Home Decisions

Decision 060/2026

Decision 060/2026:  Fitness to Teach - Outcomes of panel hearings that considered applications for cancellation of alleged misconduct cases

Authority:  General Teaching Council for Scotland
Case Ref:  202500582
 

Summary

The Applicant asked the Authority for information about Fitness to Teach Panel hearings that had considered applications for the cancellation of alleged misconduct cases, including the dates of the hearings and the outcomes as previously published on its website.  The Authority provided the dates of the hearings, but refused to provide information on the outcomes previously published on its website, on the basis that this comprised third party personal data, disclosure of which would breach data protection principles.  The Commissioner investigated and found that the Authority had correctly withheld the information requested.  However, he also found that it had failed to comply with the statutory timescale for responding to the Applicant’s requirement for review.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(2)(d) and (e)(ii) (Effect of Exemptions); 21(1) (Review by Scottish public authority); 37(1)(a) (Court records, etc.); 38(1)(b), (2A), (5) (definitions of “the data protection principles”, “data subject”, “personal data” and “processing”, “the UK GDPR”) and (5A) (Personal information); 47(1) and (2) (Application for decision by Commissioner).

United Kingdom General Data Protection Regulation (the UK GDPR) articles 4(1) (definition of “personal data”) (Definitions); 5(1)(a) (Principles relating to the processing of personal data); 6(1)(f) (Lawfulness of processing).

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data).

Background

  1. On 6 December 2024, the Applicant made a request for information to the Authority about the cancellation of Fitness to Teach misconduct cases.  He referred to the Authority’s statement in a previous response in which it had stated:

“Finally, you asked, how many involved a case ‘where the application to cancel cited the fact that five years had passed since the most recent alleged misconduct’.  In two cases, the application for cancellation cited the fact that five years had passed.”

  1. For each of the two cases referred to in that statement (i.e. those for which the application cited the fact that five years had passed), the Applicant asked the Authority for:
    1. the date of the panel meeting where the application for cancellation was considered, and
    2. a copy of the information previously published on its website about the outcome of the panel hearing that considered the application.
  2. The Authority responded on 9 January 2025 and disclosed the dates of the two panel meetings in question.  For the outcomes, the Authority withheld this information under section 38(1)(b) (Personal information) of FOISA.  The Authority explained that, while it had made these decisions available previously on its website, this was done in line with its Fitness to Teach Publication Policy,.  The Authority explained that, as the processing of personal data must be fair as well as lawful, it had an obligation to manage such information in ways that parties to the Fitness to Teach process would reasonably expect, unless the legitimate interest in the requester receiving that information outweighed that of the individual(s) involved.
  3. That same date, the Applicant wrote to the Authority requesting a review of its decision. The Applicant stated that he was dissatisfied with the decision given that the Authority had, quite recently, put the information into the public domain.  In the Applicant’s view, by publishing the material on its website, the Authority had put that information into the public domain and, given the scope for further distribution and republication of that information by others (for example, via the Internet Archive), it seemed therefore likely that the information withheld was already being published elsewhere.  The Applicant further argued that the public should not have to seek out information from information archives, rather it should be available directly from the original publisher.
  4. The Authority wrote to the Applicant on 6 February 2025 asking him to confirm what he considered his legitimate interest was in receiving the information requested, thus enabling it to issue a response to his request for review.
  5. That same date, the Applicant informed the Authority that he would provide his legitimate interests to its Chief Executive, and challenged why the Authority took until the twentieth working day allowed for responding to his request to review to ask for these.
  6. The Applicant provided his legitimate interests in accessing the information to the Authority’s Chief Executive on 7 February 2025.
  7. On 14 February 2025, the Authority notified the Applicant of the outcome of its review, upholding its original decision.  In summary, the Authority explained that:
  • All published decisions, beyond the three month publication period established by its Fitness to Teach Publication Policy, were subject to section 38(1)(b) of FOISA, and any disclosure beyond that would breach the first data protection principle.
  • The data subjects had no reasonable expectation that their personal data would be placed back into the public domain after cases had been concluded and the publication period had ended.
  • It considered that the Applicant’s legitimate interest in accessing the information did not outweigh that of the data subjects whose sensitive personal data he was seeking.
  • Recognising that information may be taken, by others, from its website during the publication period, the Authority was only able to control the flow of information through those mechanisms it administered and it was not responsible for personal downloads and global internet archiving.  The Authority stated it was necessary for it to control the information it published to ensure that this was reasonable, fair and proportionate, and met data protection requirements.
  1. The Applicant wrote to the Authority on 21 February 2025 asking it to explain why providing him with copies of the panel reports personally would place the information into the public domain in perpetuity, whereas publishing it on its website did not, in order to aid his understanding of the Authority’s review response.
  2. On 22 April 2025, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  The Applicant stated he was dissatisfied with the outcome of the Authority’s review because he disagreed that section 38(1)(b) applied.  The Applicant put forward various arguments in support of his position, including (but not limited to) the following:
    • Not all of the information was personal data and no attempt had been made to redact sensitive personal information while retaining the meaning of the information as much as possible.
    • His legitimate interests outweighed those of the data subjects, particularly as their rights were already significantly reduced by the Authority’s previous publication of the information, and these could not be achieved by other means (which the Authority had failed to identify).
    • The outcomes were in the public domain in perpetuity as a result of the Authority’s publication, not least the ability of others to download and archive the information during the publication period.
    • The published information had already been processed to remove identifying information for many of the data subjects affected, and republishing could not reasonably be considered to be further processing.
    • As the data subjects were largely teachers, in positions of responsibility, this changed consideration of their rights to information about them acting in their professional capacity (often with regard to the welfare of children in their care) being made public, and it was essential that the conduct of teachers was subject to public scrutiny.
    • With regard to the three-month publication period in the Fitness to Teach Publication Policy, the Authority had failed to adequately explain why it was acceptable to publish the information one day, but it was unacceptable to do so the next (i.e. the day after the three-month period had ended).

