Decision 114/2025: Meetings with Israeli Government representatives

Authority:  Scottish Ministers
Case Ref:  202401377

Summary

The Applicant asked the Authority for correspondence related to meetings with representatives of the Israeli Government.  The Authority withheld the information because it would, or would be likely to, prejudice substantially relations between the UK and Israel.

During the investigation, the Authority reconsidered its interpretation of the request and identified new information falling within scope.  It disclosed some of this newly identified information but withheld other newly identified information under various exemptions.  The Authority also changed its position in relation to the information it had originally withheld, arguing that disclosure would, or would be likely to, prejudice substantially the effective conduct of public affairs.

The Commissioner investigated and found that the Authority had failed to comply with FOISA in responding to the request. He required the Authority to carry out adequate searches and provide the Applicant with a properly considered review outcome.  The Commissioner also found that the Authority had not been entitled to withhold the information it had originally identified, and he required it to disclose this information.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1)(b) (Effect of exemptions); 32(1)(a)(i) (International relations); 30(c) (Prejudice to effective conduct of public affairs); 38(1)(b)(2A) and (5) (definitions of “data protection principles”, “data subject”, “personal data” and “processing”) and (5A) (Personal information); 47(1) and (2) (Application for decision by Commissioner).

United Kingdom General Data Protection Regulation (the UK GDPR) 5(1)(a) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness of processing).

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data).

Background

1. On 21 August 2024, the Applicant made a request for information to the Authority.  He asked for any correspondence since January 2024 relating to meetings with representatives of the Israeli embassy in the UK or meetings with other representatives of the Israeli government.
2. The Authority responded on 18 September 2024.  The Authority informed the Applicant it was withholding all of the information he had requested under section 32(1)(a) of FOISA and stated that the public interest favoured upholding the exemption.
3. On 19 September 2024, the Applicant wrote to the Authority requesting a review of its decision. The Applicant stated that he was dissatisfied with the decision because the Authority had not explained why or how publishing this correspondence could prejudice substantially relations between it and another state and he believed the public interest favoured disclosure.
4. The Authority notified the Applicant of the outcome of its review on 15 October 2024.  The Authority upheld its decision to withhold all of the information under section 32(1)(a)(i) of FOISA, and it explained in detail why it believed the exemption applied and why it considered that the public interest lay in withholding all of the information.  The Authority also notified the Applicant that some of the information was being withheld under section 38(1)(b) of FOISA because it was the personal data of third parties.
5. On 15 October 2024, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  The Applicant stated he was dissatisfied with the outcome of the Authority’s review because he disagreed that section 32(1)(a)(i) applied, and in any event, he considered there to be strong public interest in disclosure of the correspondence.

Investigation

6. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
7. On 5 November 2024, the Authority was notified in writing that the Applicant had made a valid application.  The Authority was asked to send the Commissioner the information withheld from the Applicant.  The Authority provided the information and the case was allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application and to answer specific questions.  These related to its searches for all information captured by the request and its reasons for applying the exemption.

Commissioner’s analysis and findings

9. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.

The Authority’s interpretation of the request

10. The Authority explained that its original interpretation of the request was that the Applicant was seeking correspondence exchanged between the Authority and the Israeli Embassy or other representatives of the Israeli government since January 2024, relating to any meetings between those two parties.  On reflection, the Authority acknowledged that this interpretation had been too narrow and that it should have considered the request as seeking all correspondence relating to meetings between the two parties that had taken place, regardless of who the correspondence was between.
11. As a consequence of its misinterpretation, the Authority submitted that further searches would be carried out and any in-scope information would be considered as a matter of urgency.  The Authority subsequently identified and disclosed some further information to the Applicant.
12. Given that the Authority has acknowledged that its interpretation of the request was too narrow, and that it has since disclosed information to the Applicant during the investigation, the Commissioner must find that it failed to comply with Part 1 of FOISA in responding to the Applicant’s request for information.

