the Commissioner must find that the Authority was correct to refuse to disclose the personal data to the Applicant.
Does the Applicant have a legitimate interest in obtaining the personal data?
77. In their submissions to the Commissioner, the Applicant considered the exemptions claimed by the Authority did not apply to the withheld information. However, they also commented that they believed certain of the redacted information to relate to names of workers and they were not seeking disclosure of this information. The Applicant also made it clear that they were only seeking disclosure of the names of senior officials (such as senior civil servants, government ministers and directors of the GFG Alliance) and all other personal data could remain redacted.
78. In seeking to justify why they considered there to be an interest in disclosure of the information, the Applicant referred to an article in the media which highlighted concerns over whether the Authority may have broken the law in relation to the purchase and sale of the steelworks.
79. The Authority submitted that it was not aware of any legitimate interest the Applicant would have in the names of the individuals in the Business Purchase Agreement, or that identifying the individuals would aid in the understanding of the information in the Business Purchase Agreement.
80. Having considered the submissions from both the Applicant and Authority, the Commissioner accepts that the Applicant does have a legitimate interest in the personal data that has been withheld. The Commissioner acknowledges that disclosure of this information would inform both the Applicant and the public more widely of who was involved in the Business Purchase Agreement between the Authority and TATA Steel for the purchase of the Dalzell and Clydebridge Steel Works. The Commissioner recognises that there was/and is a clear public interest in understanding more about this transaction and knowledge of those who were involved in it from both parties would aid that understanding.
Is disclosure of the personal data necessary?
81. The Commissioner will now consider whether disclosure of the personal data requested is necessary for the Applicant’s legitimate interest. In doing so, he must consider whether these interests might reasonably be met by any alternative means.
82. The Commissioner has considered this carefully in light of the decision of the Supreme Court in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55.
83. “Necessary” means “reasonably” rather than “absolutely” or “strictly” necessary. When considering whether disclosure would be necessary, public authorities should consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the requester’s legitimate interests can be met by means which interfere less with the privacy of the data subject(s).
84. Having considered the nature of the information that has been withheld, the Commissioner does not consider it necessary for all of this to be disclosed in order to fulfil the Applicant’s legitimate interest.
85. Given the Applicant’s specific comment that they did not require the names in Schedule Part 3 of the Business Purchase Agreement to be disclosed, the Commissioner does not consider it necessary for this information to be released.
86. Furthermore, because the Applicant has made it clear that they are only interested in the names of senior officials, the Commissioner does not consider it necessary for most of the names and signatures redacted on pages 15 and 16 of the Agreement to be disclosed in order to fulfil the Applicant’s legitimate interest.
87. The Commissioner notes that the personal data that has been redacted on pages 15 and 16 of the Agreement comprises the names and signatures of the witnesses to the Agreement, along with the Authorised Signatories from TATA Steel and LONGS Steel (the names of these Authorised Signatories have been disclosed, only the actual signatures are being withheld). On page 16, the signature of the Authorised Signatory for the Scottish Ministers has also been withheld.
88. The Commissioner is satisfied that the names and signatures of the witnesses should be withheld. He considers that these individuals were only witnessing the signing of the Agreement, they were not shaping the terms of the Agreement, nor were they signing as party to the Agreement. The Commissioner is satisfied that disclosure of their names and signatures would not add anything to the public debate or increase public knowledge of the individuals involved in agreeing the terms of the deal. The Commissioner considers that the Applicant’s legitimate interests can be met without disclosure of this information.
89. The Commissioner is also satisfied that the signatures of the Authorised Signatories for TATA Steel and LONGS Steel do not need to be disclosed to meet the Applicant’s legitimate interests. The Commissioner acknowledges that, unlike the witnesses, the Authorised Signatories did have a role in approving the Agreement, and that disclosure of their involvement would aid the Applicant’s legitimate interests. However, he notes that the names of these individuals have already been disclosed, therefore disclosure of the signatures itself would, again, add nothing to the publics’ understanding or knowledge of these events.