Investigation

  1. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
  2. On 14 May 2025, the Authority was notified in writing that the Applicant had made a valid application, and it was asked to send the Commissioner the information withheld from the Applicant. The Authority provided the information and the case was subsequently allocated to an investigating officer.
  3. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application and to answer specific questions.  These focused on the Authority’s justification for withholding the information requested under section 38(1)(b) of FOISA, the Authority’s previous publication of the information requested on its website, and its alleged failure to respond to the Applicant’s request for review within the 20 working day period provided for by section 21(1) of FOISA.
  4. The Applicant was also invited to provide any further comments on his legitimate interest in accessing the information requested.
  5. In providing submissions to the Commissioner, the Authority stated that it wished to modify its position.  While it maintained reliance on section 38(1)(b), the Authority now also wished to rely on section 37(1)(a) for all of the in-scope information.  It further stated that, should the Commissioner find that the information requested could be otherwise obtained by the Applicant, it wished to rely on section 25(1) (Information otherwise accessible) of FOISA.
  6. In the interests of natural justice, the Applicant was invited to comment on the Authority’s decision to also now rely on section 37(1)(a) of FOISA.
  7. At various stages during the investigation, the Applicant provided further details of his legitimate interests, evidence to support his position that the withheld information was available in the public domain, and comments on the Authority’s reliance on section 37(1)(a).

Commissioner’s analysis and findings

  1. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority together with the content of the withheld information.

