Decision 032/2026:  Employee responses to a consultation on reducing the standard working week from 37 hours to 35 hours

Authority: Aberdeen City Council 
Case Ref: 202500857  
 

Summary

The Applicant asked the Authority for the collated responses by employees to a formal consultation on reducing the standard working week from 37 hours to 35 hours.  The Authority withheld the information requested under various exemptions in FOISA, while also indicating that it did not hold the information.  The Commissioner investigated and found that the Authority partially complied with FOISA in responding to the Applicant’s request.  He required the Authority to disclose certain information to the Applicant.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2), (4) and (6) (General entitlement); 2(1) and (2) (Effect of exemptions); 20(1) and (3) (Requirement for review); 21(1) (Review by Scottish public authority); 30(b) (Effective conduct of public affairs); 36(2) (Confidentiality); 38(1)(b), (2A) and (5) (definitions of “data protection principles”,” data subject”, “personal data” and “processing”, “the UK GDPR”) (Personal information); 47(1) and (2) (Application for decision by Commissioner).

United Kingdom General Data Protection Regulation (the UK GDPR) Articles 4(1) (definition of “personal data”); 5(1)(a) (Principles relating to the processing of personal data); 6(1)(f) (Lawfulness of processing). 

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), 4(d), (5), (10) and 14(a), (c) and (d) (Terms relating to the processing of personal data).

Background

1. On 21 March 2025, the Applicant made a request for information to the Authority.  She asked for a copy of the collated responses by employees to the Authority’s internal staff formal consultation on reducing the standard working week from 37 hours to 35 hours.
2. The Authority responded on 21 April 2025.  As the formal consultation process was still ongoing, it issued the Applicant with a notice, in terms of section 17 of FOISA, that it did not hold the information requested.
3. Later that same day, the Applicant wrote to the Authority requesting a review of its response. She stated that she was dissatisfied with the decision because she disagreed that the Authority did not hold the information requested and because she did not consider it relevant that further information may be added to the dataset.
4. On 28 April 2025, the Authority wrote to the Applicant asking her to clarify her grounds for dissatisfaction.
5. Later that same day, the Applicant responded that the Authority had indicated that it held the information requested, despite issuing her with a notice under section 17 of FOISA and reiterated that it was not relevant that the consultation process was ongoing.
6. The Authority notified the Applicant of the outcome of its review on 28 May 2025.  It overturned its initial response and instead withheld the information requested under the exemption in sections 30(c) and 38(1)(b) of FOISA.
7. On 29 May 2025, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  She stated that she was dissatisfied with the outcome of the review because:

• she did not agree that the exemptions in sections 30(c) and 38(1)(b) of FOISA applied

• the public interest favoured disclosure of the information requested

• the Authority had failed to respond to her requirement for review within the timescale laid down by FOISA.

Investigation

8. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
9. On 5 June 2025, the Authority was notified in writing that the Applicant had made a valid application.  The Authority was asked to send the Commissioner the information withheld from the Applicant.  The Authority provided the information, which comprised a spreadsheet containing the responses from employees to the consultation.
10. When the Authority provided the information to the Commissioner, it indicated that it was no longer relying on the exemption in section 30(c) of FOISA to withhold the information requested and that it instead wished to rely on the exemptions in sections 30(b)(i), 30(b)(ii), 36(2) and 38(1)(b).  It also said that it considered section 17 of FOISA to be applicable.
11. The case was subsequently allocated to an investigating officer.
12. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application and to answer specific questions related to the applicability of the exemptions claimed, its apparent reliance on section 17(1) of FOISA and the validity of the Applicant’s requirement for review dated 21 April 2025. 

Commissioner’s analysis and findings

13. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority. 

