Decision 136/2024: GFG Alliance Guarantee and reimbursement Agreement securities and correspondence with Deloitte on claiming securities (Lochaber Smelter)
Authority: Scottish Ministers
Case Ref: 202101170
Summary
The Applicant asked the Authority for information on, and correspondence around, the securities open to the Ministers should the Lochaber guarantee not be upheld.
The Authority, after initially refusing to provide any information due to cost, informed the Applicant that some information was already available in the public domain. It provided the Applicant with some information but withheld the remainder under several exemptions in FOISA.
During the investigation, the Authority changed its position, to continue to withhold the information it considered to be personal data, and additionally, that it considered involved the formulation and development of Scottish Government policy, as well as that it considered was confidential, and/or would affect the conduct of public affairs.
The Commissioner investigated and found that the Authority was correct to withhold most of the information but had wrongly withheld a small amount.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 29(1)(a) (Formulation of Scottish Administration policy etc.); 30(c) (Prejudice to effective conduct of public affairs); 36(1) (Confidentiality); 38(1)(b), (2A) and (5) (definitions of “data protection principles”, “data subject”, “personal data” and “processing”) and (5A) (Personal information); 47(1) and (2) (Application for decision by Commissioner)
United Kingdom General Data Protection Regulation (the UK GDPR) articles 5(1)(a) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness of processing)
Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and (14) (a), (c) and (d) (Terms relating to the processing of personal data)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 11 July 2021, the Applicant made a request for information to the Authority. He asked for:
i) Details of the securities open to the Scottish Government should GFG Alliance fail to uphold its part of the Lochaber guarantee.
ii) Correspondence between Ministers, officials, and Deloitte around claiming on the securities held as part of the guarantee.
2. The Authority responded on 10 August 2021 in terms of section 12(1) of FOISA, stating that it would cost more than £600 to provide a response, and suggested the Applicant consider reducing or narrowing his request.
3. On 13 August 2021, the Applicant wrote to the Authority requesting a review of its decision. The Applicant stated that he was dissatisfied with the decision because the application of the cost exemption had not been properly detailed, nor had there been any suggestion as to how he might restrict his request to avoid the cost exemption. He considered that the detail of his request should have allowed the Authority to conduct a sufficiently narrow search, not requiring the searching of all of the records
held, as suggested in his response.
4. The Authority notified the Applicant of the outcome of its review on 10 September 2021, changing its position. In relation to part one of the Applicant’s request, the Authority responded in terms of section 25(1) of FOISA. It informed the Applicant that the information was already accessible via Companies House and provided a link. It also provided some information on a non-UK based company, that was not available from Companies House. The Authority provided some information falling within the scope of part two of the Applicant’s request, and relied upon sections 30(b)(ii), 33(1)(b), and 38(1)(b) to withhold the remainder of the in-scope information (a substantial amount of information in two of the relevant documents had been deemed to be out of the scope of the request).
5. On 16 September 2021, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Applicant stated he was dissatisfied with the outcome of the Authority’s review because he considered;
6. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
7. On 20 October 2021, the Authority was notified in writing that the Applicant had made a valid application. The Authority was asked to send the Commissioner the information withheld from the Applicant. The Authority provided the information and the case was allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Authority was invited to comment on this application and to answer specific questions. These related to the Authority’s reliance on the exemptions in sections 30(b)(ii), 33(1)(b) and 38(1)(b) to withhold information, falling within the scope of his request, from the Applicant.
9. During the investigation, the Authority informed the Commissioner that it wished to withdraw its reliance on s30(b)(ii) and s33(1)(b) of FOISA to withhold the majority of the information, and wished instead to rely on the exemptions in sections 29(1)(a), 30(c), and 36(1) of FOISA. It continued to rely upon section 38(1)(b) of FOISA.
10. The Applicant was notified of this change in position and given the opportunity to provide comments on the Authority’s decision to now rely upon the exemptions in sections 29(1)(a), 30(c), 36(1) and 38(1)(b) of FOISA to withhold some of the requested information.
Commissioner’s analysis and findings
11. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.
Background: Lochaber Smelter Guarantee
12. The Authority provided detailed background information, the following parts of which may be helpful in explaining the background of the Lochaber Smelter Guarantee.
13. The Lochaber aluminium complex in Fort William is the UK’s last remaining aluminium smelter, the operation of which is a key component of Scotland’s industrial capability and a major source of employment in the West Highlands.
14. When Rio Tinto decided to review its Lochaber operation in 2016, the smelter faced the prospect of closure, endangering over 300 jobs in total (direct, indirect and induced). The Authority’s focus at the time was to avoid the fragmentation of the Lochaber complex, to secure the long-term viability of the smelter and to realise further industrial and employment opportunities on site.
15. In September 2016, as part of the Authority’s wider overall objective to preserve jobs, protect the economy and sustain the metals industry in Scotland, the Authority indicated its willingness to support any purchaser who would retain the smelter and associated hydro-power scheme. The Authority’s offer included the potential to guarantee the power purchase obligations of the aluminium smelter and was made known to all short-listed bidders via the vendor (Rio Tinto).
