Decision 206/2024: Information disclosed in response to a previous FOI request relating to the purchase agreement with TATA Steel
Authority: Scottish Ministers
Case Ref: 202200673
Summary
The Applicant asked the Authority for an unredacted copy of information previously disclosed in response to a specified request for information, along with any internal correspondence relating to that request and requirement for review. The Authority disclosed some information, but withheld other information under a number of exemptions.
The Commissioner investigated and found that the Authority had been entitled to withhold certain information from the Applicant. He required the Authority to disclose other information to him.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1)(a), 2(1)(b) and 2(e)(ii) (Effect of exemptions), 30(c) (Prejudice to the effective conduct of public affairs), 33(1)(b) (Commercial interests and the economy), 38(1)(b), (2A), (5) (definitions of “the data protection principles”, “data subject”, “personal data” and “processing”, “the UK GDPR”) and (5A) (Personal information), 47(1) and (2) (Application for decision by Commissioner)
United Kingdom General Data Protection Regulation (the UK GDPR) articles 5(1)(a) (Principles relating to the processing of personal data); 6(1)(f) (Lawfulness of processing)
Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 22 December 2021, the Applicant made a request for information to the Authority. He asked for;
(i) An unredacted copy of all information disclosed as part of FOI/202100212787, which was a review of 202100203997.
(ii) Any internal correspondence on those FOIs, including discussions of redactions.
2. The Authority responded on 13 April 2022. In its response, the Authority refused to release information in response to the first part of the Applicant’s request because this was the subject of an appeal. As a consequence, the Authority explained it was not possible to release an unredacted version of the information. With regard to the second part of the Applicant’s request, the Authority disclosed some information but withheld the remainder under exemptions in sections 30(b)(ii), 33(1)(b), 36(1) and
38(1)(b) of FOISA.
3. On 11 May 2022, the Applicant wrote to the Authority requesting a review of its decision. The Applicant stated that he was dissatisfied with the decision because he did not agree that the exemptions applied, and even if they did, he considered that the public interest favoured disclosure. The Applicant also expressed dissatisfaction with the late response.
4. The Authority notified the Applicant of the outcome of its review on 10 June 2022. The Authority upheld its original response, with modifications. The Authority explained it was no longer relying on the exemption in section 30(b)(ii) of FOISA (this had been applied in error) but was continuing to rely on the exemptions in sections 33(1)(b), 36(1) and 38(1). The Authority commented that it had incorrectly relied on the exemption in section 36(1) of FOISA for certain information and was now relying on section 30(c) for that specific information. The Authority concluded that where the public interest test applied, it lay in maintaining the exemptions concerned.
5. On 10 June 2022, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Applicant stated he was dissatisfied with the outcome of the Authority’s review because he disagreed with the applicability of the exemptions cited and also considered that the public interest test had wrongfully concluded that the information should be withheld.
Investigation
6. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
7. On 4 July 2022, the Authority was notified in writing that the Applicant had made a valid application. The Authority was asked to send the Commissioner the information withheld from the Applicant. The Authority provided the information and the case was allocated to an investigating officer.
8. When it provided the withheld information, the Authority informed the Commissioner that it was now only relying on the exemptions in sections 30(c), 33(1)(b) and 38(1)(b) of FOISA.
9. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Authority was invited to comment on this application and to answer specific questions. These sought justification from the Authority of its reliance on the exemptions in sections 30(c), 33(1)(b) and 38(1)(b) of FOISA. Submissions were also sought around the nature of the searches carried out by the Authority to ensure it identified all recorded information held, falling within scope of the request.
10. During the course of the investigation, the Authority disclosed the purchase price recorded in the Business Purchase Agreement, on the grounds that it had been disclosed publicly in a statement made to Parliament. As a consequence of the Authority’s decision to disclose this information during the investigation, without providing any submissions as to why it was exempt from disclosure, the Commissioner must find that the Authority was not entitled to rely on the exemption in section 33(1)(b) of FOISA for this information.