Section 17 – Information not held

14. Despite providing the Commissioner with the withheld information and overturning its reliance on section 17 of FOISA in its review outcome, the Authority indicated that it still considered section 17 to be applicable.
15. Section 1(1) of FOISA provides that a person who requests information from a Scottish public authority which holds it is entitled to be given that information by the authority, subject to the qualifications which, by virtue of section 1(6) of FOISA, allow Scottish public authorities to withhold information or charge a fee for it.  The qualifications contained in section 1(6) are not applicable in this case.
16. The information to be given is that held by the authority at the time the request is received, as defined in section 1(4).  If no such information is held by the authority, section 17(1) of FOISA requires it to give the applicant notice in writing to that effect.
17. The Authority explained that the consultation to which the Applicant’s request referred was still ongoing.  It said that it had used the Cambridge Dictionary definition of “collate”: “to bring together different pieces of written information so that the similarities and differences can be seen.”  At the time of the Applicant’s request, no such exercise had been undertaken, and it submitted that it therefore did not hold a “collated” response.
18. The Authority noted that the Applicant’s requirement for review had suggested that she was most interested in information from electronic responses.  It was therefore able to provide this information to the Commissioner for the purposes of his investigation.  However, it did not consider that this information was the “collated” response.
19. Given the Applicant’s indication in her requirement for review that she was most interested in electronic responses, the Commissioner agrees it was reasonable for the Authority to proceed on the basis of the responses in its survey system.
20. The Commissioner’s guidance on section 17 of FOISA[1] states (at paragraph 46)  that if compiling information in order to respond to a request would require skill and complex judgement, it is less likely the information can be said to held for the purposes of FOISA.  
21. In Decision 210/2013[2] the Commissioner established (at paragraph 144) that a public authority will hold information if it holds the “building blocks” to generate the information and no complex judgement is required to produce it.
22. The Commissioner does not consider that extracting the information from the survey software and exporting it into a spreadsheet would require expert skill and judgement, and he has received no argument from the Authority indicating that it would.  He therefore finds that the Authority held the information requested. It may not have been collated when the request was received, but collation would have been a straightforward task involving no complex judgement.

The Authority’s approach

23. The Authority stressed to the Commissioner that the Applicant had indicated an interest in her application to him for the responses to be “unedited” and “unaltered”.  It was therefore concerned about whether the Applicant would consider a redacted document acceptable.  It confirmed that the source of this indication was annotations made by the Applicant to the Authority’s review outcome.
24. In the Commissioner’s view, the Applicant is interested in receiving as much of the information requested as possible. However, he does not accept that this means that she is only interested in receiving all of the information requested or that she would rather receive a blanket refusal than the possibility of receiving some of the information in a redacted form.
25. In any event, even had the Applicant’s request or requirement for review specifically requested unedited or unaltered responses, her request must be read in line with section 2(1) of FOISA (which permits public authorities to redact exempt information) and section 1(4) of FOISA (which sets out the limited extent to which other edits and deletions can be made to the information). 

Section 30(b)(i) and (ii) – Free and frank advice and exchange of views

26. In order for the Authority to rely on these exemptions, it must show that disclosure of the information would (or would be likely to) inhibit substantially the free and frank provision of advice (section 30(b)(i)) or the free and frank exchange of views for the purposes of deliberation (section 30(b)(ii)).  These exemptions are subject to the public interest test in section 2(1)(b) of FOISA.
27. In applying the exemptions, the chief consideration is not whether the information constitutes advice or opinion, but whether the disclosure of that information would, or would be likely to, inhibit substantially (as the case may be) the provision of advice or the exchange of views. The inhibition in question must be substantial and therefore of real and demonstrable significance.