The Authority’s change of position during the investigation

13. In relation to the information that had originally been identified (in the narrower interpretation of the request) and withheld under section 32(1)(a)(i) of FOISA, the Authority explained that it was also withholding this information under section 30(c) of FOISA, and that it was withholding some personal data under section 38(1)(b) of FOISA.  The Authority notified the Applicant of this change in position.

Scope of the investigation

14. The Applicant subsequently wrote to the Commissioner and expressed his continued dissatisfaction with the Authority’s reliance on section 32(1)(a)(i) of FOISA.  The Applicant also challenged the Authority’s reliance on section 30(c) of FOISA (arguing that there were strong public interest arguments for disclosure) and its reliance on section 38(1)(b) of FOISA (arguing that some names have been disclosed while others have not, and challenging the specific information redacted from document 4).
15. The Authority was notified of the Applicant’s grounds of dissatisfaction, and the Commissioner will investigate the Authority’s decision to withhold information under section 30(c), 32(1)(a)(i) and 38(1)(b) of FOISA.

The withheld information

16. The information originally withheld comprised:

    • Documents 1 and 2, which contain correspondence related to a meeting which was cancelled

    • Document 4, which contains WhatsApp communications

    • Documents 5 and 5a, which contain correspondence related to the meeting which took place

The Authority explained that document 3 was actually not within scope of the request because it was correspondence from 2023.  Having considered the content of document 3, the Commissioner is satisfied that it is out of scope of the request and he will not consider it any further in this decision.

17. In the following discussion the Commissioner will consider whether the Authority was entitled to withhold documents 1, 2, 4, 5 and 5a under each of the exemptions cited.

Section 32(1)(a)(i) - Substantial prejudice to international relations

18. The Authority has relied on section 32(1)(a)(i) of FOISA to withhold the complete contents of documents 1, 2, 4, 5 and 5a.
19. Section 32(1)(a)(i) states that information is exempt information if its disclosure under FOISA would, or would be likely to, prejudice substantially relations between the United Kingdom (UK) and any other State.  ("State" is defined in section 32(3) of FOISA.
20. For the exemption in section 32(1)(a)(i) to apply, the harm caused or likely to be caused by disclosure requires to be at the level of substantial prejudice: it must be of real and demonstrable significance.  For the substantial prejudice to be "likely", the Commissioner takes the view that there must be a significant possibility that it will occur, in the near (certainly the foreseeable) future.
21. In his briefing on section 32(1) of FOISA, the Commissioner notes that "when considering the exemptions in section 32(1)(a), it is important to remember that it is the international relations or interests of the UK which must be at risk of substantial prejudice from the disclosure of the information - substantial prejudice to a component region or part of the UK would not necessarily meet the test."
22. The briefing goes on to say that, even if a negative reaction is anticipated from the disclosure of the information, an assessment will have to be made as to whether this reaction would, or would be likely to, prejudice substantially international relations. There may be circumstances where the disclosure of information may cause diplomatic annoyance or irritation, but would not necessarily result in serious prejudice to relations.

The Authority's comments on section 32(1)(a)(i)