11. The Authority also disclosed details of the assumed liabilities recorded at paragraph 8 of the Business Purchase Agreement to the Applicant during the course of the investigation. The Commissioner will consider, later on in the Decision Notice, whether the Authority was entitled to rely on the exemption in section 33(1)(b) of FOISA for withholding this information in response to the Applicant’s request and requirement for review.
Commissioner’s analysis and findings
12. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.
13. Although the Authority has now disclosed some previously withheld information to the Applicant, the Commissioner’s decision focuses (as it is required to do) on the circumstances at the time the Authority responded to the Applicant’s requirement for review.
Context and background
14. The information request in this case relates to a Business Purchase Agreement entered into for the purchase, by the Authority, of the Dalzell and Clydebridge Steel Works from TATA steel in 2016. These steel works were subsequently sold to Liberty Steel (part of the GFG Alliance) by the Authority in a back to back sale transaction. This is the information which was requested, and released in redacted form, in response to the request and requirement for review referenced by the Applicant in his request for information.
Section 30(c)- Effective conduct of public affairs
Test to be applied in the use of the exemption
15. The Authority is relying on the exemption in section 30(c) of FOISA for withholding some of the information in the email trail that has been disclosed in response to the second part of the Applicant’s request.
16. Section 30(c) of FOISA provides that information is exempt information if its disclosure would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs. This exemption is subject to the public interest test in section 2(1)(b) of FOISA.
17. The word “otherwise” distinguishes the harm required from that envisaged by the exemptions in sections 30(a) and (b). This is a broad exemption and the Commissioner expects any public authority applying it to show what specific harm would (or would be likely to) be caused to the conduct of public affairs by disclosure of the information, and how that harm would be expected to follow from disclosure.
18. There is no definition of “substantial prejudice” in FOISA, but the Commissioner considers the harm in question would require to be of real and demonstrable significance. The authority must also be able to satisfy the Commissioner that the harm would, or would be likely to occur; therefore, the authority needs to establish a real risk or likelihood of actual harm occurring as a consequence of disclosure at some time in the near (certainly the foreseeable) future, not simply that the harm is a remote possibility.
The Authority’s submissions about the exemption
19. The Authority explained that it was relying on the exemption in section 30(c) for withholding the name of a legal firm.
20. The Authority submitted that, under the obligation in the Ministerial Code, it must ensure that its decisions are fully informed by appropriate analysis of legal considerations. It considered that if the name of the legal firm concerned was disclosed in response to this information request, this would breach the long-standing Law Officers’ Convention, which prevents the Authority from revealing whether Law Officers have, or have not, been asked to provide legal advice on any matter. In particular, the Authority referred to para 2.38 of the Ministerial Code which states that;
Ministers may acknowledge publicly that they have received legal advice on a particular topic, but must not divulge either who provided the advice or its contents (whether it is from the Law Officers or from anyone else). This applies to all forms of legal advice, including advice on a particular subject or advice associated with clearance of a document.
21. The Authority commented that the Convention has been given particular recognition in FOISA through section 29 so as to preserve it, subject to it being outweighed by greater considerations of the public interest. Breach of the convention itself substantially prejudices the effective conduct of public affairs. The Courts have noted that Parliament intended real weight should be afforded to the Law Officers’ Convention, and that the general considerations of good government underlining the history and nature of the convention are capable of affording weight to the interest in maintaining an exemption even in the absence of particular damage.
22. Revealing whether or not Law Officers had been asked to advise on this matter would, the Authority argued, encourage people to draw conclusions regarding the importance placed by government on the subject of this request, and whether or not there were uncertainties regarding the Scottish Government’s position. In the Authority’s view this would significantly harm the effective conduct of public affairs by placing undue pressure on Ministers and officials in future when they are considering seeking legal advice, and the suitability of who should be asked to provide that advice, in particular when considering seeking legal advice from the Law Officers.