The Applicant’s submissions on the exemption

28. As part of her application to the Commissioner, the Applicant provided submissions on why she considered the exemption in section 30(c) of FOISA did not apply.  While the Authority is no longer relying on that exemption and is instead applying alternative exemptions in FOISA, the Commissioner nevertheless considers the submissions provided by the Applicant to be pertinent.
29. The Applicant said that as the Authority had ceased all direct consultation with employees, it was unlikely that any deliberative process would be impacted.  While employees had had the opportunity to have free and frank discussions and to exchange their views, she noted that her request had not sought information pertaining to those discussions – it had sought the written consultation responses.
30. The Applicant commented that it seemed likely, given the nature of the data and the purpose of the consultation, that a respondent’s expectation would be that responses would be widely circulated internally.  She suggested that most respondents would be more concerned with personal information linked to their comments being circulated to their bosses, who in a position of power over them, than the general public (who are not in such a position).
31. The Applicant also submitted that most respondents to the consultation were well aware of FOI law and it was likely that their expectations were that their responses to the consultation would be made public in an anonymised manner.  As her request sought anonymised data, she did not consider there to be any question of a breach of privacy or trust violation.
32. During the investigation, the Applicant reiterated that the consultation had concluded by March 2025 and that disclosure of the information requested therefore posed minimal risk to future advice or views. She noted the Commissioner’s guidance on the exemptions in section 30(b) of FOISA[3] and said that these exemptions “weaken post-decision”.  She also referred to Decision 039/2024[4], which she said supported this conclusion and submitted that generic claims of “chilling effects” did not suffice.
33. The Applicant also suggested that the Authority’s concerns about protecting deliberative processes and employee trust were outweighed and could be addressed by appropriate redactions under the exemption in section 38(1)(b) of FOISA, allowing substantive views to be disclosed without breaching privacy.  She referred to Decision 182/2025[5], which ordered partial disclosure where exemptions were wrongly applied and said that, in the present case, aggregated or anonymised responses would serve transparency without harm. 

The Authority’s submissions on the exemption

34. The Authority argued that any future consultation with employees, where there was an implicit or explicit level of confidentiality, would be impacted by disclosure of the information requested, as employees would be less likely to provide free, frank, open and honest feedback to such proposals.
35. The Commissioner asked the Authority if this concern would persist if the information requested could be appropriately anonymised.  It submitted that it would as even an anonymised response (which it said would require significant redactions) would constitute a breach of the implied trust between employees and the Authority given the confidence the employees expected this information to be held in.
36. The Authority submitted that it had significant concerns regarding the potential impact of disclosure of the information requested on any future employee consultations.  Disclosure could discourage employees from being open and transparent, which was critical to informed decision-making – particularly in matters relating to budgets and employee or contractual processes.
37. Given that local authorities continue to face substantial budgetary pressures, the Authority submitted that effective staff consultation is essential to ensure that future decisions are both robust and considerate of the views and circumstances of all affected parties. Undermining this openness could detrimentally affect the quality and integrity of decisions made in these challenging financial contexts.

The Commissioner’s view on the exemption

38. The Commissioner has taken account of all the relevant submissions, together with the information that was withheld under the exemptions in section 30(b)(i) and (ii) of FOISA.
39. As with other exemptions imparting a similar test, the Commissioner expects authorities to demonstrate a real risk or likelihood that actual inhibition will occur at some time in the near (certainly the foreseeable) future, not simply that inhibition is a remote or hypothetical possibility.  For inhibition to be likely, there would need to be at least a significant probability of it occurring.
40. The Commissioner notes that these exemptions were applied on a blanket basis to all consultation responses, including responses to questions seeking basic workforce information about employees’ names, hours of work and areas of business and the dates and times responses were started and submitted.
41. The Commissioner does not agree that disclosure of this factual information would have, or would be likely to have, the substantially inhibiting effect specified in section 30(b)(i) and (ii) of FOISA – especially once the information is appropriately redacted to remove personal data. He therefore finds that the Authority was not entitled to withhold this information under the exemptions in sections 30(b)(i) or (ii) of FOISA.
42. The remaining withheld information contains a range of comments, often expressed in free and frank terms, on matters such as the personal circumstances of staff members, the operation of specific departments and services and how these would be negatively impacted by the proposals.
43. Having considered the respective submissions of the Applicant and the Authority, together with withheld information itself, the Commissioner accepts that disclosure of these comments would have, or would be likely to have, the substantially inhibiting effect specified in section 30(b)(i) and (ii) of FOISA.  Specifically, he considers that disclosure would be likely to inhibit the extent, candour and substance of future comments made by the Authority’s staff in response to future consultations.
44. The Commissioner notes the Applicant’s comments on the sensitivity of the information being diminished once a decision had been reached.  However, at the time of review negotiations between the Authority and trade unions were ongoing, with agreement not publicised until 13 June 2025.  
45. The Commissioner’s decision on whether the Authority was entitled to withhold the information requested must be assessed in relation to the specific circumstances of the case on each occasion, and at the time of the review (at the latest).  In any event, he does not consider that the risk of substantially inhibiting effect specified in section 30(b)(i) and (ii) of FOISA to be limited to discussions around the specific proposal in question.  
46. While the Commissioner does not consider it plausible that disclosure of the withheld information would act to inhibit employees from responding to such consultations entirely, he accepts that disclosure would be likely to have a substantially inhibiting effect on the extent, candour and substance of comments made by employees on future proposals that the Authority might wish to internally consult upon.
47. The Commissioner has considered whether the redaction of highly specific or particularly frank comments would be sufficient to remedy this inhibition.  However, in the circumstances, his view is that even partial disclosure of the comments would give rise to a substantial risk of inhibition and, in any event, would result in disclosure of information so fragmentary as to render it practically meaninglessness.
48. The Commissioner therefore accepts that the much of the withheld information is exempt from disclosure under the exemptions in section 30(b)(i) and (ii) of FOISA.
49. As the Commissioner found that the Authority was not entitled to withhold certain information under the exemptions in sections 30(b)(i) and (ii) of FOISA, he will consider later in his decision notice whether the Authority was entitled to withhold this information under the other exemptions it applied (i.e. sections 38(1)(b) and 36(2) of FOISA).
50. Given that the Commissioner accepts the application of the exemptions in section 30(b)(i) and (ii) of FOISA to the much of the withheld information, he is required to consider the public interest test in section 2(1)(b) for that information.

