Decision 040/2026:  Central Legal Office calculation/record of activity of work concerning a specific matter

Authority:  NHS National Services Scotland
Case Ref:  202500586
 

Summary

The Applicant asked the Authority for information about the Central Legal Office’s calculation or record of activity of work in connection with a specific appeal.  The Authority withheld some of the information requested on the basis that it was commercially confidential, or comprised third party personal data.

The Commissioner investigated and found that the Authority had correctly withheld the third party personal data present in the withheld information. However, he was not satisfied that the remaining information was commercially confidential and required the Authority to disclose it to the Applicant.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002[1] (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1)(b) and (2)(e)(ii) (Effect of Exemptions); 33(1)(b) (Commercial interests and the economy); 38(1)(b), (2A), (5) (definitions of “the data protection principles”, “data subject”, “personal data” and “processing”, “the UK GDPR”) and (5A) (Personal information); 47(1) and (2) (Application for decision by Commissioner).

United Kingdom General Data Protection Regulation[2] (the UK GDPR) articles 4(1) (definition of “personal data”) (Definitions); 5(1)(a) (Principles relating to the processing of personal data); 6(1)(f) (Lawfulness of processing).

Data Protection Act 2018[3] (the DPA 2018) sections 3(2), (3), (4)(d), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data).

Background

1. On 18 February 2025, the Applicant made the following request for information to the Authority:

   “This email is a request for information such as that contained in the ‘Dejawint database’, in respect of the Central Legal Office [(CLO)]’s calculation or record of activity, inclusive of ‘fees’, expenses or outlays in respect of each of the items (or tasks or ‘otherwise units’) of work performed in connection with the matter of DBN B204-24 or the appeal of DBN B204-24 viz.[Applicant] as ‘Data Subject’ v NHS Greater Glasgow and Clyde as ‘Data Controller’.”

   The request included further explanatory information, the full text of which is set out in Appendix 1 to this Decision Notice. The Appendix forms part of the Decision Notice.

2. The Authority responded on 18 March 2025 in the following terms:

   1. It confirmed that no information was held in the “Dejawint database”, as this was a historic fee charging application that was no longer in use.

   2. For the precise nature of the work undertaken and charged, communications about charges, and the rate paid by the Health Board to the CLO, the Authority considered all of this information to be exempt from disclosure in terms of section 33 and section 36 of FOISA.

   3. For payments made to counsel, the Authority considered this to be personal information about those individuals, disclosure of which would amount to unlawful processing of personal information.  It withheld that information under section 38 of FOISA.

   4. While it considered that exemptions applied to the information requested, the Authority informed the Applicant, in terms of section 17 of FOISA, that there was no relevant information held as the Health Board had not been charged by the CLO for the work undertaken, due to the circumstances in which the appeal was required.

   5. The Authority believed that, in the circumstances, it was not necessary to consider the public interest test in FOISA.

3. On 18 March 2025. The Applicant wrote to the Authority requesting a review of its decision.  The Applicant stated that he was dissatisfied with the Authority’s decision as follows:

   1. Noting that his request was not limited to information in the “Dejawint database”, he was dissatisfied that the Authority had focused on this.

   2. He disagreed that the exemptions in section 33 and section 36 applied to the nature of the work undertaken and charged, communications about charges, and the rate paid by Health Board to the CLO, and in particular for any work where no fee had been charged.

   3. For payments made to counsel, he disagreed that the exemption in section 38(1)(b) applied to information about the Authority’s overall outlays in respect of litigation work, or that this information would identify a commercially sensitive matter.

   4. He believed the Authority’s section 17 response rendered its previous comments “somewhat obiter” and led him to doubt its overall position.

   5. He disagreed that there was no requirement to consider the public interest test.

4. The Authority notified the Applicant of the outcome of its review on 16 April 2025, modifying its original decision as follows:

   1. It confirmed that a search of the current database had identified relevant information, which it now withheld under section 33(1)(b) of FOISA.

   2. For the nature of the work undertaken and charged, communications about charges, and the rate paid by the Health Board to the CLO, the Authority now considered this information to be exempt from disclosure solely in terms of section 33(1)(b) of FOISA.