16. To deliver its objective for the site, the Authority is standing behind a portion of the power purchase obligations of the aluminium smelter operator (Alvance British Aluminium Limited (Smelter Co)) in the event that it cannot pay for the power it is contracted to take from the hydro-electric power station operator (Simec Lochaber Hydropower 2 Limited (HydroCo)). Both companies are part of the GFG Alliance (GFG) which is a collection of global businesses and investments. A power purchase agreement
(PPA) between SmelterCo and HydroCo fixes the smelter’s electricity prices for 25 years with the aim of locking in low long-term predictable renewable energy costs for the smelter and to provide revenue certainty to the power station.
17. The commercial guarantee arrangement (the Guarantee) was entered into in December 2016 by the Authority, SmelterCo and HydroCo, and guarantees over a term of 25 years that the Authority will pay for a percentage of the power that SmelterCo is contracted to purchase from HydroCo in the event that SmelterCo is unable to do so.
18. The nominal value of the Authority’s contingent liability on day one of the Guarantee was £586 million (i.e. the total amount of payments guaranteed by the Authority across the 25 year agreement), and is the largest industrial guarantee ever agreed by the Authority.
19. In return for the Guarantee, the Authority receives a commercial guarantee fee (the Fee) from GFG.
20. In March 2021, GFG’s major providers of working capital and investment finance (Greensill Capital (UK) Limited and Greensill Capital Management Company (UK) Limited (together “Greensill”)) entered administration.
The Authority’s interests
21. In addition to the background information above, the Authority explained that, as a result of its legal obligations arising from the Guarantee, it had a significant and specific financial and economic interest in the operation of the smelter to which the information related. In addition, it had an overarching general interest in the original objectives of the proposal, namely the retention of jobs and the support of the metals industry in Scotland.
22. The Authority acknowledged that the Commissioner had previously indicated in Decision 144/2021 that he did not consider the Authority to be a commercial actor in respect of Scotland’s energy sector, but that it may have other economic interests in relation to the smelter.
23. The Authority considered that its commercial, economic and financial interests in respect of the Guarantee were manifest and quantifiable, and information within the material remained current. It also submitted that there was considerable uncertainty with respect to any future scenario involving the smelter, the loss of which could materially impact upon the local regional economy. It noted that, during the 18 months since the Greensill collapse, GFG and its primary shareholder, Sanjeev Gupta, had sought to defend and engage in legal action across multiple jurisdictions in order to preserve operations.
Withheld information
24. Four documents have been identified as falling within the scope of this request:
- Document 1 – Share Pledge by SIMEC Energy PTE Ltd - information withheld under section 38(1)(b)
- Document 2 – email relating to Lavender Outcomes Report - information withheld under section 38(1)(b)
- Document 3 – Lochaber Outcomes Report - information withheld under sections 29(1)(a), 36(1) and 38(1)(b)
- Document 4 – Draft Contingency Planning Report - information withheld under sections 29(1)(a), 30(c), 36(1) and 38(1)(b)
A considerable proportion of documents 3 and 4 had been deemed by the Authority to fall outwith the scope of the Applicant’s request.
25. During the course of the investigation a small amount of information in document 2, and document 4, previously withheld under section 33(1)(b) of FOISA, was provided to the Applicant. The Commissioner must find, therefore, that as this information was wrongly withheld by the Authority it had failed to comply with part 1 of FOISA.
Out of scope information
26. As noted above, the Authority had argued that large parts of documents 3 and 4 are outwith the scope of the request. It provided the Commissioner with its reasoning as to why it considered this to be the case.
27. The Authority explained that the Applicant had asked for information about the securities that it had over Lochaber. It submitted that the securities were a legal fact and fall to be enforced in certain scenarios. It had identified the areas of these two documents that specifically dealt with these matters and had excluded the rest as being out of scope.
28. The Commissioner has reviewed all of the information considered out of scope, and he is satisfied that the Authority has correctly identified the information, within these documents, that falls within the scope of the Applicant’s request.
Section 29(1)(a) – Formulation of Scottish Administration policy etc.
29. Under section 29(1)(a) of FOISA, information held by the “Scottish Administration” (defined in section 126 of the Scotland Act 1998 as members of the Scottish Executive and junior Scottish Ministers and their staff; and non-ministerial office holders of the Scottish Administration and their staff) is exempt information if it relates to the formulation or development of government policy.
30. “Formulation” of government policy suggests the early stages of the policy process where options are identified and considered, risks are identified, consultation takes place and recommendations and submissions are presented to the Ministers. “Development” suggests the processes involved in reviewing, improving upon or amending existing policy; it can involve piloting, monitoring, analysing, reviewing or recording the effects of existing policy.