The public interest test

51. As noted above, section 30(b) is subject to the public interest test required by section 2(1)(b) of FOISA.  As the Commissioner has found that the exemptions in section 30(b)(i) and (ii) were correctly applied to the much of the withheld information, he is now required to consider whether, in all the circumstances of the case, the public interest in disclosing the information is outweighed by the public interest in maintaining the exemption.
52. The "public interest" is not defined in FOISA but has been described as "something which is of serious concern and benefit to the public", not merely something of individual interest.  The public interest does not mean "of interest to the public" but "in the interest of the public", i.e. disclosure must serve the interests of the public.

The Applicant’s submissions on the public interest

53. The Applicant noted that the proposal to reduce the working week from 37 to 35 hours was part of efforts to reduce operating costs and had sparked significant controversy, including accusations of “fire and rehire” tactics, pay freezes, and threats of strike action.  She said that the information requested therefore related to a major organisational change, involving substantial public funds and affecting thousands of employees of the Authority, trade unions and taxpayers.
54. The Applicant commented that she considered the information shared with staff was biased, incomplete and misleading.  She said that disclosure would allow scrutiny of how employee views were collated and considered in decision-making, fostering accountability for public funds and employee rights.   She also argued that disclosure would assist in scrutiny of documents prepared by the Authority to support the policy, including a FAQ and an impact assessment.
55. The Commissioner has also taken account of the submissions rehearsed earlier regarding the application of the exemptions in section 30(b)(i) and (ii) of FOISA to the extent that they are relevant to the balancing of the public interest test.

The Authority’s submissions on the public interest

56. The Authority recognised that there may have been a general public interest in relation to the ongoing discussions and consultation in relation to the proposal to reduce the standard working week to 35 hours.  However, it said this had specifically been of interest to its employees and trade unions involved in the process, and public interest (in terms of requests, communication or enquiries received from members of the public, rather than employees) had been minimal.
57. The Authority acknowledged that disclosure of the information requested would allow the public to scrutinise the processes and decisions leading to organisational changes designed to reduce operating costs. This transparency could foster trust in public institutions and ensure that decisions are made with consideration of public feedback and scrutiny.  It would also encourage a culture of openness, where policymaking is subject to external input and critique – potentially leading to more informed and democratic decisions.
58. As it considered that these proposals were of utmost interest to its employees only, the Authority published a significant amount of information for staff on its internal intranet throughout the consultation process.  It also provided trade unions and other stakeholders with access to information during the process, to facilitate effective and thorough discussion
59. However, the Authority also considered that it is in the public interest to allow these strategic organisational change discussions to take place in a free and frank manner, so that the decision-making process can be followed effectively.  Disclosure of the information requested could disrupt the decision-making process, stifle the free and frank provision of advice and inhibit the exchange of views necessary for thorough deliberation.  Disclosure could also undermine officials' ability to explore all policy options, ultimately harming the efficiency and effectiveness of public services.
60. The Authority argued that, if staff were to believe that their feedback on consultations of this sort would be published publicly, it may deter involvement and the frank exchange of feedback and thoughts.  This would ultimately make the feedback and consultation process, the aim of which is to gather the honest and unedited views of employees about changes to their contractual terms, redundant.   The Authority also reiterated the arguments set out above in paragraphs 36 and 37.
61. On balance, the Authority considered that the public interest favoured withholding the information requested.  While it understood the importance of transparency and accountability, it believed that withholding the information requested was necessary to protest the public interest, by ensuring that its deliberative processes were not compromised.