Section 38(1)(b) – Personal information

  1. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is "personal data" (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or (where relevant) in the DPA 2018.
  2. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption.  This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
  3. To rely on this exemption, the Authority must show that the information withheld is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Article 5(1) of the UK GDPR.
  4. In his request for information, the Applicant sought copies of the information, previously published on the Authority’s website, about the outcome of two panel hearings that had considered applications for the cancellation of Fitness to Teach misconduct cases, where the application to cancel cited the fact that five years had passed since the most recent alleged misconduct.
  5. The Authority explained that the information in question comprised the outcome of the two panel hearings that had considered these applications, as contained within documents previously published (for a limited period) on its website.  It submitted that disclosure of this information would contravene the first data protection principle.
  6. The Commissioner must decide whether the Authority was correct to withhold the information requested under section 38(1)(b) of FOISA.

Is the withheld information personal data?

  1. The first question that the Commissioner must address is whether the withheld information is personal data for the purposes of section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable living individual. "Identifiable living individual" is defined in section 3(3) of the DPA 2018. (This definition reflects the definition of personal data in Article 4(1) of the UK GDPR.)
  2. Information which could identify individuals will only be personal data if it relates to those individuals.  Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.
  3. In both his application and his submissions to the Commissioner, the Applicant argued that not all of the withheld information was personal data.  He believed the Authority appeared to have classed all of the information as personal data without actually considering each piece of information separately.
  4. In its submissions to the Commissioner, the Authority confirmed that the withheld information comprised personal data, and was the information which had been published on its website for a limited period for a specific purpose, which had been redacted (prior to publication) to remove some third-party personal data that was never published. 
  5. The Authority submitted that the information was about the outcome of a Fitness to Teach Panel’s hearing, convened to consider matters raised in the referral of a specific named individual, with other individuals referenced in the decision, e.g. witnesses. It explained that these individuals were identifiable by name or by other identifiers.  Even by removing names in an attempt to anonymise the information, the Authority believed that these individuals would still be identifiable from other data that had already been disclosed under FOISA and other information in the public domain.
  6. The Authority further submitted that the personal data related to a small number of specific people involved in Fitness to Teach Panel proceedings in 2023, as opposed to some large-scale dataset that might be less likely to lead to the identification of individuals.  It further stated that, as the events recorded in the information were uncommon (reported in the media at the time of the events and hearings), this led to a greater risk of identification through disclosure, particularly as the dates of the decisions had been disclosed.  Given the information related to recent events, the Authority believed that the risk of identification had not decreased with the passage of time.
  7. In addition, the Authority stated that some of the information comprised health data, and this constituted special category personal data which required additional protection from public disclosure.
  8. During the investigation, the Authority was asked to specify which information was being withheld under section 38(1)(b) and/or section 37(1)(a), as this had not been made clear.  In providing this detail, the Authority explained that, while it considered all of the information was caught by section 37(1)(a), certain of it was also caught by section 38(1)(b). 
  9. Having considered the submissions from both parties and the withheld information itself, the Commissioner notes that the information in question relates to determinations to be taken about individuals’ fitness to teach.  It is clear to the Commissioner any information relating to those determinations is the personal data of the individuals in question, and he is therefore satisfied that all of the information withheld in this case "relates to" identifiable living individuals. Notwithstanding the Authority’s change of position that certain of the withheld information was caught only by section 37(1)(a), the Commissioner therefore concludes that all of the information withheld in this case is personal data, for the purposes of section 3(2) of the DPA 2018.

Which of the data protection principles would be contravened by disclosure?

  1. The Authority stated that disclosure of this personal data would contravene the first data protection principle (Article 5(1)(a)).  Article 5(1)(a) of the UK GDPR states that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.
  2. In the Authority’s view, disclosure in perpetuity under FOISA would be unfair and thereby unlawful.  It explained that its Fitness to Teach Publication Policy made clear that (and explained why) decisions were published (sometimes redacted) for three months then withdrawn.  Other relevant factors included the circumstances in which personal data in Fitness to Teach proceedings were obtained, the reasonable expectations of those providing the information, the consequences of such disclosure (including personal harm and distress), and the Authority’s legal duty to take a proportionate approach to ensure transparency in respect of decisions whilst respecting people’s right to privacy in terms of both data protection law and the Article 8 “right of privacy” of the European Convention of Human Rights (ECHR).
  3. In terms of section 3(4) of the DPA 2018, disclosure is a form of processing.  In the case of FOISA, personal data is processed when it is disclosed in response to a request.
  4. The Commissioner must now consider if disclosure of the personal data would be lawful (Article 5(1)(a)).  In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed.  The Commissioner considers condition (f) in Article 6(1) to be the only one which could potentially apply in the circumstances of this case.