90. As the Commissioner has concluded that it is not necessary for the personal data, that he has described above to be disclosed in order to fulfil the Applicant’s legitimate interest, he finds that condition (f) of Article 6(1) of the UK GDPR cannot be satisfied.
91. The final piece of personal data for the Commissioner to consider is the signature of the Authorised Signatory for the Scottish Ministers. Unlike the Authorised Signatories for the steel companies, the name of this individual is not provided in written form in the Agreement, and therefore it has not been disclosed to the Applicant. The redacted signature is the only mention of this individual in the Agreement, and the Commissioner considers that disclosure of this information could provide insight into who signed the Agreement on behalf of the Authority. He is therefore satisfied that disclosure of this information would be necessary to meet the Applicant’s legitimate interests.
92. As the Commissioner has concluded that it is necessary to disclose one of the signatures on page 16 of the Agreement in order to meet the Applicant’s legitimate interest he must now balance this against the fundamental rights and freedoms of the data subject (the senior official whose signature has been redacted). Only if the legitimate interests of the Applicant outweighed those of the data subject could personal data be disclosed without breaching the first data protection principle.
93. The Commissioner has considered the submissions from both parties carefully, in the light of the decision by the Supreme Court in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 555 .
94. In its submissions, the Authority argued that it would be unfair to release the information as the employee in question would not expect their personal data to be processed in this way.
95. The Authority submitted that it has a general approach of disclosing information about senior members of staff, releasing details of those within senior civil service roles and officials with relatively senior roles that are public facing.
96. The Authority recognised that the data subject whose signature has been redacted would come within the definition of being a senior member of staff. It is the Authority’s position that had the data subject’s name been included in the Agreement rather than only their signature, it would have disclosed their name. But it considered it would amount to unfair processing to release the data subject’s signature.
97. The Commissioner's guidance on section 38 of FOISA notes that, in carrying out the balancing exercise, much will depend on the reasonable expectations of the data subjects. Factors which will be relevant in determining reasonable expectations include:
(i) whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)
(ii) the potential harm or distress that may be caused by disclosure
(iii) whether the individual objected to the disclosure.
98. The Commissioner agrees with the Authority that a signature would be information which an employee would not expect to be released in response to an information request.
99. Whilst the data subject signed the Agreement as part of their work as a public official or employee, the Commissioner considers that harm and distress would be caused to the data subject by disclosure of their signature.
100. After carefully balancing the legitimate interests of the Applicant against the interests or fundamental rights or freedoms of the data subject, the Commissioner finds that the legitimate interests served by disclosure of the signature would be outweighed by the unwarranted prejudice that would result to the rights and freedoms or
legitimate interests of the data subject in question.
101. In all the circumstances of the case, the Commissioner concludes that condition (f) in Article 6(1) of the UK GDPR could not be met in relation to the personal data that has been withheld.
102. Given that the Commissioner has found that the processing would be unlawful, he is not required to go on to consider separately the data subject’s interests or fundamental rights and freedoms (or balance them against any legitimate interest in disclosure of the information).
103. Given that the Commissioner has concluded that the processing of personal data would be unlawful, he is not required to go on to consider whether disclosure of such personal data would otherwise be fair and transparent in relation to the data subject.
104. In all the circumstances of the case, in the absence of a condition in Article 6(1) of the UK GDPR being met, the Commissioner must conclude that disclosure of the personal data would breach the data protection principle in Article 5(1)(a) of the UK GDPR. Consequently, he is satisfied that disclosure of the personal data is exempt
under section 38(1)(b) of FOISA.
Decision
The Commissioner finds that the Authority partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request
made by the Applicant.
The Commissioner finds that by informing the Applicant, in line with section 17 of FOISA, that no relevant recorded information was held which would fulfil the second part of their request and by relying on the exemption in section 38(1)(b) of FOISA for withholding personal data from the Applicant, the Authority complied with Part 1.