The Commissioner’s view on the public interest

62. The Commissioner has considered all the submissions carefully, alongside the withheld information in question.  He finds this to be a case where the public interest is finely balanced.
63. The Commissioner recognises that there is always a public interest in transparency and accountability and in scrutinising the decisions and decision-making processes followed by public authorities.  The Authority’s (now implemented) proposal to reduce the working week is clearly a matter of importance to the local public (or a substantial proportion of that public, including at least the Authority’s employees and their families), over which there are strong feelings.
64. Given current debates on such changes, in relation to the Authority and other organisations, and the backdrop of funding pressures on local authorities, the Commissioner agrees that disclosure of the substantive responses by employees would help facilitate scrutiny of the proposal and its supporting documentation.
65. However, the Commissioner also recognises that there is a public interest in respondents to such consultations being able to provide full and candid comments – both in connection with this specific consultation and with other consultations that the Authority may be required to hold in the future.  He considers that the substantially inhibiting effect that he has accepted would, or would be likely to, result from disclosure would negatively impact decision-making within the Authority, which would be contrary to the public interest.
66. The Commissioner has also taken into account the fact that the Authority and trade unions have both published information on this proposal.  While he notes the Applicant’s concerns with this published information in mind, he considers that this information goes some way to satisfying the public interest in transparency and accountability.
67. Having weighed up the public interest for and against disclosure, the Commissioner finds that, on balance and in all the circumstances of this case, the public interest in disclosure of the withheld information in question is outweighed by that in favour of maintaining the exemptions in section 30(b)(i) and (ii) of FOISA.
68. Accordingly, the Commissioner has concluded that the Authority was entitled to withhold the information in question in terms of section 30(b)(i) and (ii) of FOISA.
69. However, the Commissioner would stress that this does not mean that all disclosure of all responses to any future such employee consultation would necessarily give rise to the same (or similar) issues as in this case.  It is important for public authorities to treat each request for information on a case-by-case basis. That information is withheld in one case should not be taken to imply that information of a particular type will be routinely withheld in future. The circumstances of each case, including the content of the specific information under consideration, must be taken into consideration and (where required) the public interest in each case assessed on its own merits.
70. As the Commissioner found that the Authority was not entitled to withhold certain information under the exemptions in sections 30(b)(i) and (ii) of FOISA, he will now go on to consider whether the Authority was entitled to withhold this information under the other exemptions it applied (i.e. sections 38(1)(b) and 36(2) of FOISA). 

Section 38(1)(b) – Personal information

71. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) (or (b)), exempts information from disclosure if it is “personal data”, as defined in section 3(2) of the DPA 2018 and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR.
72. The exemption in section 38(1)(b) of FOISA applied on the basis set out in the preceding paragraph, is an absolute exemption.  This means it is not subject to the public interest test in section 2(1)(b).
73. Although the Authority applied this exemption on a blanket basis to all responses, the Commissioner has already agreed that the substantive comments were appropriately withheld under the exemptions in section 30(b)(i) and (ii) of FOISA.  He will therefore not consider whether it was also appropriate to withhold this information under the exemption in section 38(1)(b) of FOISA.
74. The remaining information withheld under section 38(1)(b) of FOISA consists of employees’ names, information on their roles within the Authority (including their job titles and working patterns) and the dates and times responses were started and submitted.
75. To rely on this exemption, the Authority must show that the withheld information is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles found in Article 5(1) of the UK GDPR. 