The Applicant's submissions about the exemption
23. The Applicant argued that he did not believe that disclosure of all of the information withheld under this exemption would be likely to substantially prejudice the effective conduct of public affairs. Instead, the Applicant submitted that the Authority was using this exemption to shield itself from criticism of the discussions that were ongoing at the time of the agreement.
24. In the Applicant’s view, disclosing information that would result in the embarrassment of the government, ministers and civil service would not substantially prejudice the effective conduct of public affairs, in fact, it would, in his view, actively improve such conduct because it would improve the accountability for actions taken.
The Commissioner's view about the exemption
25. Having fully considered the nature of the information for which the Authority has relied on the exemption in section 30(c) of FOISA, together with the submissions received from both parties, the Commissioner is unable to accept that the exemption is engaged.
26. As mentioned above, the Ministerial Code sets out a requirement that the Authority would not disclose, into the public domain, whether or not it has consulted the Law Officers on a particular matter. The Law Officers referred to include the Advocate General for Scotland, the Lord Advocate and the Solicitor General for Scotland.
27. The Commissioner does not consider that use of a law firm, external to the Authority would fall within the definition of the Law Officers (and it is perfectly obvious from the context that the redactions in question relate to an external firm and not to any Law Officer). As a consequence, the name of that law firm would not be within scope of the Law Officers’ Convention.
28. For that reason, the Commissioner cannot agree that disclosure of the name of the law firm in this case would substantially prejudice the effective conduct of public affairs.
29. Because the Commissioner is not satisfied that the Authority was entitled to rely on the exemption in section 30(c) of FOISA for withholding the name of the external legal firm from the Applicant, he is not required to go on to consider the application of the public interest test in section 2(1)(b) of FOISA.
Section 33(1)(b) – Commercial interests and the economy
30. The Authority has relied on the exemption in section 33(1)(b) for withholding some information from the Business Purchase Agreement covered by the first part of the Applicant’s request.
31. Section 33(1)(b) of FOISA provides that information is exempt if its disclosure under FOISA would, or would be likely to, prejudice substantially the commercial interests of any person (including a Scottish public authority). This is a qualified exemption and is subject to the public interest test in section 2(1)(b) of FOISA.
32. There are certain elements which an authority needs to demonstrate are present when relying on this exemption. In particular, it needs to identify:
(i) whose commercial interests would (or would be likely to) be harmed by disclosure;
(ii) the nature of those commercial interests; and
(iii) how those interests would (or would be likely to) be prejudiced substantially by disclosure.
33. In order to evidence that this exemption is engaged, an authority has to show that disclosure of the information would, or would be likely to, be the catalyst that would cause the substantial prejudice to a commercial interest. The prejudice must be substantial, in other words of real and demonstrable significance.
The Authority’s submissions on the exemption
34. The Commissioner is unable to discuss the precise detail of much of the submissions in this decision; he must be careful not to disclose the withheld information in his reasoning, or anything which would lead to the withheld information being confirmed or otherwise discovered. This restriction limits the level of detail he can give to justify his conclusion. (This consideration has been acknowledged by the courts. In the case of Scottish Ministers v Scottish Information Commissioner (William Alexander’s Application) [2006] CSIH 8 , the Court of Session commented that, in giving reasons, the Commissioner is necessarily restrained by the need to avoid disclosing information which ought not to be disclosed.)
35. The Authority stated that the commercial interests of concern in relation to the withheld information are those of both TATA Steel and Liberty Steel. It is the Authority’s assertion that disclosure of the withheld information would substantially prejudice the commercial interests of both TATA and Liberty Steel.
36. Submissions were provided by the Authority in relation to the specific information withheld and these will be fully considered by the Commissioner but, for the reasons given in paragraph 34 above, will not be set out here.
37. The Authority explained that TATA Steel and Liberty Steel operate in a very competitive commercial environment, where any advantage can be crucial. The Authority commented that knowledge of the withheld information could be used to advantage competitors.
38. Furthermore, TATA Steel and Liberty Steel are both customers of each other, and compete in the same market place against one another. For that reason, together with the fact that they come from different market positions and adopt different strategies to achieve their objectives, the Authority submitted that knowledge of the withheld information would have an adverse impact on their business relations as well as an economic impact on the way the businesses trade.