However, by applying the exemption in section 33(1)(b) of FOISA to certain information withheld in the Business Purchase Agreement, the Commissioner finds that the Authority failed to comply with Part 1.
Given that the Authority disclosed information in section 8 of the Business Purchase Agreement to the Applicant during the course of the investigation, the Commissioner does not require it to take any action in relation to that breach.
The Commissioner does however require the Authority to disclose to the Applicant the remaining information withheld in paragraph 3 and all of the information withheld in paragraph 12.4 of the Business Purchase Agreement by 29 July 2024.
Appeal
Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such
appeal must be made within 42 days after the date of intimation of this decision.
Enforcement
If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply. The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.
David Hamilton
Scottish Information Commissioner
13 June 2024
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
(2) The person who makes such a request is in this Part and in Parts 2 and 7 referred to as the “applicant.”
…
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that –
(a) the provision does not confer absolute exemption; and
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption –
…
(e) in subsection (1) of section 38 –
..
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied.
…
17 Notice that information is not held
(1) Where-
(a) a Scottish public authority receives a request which would require it either-
(i) to comply with section 1(1); or
(ii) to determine any question arising by virtue of paragraph (a) or (b) of section 2(1),
if it held the information to which the request relates; but
(b) the authority does not hold that information,
it must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it.
(2) Subsection (1) is subject to section 19.
(3) Subsection (1) does not apply if, by virtue of section 18, the authority instead gives the applicant a refusal notice.
…
33 Commercial interests and the economy
(1) Information is exempt information if-
…
(b) its disclosure under this Act would, or would be likely to, prejudice substantially the commercial interests of any person (including, without prejudice to that
generality, a Scottish public authority).
…
38 Personal information
(1) Information is exempt information if it constitutes-
…
(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);
…
(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act -
(a) would contravene any of the data protection principles, or
(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.
…
(5) In this section-
"the data protection principles" means the principles set out in –
(a) Article 5(1) of the UK GDPR, and
(b) section 34(1) of the Data Protection Act 2018;
"data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
…
“personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act);
“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).
(5A) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information, Article 6(1) of the UK GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.
…
47 Application for decision by Commissioner
(1) A person who is dissatisfied with -
(a) a notice under section 21(5) or (9); or
(b) the failure of a Scottish public authority to which a requirement for review was made to give such a notice.
may make application to the Commissioner for a decision whether, in any respect specified in that application, the request for information to which the requirement relates
has been dealt with in accordance with Part 1 of this Act.
(2) An application under subsection (1) must -
(a) be in writing or in another form which, by reason of its having some permanency, is capable of being used for subsequent reference (as, for example, a recording made
on audio or video tape);
(b) state the name of the applicant and an address for correspondence; and
(c) specify –
(i) the request for information to which the requirement for review relates;
(ii) the matter which was specified under sub-paragraph (ii) of section 20(3)(c); and
(iii) the matter which gives rise to the dissatisfaction mentioned in subsection (1).
UK General Data Protection Regulation
Article 5 Principles relating to processing of personal data
1 Personal data shall be:
a. processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”)
…
Article 6 Lawfulness of processing
1 Processing shall be lawful only if and to the extent that at least one of the following applies:
…
f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests
are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in
particular where the data subject is a child.
…
Data Protection Act 2018
3 Terms relating to the processing of personal data
…
(2) “Personal data” means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).
(3) “Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to –
(a) an identifier such as a name, an identification number, location data or an online identifier, or
(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
(4) “Processing”, in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as –
…
(d) disclosure by transmission, dissemination or otherwise making available,
…
(14) In Parts 5 to 7, except where otherwise provided –
(a) references to the UK GDPR are to the UK GDPR read with Part 2;
…
(c) references to personal data, and the processing of personal data, are to personal data and processing to which Part 2, Part 3 or Part 4 applies;
(d) references to a controller or processor are to a controller or processor in relation to the processing of personal data to which Part 2, Part 3 or Part 4 applies.