31. For information to fall under this exemption, it need only “relate” to the formulation or development of government policy, i.e. to the consideration or development of options and priorities for Scottish Ministers, who will subsequently determine which of these should be translated into policy action and/or legislation, and when.
The Authority’s submissions on section 29(1)(a)
32. The Authority submitted that the information being withheld under this exemption related to the formulation or development of Government policy in respect of employment, industry, the economy, and sustainable development.
33. Its view was that the reports, produced by Deloitte, acting as a provider of consultancy services on the Authority’s instructions, considered its strategic position in relation to Lochaber smelter, for the purposes of ensuring the ongoing sustainability and viability of the industry, with the overarching objective of protecting jobs and the economy in Scotland.
34. The Authority argued that the reports remained under consideration for the ongoing purpose of formulating its economic strategy, and that the analysis contained within the report formed an integral part of the development of the policy. It outlined that not all of the proposals will be taken forward, but that it was a necessary part of policy development to examine all of the options before it concluded its final policy objective. The Authority explained that it had not come to a settled view on how to
proceed on any of the options set out in the contingency reports
35. This aspect of the policy, it argued, remains in development, and it is this element to which the withheld material related.
36. The Authority considered that a number of highly politically sensitive and economically important choices need to be made in developing its thinking, taking into consideration a number of contingencies, factors and variables that the withheld reports discussed and provided analysis and advice on.
The Applicant's submissions on section 29(1)(a)
37. The Applicant questioned the application of this exemption, and argued that it could hardly be at the early policy stage of the guarantee in 2021, several years after the guarantee was agreed with GFG Alliance/Liberty Steel.
38. He disagreed with a blanket application of an exemption on the discussions around the Lochaber smelter.
39. The Applicant also conceded that it was difficult to argue against the application of this exemption due to the fact that almost everything under the Authority’s umbrella of activity could, theoretically be captured by it.
The Commissioner's view on section 29(1)(a)
40. For information to be exempt under section 29(1)(a) of FOISA, it only has to “relate to” the formulation or development of government policy, i.e. to the consideration or development of options and priorities for Ministers, which will subsequently determine which of these should be translated into political action and when.
41. The Commissioner notes that the exemption has not been applied in a blanket fashion to all of the information being withheld in documents 3 and 4 but rather to specific information.
42. Having considered the withheld information, the Commissioner does not accept that all of the information being withheld under this exemption relates to the formulation or development of Government policy. He considers that a small amount of information has been wrongly withheld:
43. The Commissioner is, however, satisfied that the remaining information withheld under this exemption relates to the formulation or development of Government policy and, accordingly, that the exemption in section 29(1)(a) of FOISA is engaged.
44. The Commissioner therefore requires the Authority to provide the information wrongly withheld to the Applicant.
Public interest test - section 29(1)(a)
45. As indicated above, the exemption in section 29(1)(a) is a qualified exemption, which means that its application is subject to the public interest test set out in section 2(1)(b) of FOISA. Having concluded that most of the withheld information is exempt under section 29(1)(a), the Commissioner must go on to consider whether, in all the circumstances of the case, the public interest in disclosing this information is outweighed by the public interest in maintaining the exemption.
The authority’s submissions about the public interest – section 29(1)(a)
46. The Authority recognised the public interest in ensuring transparency and accountability in the decision making of government.
47. It noted that not all of the proposals would be taken forward, but that it was important that consideration be given to all of the possible options and the Authority considered that, at the moment, there is a need for both Ministers and officials to have space to discuss and develop policies.
48. The Authority therefore believed that the release of the information would not meet the longer-term public interest in mature policy making.
The Applicant’s submissions about the public interest – section 29(1)(a)
49. The Applicant submitted that the Lochaber smelter guarantee was worth more than £500m when it was signed between GFG Alliance and the Scottish Ministers, and he argued that whether the deal was appropriate is a matter of significant public interest given the risk to public funds committed at the time, and the outstanding risk today. He considered there was a central question of transparency that would help and enhance accountability significantly given the secrecy around the deal to date. He believed
that disclosure would give the public more confidence that value for money had been achieved, and enable them to hold decision makers to account.
The Commissioner's view on the public interest – section 29(1)(a)
50. The Commissioner has considered carefully the representations made by both the Applicant and the Ministers when balancing the public interest both for and against disclosure of the information.
51. The Commissioner agrees there is a general public interest in transparency and accountability, and in scrutinising actions taken in the process of policy development. He also accepts that a significant amount of public money was involved in this instance, and that disclosure would allow the public some incite into the situation, and decision making process.
52. The Commissioner also accepts the Authority’s position that the process is still ongoing, and that circumstances may determine the policy options that are taken
forwards. He accepts the general public interest in allowing all options to be explored and debated by the Authority, and in allowing them a private space to discuss these
options freely and frankly in the interest of a fully-informed basis for policy development.