39. It is the Authority’s view that release of the withheld information could prompt further financial analysis of the businesses, undermine customer confidence in the business, which, in effect would add to the complicated nature of the industry by putting at risk the livelihood of those employed in the businesses throughout the UK. The Authority also considered that this information could be leveraged by competitors, suppliers, customers and creditors.
40. In justifying its reliance on this exemption, the Authority clarified the nature of the transaction that took place around the sale and purchase of the Dalzell and Clydebridge Steel Works. Specifically, the Authority explained that having purchased both Dalzell and Clydebridge Steel Works from TATA Steel, the Authority then immediately sold these to Liberty Steel.
The Applicant’s submissions on the exemption
41. In his submissions, the Applicant commented, that given the information placed in the public domain by the Authority around the transaction, he did not believe there to be any commercial interests that remained a serious consideration to take into account.
42. The Applicant referred to a statement made by the Minister for Business, Trade, Tourism and Enterprise, Ivan McKee MSP, on the matter of the sale of the Dalzell and Clydebridge Steel Works, and argued that this meant that the central commercial pillars of the deal were under serious scrutiny, namely state aid. The Applicant was of the view that neither TATA Steel nor the Authority had any commercial interests here, and that there was only a legal and political interest.
The Commissioner's view about the exemption
43. The Commissioner is satisfied that both TATA Steel and Liberty Steel have commercial interests in relation to the withheld information.
44. That said, the Commissioner is not satisfied that disclosure of the withheld information in response to this information request would cause the harm anticipated by the Authority to those commercial interests.
45. With regard to the remaining information in paragraph 3 and all of the information withheld in paragraph 12.4 in the Business Purchase Agreement, the Commissioner does not accept that disclosure would harm the commercial interests of either party.
46. During the course of the investigation, the Authority provided the Commissioner with a copy of the Business Sale Agreement which covered the sale of the Dalzell and Clydebridge Steel Works to Liberty Steel. Having compared the information in both the Business Purchase Agreement and Business Sale Agreement (one of which would have been seen by TATA Steel and the other by Liberty Steel), the Commissioner is unable to accept the contention of the Authority that disclosure of the remaining information in
paragraph 3 and all of the information in paragraph 12.4 would harm the financial or economic interests of either party when competing against each other for work within the steel market.
47. The Commissioner appreciates that TATA and Liberty Steel may not be the only operators in the steel market, and that other competitors may exist, along with suppliers, customers and creditors. However, where the Authority asserted that disclosure of the information in paragraph 3 and paragraph 12.4 would substantially prejudice the commercial interests of TATA and Liberty Steel if it was known to competitors, suppliers, customers and creditors, it has not said specifically how this would be the case, or when the harm it anticipated from disclosure would occur. For that reason, the Commissioner does not agree that the Authority has demonstrated that disclosure of the particular information in paragraphs 3 and 12.4 of the Agreement would, or would be likely to, prejudice substantially the commercial interests of either TATA Steel or Liberty Steel if it was disclosed in response to this request.
48. As mentioned above, because the Commissioner’s decision in this case must focus on the circumstances at the time the Applicant submitted his requirement for review, the Commissioner has also considered whether the Authority was entitled to rely on the exemption in section 33(1)(b) for the information withheld in section 8 of the agreement.
49. In doing so, the Commissioner is aware of the time-bar that exists in respect of clauses of this nature included in agreements. Given the fact that the Business Purchase Agreement in this case was signed in 2016, it is evident to the Commissioner that any actions that could be taken regarding matters covered by the information in section 8 would have expired before the Applicant submitted his information request. As such, in the absence of any specific submissions from the Authority around the actual
harm that would result to the commercial interests of either TATA Steel or Liberty Steel as a consequence of disclosure of this information at the time of the requirement for review, the Commissioner does not agree that the exemption in section 33(1)(b) of FOISA is (or was, at the time of the requirement for review) engaged.
