Decision 096/2026: Photography procedures – failure to respond
Authority: Greater Glasgow and Clyde Health Board
Case Ref: 202600194
Summary
The Applicant asked the Authority for information about procedures relating to the deletion of photographs. This decision finds that the Authority failed to respond to the request and requirement for review within the timescales allowed by the Freedom of Information (Scotland) Act 2002 (FOISA).
Background
- The Applicant made an information request to the Authority on 1 November 2025.
- The Authority did not respond to the information request.
- On 5 December 2025, the Applicant wrote to the Authority in respect of its failure to respond.
- The Applicant did not receive a response to her requirement for review.
- The Applicant wrote to the Commissioner on 29 January 2026, stating that she was dissatisfied with the Authority’s failure to respond and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
- The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
Investigation
- Section 49(3)(a) of FOISA requires the Commissioner to notify public authorities of an application and to give them an opportunity to comment. The Commissioner did this on 4 February 2026.
- The Commissioner received submissions from the Authority. These submissions are considered below.
Commissioner’s analysisand findings
Validity of the request
- Section 8(1) of FOISA sets down the basic requirements for a valid request for information in terms of section 1(1). Section 8(1) specifies that a request for information for the purposes of FOISA is one which:
- is made in writing or another permanent form capable of subsequent reference,
- states the name of the applicant and an address for correspondence, and
- describes the information requested.
- The interpretation of section 8(1)(c) must be consistent with the overall aim of FOISA which is to achieve openness with a minimum of formal requirements. Accordingly, the only requirement is that the description is clear enough to allow the information to be identified and located.
- The Authority confirmed that it had received the Applicant’s correspondence of 1 November 2025 but explained that it did not consider this email to be a Freedom of Information (FOI) request.
- The Authority submitted that the email was assessed and recorded as non-FOI because it raised issues of confidentiality, consent, and the deletion of personal data which, in its view, fell within scope of the UK General Data Protection Regulation (the UK GDPR), rather than FOISA. It explained that it had therefore treated the email as a request for erasure and a data protection complaint under the UK GDPR.
- The Commissioner has carefully considered the terms of the Applicant’s request of 1 November 2025. It asked for information in relation to who (in terms of a person or entity) within the Authority had permission to delete particular photographs, and for information in respect of complaint procedures.
- The Commissioner acknowledges the Authority’s position that the request was not a valid FOI request but considers that the requirements of section 8(1) have been met in terms of clearly describing the recorded information requested and he considers that the request was therefore valid under FOISA. (He also considers that the request was made in writing and that it stated the name of the Applicant and an address for correspondence and that it therefore met the other validity requirements.)
- Section 10(1) of FOISA gives Scottish public authorities a maximum of 20 working days following the date of receipt of the request to comply with a request for information. This is subject to qualifications which are not relevant in this case.
- It is a matter of fact that the Authority did not provide a response to the Applicant’s request for information within 20 working days, so the Commissioner finds that it failed to comply with section 10(1) of FOISA.
- Section 21(1) of FOISA gives Scottish public authorities a maximum of 20 working days following the date of receipt of the requirement to comply with a requirement for review. Again, this is subject to qualifications which are not relevant in this case.
- It is a matter of fact that the Authority did not provide a response to the Applicant’s requirement for review within 20 working days, so the Commissioner finds that it failed to comply with section 21(1) of FOISA.
- The remainder of section 21 sets out the requirements to be followed by a Scottish public authority in carrying out a review. As no review has been carried out in this case, the Commissioner finds that the Authority failed to discharge these requirements: he now requires a review to be carried out in accordance with section 21.
- The Commissioner recommends that the Authority considers whether it would be appropriate to apologise to the Applicant for its failure to comply.
Decision
The Commissioner finds that the Authority failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in dealing with the information request made by the Applicant. In particular, the Authority failed to respond to the Applicant’s request for information and requirement for review within the timescales laid down by sections 10(1) and 21(1) of FOISA. The Commissioner requires the Authority to issue a response to the Applicant’s requirement for review, by 19 June 2026.
Appeal
Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Enforcement
If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply. The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.
Jill Walker
Deputy Head of Enforcement
5 May 2026
^