Condition (f): legitimate interests

  1. The Authority submitted that condition (f) of Article 6(1) of the UK GDPR was the only legal basis providing for disclosure of the information, under FOISA, in perpetuity.
  2. Condition (f) states that the processing will be lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data (in particular where the data subject is a child).
  3. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
  4. The tests which must be met before Article 6(1)(f) can be met are as follows:
    1. Does the Applicant have a legitimate interest in obtaining the personal data?
    2. If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?
    3. Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?

Does the Applicant have a legitimate interest in obtaining the personal data?

  1. When submitting his application to the Commissioner, the Applicant provided the Commissioner with a copy of his email of 7 February 2025 to the Authority’s Chief Executive setting out his legitimate interests.  As he considered these to be highly confidential, he asked that these were not published.  During the investigation, the Applicant copied the Commissioner into a further confidential email to the Authority’s Chief Executive, providing further information in support of his legitimate interests in accessing the information requested.  Given the confidential and sensitive nature of the content of those communications, the arguments therein have therefore not been replicated here, but have been fully considered by the Commissioner.
  2. In his application to the Commissioner, the Applicant argued that his stated legitimate interest could not be achieved, either through the Authority’s limited three-month period publication period, or by other means (as claimed by the Authority); however, the Authority had failed to identify what those other means were.
  3. The Applicant further believed it was essential for the protection of the public that the conduct of teachers was subject to public scrutiny.  He argued that, as teachers entered the profession knowing that their registration was governed by the Authority, their behaviour (in both their professional and personal life) must remain within the Authority’s Code of Professionalism and Conduct.
  4. Given that the data subjects were largely teachers in positions of responsibility, where the information related to them acting in their professional capacity (often with respect to the welfare of children in their care), the Applicant believed this changed consideration of their rights to their personal information being made public.
  5. In its submissions to the Commissioner, the Authority confirmed that, when reaching its review decision, it had taken into account the relevant factors from the Applicant’s email [of 7 February 2025] to its Chief Executive.
  6. The Authority acknowledged that the Applicant had legitimate interests, including a personal interest, in the withheld personal data, but it did not agree (on an objective basis) with the weight he had attached to these, balanced against the weight he attached to the interests of third parties.

The Commissioner’s views on legitimate interests

  1. The Commissioner accepts that disclosure of the withheld information would facilitate transparency and accountability to the Applicant (and the wider public) regarding the outcomes of the two panel hearings which considered applications to cancel Fitness to Teach misconduct cases.
  2. The Commissioner recognises that teachers are professional individuals charged with not only the education, but to a certain extent on varying levels, the welfare of those children whom they are employed to teach.
  3. Given this, there is clearly a wider public interest in the public being satisfied that any allegations of teacher misconduct are handled, considered and decided upon in a fair and appropriate manner, with as much transparency as possible without breaching obligations under data protection law.  Consequently, the Commissioner accepts that the Applicant has a legitimate interest in disclosure of these personal data.

Is disclosure of the personal data necessary?

  1. Having accepted that the Applicant has a legitimate interest in the withheld personal data, the Commissioner must consider whether disclosure of those personal data is necessary to achieve the Applicant's legitimate interests.  In doing so, he must consider whether these interests might reasonably be met by any alternative means.
  2. The Commissioner has considered this carefully in light of the decision by the Supreme Court in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55.  In this case, the Supreme Court stated (at paragraph 27):

A measure which interferes with a right protected by Community law must be the least restrictive for the achievement of a legitimate aim.  Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less.