50. The Commissioner therefore finds that the Authority was not entitled to rely on the exemption in section 33(1)(b) of FOISA for withholding the remaining information in paragraph 3 and all of the information paragraph 12.4 and section 8 from the Applicant.
51. Because the Commissioner finds that the Authority was not entitled to rely on the exemption in section 33(1)(b) of FOISA he is not required to go on to consider the application of the public interest test in section 2(1)(b).
Section 38(1)(b) – Personal information
52. The Authority has withheld some information within the email correspondence disclosed in response to request (ii) in line with the exemption in section 38(1)(b) of FOISA. It has also relied on this exemption for withholding information in the Business Purchase Agreement.
53. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is “personal data” (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or (where relevant) in the DPA 2018.
54. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption. This means that it is not subject to the public interest test in section 2(1)(b) of FOISA.
55. To rely on this exemption, the Authority must show that the withheld information is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles found in Article 5(1) of the UK GDPR.
56. The Commissioner must decide whether the Authority was correct to withhold some of the information requested under section 38(1)(b) of FOISA.
Is the withheld information personal data?
57. The first question the Commissioner must address is whether the specific information withheld in the email correspondence and Business Purchase Agreement is personal data for the purposes of section 3(2) of the DPA 2018.
58. “Personal data” is defined in section 3(2) of the DPA 2018 as “any information relating to an identified or identifiable living individual”. Section 3(2) of the DPA 2018 defines “identifiable living individual” as a living individual who can be identified, directly or indirectly, in particular by reference to –
(i) an identifier, such as a name, an identification number, location data, or an online identifier, or
(ii) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
59. The Authority stated that it considered the information to be personal data as it relates to identified individuals.
60. The two main elements of personal data are that the information must “relate” to a living person, and that person must be identified – or identifiable – from the data, or from the data and other accessible information.
61. Information will “relate to” a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus.
62. An individual is “identified” or “identifiable” if it is possible to distinguish them from other individuals.
63. Having considered the submissions received, the Commissioner accepts the withheld information covering names, signatures, partial and full email addresses, telephone numbers and job titles (where the job titles are unique), relate to identifiable individuals. The Commissioner is therefore satisfied that the withheld information is the personal data of identifiable individuals and, as such, is personal data in terms of section 3(2) of the DPA 2018.
Would disclosure contravene one of the data protection principles?
64. Article 5(1)(a) of the UK GDPR, which the Authority considered applicable in this case, requires personal data to be processed “lawfully, fairly and in a transparent manner in relation to the data subject.”
65. The definition of “processing” is wide and includes (section 3(4)(d) of the DPA 2018) “disclosure by transmission, dissemination or otherwise making available”. In the case of FOISA, personal data are processed when disclosed in response to a request. Personal data can only be disclosed if disclosure would be both lawful (i.e. if it would meet one of the conditions of lawful processing listed in Article 6(1) of the UK GDPR) and fair.
Lawful processing: Article 6(1)(f) of the UK GDPR
66. The Commissioner must consider if disclosure of the personal data would be lawful. In considering lawfulness, he must consider whether any of the conditions in Article 6(1) of the UK GDPR would allow the personal data to be disclosed.
67. The Authority considered that the only condition of lawful processing which may apply would be that in Article 6(1)(f) of the UK GDPR.
68. The Commissioner agrees that this is the only condition which could potentially apply in the circumstances of this case.
Condition (f): legitimate interest
69. Condition (f) states that processing will be lawful if it “…is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child”.
70. Although Article 6 states that this condition cannot apply to processing carried out by public authorities in the performance of their tasks, section 38(5A) of FOISA (see Appendix 1) makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
71. The tests which must be met before Article 6(1)(f) can be met are as follows:
(i) Does the Applicant have a legitimate interest in obtaining the personal data?
(ii) If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?
(iii) Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subject?
72. There is no presumption in favour of the disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. Accordingly, the legitimate interests of the Applicant must outweigh the rights and freedoms or legitimate interests of the data subject before condition (f) will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the Authority was correct to refuse to disclose the personal data to the Applicant.