23. The Authority submitted that the withheld correspondence concerned arrangements for a meeting that covered a range of devolved interests (community relations, trade, climate change, diaspora) as well as being an opportunity to present Scotland’s position on the crisis in the Middle East, and that these arrangements were discussed with the full knowledge of the UK government.  As foreign relations are reserved to the UK Government, the Authority considered that UK interests were as directly involved as any Scottish interests, and it considered UK and Scottish interests to be inextricably linked in these matters.
24. The Authority sought comments from the UK government and Israeli embassy in relation to the specific information being withheld and provided evidence of this to the Commissioner.
25. The Authority submitted that the effective conduct of international relations was dependent upon maintaining trust and confidence between the UK Government and other states.  It argued that, in this case, the correspondence took place on the understanding that it was in confidence.  
    The Authority argued that it has been Israel’s position for a number of years, that diplomatic communications were confidential and disclosure of such communications would substantially prejudice UK relations with the Government of Israel.  
26. If the Authority did not respect this confidence, it was the Authority’s view that Israeli relations with the UK Government (directly, and through the devolved governments), would adversely impact “fruitful dialogue” with the UK overall, which would substantially prejudice UK interests.  The Authority submitted that its view was confirmed by the UK Government who had commented that releasing the correspondence, against the wishes of the state of Israel, is “highly likely” to result in a negative response from the state of Israel which would substantially prejudice relations.
27. The Authority argued that the substantial prejudice could take a number of forms because Israel had a multifaceted relationship with the UK which included trade, investment, security, culture and education.  It noted that, given the devolved settlement, Israel discussed these issues directly with devolved governments, such as the Authority, on confidential terms, and limiting its ability to do this would, by its very nature, prejudice UK relations.  This is because, in its correspondence with Israel, the UK would expect the Authority to fulfil international obligations such as those related to security or trade partnerships.
28. The Authority submitted that the UK needed to engage, at a sovereign level, on Israel’s international and domestic affairs, seeking resolution to the Middle East crisis, and that it did so on terms that Israel requested.  The Authority argued that given Israel’s involvement in conflict (as widely reported in the media) with multiple states in the Middle East, with highly sensitive negotiations on peace and arms trade ongoing, and an International Criminal Court ruling which may compel the UK to arrest the President of Israel should he visit the UK, these matters and the relationship between the UK and Israel were extremely delicate.  The Authority submitted that prejudicing the exchange of views between Israel and the UK had strong potential to have a substantial impact beyond the borders of the UK and would limit the ability to engage on complex issues.
29. The Authority referred to comments received from the UK government stating that disclosure was highly likely to result in a negative response from Israel, and it noted that the Israeli Foreign Minister had closed a diplomatic mission in Dublin in late December 2024, which was a highly unusual occurrence.
30. The Authority submitted that disclosure of the information would receive widespread media attention which would, in turn, lead other foreign governments to reconsider their own relationships with the Authority, if they believed that there was a strong likelihood of information being disclosed that they would reasonably have expected to be confidential.  It argued that this could create an immediate concern that information historically shared with it, in confidence, might be released to the public domain, undermining and damaging relationships and decision-making which relies on those confidential relationships.  As such, the Authority submitted that there would be far-reaching consequences for the ability of the Authority and the UK to maintain and build relationships, which would indirectly impact on critical aspects of engagement including trade, investment and education.
31. The Authority explained that whilst international relations were reserved, in terms of the Scotland Act 1998, there was an exemption to that reservation insofar as observing and implementing international obligations was not reserved.  The international obligations being observed here would be the Vienna Convention (1961) which specifies, under Article 41 that states should “respect the confidentiality of diplomatic communications”.  
    The Authority submitted that it was mindful that were it not to observe international obligations then it would be open to the government of the UK to compel it to do so, in terms of section 58 of the Scotland Act 1998.  The Authority submitted that, given Israel has asked the Authority to “respect confidentiality of diplomatic communications” ignoring this, may leave the Authority open to said action, and the UK may feel pressure to take such action.
32. The Authority stated that it had to be mindful of the need to treat Israel as it would “any other democratic nation”, in line with the International Holocaust Remembrance Alliance (IHRA) definition of Antisemitism which the Authority formally adopted in June 2017.  The Authority argued that ignoring Israel’s wishes in circumstances where other countries’ wishes have been respected, could be considered as an antisemitic action under the IHRA definition.

The Applicant's comments on section 32(1)(a)(i)

33. The Applicant did not consider that the exemption applied.  He noted that he had made a request to the Welsh Government for its correspondence with the Israeli government on a separate matter, and this was disclosed with only minor redactions.  The Applicant argued it was inconceivable that none of the Welsh Government’s entire correspondence with these parties would prejudice relations between the UK and the state of Israel, but all of the Authority’s correspondence purely relating to meetings with representatives of that embassy and state would prejudice such relations.