53. In all the circumstances of this case, the Commissioner has concluded that the public interest in disclosure of the remaining withheld information is outweighed by
that in maintaining the exemption in section 29(1)(a) of FOISA. The Authority was therefore entitled to withhold this information under this exemption.
Section 30(c) – Prejudice to effective conduct of public affairs
54. Section 30(c) of FOISA exempts information if its disclosure “would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs”. This exemption is subject to the public interest test in section 2(1)(b) of FOISA.
55. The use of the word “otherwise” distinguishes the harm required from that envisaged by the exemptions in sections 30(a) and (b). This is a broad exemption and the Commissioner expects any public authority citing it to show what specific harm would (or would be likely to) be caused to the conduct of public affairs by disclosure of the information, and how that harm would be expected to follow from disclosure.
56. The standard to be met in applying the tests contained in section 30(c) is high: the prejudice in question must be substantial and therefore of real and demonstrable significance. The Commissioner expects authorities to demonstrate a real risk or likelihood of substantial prejudice at some time in the near (certainly foreseeable) future, not simply that such prejudice is a remote or hypothetical possibility. Each request should be considered on a case by case basis, taking into consideration the content of the information and all other relevant circumstances (which may include the timing of the request).
57. The Authority relied on section 30(c) to withhold a small amount of information in document 4.
The Authority’s submissions on section 30(c)
58. The Authority submitted that it was under an obligation set out in the Ministerial Code to ensure that decisions are informed by appropriate analysis of legal considerations.
59. The Authority stated that the exemption in section 30(c) applied because release of the information would breach the longstanding Law Officer Convention (reflected in the Ministerial Code) which prevents the Scottish Government from revealing whether Law Officers either have or have not been asked to provide legal advice on any matter.
60. The Authority noted that the Ministerial Code states at paragraph 2.38 that the Authority must not divulge who provided the advice (whether it was from the Law Officers or anyone else).
61. The Authority considered that the Law Officers’ Convention has been given particular recognition in FOISA through section 29, subject to it being outweighed by greater considerations of public interest. The Authority submitted that breach of Law Officers’ Convention itself substantially prejudices the effective conduct of public affairs.
62. Additionally, the Authority noted that the courts have found that Parliament intended real weight should be afforded to the Law Officers’ Convention, and that the general considerations of good government underlining the history and nature of the convention are capable of affording weight to the interest in maintaining an exemption even in the absence of evidence of particular damage (see HM Treasury V IC [2009] EWHC 1811 (Admin) [2010] QB 56
63. The Authority also submitted that revealing whether or not Law Officers had been asked to advise on this matter would encourage people to draw conclusions regarding the importance placed by government on the subject.
64. The Authority explained that this would significantly harm the effective conduct of public affairs by placing undue pressure on it and its officials in future when it is considering seeking legal advice and the suitability of who should be asked to provide that advice, in particular when considering seeking advice from the Law Officers.
Applicant’s submissions on section 30(c)
65. During the course of the investigation the Applicant was informed of the Authority’s decision to rely on the exemption in section 30(c) of FOISA for withholding some information from him and invited to provide comment. No submissions were received from the Applicant about this.
The Commissioner's view on section 30(c)
66. Information can only be exempt under section 30(c) of FOISA if its disclosure would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.
67. The Commissioner has considered the issue of the Law Officers’ Convention in previous decisions, and in each case, he has accepted its importance and the risks posed by a breach. The Commissioner has taken a similar approach in this case, and he finds that the exemption contained in section 30(c) of FOISA is engaged, with respect to this information.
Public interest test – section 30(c)
68. As indicated above, the exemption in section 30(c) is a qualified exemption, which means that its application is subject to the public interest test set out in section 2(1)(b) of FOISA. Having concluded that the information was correctly withheld under section 30(c), the Commissioner will now go on to consider whether, in all the circumstances of the case, the public interest in disclosing this information is outweighed by the public interest in maintaining the exemption.
The authority’s submissions about the public interest – section 30(c)
69. The Authority recognised that there is some public interest in disclosure in order to promote transparency and inform public debate as releasing details of who provided legal advice may be of interest to some people.
70. The Authority did not consider, that in this case, that public interest outweighed the public interest in maintaining the law Officers’ Convention. In its view disclosure of this information would not add to the public’s understanding of the issues in relation to the Authority’s policy position on the Lochaber smelter and associated matters.
71. It submitted, therefore, that the public interest in maintaining the exemption outweighed any public interest in the release of the information.
The Applicant’s submissions about the public interest – section 30(c)
72. The Applicant’s public interest argument in favour of disclosure was made to counter all of the exemptions applied by the Authority. He strongly believed that the public interest outweighed any argument made to withhold the information. In his view the scale of the commitment from the government in financial terms raised serious questions about value for money, but critically if there is a lack of transparency then it fatally undermines the ability of anyone outside of government to hold the Authority to account. He stated that transparency on this topic was therefore clearly and demonstrably in the public interest.