Does the Applicant have a legitimate interest in obtaining the personal data?
73. In his submissions to the Commissioner, the Applicant argued that there was a legitimate interest in knowing the identities of those involved in the purchase agreement and correspondence due to the consequences of the agreement, namely the potential multi-million pound environmental clean up at Dalzell, and the state aid issues narrated in Parliament.
74. The Authority submitted that it did not consider that the Applicant had any legitimate interest in obtaining names that had been withheld. It commented that identifying the individuals would not aid the Applicant’s understanding of the information provided. As a consequence, the Authority argued that the Applicant did not have a legitimate interest in obtaining the personal data included in the information falling within scope of his request.
75. Having considered the submissions from both the Applicant and the Authority, the Commissioner accepts that the Applicant does have a legitimate interest in the personal data that has been withheld. The Commissioner acknowledges that disclosure of this information would inform both the Applicant, and the public more widely of who was involved in the Business Purchase Agreement between the Authority and TATA Steel for the purchase of the Dalzell and Clydebridge Steel Works. The Commissioner recognises that there was/and is a clear public interest in understanding more about this transaction and knowledge of those who were involved in it from both parties would aid that understanding.
Is disclosure of the personal data necessary?
76. The Commissioner will now consider whether disclosure of the personal data requested is necessary for the Applicant’s legitimate interest. In doing so, he must consider whether these interests might reasonably be met by any alternative means.
77. The Commissioner has considered this carefully in light of the decision of the Supreme Court in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55.
78. “Necessary” means “reasonably” rather than “absolutely” or “strictly” necessary. When considering whether disclosure would be necessary, public authorities should consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the requester’s legitimate interests can be met by means which interfere less with the privacy of the data subject(s).
79. In its submissions, the Authority acknowledged that if the Applicant did have a legitimate interest in the withheld information, disclosure of the data would be necessary to achieve their legitimate interests.
80. The Commissioner does not agree with the Authority’s view in relation to all of the personal data that has been withheld.
81. Given the Applicant’s specific comment that he considered his legitimate interest to cover personal data which would reveal the identity of those involved in the Business Purchase Agreement and correspondence, due to the consequences of the Agreement, the Commissioner does not consider it necessary for the names redacted in Schedule Part 3 of the Business Purchase Agreement to be disclosed. For the same reason, the Commissioner does not consider it necessary for the name of the person who made the
request and requirement for review covered by the first part of the Applicant’s request to be disclosed.
82. With regard to the personal data that has been withheld from the email correspondence covered by the second part of the Applicant’s request, the Commissioner does not consider it necessary for any of this information to be disclosed in order to fulfil the Applicant’s legitimate interest.
83. It is clear that none of the named individuals involved in the email correspondence were involved in signing or agreeing the terms of the Business Purchase Agreement. Furthermore, the correspondence contained in the emails relates to decision making, by the Authority, around how to respond to a particular information request. It does not relate to any consequences arising from the Business Purchase Agreement. It is also quite clear from the information that has been disclosed to the Applicant from the emails which areas/departments of the Authority were involved in these discussions. As a consequence, the Commissioner does not consider it necessary for the personal data to be disclosed.
84. Furthermore, because it is clear from information that has already been disclosed who some of the named signatories to the agreement were, the Commissioner does not consider it necessary to require disclosure of the signatures or printed names that have been withheld on pages 15 and 16 of the Agreement.
85. The Commissioner notes that the personal data that has been redacted on pages 15 and 16 of the Agreement comprises the names and signatures of the witnesses to the Agreement, along with the Authorised Signatories from TATA Steel and LONGS Steel (the names of these Authorised Signatories have been disclosed, only the actual signatures are being withheld). On page 16, the signature of the Authorised Signatory for the Scottish Ministers has also been withheld.