   3. For payments made to counsel, the Authority upheld its decision to withhold that information under section 38(1)(b) of FOISA.

   4. As a total cost was recorded (which the Authority now withheld under section 33(1)(b)), it withdrew its reliance on section 17(1).  The Authority explained that all time had been put through at “Free rate” so there were no CLO fees and no charges to the Health Board.

   5. The Authority considered the public interest test, concluding that there was no public interest in the disclosure of the information requested as there existed no serious concern or benefit to the public in its release.

5. On 17 April 2025, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  The Applicant stated that he was dissatisfied with the outcome of the Authority’s review because:

• it had failed to disclose any information;

• he did not believe that the exemptions in section 33(1)(b), section 36 or section 38(1)(b) applied (and it was also unclear whether section 36 was still being relied on), and

• he believed that the public interest favoured disclosure.

Investigation

6. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
7. On 13 May 2025, the Authority was notified in writing that the Applicant had made a valid application.  The Authority was asked to send the Commissioner the information withheld from the Applicant.  The Authority provided the information and the case was subsequently allocated to an investigating officer.
8. At the start of the investigation, the Investigating Officer asked the Authority to clarify its position for parts (ii) and (iii) of its review outcome, as set out above.  In response, the Authority confirmed that:

   • for part (ii), it had withdrawn reliance on section 36 at review stage but upheld section 33(1)(b), a position which remained unchanged, and

   • for part (iii), it continued to rely on section 38(1)(b) to withhold the cost of individual pieces of work by advocates, but not the total cost of this work, which it had withheld at review stage (and continued to withhold) under section 33(1)(b).

9. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was subsequently invited to comment on this application and to answer specific questions.  These focused on the Authority’s justification for relying on the exemptions in section 33(1)(b) and section 38(1)(b) of FOISA to withhold the information requested, including consideration of the public interest where required.
10. The Applicant was also informed of the Authority’s clarified position for parts (ii) and (iii) of its review outcome, and was invited to provide comment on the public interest in disclosure of the information being withheld under section 33(1)(b), and on his legitimate interests in obtaining the third party personal data being withheld under section 38(1)(b).
11. Both parties provided submissions to the Commissioner during the investigation.

Commissioner’s analysis and findings

12. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.

Handling issues

13. As rehearsed above, at review stage, the Authority withheld the information requested under the exemptions in section 33(1)(b) and section 38(1)(b) of FOISA, having withdrawn reliance on section 17(1) and section 36 for certain information.
14. Early in the investigation, in its submissions to the Commissioner, the Authority explained that, for part (ii) of the request, it had withdrawn section 36 at review stage but maintained reliance on section 33(1)(b), a position which remained unchanged.  At that time, while it considered that section 38(1)(b) also applied to part (ii), it had chosen not to rely on that exemption at review stage given section 33(1)(b) already applied.
15. For part (iii), the Authority confirmed that, at review stage, it had withheld (and continued to withhold) the total cost of work by advocates under section 33(1)(b).  It explained that, while section 38(1)(b) did apply to the cost of individual pieces of work by advocates, given that the Applicant was looking for the total cost, it was decided that section 38(1)(b) did not apply [to the total cost].  The Authority accepted that there had been no mention of reliance on section 33(1)(b) in its review response for part (iii).
16. The Authority acknowledged that it was not clear what was decided and which exemptions had been applied and that its review response could have been far clearer.
17. Having considered the above, it is clear to the Commissioner that the Authority’s review outcome was, in these respects, somewhat confusing and he can understand why it was unclear to the Applicant whether or not a particular exemption was still being applied.
18. While not a finding in terms of compliance with FOISA, the Commissioner would urge the Authority, and indeed all Scottish public authorities, to ensure that any change of position adopted at review stage is clearly reflected in the review outcome, clarifying (with explanation) any exemptions no longer been relied on, those being maintained, and any further exemptions now being applied.
19. The Commissioner will now go on to consider whether the Authority was entitled to rely on the exemptions being claimed to withhold the information requested.