The Commissioner's view on the public interest – section 30(c)
73. The Commissioner is satisfied that the public interest lies in protecting the source of the Authority’s legal advice. He has taken account of the public interest arguments put forward by both the Applicant and the Authority in coming to this conclusion, and does not consider the public interest concerns expressed by the Applicant would be addressed by disclosing this information.
74. The Commissioner considers that, on balance, the public interest in maintaining the Law Officers’ Convention, and upholding the exemption outweighs the public interest in disclosure. He therefore, finds that the Authority has correctly withheld this information, in document 4, under section 30(c) of FOISA.
Section 36(1) – Confidentiality of communications
75. Section 36(1) of FOISA exempts from disclosure information in respect of which a claim of confidentiality of communications could be maintained in legal proceedings. One type of communication covered by this exemption is that to which legal advice privilege, a form of legal professional privilege, applies.
76. Legal advice privilege covers communications between lawyers and their clients in the course of which legal advice is sought or given. For the exemption to apply to this particular type of communication, certain conditions must be fulfilled:
(i) The information must relate to communications with a professional legal adviser, such as a solicitor or advocate;
(ii) The legal adviser must be acting in their professional capacity; and
(iii) The communications must occur in the context of the legal adviser’s professional relationship with their client.
77. Information cannot be privileged unless it is also confidential. It must be information in respect of which a claim of confidentiality of communications could be maintained in legal proceedings. The claim must be capable of being sustained at the time the exemption is claimed: the information must possess the quality of confidence at that time, and so cannot have been made public, either in full or in a summary substantially reflecting the whole.
The Authority’s submissions on section 36(1)
78. The Authority was withholding some information in both document 3 and 4 under this exemption.
79. It submitted that the information withheld under section 36(1) fell within the scope of legal advice and was therefore exempt because disclosure would breach legal professional privilege. The Authority explained that the withheld information summarised legal advice as part of the presentation and consideration of options for policy actions, leading to its adoption of its legal position. It submitted that disclosure would disclose the substance and source of the advice. and undermine consideration of
options.
80. The Authority stated that release of the information would breach legal professional privilege by divulging information about the points being considered by legal professionals, the extent of their comments and the issues being flagged for further consideration. It confirmed that all of the necessary conditions for legal advice privilege to apply were satisfied.
81. The Authority considered that a claim to confidentiality could be maintained in legal proceedings because the correspondence in questions was only shared between it and its legal advisers.
The Commissioner’s view on section 36(1)
82. The Commissioner has considered the content of the information withheld under section 36(1) of FOISA and the circumstances in which it was created. He accepts that it meets the conditions for legal advice privilege to apply.
Public interest test – section 36(1)
The Authority’s submissions about the public interest - section 36(1)
83. The exemption in section 36(1) is a qualified exemption, which means that it is subject to the public interest test in section 2(1)(b) of FOISA. This means that the exemption can only be upheld if the public interest in disclosing the information is outweighed by the public interest in maintaining the exemption.
84. The Authority recognised the public interest in the disclosure of the withheld information as part of open, transparent and accountable government, and acknowledged that there was a strong public interest in relation to its involvement in the Lochaber smelter.
85. However, it considered that there was a very strong public interest in maintaining the exemption relating to legal professional privilege in order to ensure confidentiality of communications for the following reasons.
86. The Authority stated that it remained important that in all cases that lawyers can provide free and frank legal advice which considers and discusses all issues and options without fear that advice may be disclosed, and, as a result, potentially be taken out of context.
87. It considered that in areas such as this, which are subject to public scrutiny, an expectation that legal advice could be released would inevitably lead to the legal advice being more circumspect and therefore less effective.
88. On balance, the Authority considered that the public interest in maintaining the exemption outweighed that of disclosure, given the overriding public interest in maintaining the confidentiality of communications between lawyers and their clients and the public interest in allowing full and detailed internal consideration of the legal issues in relation to consideration of policy actions in relation to the operation of the Lochaber smelter.
The Applicant’s submissions about the public interest – section 36(1)
89. The Applicant’s public interest arguments have been stated previously in paras 49 and 72. He considered transparency was needed to satisfy the public interest around this matter particularly given the nature of the agreement, and level of risk entered into by the Authority in relation to Lochaber smelter.
The Commissioner’s view on the public interest – section 36(1)
90. As the Commissioner has noted in a number of previous decisions, the courts have long recognised the strong public interest in maintaining the right to confidentiality of communications between legal adviser and client on administration of justice grounds.
91. In a freedom of information context, the strong inherent public interest in maintaining legal professional privilege was emphasised by the High Court (of England and Wales) in the case of Department for Business, Enterprise and Regulatory Reform v Information Commissioner and O'Brien [2009] EWHC 164 (QB) . Generally, the Commissioner
will consider the High Court's reasoning to be relevant to the application of section 36(1) of FOISA.
92. The Commissioner accepts that there is a considerable, in-built, public interest in maintaining the ability of the Authority to receive full, unhindered legal advice.