The Commissioner's view on section 32(1)(a)(i)

34. The Commissioner has considered the submissions of both parties, and the withheld information. The Commissioner notes that the contents of documents 1, 2, 4, 5 and 5a (the withheld information) are almost entirely logistical and comprise of discussions between officials making arrangements for a meeting between representatives of the Israeli government and the Authority.
35. The Commissioner acknowledges that the Israeli Embassy did not give consent for the information to be disclosed, and that it took the view that official meetings and diplomatic communications between governments were confidential unless otherwise agreed by the parties.  The Commissioner notes, however, that the Israeli Embassy officials appear to have made these comments in relation to a completely different information request that was made to the Authority; a request which was much wider in scope than that made by the Applicant, and that further consultation was made in very general terms on “minutes, briefing, agenda, and communications” between the parties.  The consultation was not specific to the exact information under consideration here.
36. The Commissioner has also considered the submissions the Authority obtained from the UK Government. The submissions from the UK Government were predicated on the comments received from the Israeli Embassy and advised that the exemption was being used to withhold “the content of emails from the Israeli embassy in London, WhatsApp communications and also minutes of a meeting between the governments”.  It is not clear that the UK Government was provided with copies of the information being withheld in this case, before providing its submissions.  Indeed, there are no minutes in the withheld information, therefore the Commissioner has no confidence that the submissions obtained from the UK Government and the Israeli Embassy actually relate to the information that has been identified in relation to the Applicant’s request.
37. The Authority’s arguments are based on its view, and that of the Israeli Embassy and UK Government, that the correspondence under consideration took place on a confidential and diplomatic basis.  Given the nature of the correspondence, the Commissioner is struggling to comprehend these views. He is not persuaded that the content of the withheld information has been properly considered by the Authority, or by the Israeli Embassy and UK government officials.
38. The Commissioner has considered the disclosure of information from the Welsh Government, in response to a similar request that had been made to the Welsh Government by the Applicant.  He notes that the disclosed information differs from that under his consideration in this case and is not related to meetings (the Welsh Government stated that it held no information related to meetings during the time period specified). Nonetheless, the content of the Welsh disclosure has substance; it contains a note of congratulation to the Welsh First Minister and the Welsh First Minister’s response to that which discusses various shared interests.  The Commissioner has no knowledge of whether any consultation with the Israeli Embassy was carried out prior to this disclosure by the Welsh Government, however he cannot fathom why the information withheld by the Authority should be any more sensitive or confidential than the correspondence already disclosed by the Welsh Government.
39. The Commissioner accepts that the Israeli Embassy’s reaction to disclosure could be negative, however, he cannot foresee that this reaction would, or would be likely to, prejudice substantially international relations between the UK and Israeli governments.  The fact that the meeting between the Authority and the Israeli Embassy took place, and the date that it took place, is a matter of public record and has been widely written about in the media.
40. The Commissioner does not accept that disclosure of the information being withheld in this case, would generate the substantial prejudice claimed.  For this reason, the Commissioner cannot accept that the exemption applies.  He finds that the Authority was not entitled to withhold this information under section 32(1)(a)(i) of FOISA.
41. As the Commissioner is not satisfied that the information was withheld correctly under section 32(1)(a)(i) of FOISA, he is not required to go on to consider the public interest test in section 2(1)(b) of FOISA.
42. Given that the Commissioner has found that the Authority was not entitled to withhold the information under section 32(1)(a)(i) of FOISA, he will now go on to consider the remaining exemptions.

Section 30(c) – Prejudice to effective conduct of public affairs

43. The Authority submitted that, if the Commissioner did not accept that it was entitled to withhold the information under section 32(1)(a)(i), then it wished to retrospectively withhold all of the information under section 30(c) of FOISA. It is relying on section 30(c) of FOISA to withhold the complete contents of documents 1, 2, 4, 5 and 5a.
44. Section 30(c) of FOISA exempts information if its disclosure "would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs."  The use of the word "otherwise" distinguishes the harm required from that envisaged by the exemptions in sections 30(a) and (b).  This is a broad exemption and the Commissioner expects any public authority citing it to show what specific harm would (or would be likely to) be caused to the conduct of public affairs by disclosure of the information, and how that harm would be expected to follow from disclosure.  This exemption is subject to the public interest test in section 2(1)(b) of FOISA.
45. In order for the exemption in section 30(c) to apply, the prejudice caused by disclosure must be substantial and therefore of real and demonstrable significance.  The Commissioner expects authorities to demonstrate a real risk or likelihood of substantial prejudice at some time in the near (certainly foreseeable) future, not simply that such prejudice is a remote or hypothetical possibility.  Each request should be considered on a case-by-case basis, taking into consideration the content of the information and all other relevant circumstances.