  1. "Necessary" means "reasonably" rather than "absolutely" or "strictly" necessary.  When considering whether disclosure would be necessary, public authorities should consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the requester's legitimate interests could reasonably be met by means which interfere less with the privacy of the data subject.
  2. In his application to the Commissioner, the Applicant argued that disclosure of the information was necessary to achieve his stated legitimate interest.  In his view, it was essential for the protection of the public that the conduct of teachers was subject to public scrutiny.
  3. In its submissions to the Commissioner, the Authority did not believe that the Applicant’s stated legitimate interests attracted a strong weight in terms of how they could be advanced through disclosure of the personal data requested into the public domain in perpetuity.  It considered that the Applicant’s stated aims were better achieved via its own initiatives, recent examples of which included the commissioning and subsequent publication of an independent and expert review of its Fitness to Teach process by the Professional Standards Authority, the publication of assurance information in its annual report, strategic plans and news updates available on its website.
  4. The Authority considered that disclosure of the information in perpetuity (i.e. under FOISA) could have an enduring adverse effect on the privacy rights and legitimate interests of the data subjects.  It believed that the Applicant’s stated legitimate interests could be met by those less interfering ways described above.  In the Authority’s view, there were no appropriate safeguards (for example anonymisation) that could be put in place to prevent the potential impact on the data subjects, should the information be made publicly available in perpetuity.
  5. The Authority explained that its Fitness to Teach Publication Policy (to which all registrants had access) supplemented its General Privacy Notice, and provided for the publication of the outcome of cases for a period of three months.  It stated that the aim of this was to strike a balance of being open and transparent about its processes, while ensuring it processed personal data lawfully and proportionately.  The Authority submitted that published decisions were withdrawn after three months because the purpose of informing those with an interest in the case and providing more general information had been satisfied, and making these decisions publicly available in perpetuity (which, the Authority stated, was the effect of a disclosure under FOISA), would be disproportionate.
  6. The Authority stated that the Fitness to Teach Publication Policy made clear, and explained why, decisions were published (sometimes with redaction) for three months then withdrawn.
  7. The Authority submitted that those subject to Fitness to Teach processes (in addition to other individuals providing information to a panel) understood the extent of the processing of their personal data through privacy notices assigned for each purpose, which signposted to the Fitness to Teach Publication Policy, (namely the “Privacy Notice for Registrants who are the subject of a Fitness to Teach Referral” and “Privacy Notice for Referrers and Witnesses – Fitness to Teach”).  Both of these documents, the Authority submitted, stated that the Fitness to Teach Publication Policy explained what was published in Fitness to Teach decisions and why, and cross-referred to the Fitness to Teach Publication Policy which formed part of the notice given to individuals about how their personal data was processed.
  8. The Authority further considered that disclosure would also be a disproportionate and unlawful interference with the Article 8 ECHR right of privacy of the data subjects.  It did not believe that disclosure of the information would meet a pressing social need, and would be an interference with the data subjects’ rights which, it considered, was unnecessary in a democratic society.

The Commissioner’s views on necessity of disclosure

  1. Having fully considered the submissions from both parties and the withheld information itself, the Commissioner accepts that disclosure of the personal data would assist the Applicant in understanding the decisions of the panels, and the reasons for those decisions, in the two cases in question, as previously published on the Authority’s website.  However, he does not consider it necessary for this information to be disclosed to the Applicant to fulfil his legitimate interest.
  2. Turning to the question of whether information, previously published on the Authority’s website for a stated purpose and for a limited period, can be considered to be made publicly available “in perpetuity”, the Commissioner has considered the guidance on Information in the Public Domain, published on the Information Commissioner (ICO)’s website, which states:

“Information that was in the public domain at some point in time prior to the information request does not necessarily remain there indefinitely.  Key is whether at the time of dealing with a request a hypothetical member of the general public is in a position to realistically access it in practice.”