93. The Commissioner acknowledges that there will be occasions where the significant in-built public interest in favour of withholding legally privileged communications may be outweighed by the public interest in disclosing the information. For example, disclosure may be appropriate where (the list is not exhaustive):
- the privileged material discloses wrongdoing by/within an authority
- the material discloses a misrepresentation to the public of advice received
- the material discloses an apparently irresponsible and wilful disregard of advice
- the passage of time is so great that disclosure cannot cause harm.
94. Having examined the withheld information, while the Commissioner accepts that the contents of the advice would be of interest to the Applicant and to the general public, he does not consider that any of the above categories would apply.
95. The Commissioner accepts that there is a public interest in the subject matter of the advice and its disclosure in terms of accountability and transparency, particularly given the level of public money involved.
96. However, the Commissioner must take account of the important public interest in legal professional privilege itself and the public interest in allowing public authorities to obtain confidential legal advice.
97. The Commissioner accepts that there is a strong public interest in a Scottish public authority being able to receive full, unhindered legal advice. Without such comprehensive advice being available to Authority, its ability to come to fully-formed decisions would be restricted, which would not be in the public interest.
98. On balance, and after careful consideration, the Commissioner does not find the public interest in disclosure of this information is sufficiently compelling to outweigh the strong public interest in maintaining the confidentiality of communications between legal adviser and client.
99. The Commissioner is therefore satisfied that the Authority correctly withheld this information under section 36(1) of FOISA.
Section 38(1)(b) – Personal information
100. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is “personal data” (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or where relevant in the DPA 2018.
101. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
102. To rely on this exemption, the Authority must show that the information withheld is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Article 5(1) of the UK GDPR.
103. The Commissioner must decide whether the Authority was correct to withhold some of the information requested in documents 1, 2, 3 and 4 under section 38(1)(b) of FOISA.
Is the information personal data?
104. The first question that the Commissioner must address is whether the withheld information is personal data for the purposes of section 3(2) of the DPA 2018.
105. “Personal data” is defined in section 3(2) of the DPA 2018 as “any information relating to an identified or identifiable individual”. Section 3(3) of the DPA 2018 defines “identifiable living individual” as a living individual who can be identified, directly or indirectly, in particular by reference to:
(i) An identifier such as a name, an identification number, location data, or an online identifier, or
(ii) One or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
106. Information will “relate to” a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.
107. The Court of Justice of the European Union looked at the question of identification in Breyer v Bundesrepublik Deutschland. The Court took the view that the correct test to consider is whether there is a realistic prospect of someone being identified. When making that determination, account can be taken of the information in the hands of a third party. However, there must be a realistic causal chain – if the risk of identification is insignificant, the information will not be personal data.
108. Although this decision was made before the UK GDPR and the DPA 2018 came into force, the Commissioner considers that the same rules will apply. In accordance with Recital 26 of the GDPR (the source of the UK GDPR), the determination of whether a natural person is identifiable should take account of all means reasonably likely to be used to identify the person, directly or indirectly. In considering what is reasonably likely, the Recital states that all objective factors should be taken into account,
such as the costs and amount of time required for identification, taking into consideration the available technology at the time of processing and technological developments.
109. The Authority submitted that the information being withheld by it under section 38(1)(b) was personal data as it comprised the names of individuals, and that, as those individuals could be identified from this information, it met the definition as described above.
110. Having considered the withheld information (names, signatures, job titles, email addresses and telephone numbers), the Commissioner accepts that it “relates to” identifiable living individuals. The Commissioner therefore concludes that the withheld information is personal data for the purposes of section 3(2) of the DPA 2018.
Which of the data protection principles would be contravened by disclosure?
111. The Authority stated that disclosure of the personal data would contravene the first data protection principle (Article 5(1)(a) of the UK GDPR). Article 5(1)(a) states that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.
112. In terms of section 3(4)(d) of the DPA 2018, disclosure is a form of processing. In the case of FOISA, personal data is processed when it is disclosed in response to a request for information.
113. The Commissioner must now consider if disclosure of the personal data would be lawful (Article 5(1)(a)). In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed.
114. The Authority concluded that it could not identify a lawful basis for disclosure under Article 6 of the UK GDPR. The only condition the Authority felt was potentially applicable was the condition in Article 6(1)(f).
115. The Commissioner agrees that condition (f) in Article 6(1) is the only one which could potentially apply in the circumstances of this case.
Condition (f): legitimate interests
116. Condition (f) states that the processing will be lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data (in particular where the data subject is a child).
117. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA (see Appendix 1) makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
118. The tests which must be met before Article 6(1)(f) can be met are as follows:
(i) Does the Applicant have a legitimate interest in obtaining the personal data?
(ii) If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?
(iii) Even if processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?
Does the Applicant have a legitimate interest in obtaining the personal data?
119. In his submissions to the Commissioner, the Applicant has stated that the names of senior figures within the organisations concerned should be disclosed due to the high public interest in this particular deal between Ministers and private business.