The Authority’s comments on the section 30(c)

46. The Authority submitted that the exemption applied to the information because disclosure would be likely to inhibit future candid and robust discussions between the Authority and the Israeli government in matters of devolved policy.
47. The Authority argued that the effective conduct of public affairs was dependent on it maintaining the trust and confidence of other states, governments and international actors.  It submitted that, in this case, the correspondence was shared with the Authority on the explicit understanding that it would be treated as being in confidence.  Given the clear steer from Israel that diplomatic communications are made in confidential terms, the Authority submitted it was its strong view that disclosure of these communications would substantially prejudice its relations with the Israeli government and would have a chilling effect on any future discussion of this nature.  The Authority considered that it was important to protect the integrity and confidentiality of sensitive exchanges as this was critical for maintaining the Authority’s capacity to be trusted by its interlocutors and thus protect and promote Scottish interests internationally.
48. The Authority noted that, prior to the meeting, Scotland and Israel had an existing relationship on various fronts such as culture, trade and education.  The Authority submitted that disclosure of the information could have a fundamental and long-lasting impact on these links because Israel and other countries would be much more reluctant to engage, and the Authority argued that this would be likely to have a wide, negative impact on its standing internationally.
49. The Authority submitted that concern over the effect of releasing this information could lead officials to understate or set aside legitimate and important concerns about the matters under discussion which in turn would impact on the overall effectiveness of diplomatic engagements.
50. The Authority submitted that disclosure in this case, which would receive widespread media attention, would lead other foreign governments, particularly those who resist transparency, to consider the nature and substance of their contact with the Authority if they believed it likely that information they would reasonably expect to be exchanged on a confidential basis would subsequently be disclosed to the public domain.  The Authority argued that disclosure would also create immediate concerns that information historically shared in confidence with it could now be released and a range of decisions supporting confidentiality would be undermined which would create significant diplomatic pressure for Scotland, damaging relationships and trust.  The Authority submitted that this would have far-reaching implications and would indirectly impact on critical aspects of engagement including trade, investment and education.
51. The Authority repeated the arguments it made previously, in paragraphs 31 and 32 in relation to its obligations under the Vienna Convention (1961) and in relation to the IHRA definition of Antisemitism.

The Applicant’s comments on section 30(c)

52. The Applicant submitted that he could not understand why section 30(c) of FOISA had now been applied when it was not considered relevant by the Authority previously.  He considered that, in applying this exemption, the Authority was attempting to obstruct and / or delay the disclosure of important information that should be accessible to the public.
53. The Applicant disagreed with the Authority’s reasons for applying the exemption and considered those reasons to be “nonsensical”.  He submitted that the Authority had stated that it did not intend to hold any meetings with the Israeli Embassy for the foreseeable future and so he could not understand why there would be substantial prejudice to future relations.

The Commissioner’s view on section 30(c)