  1. In this regard, the Commissioner notes the reasoning in Kayode v Information Commissioner and The General Medical Council [2021] UKUT 86 (AAC).  That case concerned a request for a copy of a determination about a doctor’s fitness to practice which had previously been made available on the General Medical Council (GMC)’s website.
  2. In that case, the ICO agreed that, as the requested information comprised personal data, disclosure of which would breach data protection principles, the authority in that case had correctly withheld the information, a position which was subsequently upheld by the First-tier Tribunal because the authority’s policy was that fitness to practice determinations would be deleted from publication after ten years, and this period had already passed when the information request had been made.  The First-tier Tribunal found that the information was not in the public domain “at the relevant time”.
  3. As set out at paragraph 10 of Kayode, the First-tier Tribunal had concluded that the relevant time for deciding whether the requested information was in the public domain, was at the date of the authority’s response to the information request:

“Further, the relevant time for deciding whether the requested information was already in the public domain was the date of the GMC’s response to the FOIA request as that was the moment when the requester’s appeal rights crystallised, and the requested information was not in the public domain at that time.  Moreover, the relevant time for considering the data subject’s reasonable expectations was also the date of the GMC’s final response to the information request.”

  1. Further, at paragraph 27 of Kayode, the First-tier Tribunal found that, as the information was not obviously available in the public domain at the relevant time, the data subject in that case would have reasonably expected that the requested information would not be disclosed at that time:

            “… the First-tier Tribunal found as a fact that the information was not obviously in the public domain at the relevant time and because of this the doctor concerned would “at that time” have had a reasonable expectation that the requested information would not be disclosed.”

  1. The applicant in that case challenged the First-tier Tribunal’s findings on the basis that the doctor could have no reasonable expectation to privacy on the matter, given the information was previously available in the public domain. However, the Upper Tribunal endorsed the First-tier Tribunal’s findings.
  2. While the Commissioner is not bound by a determination of the Upper Tribunal, he is of the view that it can be persuasive when he is required to reach a decision on a case.  In this case, in the context of FOISA, he can see no reason why the reasoning in Kayode should not apply.
  3. With that in mind, the Commissioner considers the fact that the information has previously been published or disseminated, including in response to an information request, is irrelevant (see paragraph 27 of Kayode).  What is relevant is whether, at the time of the dealing with this request for information, the information was still publicly available and, if so, whether it was realistically accessible in practice.
  4. While it is a matter of fact that the information under consideration here was previously published on the Authority’s website, for a stated purpose and for a limited period (which had passed by the time the Applicant submitted his information request and the information had been withdrawn from the Authority’s website), the Commissioner cannot be satisfied that, at the time the request was dealt with by the Authority, the information was still “obviously” publicly available and, if so, whether it was realistically accessible in practice at that time.
  5. With regard to the less intrusive measures put forward by the Authority as being more appropriate to meeting the Applicant’s legitimate interests, having researched the information present in those documents, the Commissioner notes that these provided assurance in relation to ongoing work in relation to governance of the Fitness to Teach process and the review of current Fitness to Teach rules and process, to ensure it complied with legislation and best practice, and was as efficient as possible while satisfying the public interest and ensuring fairness.  In the Commissioner’s view, this goes a reasonable way to satisfying the legitimate interest in ensuring and achieving improvement and accountability in the Fitness to Teach process going forward.
  6. For the two cases referred to in his information request, the Commissioner notes that the Applicant was already aware of the existence of these two cases; these had been published on the Authority’s website at some point. However, the Commissioner does not consider that the disclosure of the information requested for those two cases would shed any light on whether there were any further similar cases, and whether these had been dealt with in an appropriate manner.
  7. Having fully considered all of the above, the Commissioner does not consider it necessary for the Applicant to have access to the withheld personal data.  He therefore does not consider disclosure of the information, which he is satisfied constitutes third  party personal data, is necessary in this case.
  8. In all the circumstances, therefore, the Commissioner finds that condition (f) in Article 6(1) of the UK GDPR cannot be met and disclosure of the information would therefore be unlawful.
  9. Given that the Commissioner has concluded that the processing of the personal data would be unlawful, he is not required to go on to consider whether disclosure of the personal data would otherwise be fair and transparent.
  10. The Commissioner is satisfied, in the absence of a condition in Article 6(1) of the UK GDPR which would allow the data to be disclosed, that disclosure would be unlawful.  He finds that the personal data is therefore exempt from disclosure (and properly withheld) under section 38(1)(b) of FOISA.