86. The Commissioner is satisfied that the names and signatures of the witnesses should be withheld. He considers that these individuals were only witnessing the signing of the Agreement, they were not shaping the terms of the Agreement, nor were they signing as party to the Agreement. The Commissioner is satisfied that disclosure of their names and signatures would not add anything to the public debate or increase public knowledge of the individuals involved in agreeing the terms of the deal. The Commissioner considers that the Applicant’s legitimate interests can be met without disclosure of this information.
87. The Commissioner is also satisfied that the signatures of the Authorised Signatories for TATA Steel and LONGS Steel do not need to be disclosed to meet the Applicant’s legitimate interests. The Commissioner acknowledges that, unlike the witnesses, the Authorised Signatories did have a role in approving the Agreement, and that disclosure of their involvement would aid the Applicant’s legitimate interests. However, he notes that the names of these individuals have already been disclosed, so disclosure of the signatures itself would, again, add nothing to the publics’ understanding or knowledge of these events.
88. As the Commissioner has concluded that it is not necessary for the personal data, that he has described above to be disclosed in order to fulfil the Applicant’s legitimate interest, he finds that condition (f) of Article 6(1) of the UK GDPR cannot be satisfied.
89. The final piece of personal data for the Commissioner to consider is the signature of the Authorised Signatory for the Scottish Ministers. Unlike the Authorised Signatories for the steel companies, the name of this individual is not provided in written form in the Agreement, and therefore it has not been disclosed to the Applicant. The redacted signature is the only mention of this individual in the Agreement, and the Commissioner considers that disclosure of this information could provide insight into who signed the Agreement on behalf of the Authority. He is therefore satisfied that disclosure of this information would be necessary to meet the Applicant’s legitimate interests.
90. As the Commissioner has concluded that it is necessary to disclose one of the signatures on page 16 of the Agreement in order to meet the Applicant’s legitimate interests, he must now balance this against the fundamental rights and freedoms of the data subject (the senior official whose signature has been redacted). Only if the legitimate interests of the Applicant outweigh those of the data subject could personal data be disclosed without breaching the first data protection principle.
91. The Commissioner has considered the submissions from both parties carefully, in the light of the decision by the Supreme Court in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 555.
92. In its submissions, the Authority argued that it would be unfair to release the information as the employee in question would not expect their personal data to be processed in this way.
93. The Authority submitted that it has a general approach of disclosing information about senior members of staff, releasing details of those within senior civil service roles and officials with relatively senior roles that are public facing.
94. The Authority recognised that the data subject whose signature has been redacted would come within the definition of being a senior member of staff. It is the Authority’s position that had the data subject’s name been included in the Agreement rather than only their signature, it would have disclosed their name. But it considered it would amount to unfair processing to release the data subject’s signature.
95. The Commissioner's guidance on section 38 of FOISA notes that, in carrying out the balancing exercise, much will depend on the reasonable expectations of the data subjects. Factors which will be relevant in determining reasonable expectations include:
(i) whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)
(ii) the potential harm or distress that may be caused by disclosure
(iii) whether the individual objected to the disclosure.
96. The Commissioner agrees with the Authority that a signature would be information which an employee would not expect to be released in response to an information request.
97. Whilst the data subject signed the Agreement as part of their work as a public official or employee, the Commissioner considers that harm and distress would be caused to the data subject by disclosure of their signature.
98. After carefully balancing the legitimate interests of the Applicant against the interests or fundamental rights or freedoms of the data subject, the Commissioner finds that the legitimate interests served by disclosure of the signature would be outweighed by the unwarranted prejudice that would result to the rights and freedoms or legitimate interests of the data subject in question.
99. Given that the Commissioner has found that the processing would be unlawful, he is not required to go on to consider separately the data subject’s interests or fundamental rights and freedoms (or balance them against any legitimate interest in disclosure of the information).
100. Given that the Commissioner has concluded that the processing of personal data would be unlawful, he is not required to go on to consider whether disclosure of such personal data would otherwise be fair and transparent in relation to the data subject.