54. The Commissioner’s briefing on section 30[1] sets out the factors which must be considered by authorities when seeking to apply section 30(c) of FOISA.  These factors are the sensitivity of the information and the passage of time.
55. The Commissioner has considered the sensitivity of the withheld information.  As he has previously stated, the withheld information is mostly concerning the logistical arrangements for a meeting between the Israeli Embassy and the Authority; a meeting due to take place in June 2024 which was cancelled, and the re-arranged meeting that took place on 9 August 2024. It is the Commissioner’s view that the majority of information withheld by the Authority has no inherent sensitivity, particularly as, at the time of the Applicant’s request, the meeting had taken place and both parties had published communications which confirmed that the meeting had taken place.
56. The Authority argued that the correspondence was shared with the Authority on the explicit understanding that it would be treated as being in confidence.  The Commissioner finds this position difficult to understand.  The withheld information does not relate to substantive correspondence or free and frank exchanges of views.  Whilst he can accept that correspondence about meeting arrangements could be sensitive or confidential prior to the meeting taking place, he cannot accept that is the case here, based on the withheld information that he has seen.
57. There is, however, information relating to two email addresses contained within the withheld information which the Commissioner can accept is exempt information under section 30(c) of FOISA.  The Commissioner is satisfied that these two email addresses are not currently in the public domain and are operational email addresses.  He considers that disclosure of these emails could result in them being used by the public, or others, to raise issues with the Israeli Embassy, rather than using the recognised and published routes set up for that particular purpose.  If this occurred, it would significantly undermine the trust that third party organisations have in the Authority’s ability to protect sensitive and operational information.
58. In all the circumstances, the Commissioner is not satisfied that disclosure of the vast majority of the withheld information (other than the two email addresses) would prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.  He finds that the Authority was not entitled to withhold most of this information under section 30(c) of FOISA.
59. Subject to the Commissioners conclusions on the remaining exemption (relating to personal data), the Commissioner requires the Authority to disclose the information it is withholding (other than the information relating to two email addresses) under section 30(c) and 32(1)(a)(i) of FOISA.
60. Having concluded that information relating to two email addresses is exempt from disclosure under section 30(c), the Commissioner must go on to consider the application of the public interest test in section 2(1)(b) of FOISA in relation to this information. The information can only be withheld if the public interest in maintaining the exemption outweighs the public interest in its disclosure. 

The public interest test – section 30(c)

61. The “public interest” is not defined in FOISA but has been described as “something which is of serious concern and benefit to the public”, not merely something of individual interest.  The public interest does not mean “of interest to the public” but “in the interest of the public”, i.e. disclosure must serve the interests of the public.

The Authority’s submissions on the public interest

62. The Authority acknowledged the public interest in its communications with other states and recognised the public interest in disclosure as part of open, transparent and accountable government.  It further acknowledged the heightened public interest in these matters because of the ongoing crisis in the Middle East.
63. However, the Authority submitted there was a greater public interest in withholding the information to ensure the maintenance of good relations with other states and in order to protect and promote Scottish interests abroad.
64. The Authority argued that there was no public interest in jeopardising those relations by disclosing confidential information (such as email addresses).
65. The Authority submitted that the public interest lay in maintaining good relations, based on trust and respect and that inappropriate disclosure was likely to damage other states’ confidence and trust in Scotland, thus undermining future discussions and international relations more generally.  It concluded that there was no public interest in releasing information which would damage Scotland’s interests.

The Applicant’s submissions on the public interest

66. The Applicant disagreed that disclosure of the withheld information would undermine trust in the Authority or would substantially inhibit future communications.
67. The Applicant submitted that any material which did truly prejudice relations could be dealt with via the usual redactions.

The Commissioner’s view on the public interest

68. The Commissioner has considered the submissions from both parties.  As stated earlier, the public interest should be considered in the context of FOISA as “something which is of serious concern and benefit to the public”.
69. It is clear that the information related to email addresses is a necessary part of the communications under consideration because it is the means by which the substantive information is conveyed.  The Commissioner recognises that this information was provided to the Authority by the Israeli Embassy as a method of contact.
    The Commissioner does not consider disclosure of operational email addresses would enlighten the public as to the nature of any discussions between the Authority and Israel in relation to the subject of the request.
70. Furthermore, the Commissioner can see no public interest in disclosure of information which would negatively impact the ability of the Authority and any third party from being able to effectively discharge their functions under internal or external processes and which carries a significant and real risk of harming trust in the Authority.
71. Having carefully considered the circumstances and the specific information being withheld; the Commissioner is satisfied that the public interest in withholding the information outweighs that in disclosing it.  The Commissioner therefore concludes that the Authority was entitled to withhold the information related to two email addresses under section 30(c) of FOISA.