Section 37(1)(a) – Court records, etc.

  1. Under section 37(1) of FOISA, information is exempt from disclosure if it is contained in a document:
  • lodged with, or otherwise placed in the custody of, a court for the purposes of proceedings in a cause or matter (section 37(1)(a)(i)); or
  • served on, or by, a Scottish public authority for the purposes of such proceedings (section 37(1)(a)(ii)); or
  • created by a court or member of its administrative staff for the purposes of, or in the course of, such proceedings (section 37(1)(a)(iii)),

and provided the authority holds the information solely because it is contained in such a document.

  1. Section 37(2) defines “court” as including “a tribunal or body exercising the judicial power of the state”.
  2. This exemption is not subject to the public interest test in section 2(1)(b) of FOISA.  This means that the Commissioner is not required to (and, indeed, cannot) go on to consider whether the public interest in disclosing the information is outweighed by that in maintaining the exemption.  So, provided the information falls into one of the categories listed in section 37(1), it will be exempt from disclosure.
  3. In its submissions to the Commissioner, the Authority stated that it also now wished to rely on (variously) the sub-sections in section 37(1)(a) to withhold all of the in-scope information.  Noting that “court”/”tribunal” was not exhaustively defined in FOISA, it submitted that, in Fitness to Teach cases, it acted as a tribunal within the meaning of section 37.
  4. For some of the information, the Authority submitted, this was lodged with, placed in the custody of, or served upon the Fitness to Teach Panel as a tribunal, for the purposes of proceedings.  For other of the requested information, this was created by a tribunal or a member of administrative staff for the purposes of, or in the course of, Fitness to Teach Panel proceedings.
  5. The Authority believed that disclosure of information in court or tribunal documents, which may contain confidential information or have special restrictions upon use, should be regulated by the procedures and policies of the court or tribunal in question, rather than by the general FOI regime.
  6. Having already found that the Authority was entitled to withhold the information requested under section 38(1)(b) of FOISA, there is no requirement for the Commissioner to go on to consider the Authority’s reliance on section 37(1)(a).
  7. However, the Commissioner considers it is important to give some consideration to the Authority’s decision to now also rely on section 37(1)(a) of FOISA, with regard to its stated position that it acted as a tribunal within the meaning of section 37.
  8. The Commissioner notes that, in the Decision Kanter-Webber v ICO [2025] UKUT 171 (AAC), the Upper Tribunal found that a police misconduct panel was not a court within the meaning of section 32(4)(a) of the Freedom of Information Act 2000 (FOIA).  (Section 32(4)(a) of FOIA is the equivalent of section 37 of FOISA).
  9. In that case, the Upper  Tribunal found inter alia that, following a holistic assessment:
    • a police misconduct panel exercised a disciplinary function regarding conduct matters, on behalf of a chief officer (paragraph 176);
    • it had to act judicially, in the sense that it had to act fairly to all parties and apply an impartial and independent mind to the tasks it had to carry out (paragraph 177), and
    • the powers and procedures of police misconduct panels had been adjusted over time to restore to chief officers of police forces the ability to decide who is dismissed.  The justification for this being that the chief officer who must account for the standard and conduct of the officers under their direction and control should not be held to account for them without being able to determine who to recruit and who to dismiss (paragraph 178).
  10. Based on the holistic assessment set out in full in paragraphs 176-178 of the Upper Tribunal’s decision, it was satisfied that, while a police misconduct panel acted in the public interest and had to act judicially in doing so, it did not exercise the judicial power of the state, and therefore did not satisfy the definition of a “court” for the purpose of section 32(4)(a) of FOIA (paragraph 179).
  11. With regard to the circumstances of the case under consideration here, the Commissioner considers that the reasoning in Kanter-Webber, relating to the finding that a police misconduct panel was not a court within the meaning of section 32(4)(a) of FOIA, is highly relevant to the consideration of whether the Authority’s Fitness to Teach Panel was a tribunal within the meaning of section 37 of FOISA, as claimed by the Authority in its submissions to him.  In the Commissioner’s view, in this case, and for reasons similar to those set out in Kanter-Webber, the Authority’s Fitness to Teach Panel could not be considered as a “tribunal” for the purposes of section 37 of FOISA, and so he would have been unable to uphold the Authority’s reliance on that exemption, were he required to do so.