Is the withheld information personal data?

76. The first question the Commissioner must address is whether the information is personal data for the purposes of section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable individual.
77. Information will “relate to” a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.
78. An “identifiable living individual” is one who can be identified, directly or indirectly, by reference to an identifier (such as a name) or one or more factors specific to the individual (see section 3(3) of the DPA 2018).
79. The Authority argued that the combined information contained in the withheld spreadsheet could realistically lead to the identification of employees.  It said that it has a number of unique job titles and other job titles which relate to a small number of staff, which would make it possible to identify responses given by individual staff members.
80. Additionally, the Authority said that employees knew the consultation was ongoing and that they could use identifiers contained in the withheld spreadsheet to work out if and when their colleagues responded to the consultation.
81. Given the small number of staff in certain roles and departments, the Commissioner accepts that the majority of the remaining withheld information – once combined with other information in the spreadsheet or known to the colleagues of respondents – could allow the realistic prospect of identification of individuals who responded.  He also agrees that the respondents’ names are, clearly, their personal data.
82. The Commissioner therefore agrees that the majority of this information constitutes third-party personal data.  However, he is not satisfied that the information on working patterns (which is at the high level of either part time or full time working), or the dates and times the responses were started or submitted, would allow the realistic prospect of identification of individuals – especially once the other columns have been withheld.
83. As the Authority has also withheld the information on working patterns and the dates and times the responses were started and submitted under the exemption in section 36(2) of FOISA, he will consider the application of that exemption to this information later in his decision notice.

Would disclosure of the personal data contravene any of the data protection principles? 

84. Article 5(1)(a) of the UK GDPR requires personal data to be processed “lawfully, fairly and in a transparent manner in relation to the data subject.”
85. "Processing" of personal data is defined in section 3(4) of the DPA 2018.  It includes (section 3(4)(d)) disclosure by transmission, dissemination or otherwise making available personal data.  The definition therefore covers disclosing information into the public domain in response to a FOISA request.
86. The Commissioner must consider whether disclosure of the personal data would be lawful.  In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed.
87. The Commissioner considers that condition (f) in Article 6(1) of the UK GDPR is the only condition which could potentially apply in the circumstances of this case.  

Condition (f): legitimate interests

88. Condition (f) states that processing shall be lawful if it: “…is necessary for the purposes of legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data...”.
89. Although Article 6 of the UK GDPR states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
90. The three tests which must be fulfilled before Article 6(1)(f) can be relied on are as follows (see paragraph 18 of South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 551[6] – although this case was decided before the GDPR (and the UK GDPR) came into effect, the relevant tests are almost identical):

    1. does the Applicant have a legitimate interest in the personal data? 

    2. if so, would the disclosure of the personal data be necessary to achieve that legitimate interest? 

    3. even if the processing would be necessary to achieve the legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects which require protection of personal data?

Does the Applicant have a legitimate interest in the personal data?

91. The Applicant said that she was seeking anonymised data and specifically highlighted the names of employees as information that she would expect to be redacted.  However, as described above, the Applicant explained that she otherwise considered that disclosure of the withheld information would assist in the scrutiny of the Authority’s decision-making.
92. The Commissioner has already accepted that the Authority was entitled to withhold the majority of the withheld information under the exemptions in sections 30(b)(i) and (ii) of FOISA, including the substantive comments made by employees.  However, he accepts that disclosure of the remaining withheld information may nevertheless, to a limited extent, assist in scrutiny of the Authority’s decision-making in relation to the consultation by providing insight into the distribution of employees who decided to provide feedback and provide a level of scrutiny of the Authority’s approach to this research.
93. In the circumstances, the Commissioner therefore accepts that, other than the names of employees, the Applicant has a legitimate interest in the remaining withheld information.

Would disclosure of the personal data be necessary?