Section 38(1)(b) – personal information

72. During the investigation, the Authority retrospectively applied section 38(1)(b) to the personal data of third parties contained within the withheld information.
73. The Authority withheld information under section 38(1)(b) in documents 1, 2, 4 and 5.  The Commissioner notes that the Authority has not indicated its intention to withhold information under section 38(1)(b) in relation to the attachment to document 5 (document 5a).
74. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is “personal data” (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or (where relevant) in the DPA 2018.
75. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption.  This means that it is not subject to the public interest test in section 2(1)(b) of FOISA.
76. To rely on this exemption, the Authority must show that the withheld information is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles found in Article 5(1) of the UK GDPR.
77. The Commissioner must decide whether the Authority was correct to withhold some of the information covered by the Applicant’s request under section 38(1)(b) of FOISA.

Is the withheld information personal data?

78. The first question the Commissioner must address is whether the specific information withheld by the Authority, and identified as personal data, is personal data for the purposes of section 3(2) of the DPA 2018.

79. Personal data” is defined in section 3(2) of the DPA 2018 as “any information relating to an identified or identifiable living individual”.  Section 3(2) of the DPA 2018 defines “identifiable living individual” as a living individual who can be identified, directly or indirectly, in particular by reference to – 

    (i)   an identifier, such as a name, an identification number, location data, or an online identifier, or

    (ii)  one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

80. The two main elements of personal data are that the information must “relate” to a living person, and that person must be identified – or identifiable – from the data, or from the data and other accessible information.
81. Information will “relate to” a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus.
82. An individual is “identified” or “identifiable” if it is possible to distinguish them from other individuals.
83. Having considered the information that the Authority is withholding under section 38(1)(b) of FOISA, the Commissioner notes that most of it comprises the names, contact details and job titles of individuals.  He accepts that all of the information withheld under this exemption is information that relates to identifiable individuals.  The Commissioner is therefore satisfied that the withheld information is the personal data of identifiable individuals and, as such, is personal data in terms of section 3(2) of the DPA 2018.

Would disclosure contravene one of the data protection principles?

84. The Authority considered the first principle in Article 5(1) of the GDPR was applicable in this case because the individuals involved are junior members of staff and would not expect their personal data to be processed in this way.
85. Article 5(1)(a) of the UK GDPR requires personal data to be processed “lawfully, fairly and in a transparent manner in relation to the data subject.”
86. "Processing" of personal data is defined in section 3(4) of the DPA 2018. It includes (section 3(4)(d)) disclosure by transmission, dissemination or otherwise making available personal data. The definition therefore covers disclosing information into the public domain in response to a FOISA request.
87. The Commissioner must consider whether disclosure of the personal data would be lawful.  In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed.
88. The Commissioner considers condition (f) in Article 6(1) is the only condition which could potentially apply in the circumstances of this case.

Article 6(1)(f) of the UK GDPR - legitimate interests

89. Condition (f) states that processing shall be lawful if it –

    “…is necessary for the purposes of legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data...”

90. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.

91. The three tests which must be met before Article 6(1)(f) can be relied on are as follows (see paragraph 18 of South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55[2] - although this case was decided before the GDPR (and the UK GDPR) came into effect, the relevant tests are almost identical).

    i)    does the Applicant have a legitimate interest in the personal data?

    ii)   if so, would the disclosure of the personal data be necessary to achieve that legitimate interest?

    iii)  even if the processing would be necessary to achieve the legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects which require protection of personal data (in particular where the data subject is a child)?

Does the Applicant have a legitimate interest in obtaining the personal data?

92. The Authority submitted that it was unaware of any legitimate interest the Applicant might have in the personal data or that the identifying the individuals would help in his understanding of the withheld information.  The Authority submitted that it had a general approach of disclosing information about senior members of staff, those holding senior civil service roles and officials with relatively senior roles who are public facing; but that it would generally withhold those details for junior members of staff.
93. The Applicant asked that the Commissioner applied particular scrutiny to the withholding of personal data in document 4 (the WhatsApp correspondence).  It was the Applicant’s view that there was a strong case for disclosing this information on public interest grounds and that the public had a right to know with which organisation a member of the International Relations team was communicating.
94. The Commissioner is willing to accept the Applicant’s argument that there is a legitimate interest in the detail of the meeting arrangements and in knowing who was making those arrangements.

Is disclosure of the personal data necessary?