120. The Authority submitted that it was not aware of any legitimate interest the Applicant had in the names of the individuals. It did not consider that identifying individuals would aid in the understanding of the information in the reports, nor in the actions of the organisations involved.
121. Having considered the submissions from both parties, the Commissioner accepts that, given the significant public interest there was (and is) in the financial risk and circumstances around the guarantee agreement with GFG Alliance, the Applicant and the public as a whole, have a legitimate interest in understanding who was involved. The Commissioner is therefore satisfied that the Applicant has a legitimate interest in the personal data.
Is disclosure of the personal data necessary?
122. The Commissioner will now consider whether disclosure of the personal data requested is necessary for the Applicant’s identified legitimate interest. In doing so, he must consider whether these interests might reasonably be met by any alternative means.
123. The Commissioner has considered this carefully in light of the decision by the Supreme Court in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55.
124. "Necessary" means "reasonably" rather than "absolutely" or "strictly" necessary. When considering whether disclosure would be necessary, public authorities should consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the requester's legitimate interests can be met by means which interfere less with the privacy of the data subject.
125. The personal data being withheld by the Authority relates to a range of individuals, some of whom are very senior within their organisations, and some of which was already in the public domain.
126. The Authority submitted that, if the Applicant did have a legitimate interest in the withheld information, it did not consider that the identities of the individuals concerned was necessary to meet this.
127. Having considered the Applicant’s legitimate interests, the Commissioner accepts that, to some extent, disclosure some of the withheld personal data would provide the Applicant with information to aid his understanding the circumstances of the guarantee.
128. The Commissioner can identify no viable means of fully meeting the Applicant's legitimate interests which would interfere less with the privacy of the data subjects than providing the remaining withheld personal data in full. In all the circumstances, therefore, the Commissioner is satisfied that disclosure of the information is necessary for the purposes of the Applicant's legitimate interests.
129. The Commissioner will now consider whether the Applicant’s legitimate interest in obtaining the remaining withheld personal data outweighs the rights and freedoms of the data subjects.
The data subjects’ interests or fundamental rights and freedoms
130. The Commissioner must balance the legitimate interests in disclosure against the data subjects' interests or fundamental rights and freedoms. In doing so, it is necessary for him to consider the impact of disclosure. For example, if the data subjects would not reasonably expect that the information would be disclosed to the public under FOISA in response to the request, or if such disclosure would cause unjustified harm, their interests or rights are likely to override any legitimate interests in disclosure. Only if the legitimate interests of the Applicant outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle.
131. The Commissioner's guidance on section 38 of FOISA notes factors that should be taken into account in balancing the interests of parties. He notes that much will depend on the reasonable expectations of the data subjects. These are some of the factors public authorities should consider:
- Does the information relate to an individual's public life (their work as a public official or employee) or to their private life (their home, family, social life or finances)?
- Would the disclosure cause harm or distress?
- Whether the individual has objected to the disclosure.
132. The Commissioner acknowledges that the withheld information relates to the individuals’ public live, in that it identifies them as individuals connected in some way to the Guarantee, or the parties to the guarantee. However, he acknowledges that, by association, the information also relates to their private lives.
133. The Commissioner notes that the one of the people whose data has been withheld in document one holds a very senior position, and his identity could be determined through easily accessible sources from the information that has already been provided to the Applicant. The Authority has not explained specifically why disclosure of this data subject’s personal data would cause harm to their interests, fundamental rights or freedoms. Therefore, given the seniority of the data subject, the Commissioner
considers that it would be within their reasonable expectation that their involvement in the Share Pledge. As a consequence, the Commissioner finds that fulfilment of the legitimate interest of the Applicant in this case outweighs any harm to the data subject.
134. Similarly, on page 14 of document 3, information relating to the identities of four individuals, who again are at a senior level within their organisation, has already been published in The Standard newspaper on 5 May 2021. The Commissioner therefore, cannot see evidence of any harm to their interests, fundamental rights or freedoms from the disclosure of the same information within document 3. Again, in this instance, the Commissioner finds that fulfilment of the legitimate interest of the
Applicant in this case outweighs any harm to the data subject.
135. On pages 1 and 2 of document 4, some of the information withheld relates to senior people within the organisation. The Authority has again not explained specifically why disclosure of this data subject’s personal data would cause harm to their interests, fundamental rights or freedoms. Therefore, given the seniority of the data subject, the Commissioner considers that it would be within their reasonable expectation that their involvement in the report. As a consequence, the Commissioner finds that fulfilment of the legitimate interest of the Applicant in this case outweighs any harm to the data subject.
136. For the remaining information, that comprises of names, telephone numbers, email addresses and signatures, the Commissioner accepts that these individuals would, otherwise, have no expectations that their personal data would be publicly disclosed in response to a request under FOISA and he recognises their right to privacy in this regard.