Section 33(1)(b) – Commercial interests and the economy

20. Section 33(1)(b) of FOISA provides that information is exempt information if its disclosure under this Act would, or would be likely to, prejudice substantially the commercial interests of any person (including, without prejudice to that generality, a Scottish public authority).  This exemption is subject to the public interest test in section 2(1)(b) of FOISA.
21. There are a number of elements an authority needs to demonstrate are present when relying on this exemption.  In particular, it needs to establish:

    1. whose commercial interests would (or would be likely to) be harmed by disclosure,

    2. the nature of those commercial interests, and

    3. how those interests would (or would be likely to) be prejudiced substantially by disclosure.

22. The prejudice must be substantial, in other words of real and demonstrable significance.  Where the authority considers that the commercial interests of a third party would (or would be likely to) be harmed, it must make this clear.  Generally, while the final decision on disclosure will always be one for the authority, it will assist matters if the third party has been consulted on the elements referred to above.

The Applicant’s submissions

23. In his application to the Commissioner, the Applicant was dissatisfied with the Authority’s decision to withhold, under section 33(1)(b), the information he had requested.
24. Both in his application, and at various stages during the investigation, the Applicant provided lengthy submissions on why he did not believe the Authority had commercial interests that would be impacted by disclosure of the information requested. The main points of these are summarised below:

    1. Nothing in his information request related to any information that could be properly said to be “commercially sensitive” or could relate to a “commercial interest”, given that the Authority was a publicly-owned, publicly-funded and non-profit-making organisation.

    2. The Authority had mistaken their “financial interests” to be “commercial interests”.  None of the parties involved in providing or receiving the service were commercial organisations, and there was no element of “trade” or “marketplace competition”.

    3. There was no evidence that the CLO required to be in competition with private solicitors in relation to providing legal services for client health boards, or that any tender process for these services took place. He questioned whether, in reality, NHS health boards were ever represented by private legal firms in litigation.

    4. The Authority was unable to change the nature of its legal services and so was unlikely to be operational within a marketplace.

    5. The legal services provided by the CLO were “in house”, the key difference between those and marketplace legal services being the executive responsibility of the in-house legal team to take decisions on the use of client funds and the position adopted in litigation, as opposed to “high street solicitors” that take instructions from clients.

    6. The Clinical Negligence and Other Risks Indemnity Scheme (CNORIS) [which limits a health board’s liability for legal costs to £25,000] appeared to assume that health boards will have used the CLO as opposed to external legal advisers, and there was no option for health boards to opt-out of the CNORIS scheme.

    7. CLO funding came from the public purse, and the function of the Authority was to provide a public service to public sector clients using only public funds, as opposed to taking business away from private law firms that might be less expensive.

    8. He disagreed that advocates’ fees were exempt under section 33(1)(b), arguing that the Authority had not stated the harm to its commercial interests, or had provided any evidence that advocates would expect this information to be withheld under FOI.

    9. The VAT arrangements of the Authority set out that, unlike a firm in the marketplace, the CLO, because of the arrangement of a divisional VAT group, was not obliged to charge output VAT to health boards for legal services.  This inherent favourability to the health board of obtaining legal representation from a provider that was under no obligation to charge it VAT, led him to believe that there was no genuine competition between private law firms and in the in-house CLO, thereby further undermining the Authority’s reliance on the “commercial interests” exemption.

The Authority’s submissions

25. In its submissions to the Commissioner, the Authority confirmed that it wished to maintain reliance on section 33(1)(b) to withhold the information requested.
26. The Authority explained that the CLO provided legal services to the NHS in Scotland, paid for by fees charged by the CLO to the health boards it carried out work for.  As the CLO charged on a cost recovery basis, its fees were considered to be significantly lower than those that would be offered by equivalent private law firms.  The Authority pointed out that that health boards could obtain the services of private law firms if they chose to do so.
27. The Authority submitted that, if the legal costs in individual cases were disclosed, this information could be used by private law firms to try to attract engagement by health boards, by undercutting the CLO.  It argued that private law firms were not obliged to disclose their fee rates and so the CLO should not be placed in a disadvantaged position through disclosure of such information for individual cases, as opposed to on an aggregated basis where it would not be possible to ascertain the fees charged.
28. In litigation cases and claims, the Authority submitted, parties were required to keep information confidential unless instructed otherwise by a court, and there was no requirement to disclose litigation legal costs as part of court procedure.  In the Authority’s view, disclosure of any financial information in a specific case created a significant imbalance as it could be used:

    1. by the other party when making decisions about the litigation, e.g. whether to accept a settlement offer;

    2. in negotiations, and

    3. in making decisions about the most advantageous way to proceed, particularly where one party had not been required to make such a disclosure.

29. The Authority believed that disclosure of the information might lead to health boards choosing to instruct a private law firm rather than the CLO, as a private law firm would not be required to disclose legal costs given it would not be subject to FOISA.

Commercial interests and how disclosure would prejudice these

30. The Authority submitted that section 33(1)(b) applied as disclosure of the information on fees and costs was potentially damaging to its own commercial interests, and those of the health boards using its CLO services.
31. The Authority explained that its own (i.e. the CLO’s) commercial interests lay in maintaining its services to health boards and the fees charged to do so.  Were health boards to instruct private law firms on a regular basis in the circumstances described above, the CLO might no longer be able to recover the costs of its services (i.e. meet salaries). The Authority submitted that this existential threat to the CLO also had implications for the wider provision of legal services within the NHS in Scotland.
32. In respect of the commercial interests of the health boards, the Authority submitted that these were the costs incurred for legal services and the resolution of legal claims for compensation.  It explained that litigation legal costs in excess of £25,000 were currently met by the CNORIS scheme, with each health board being required to contribute to CNORIS on an annual basis.  In the Authority’s view, those contributions would increase should legal and settlement costs increase on an annual basis.
33. In these respects, the Authority submitted that it had applied section 33(1)(b) to protect itself and the health boards in relation to the thousands of cases dealt with by the CLO, plus other legal work carried out for the NHS in Scotland, and not solely in respect of the Applicant’s case.
34. Turning to the work carried out in this case where no fees had been charged to the Health Board, the Authority argued that this could be used to try to influence the approach to litigation.  It believed that the Applicant wished to obtain this information to gain advantage in this regard.  In the Authority’s view, disclosure of this information could prejudice substantially the Health Board’s commercial interests in its dealings with the Applicant, and would set a precedent for all other claims and litigation favouring disclosure of non-chargeable elements of a case.
35. The Authority submitted that fee narratives were confidential and could include legally privileged material from time to time.  In the Authority’s view, it would not be practicable for the CLO to review every fee entry and assess this if required to provide this information.  It submitted that private law firms would produce similar information on fee charging arrangements for their clients.
36. The Authority confirmed that it had considered whether the information could be partially disclosed, with some redaction.  It believed, however, that the point of principle was about providing information on legal fees and related narratives in individual cases, which would be prejudicial in an individual case but, more significantly, potentially prejudicial in all cases.  In this instance, it submitted, the general prejudice to dealing with cases amounted to substantial prejudice to its own commercial interests and those of the health boards.
37. In relation to information on the total cost of work carried out by advocates, the Authority argued that disclosure would carry the same prejudice as that outlined above. In addition, the Authority believed that should advocates become aware that their CLO fees were disclosable under FOISA, they might refuse to work for the CLO in future, thereby damaging the commercial interests of the Authority and the health boards.
38. The Authority confirmed that it had not considered it necessary to consult with other health boards, or with counsel/experts, to obtain third party views.

The Commissioner’s views – section 33(1)(b)

39. The Commissioner has carefully considered all the arguments put forward, along with the information being withheld under section 33(1)(b) of FOISA.
40. The first matter which the Commissioner must decide is whether the interests described are commercial interests for the purpose of section 33(1)(b).