95. Having satisfied himself that the Applicant has a legitimate interest, the Commissioner must consider whether disclosure of the withheld information, the personal data, is necessary to achieve the legitimate interest in the information.  Necessary” means “reasonably” rather than “absolutely” or “strictly” necessary.  When considering whether disclosure would be necessary, public authorities must consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the Applicant’s legitimate interests could reasonably be met by means which interfered less with the privacy of the data subject(s).
96. The Applicant argued that it was in the interests of the general public to know which organisations were involved in the correspondence.
97. The Authority argued that any legitimate interest the Applicant did have in disclosure of the information would be outweighed by the rights and freedoms of the data subjects because those data subjects were not senior employees and did not have a public profile.
98. The Commissioner has considered the withheld personal data and the comments from both parties, carefully.  The Commissioner agrees to some extent with the Authority that, in the main, these individuals are not senior officials and would have no expectation that their personal data would be disclosed in response to the Applicant’s information request.  However, it is clear that some individuals whose personal data is being withheld are more senior and/or do have a public facing role or online presence.
99. In relation to the personal data of these particular individuals, the Commissioner finds that the Authority was not entitled to apply section 38(1)(b) of FOISA in withholding.
100. The Commissioner is, however, satisfied that condition (f) in Article 6(1) of the UK GDPR could not be met in relation to the personal data of the junior officials and, as such, this information was correctly withheld under section 38(1)(b) of FOISA.  He requires the Authority to disclose this information.
101. The Commissioner will provide the Authority with a marked up copy of the information to be disclosed.

Has the Authority identified all the information it held?

102. The Authority provided the Commissioner with a record of the searches it had originally carried out in identifying the five documents that it withheld in relation to the Applicant’s request.  Four of the five documents originally identified (and found to be in scope) were held in the mailboxes of two members of staff (documents 1, 2, 5 and 5a).
103. The search record shows that searches of the Authority’s electronic records management system (eRDM) were carried out using the search terms “gov.il” and “Israel Embassy”. The WhatsApp correspondence (document 4) was identified in this search.  Although there were 319 search returns in total, the Authority that submitted that, apart from document 4, there were no other results in scope of the request.  A file titled “Israel Crisis Response” was also searched and, again, the Authority stated that it contained no correspondence in scope of the request.
104. The Authority did not provide the Commissioner with details of the additional searches it had carried out during the investigation in relation to its wider interpretation of the request.  Therefore, the Commissioner has no understanding of how these additional searches were carried out, what was searched or who carried out the searches.
105. The Commissioner has significant concerns about the Authority’s searches for the following reasons.  He has no confidence that the Authority has carried out appropriate and reasonable searches to identify all the information it holds that fall within scope of the Applicant’s request. The unconventional approach taken by the Authority with its mistaken belief it can issue multiple revisions of reviews has resulted in a confusing and contradictory position that is unacceptable to the Commissioner.
106. Consequently, the Commissioner requires the Authority to reconsider the Applicant’s request and issue him with a revised review outcome.

107. The Authority should ensure, when providing this new review outcome, that it carries out thorough and proportionate searches for all of the information captured by the information request, and that records of these searches are retained.

Decision 

The Commissioner finds that the Authority failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.

The Authority failed to comply with Part 1 of FOISA by failing to identify, locate, retrieve and properly consider all of the information that fell within scope of the request and incorrectly withheld information under sections 32(1)(a)(i) and 30(c) of FOISA. The Authority also incorrectly withheld some information incorrectly under section 38(1)(b) of FOISA although other information was withheld correctly under this exemption.

The Commissioner therefore requires the Authority to

• disclose the information that was incorrectly withheld to the Applicant,

• carry out through and comprehensive searches for the information falling with scope of the Applicant’s request and provide evidence to the Commissioner that the searches have been carried out to his satisfaction,

• reach a decision on the basis of those searches and notify the Applicant of the outcome (in compliance with section 21 of FOISA).  This should include all information previously disclosed to the Applicant such that he has one complete response.

                by 27 June 2025.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement 

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply.  The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

David Hamilton

Scottish Information Commissioner

13 May 2025