101. In all the circumstances of the case, in the absence of a condition in Article 6(1) of the UK GDPR being met, the Commissioner must conclude that disclosure of the personal data would breach the data protection principle in Article 5(1)(a) of the UK GDPR. Consequently, he is satisfied that disclosure of the personal data is exempt under section 38(1)(b) of FOISA.
Decision
The Commissioner finds that the Authority partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.
The Commissioner finds that by relying on the exemption in section 38(1)(b) of FOISA for withholding personal data from the Applicant, the Authority complied with Part 1.
However, by applying the exemption in section 30(c) to certain information withheld in the email correspondence and relying on the exemption in section 33(1)(b) of FOISA for information contained in the Business Purchase Agreement the Authority failed to comply with Part 1
Given that the Authority disclosed information in section 8 of the Business Purchase Agreement to the Applicant during the course of the investigation, the Commissioner does not require it to take any action in relation to that breach.
The Commissioner does however require the Authority to disclose to the Applicant the remaining information withheld in paragraph 3 and all of the information withheld in paragraph 12.4 of the Business Purchase Agreement, together with the name of the law firm mentioned in the email correspondence, by 1 November 2024.
Appeal
Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Enforcement
If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply. The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.
David Hamilton
Scottish Information Commissioner
17 September 2024
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
(2) The person who makes such a request is in this Part and in Parts 2 and 7 referred to as the “applicant.”
…
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that –
(a) the provision does not confer absolute exemption; and
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption –
…
(e) in subsection (1) of section 38 –
(i) paragraphs (a), (c) and (d); and
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied.
…
30 Prejudice to effective conduct of public affairs
Information is exempt information if its disclosure under this Act-
…
(c) would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.
…
33 Commercial interests and the economy
(1) Information is exempt information if-
…
(b) its disclosure under this Act would, or would be likely to, prejudice substantially the commercial interests of any person (including, without prejudice to that
generality, a Scottish public authority).
…
…
38 Personal information
(1) Information is exempt information if it constitutes-
…
(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);
…
(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act -
(a) would contravene any of the data protection principles, or
(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.
…
(5) In this section-
…
"data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
…
“personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act);
“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).
(5A) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of
information, Article 6(1) of the UK GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public
authorities) were omitted.
…
47 Application for decision by Commissioner
(1) A person who is dissatisfied with -
(a) a notice under section 21(5) or (9); or
(b) the failure of a Scottish public authority to which a requirement for review was made to give such a notice.
may make application to the Commissioner for a decision whether, in any respect specified in that application, the request for information to which the requirement relates
has been dealt with in accordance with Part 1 of this Act.
(2) An application under subsection (1) must -
(a) be in writing or in another form which, by reason of its having some permanency, is capable of being used for subsequent reference (as, for example, a recording made
on audio or video tape);
(b) state the name of the applicant and an address for correspondence; and
(c) specify –
(i) the request for information to which the requirement for review relates;
(ii) the matter which was specified under sub-paragraph (ii) of section 20(3)(c); and
(iii) the matter which gives rise to the dissatisfaction mentioned in subsection (1).
UK General Data Protection Regulation
Article 5 Principles relating to processing of personal data
1 Personal data shall be:
a. processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”)
…
Article 6 Lawfulness of processing
1 Processing shall be lawful only if and to the extent that at least one of the following applies:
…
f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.
Data Protection Act 2018
3 Terms relating to the processing of personal data
…
(2) “Personal data” means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).
(3) “Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to –
(a) an identifier such as a name, an identification number, location data or an online identifier, or
(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
(4) “Processing”, in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as –
…
(d) disclosure by transmission, dissemination or otherwise making available,
…
(10) “The UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4)).
…
(14) In Parts 5 to 7, except where otherwise provided –
(a) references to the UK GDPR are to the UK GDPR read with Part 2;
…
(c) references to personal data, and the processing of personal data, are to personal data and processing to which Part 2, Part 3 or Part 4 applies;
(d) references to a controller or processor are to a controller or processor in relation to the processing of personal data to which Part 2, Part 3 or Part 4 applies.
…