41. In his briefing on section 33(1)(b) of FOISA[4], at paragraph 19, the Commissioner notes that:

    “”Commercial interests” is not defined in FOISA.  These are not the same as financial interests.  A person’s or organisation’s commercial interests will usually relate to the commercial trading activity they undertake, e.g. the ongoing sale and purchase of goods and services, commonly for the purpose of revenue generation.  Such activity will normally take place within a competitive environment.”.

42. While the Commissioner’s briefing (at paragraph 20) does recognise that there may be cases where prejudice to a person’s financial interests may affect their commercial interests, he is not persuaded that this is the case here, particularly with regard to the information being withheld which, in the Commissioner’s view, does not relate to, or impact on, any commercial activity.
43. In the Commissioner’s view, the interests put forward by the Authority (described as the provision of legal services to health boards and the fees charged in doing so, along with the ability to recover the costs of these services, i.e. meet salaries) are mainly operational and financial, relating to its core functions in providing, for the most part, legal services to the NHS in Scotland.
44. For the stated commercial interests of the health boards (described by the Authority as the costs incurred by the health boards for legal services and the resolution of legal claims for compensation), the Commissioner recognises that health boards are not “bound” to engage the CLO when requiring legal services.  However he considers it unlikely that they will seek private legal services elsewhere, given that the CLO operates on a cost recovery basis and any fees charged will, in light of this, be generally lower than those charged by any private legal firm (and limited to £25,000 by the CNORIS scheme).
45. The Commissioner is not convinced by the Authority’s argument that disclosure of the information under consideration here would lead to an increase in the amount of contributions due by health boards to the CNORIS scheme, or that advocates might, in future, refuse to work for the CLO should the total cost of their fees in any given case be disclosed under FOISA.  Neither does he believe disclosure would be likely to have a significant impact on the resolution and/or progression of cases, given that decisions on these matters (by either party) are unlikely to be influenced substantially by legal costs alone – and, by extension, it is not clear to the Commissioner what material tactical advantage might be conferred on the other party by knowing this information.
46. While the Commissioner notes the Authority’s concerns in relation to the management of legal actions more generally, these appear to be speculative and lacking in real clarity. While such concerns are not necessarily to be dismissed as never being of relevance, section 33(1)(b) is not a class-based exemption and the Commissioner (and public authorities) must consider each request on its own facts and circumstances.
47. In light of the above, the Commissioner is not satisfied that the Authority has demonstrated that the interests identified are commercial interests for the purposes of the exemption in section 33(1)(b) of FOISA – or, to the extent that they may be so described, that the Authority has identified any harm that would be likely to result from disclosure and which could reasonably be described as substantial.
48. The Commissioner cannot accept that the Authority has identified commercial interests relating to itself, or to the health boards utilising its services, which might be adversely impacted through disclosure of the information requested in this case.
49. The Commissioner therefore finds that the exemption in section 33(1)(b) is not engaged in this case, and that the Authority wrongly withheld the information requested under that exemption.  In light of this finding, the Commissioner is not required to go on to consider where the balance of public interest lies in disclosure of that information, as set out in section 2(1)(b) of FOISA.
50. The Commissioner notes that the Authority is also withholding some of this information under section 38(1)(b) of FOISA.  He will therefore now go on to consider whether the Authority was entitled to rely on section 38(1)(b) to withhold the third party personal data present in the withheld information.
51. For the remainder of the information withheld under section 33(1)(b), the Commissioner requires the Authority to fully disclose this to the Applicant.

Section 38(1)(b) – Personal information

52. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is "personal data" (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or (where relevant) in the DPA 2018.
53. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption.  This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
54. To rely on this exemption, the Authority must show that the information withheld is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Article 5(1) of the UK GDPR.
55. The Commissioner must decide whether the Authority was correct to withhold the information requested under section 38(1)(b) of FOISA.

Is the withheld information personal data?