Handling of the request for review – timescale for compliance

  1. In his application to the Commissioner, the Applicant was dissatisfied with the failure of the Authority to comply with the statutory timescale in section 21(1) of FOISA for responding to his requirement for review.
  2. As set out in the Scottish Ministers’ Code of Practice on the Discharge of Functions by Scottish Public Authorities under FOISA and the Environmental Information (Scotland) Regulations 2004 (the EIRs) (the “Section 60 Code”), section 21(1) of FOISA requires all public authorities to respond “promptly” to a requirement for review (and, in any case, within a statutory 20 working day timescale).
  3. Section 21(1) of FOISA gives Scottish public authorities a maximum of 20 working days following the date of receipt of the requirement to comply with a requirement for review.  This is subject to qualifications which are not relevant in this case.
  4. The provision in section 21(1) makes it clear that the 20 working day period is a long-stop and that the overriding requirement is to respond promptly.
  5. In its submissions to the Commissioner, the Authority expressed regret that the review response was issued late, but it believed that the Applicant’s annoyance with that minor delay was disproportionate to the impact of the delay upon him.  In the Authority’s view, it was better to ensure that all of the Applicant’s legitimate interests were carefully considered, rather than rushing to issue a decision on the twentieth working day.
  6. The Authority further submitted that it endeavoured to respond promptly and within 20 working days.  It stated that, at the time of preparing the review response in this case, it was involved in multiple appeals with the Commissioner’s office, in addition to handling information requests, requests for reviews and Subject Access Requests.  It explained that it had since recruited additional Information Governance resource, was consistently issuing timeous responses, and remained committed to doing so.
  7. While the Commissioner understands that authorities have competing priorities and deadlines to satisfy, he notes that there is no latitude in FOISA allowing authorities to take more than the 20 working days provided for by section 21(1) to respond to a request for a review, regardless of circumstances.
  8. It is a matter of fact that the Authority did not provide a response to the Applicant’s requirement for review, received on 9 January 2025, within 20 working days.  The Commissioner therefore finds that the Authority failed to comply with section 21(1) of FOISA in this respect.

Decision

The Commissioner finds that the Authority partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.

The Commissioner finds that, by withholding the information requested under the exemption in section 38(1)(b) of FOISA, the Authority complied with Part 1 of FOISA.

However, the Commissioner also finds that the Authority failed to comply with Part 1 of FOISA, by failing to respond to the Applicant’s requirement for review within the statutory timescale, and in that respect it failed to comply with section 21(1) of FOISA.

For the reasons set out in this Decision Notice, the Commissioner does not require the Authority to take any action in respect of this failure, in response to the Applicant’s application.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

 

 

David Hamilton

Scottish Information Commissioner

 

26 March 2026

  1. ^

  2. ^

  3. ^

  4. ^

  5. ^

  6. ^

  7. ^

  8. ^

  9. ^

  10. ^

  11. ^

  12. ^

  13. ^