94. Having accepted that the Applicant has a legitimate interest in the personal data, the Commissioner must consider whether disclosure of the personal data would be necessary to meet the Applicant's legitimate interests.
95. Here, “necessary” means “reasonably” rather than absolutely or strictly necessary.  The Commissioner must therefore consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the Applicant’s legitimate interest can be met by means which interfere less with the privacy of the data subjects.
96. The Commissioner considers that disclosure of high-level statistical information on responses could assist the Applicant in understanding the distribution of staff who decided to provide feedback, without giving rise to the risk of identification from disclosing individual responses.
97. To the extent that the remaining withheld information may, to a limited extent, assist in scrutiny of the Authority’s decision-making in relation to the consultation and its approach to this research, the Commissioner considers that this scrutiny would more effectively be achieved (and by means which interfere less with the privacy of the data subjects) through, for example, the disclosure of a blank form showing the options that respondents could select.
98. In the circumstances, the Commissioner therefore does not agree that disclosure of the remaining withheld personal data is necessary to address the Applicant’s legitimate interest.
99. As the Commissioner is not satisfied that disclosure of the withheld information is necessary to satisfy the Applicant’s legitimate interest, he is not required to go on to consider whether the legitimate interest of the Applicant outweigh the interests or fundamental rights and freedoms of the data subjects.
100. Having found that disclosure of the personal data would not be necessary to fulfil the Applicant’s legitimate interest, the Commissioner finds that condition (f) in Article 6(1) of the UK GDPR cannot be met in this case and that disclosure of the information in question would be unlawful.

Fairness and transparency

101. Given that the Commissioner has concluded that the processing of the personal data, would be unlawful, he is not required to go on to consider whether disclosure of such personal data would otherwise be fair and transparent in relation to the data subjects.

Conclusion on the data protection principles

102. In all the circumstances, the Commissioner is satisfied, in the absence of a condition in Article 6 of the UK GDPR which would allow the data to be disclosed, that disclosure would be unlawful.  The personal data in question is therefore exempt from disclosure under section 38(1)(b) of FOISA.

Section 36(2) – Confidentiality

103. The Commissioner has already accepted that the Authority was entitled to withhold much of the withheld information under the exemptions in sections 30(b)(i) and (ii) and 38(1)(b) of FOISA.  He will therefore not consider whether the Authority was also entitled to withhold this information under the exemption in section 36(2) of FOISA.  The only information that the Commissioner will consider under this heading is the information on the working patterns of individuals who responded to the survey and the dates and times the responses were started and submitted.
104. Under section 36(2) of FOISA, information is exempt from disclosure if it was obtained by a Scottish public authority from another person (including another such authority) and its disclosure by the authority so obtaining it to the public (otherwise than under FOISA) would constitute a breach of confidence actionable by that person or any other person.
105. Section 36(2) is an absolute exemption and is not, therefore, subject to the public interest test in section 2(1)(b) of FOISA.  However, it is generally accepted in common law that an obligation of confidence will not apply if the disclosure of the information is necessary in the public interest.
106. Section 36(2) of FOISA contains a two-stage test, both parts of which must be fulfilled before the exemption can be relied upon.
107. The first test is that the information must have been obtained by a Scottish public authority from another person.  "Person" is defined widely and means another individual, another Scottish public authority or any other legal entity, such as a company or partnership.
108. The Commissioner does not consider that the first test is met for the dates and times the responses were started and submitted. This information appears to be metadata logged by the Authority and, in that respect, was not obtained from another person.
109. The Commissioner therefore does not agree that this information was appropriately withheld under section 36(2) of FOISA. He requires the Authority to disclose this information to the Applicant.
110. The Commissioner is also not persuaded that the first test is met for the working patterns of individuals who responded to the survey.  While these individuals provided this information to the Authority as part of their responses, this information is the product of contracts entered into by these individuals with the Authority and the Authority will already hold this information itself.  However, in the circumstances, he will go on to consider the second part of the test for this information.
111. The second part of the test is that disclosure of the information by a public authority must constitute a breach of confidence actionable either by the person who gave the information to the public authority or by any other person.  The Commissioner takes the view that “actionable” means that the basic requirements for a successful action must appear to be fulfilled.
112. There are three main requirements which must be met before a claim for breach of confidence can be established to satisfy the second element to this test.  These are: 