56. The first question that the Commissioner must address is whether the withheld information is personal data for the purposes of section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable individual.  "Identifiable living individual" is defined in section 3(3) of the DPA 2018.  (This definition reflects the definition of personal data in Article 4(1) of the UK GDPR.)
57. Information which could identify individuals will only be personal data if it relates to those individuals.  Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.
58. In its submissions to the Commissioner, the Authority confirmed that it wished to withhold the third party personal data present in the withheld information under section 38(1)(b) of FOISA.
59. Having considered the withheld third party personal information in question (i.e. the names or initials of individuals connected with elements of the work carried out), the Commissioner is satisfied that this “relates to” identifiable living individuals and is therefore personal data, for the purposes of section 3(2) of the DPA 2018.

Which of the data protection principles would be contravened by disclosure?

60. The Authority stated that disclosure of this personal data would contravene the first data protection principle (Article 5(1)(a)).  Article 5(1)(a) states that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.
61. In terms of section 3(4)(d) of the DPA 2018, disclosure is a form of processing.  In the case of FOISA, personal data is processed when it is disclosed in response to an information request.
62. The Commissioner must now consider if disclosure of the personal data would be lawful (Article 5(1)(a)).  In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed.  The Commissioner considers condition (f) in Article 6(1) to be the only one which could potentially apply in the circumstances of this case.

Condition (f) - legitimate interests

63. Condition (f) states that the processing shall be lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data (in particular where the data subject is a child).
64. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
65. The tests which must be met before Article 6(1)(f) can be met are as follows:

    1. Does the Applicant have a legitimate interest in obtaining the personal data?

    2. If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?

    3. Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?

Does the Applicant have a legitimate interest in obtaining the personal data?

66. In his submissions to the Commissioner, the Applicant argued that there was a public interest in scrutiny of the use of public funds, and so that the individuals responsible for such use could be held accountable.  As a member of the public, the Applicant believed that he had a legitimate interest in scrutinising the functions of the key public service (the in-house legal service) of health boards in Scotland.
67. The Applicant further submitted that, having been made aware that the Authority or the Health Board may seek to recover their expenses in litigation, he had a legitimate interest in understanding what expenses were being claimed for and whether or not these were justified.  In this regard, he believed that certain costs were non-recoverable and therefore knowing the identities of the individuals involved in providing the service was the only means of identifying whether the auditor of court was able to consider that the award of expenses covered the specific work done by that person.
68. In its submissions to the Commissioner, the Authority confirmed that it did not consider the Applicant had a legitimate interest in accessing the third party personal information in question. It understood that the Applicant was seeking to obtain information regarding his claim against the CLO to ascertain figures and the time spent on handling his claim.  In the Authority’s view, there was no wider public benefit in its disclosure (and there would be no public impact in withholding the information) as no party, other than the Applicant, would benefit from this information.
69. The Commissioner accepts that disclosure of the withheld personal data would give the Applicant knowledge about individuals connected with specific pieces of work relating to his claim against the CLO, the nature of the work carried out by them and any corresponding costs, which might assist him in judging whether any claim for expenses made against him was justified.  He recognises that the Applicant has a personal legitimate interest in this regard, but he can identify no wider public interest in disclosure of that personal data.

Is disclosure of the personal data necessary?

70.     The Commissioner must now consider whether disclosure of the personal data would be necessary to meet the Applicant’s legitimate interests.

71.     Here, “necessary” means “reasonably” rather than absolutely or strictly necessary.  The Commissioner must consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the Applicant’s legitimate interests can be met by means which interfere less with the privacy of individuals.