137. Therefore, in all of the circumstances of the case, the Commissioner concludes that condition (f) in Article 6(1) of the UK GDPR could only be met in relation to the personal data of some of the data subjects.
Fairness and transparency
138. Given that the Commissioner has concluded that the condition of processing in Article 6(1)(f) of the UK GDPR would permit the processing of certain of the personal data in response to the Applicant’s request, he has concluded that disclosure of that personal data would also be fair and transparent in relation to the data subjects concerned.
139. Given that the Commissioner has concluded that the processing of the personal data of the other data subjects would be unlawful, he is not required to go on to consider whether disclosure of such personal data would otherwise be fair and transparent in relation to the data subjects.
Conclusion on the data protection principles
140. For the reasons set out above, the Commissioner is satisfied that disclosure of the personal data of some of the data subjects would not breach the data protection principle in Article 5(1)(a) of the UK GDPR. The Commissioner therefore finds that these personal data are not exempt from disclosure under section 38(1)(b) of FOISA.
141. However, also for the reasons set out above, the Commissioner is satisfied that disclosure of the personal data of the remaining data subjects whose data have been withheld would breach the data protection principle in Article 5(1)(a) of the UK GDPR. The Commissioner therefore finds that these personal data are exempt from disclosure under section 38(1)(b) of FOISA.
Decision
The Commissioner finds that the Authority partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request
made by the Applicant.
The Commissioner finds that by relying on sections 29(1)(a), 30(c), 36(1) and 38(1)(b) of FOISA for withholding certain information from the Applicant, the Authority complied
with Part 1.
However, the Commissioner finds that the Authority was not entitled to rely on the exemptions in sections 29(1)(a), 33(1)(b) and 38(1)(b) of FOISA for withholding other
information from the Applicant and, in doing so, it failed to comply with section 1(1).
The Commissioner therefore requires the Authority to disclose the information detailed in the attached Appendix, by 4 August 2024.
Appeal
Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Enforcement
If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply. The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.
David Hamilton
Scottish Information Commissioner
19 June 2024
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
(2) The person who makes such a request is in this Part and in Parts 2 and 7 referred to as the “applicant.”
…
(6) This section is subject to sections 2, 9, 12 and 14.
…
29 Formulation of Scottish Administration policy etc.
(1) Information held by the Scottish Administration is exempt information if it relates to-
(a) the formulation or development of government policy;
…
30 Prejudice to effective conduct of public affairs
Information is exempt information if its disclosure under this Act-
…
(c) would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.
…
36 Confidentiality
(1) Information in respect of which a claim to confidentiality of communications could be maintained in legal proceedings is exempt information.
…
…
38 Personal information
(1) Information is exempt information if it constitutes-
…
(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);
….
(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act -
(a) would contravene any of the data protection principles, or
(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.
…
(5) In this section-
"the data protection principles" means the principles set out in –
(a) Article 5(1) of the UK GDPR, and
(b) section 34(1) of the Data Protection Act 2018;
"data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
“personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act);
“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).
(5A) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of
information, Article 6(1) of the UK GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests
gateway in relation to public authorities) were omitted.
…
47 Application for decision by Commissioner
(1) A person who is dissatisfied with -
(a) a notice under section 21(5) or (9); or
(b) the failure of a Scottish public authority to which a requirement for review was made to give such a notice.
may make application to the Commissioner for a decision whether, in any respect specified in that application, the request for information to which the requirement relates
has been dealt with in accordance with Part 1 of this Act.
(2) An application under subsection (1) must -
(a) be in writing or in another form which, by reason of its having some permanency, is capable of being used for subsequent reference (as, for example, a recording made
on audio or video tape);
(b) state the name of the applicant and an address for correspondence; and
(c) specify –
(i) the request for information to which the requirement for review relates;
(ii) the matter which was specified under sub-paragraph (ii) of section 20(3)(c);
and
(iii) the matter which gives rise to the dissatisfaction mentioned in subsection (1).
….
UK General Data Protection Regulation
Article 5 Principles relating to processing of personal data
1 Personal data shall be:
a. processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”)
…
Article 6 Lawfulness of processing
1 Processing shall be lawful only if and to the extent that at least one of the following applies:
…
f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden
by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.
…
Data Protection Act 2018
3 Terms relating to the processing of personal data
…
(2) “Personal data” means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).
(3) “Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to –
(a) an identifier such as a name, an identification number, location data or an online identifier, or
(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
(4) “Processing”, in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as –
…
(d) disclosure by transmission, dissemination or otherwise making available,
…
(10) “The UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the
processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales,
Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4)).
…
(14) In Parts 5 to 7, except where otherwise provided –
(a) references to the UK GDPR are to the UK GDPR read with Part 2;
…
(c) references to personal data, and the processing of personal data, are to personal data and processing to which Part 2, Part 3 or Part 4 applies;
(d) references to a controller or processor are to a controller or processor in relation to the processing of personal data to which Part 2, Part 3 or Part 4 applies.
…