     1. The information must have the necessary quality of confidence; 

     2. The public authority must have received the information in circumstances which imposed an obligation on it to maintain confidentiality; and 

     3. Unauthorised disclosure must be to the detriment of the person who communicated the information.

113. Given the nature of the remaining information being considered under this exemption (i.e. working patterns of individuals who responded to the survey) and the redactions that he has accepted were properly made under the exemptions in sections 30(b)(i) and (ii) and 38(1)(b) of FOISA, the Commissioner does not consider that any of the above three requirements are satisfied.  (He would have reached the same conclusion for the dates and times the responses were started and submitted, had he concluded this information had been obtained from another person.)
114. The Commissioner therefore does not agree that this information was appropriately withheld under section 36(2) of FOISA. He requires the Authority to disclose this information to the Applicant.

Section 21 of FOISA – review by a Scottish public authority

115. The Applicant expressed dissatisfaction in her application that the Authority’s review outcome was late.
116. Section 21(1) of FOISA gives Scottish public authorities a maximum of 20 working days following the date of receipt of the requirement to comply with a requirement for review.  This is subject to qualifications which are not relevant in this case.
117. As stated above, the Authority asked the Applicant to specify the exact reason for her dissatisfaction with its initial response to allow it to undertake a review.  There is no provision within FOISA allowing public authorities to pause responding to a requirement for review until the clarification requested is provided.
118. Assuming the Applicant’s requirement for review dated 21 April 2025 was valid, then the Authority’s review outcome was late.  The Commissioner must therefore consider whether the Applicant’s requirement for review dated 21 April 2025 was valid in terms of section 20 of FOISA.
119. Section 20(3) of FOISA provides that a requirement for review must be in writing or some other form of permanency, it must state the name of the applicant and an address for correspondence, and it must specify the request for information to which the requirement for review relates and the matter which gives rise to the applicant’s dissatisfaction.
120. The Commissioner is satisfied that the Applicant’s requirement for review dated 21 April 2025 specified both the request for information to which it related and the matter which gave rise to her dissatisfaction.  In this case, he considers that the Applicant’s requirement for review dated 21 April 2025 was sufficiently clear that she was disputing the Authority’s position that it did not hold the information requested and that she was seeking a review of that decision.
121. The Commissioner would stress that it is good practice for public authorities to seek clarification where the terms of a requirement for review are unclear.  In doing so, given that there no provision within FOISA allowing public authorities to pause responding to a requirement for review until the clarification requested is provided, he would urge authorities to ensure that any such clarification is sought as soon as possible.
122. During the investigation, the Authority also noted that the Applicant had not included her full name as part of her requirement for review.  The Commissioner has made his position clear on this point in response to a separate application from the same Applicant in Decision 304/2025[7].  In this case, the Authority appears to have been aware of the Applicant’s full name and, as such, took the sort of common-sense approach the Commissioner endorsed in Decision 304/2025.
123. In the circumstances, the Commissioner is therefore satisfied that the Applicant’s requirement for review dated 21 April 2025 satisfied the requirements of section 20 of FOISA and was therefore valid. It is a matter of fact that the Authority did not provide a response to the Applicant’s requirement for review within 20 working days, so the Commissioner finds that it failed to comply with section 21(1) of FOISA.

Decision 

The Commissioner finds that the Authority partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant. 

The Commissioner finds that by correctly withholding much of the information requested under the exemptions in sections 30(b)(i) and (ii) and 38(1)(b), the Authority complied with Part 1 of FOISA.

However, the Commissioner finds that the Authority failed to comply with Part 1 of FOISA by:

• failing to comply with the timescales for review set out in section 21(1)

• incorrectly withholding certain information under sections 30(b)(i) and (ii), 36(2), and 38(1)(b). 

The Commissioner therefore requires the Authority to disclose to the Applicant the information in columns B, C and H of the withheld information, by 16 April 2026.  

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement 

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply.  The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

Euan McCulloch 

Head of Enforcement 

2 March 2026