72. In its submissions, the Authority explained that, as it did not consider the Applicant to have a legitimate interest in obtaining the information, it did not consider it applicable to determine whether disclosure of the withheld information was necessary to achieve such interests.
73. Having fully considered the withheld information itself, the Commissioner accepts that disclosure of the personal data would assist the Applicant in understanding the professional status of those involved in carrying out the work associated with the case.  However, he does not consider it necessary for this information to be disclosed to the Applicant to fulfil his legitimate interest.
74. The Commissioner is acutely aware that any auditor, appointed by the Court to assess the account in order to allow agreement on what expenses could be legitimately claimed against the Applicant, would have access to all relevant information in order to be able to carry out such an audit.  Given the independent role of the Court auditor in determining those expenses that were justified, or any which were non-recoverable, the Commissioner does not consider it necessary for the Applicant to have access to the withheld personal data.
75. As the Commissioner has identified an alternative means which would enable the Applicant’s legitimate interest to be fulfilled which would interfere less with the privacy of the data subjects than providing the withheld information, he does not consider disclosure of the information, which, he is satisfied, constitutes third party personal data, is necessary in this case.
76. In the circumstances, therefore, the Commissioner finds that condition (f) in Article 6(1) of the UK GDPR cannot be met and disclosure of the information would therefore be unlawful.
77. Given that the Commissioner has concluded that the processing of the personal data would be unlawful, he is not required to go on to consider whether disclosure of the personal data would otherwise be fair and transparent.
78. The Commissioner is satisfied, in the absence of a condition in Article 6(1) of the UK GDPR which would allow the data to be disclosed, that disclosure would be unlawful.  He finds that the personal data is therefore exempt from disclosure (and properly withheld) under section 38(1)(b) of FOISA.

Decision

The Commissioner finds that the Authority partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.

The Commissioner finds the Authority correctly withheld the third party personal data present in the withheld information under section 38(1)(b) of FOISA, and complied with Part 1 in this respect.

However, he finds that the Authority failed to comply with Part 1 by wrongly withholding the remaining information under section 33(1)(b) of FOISA.

The Commissioner therefore requires the Authority to disclose to the Applicant the information he has found to have been wrongly withheld, by 24 April 2026.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply.  The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

Euan McCulloch

Head of Enforcement

10 March 2026

Appendix 1 : Full text of Applicant’s request of 18 February 2025

“This email is a request for information such as that contained in the ‘Dejawint database’, in respect of the central legal offices calculation or record of activity, inclusive of ‘fees’, expenses or outlays in respect of each of the items (or tasks or ‘otherwise units’) of work performed in connection with the matter of DBN B204-24 or the appeal of DBN B204-24 viz. [Applicant] as ‘Data Subject’ v NHS Greater Glasgow and Clyde as ‘Data Controller’.

• ‘All information’ includes names and/or designations and/or job titles of members of staff who have authorised, generated or completed such work and when these items (or tasks or otherwise units of work) were logged on the database or logged in any record of information.

• ‘All information’ includes when such work was requested (or started), conducted, and concluded.

• ‘All information’ includes any record of information that the client has authorised such work, fee, outlay, expense, to be incurred.  All information includes the identity of which office holder of the client party has given the necessary authorisation – if such authorisation was deemed necessary or at all given.

• All information’ includes updates on the activity of work (such as descriptions of the activity) logged in the database and when these updates were made (the metadata regarding when this was logged on a database or received within an electronic or manual filing system) and which members of staff/designation or job title is involved in the activity of logging.

All information is not limited by the descriptions in the above bullet-pointed list – neither are the descriptions necessarily mutually exclusive.

To narrow your search these records will likely be held and retained by staff members or office holders of the ‘central legal office, will likely have been made between (and inclusive of) April 2024 until the present day.

In respect of this request I will also notify the searcher and respondent to this request of the following observations and notifications regarding the request:

• There can not claim legal privilege in respect of the information asked for – these are public expenses and the information does not relate to the substance of any legal advice.  It relates entirely to the activity of the public body.

• The ‘Central Legal Office’ does not participate in any mercantile or commercially sensitive activity.  Thereby there is no ‘trade secret’ that should be kept from the public.  I will note this to also be true in respect of any faculty of Advocates members’ honorarium: there is no obligation to dispense the ‘honorarium’ by the party instructing the advocate or their client.  There is no ‘trade’ there can be no secret.

• Neither NSS nor NHS GGC are natural persons and do not have personal data.  Nor is the relationship between them of a mercantile or commercial or trading nature.

• I, [Applicant], give NHS NSS my permission to reveal any personal data that relates to me in so far as this fulfils a response to the request for information.  It should be said that I would find it impossible for any of the requested information to be construed as my personal data or any individuals personal data (data of a purely personal or household nature).  Esto, any information that is my personal information within the ambit of the request can be treated as a subject access request and revealed personally to me in response to a subject access request.”

END