Decision 155/2026 | Scottish Information Commissioner

Home Decisions

Decision 155/2026

Decision 155/2026: Special Management Committee meetings

Authority: Govan Housing Association Ltd
Case ref: 202300651

Summary

The Applicant asked the Authority for information relating to its Special Management Committee meetings. The Authority released some information but withheld other information under a number of exemptions. The Commissioner investigated and found that the Authority had wrongly withheld most of the information. He required the Authority to disclose the information requested, subject to redaction of some personal data.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); (2)(1)(b) and (e)(ii) (Effect of exemptions); 30(b)(ii) and 30(c) (Prejudice to effective conduct of public affairs); 36(1) (Confidentiality); 38(1)(b), (2A), (5) (definitions of “the data protection principles”, “data subject”, “personal data” and “processing”, “the UK GDPR”) and (5A) (Personal information); 47(1) and (2) (Application for decision by Commissioner)

United Kingdom General Data Protection Regulation (the UK GDPR) articles 4(1) (definition of “personal data”) (Definitions), 5(1)(a) (Principles relating to processing of personal data) and 6(1)(f) (Lawfulness of processing).

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data).

Background

On 9 February 2023, the Applicant made a request for information to the Authority. He asked for the dates, times, attendees, agenda items and minutes relating to all of the Authority's Special Management Committee meetings held from 2002 to 9 February 2023.
The Authority did not respond to the request.
On 12 March 2023, the Applicant wrote to the Authority to express dissatisfaction with its failure to respond within the 20-day statutory timeframe.
The Authority acknowledged receipt of the request on 13 March 2023, and it explained that the delay was due to the original request being blocked by its firewall and only recently released. It provided the Applicant with three specific email addresses to be used when making information requests in the future. The Authority acknowledged that the original request should have been responded to by 10 March 2023, but as the email was blocked by its firewall it would provide him with a response by 7 April 2023. The Authority commented that this was in line with FOISA, where it was permitted to request an extension to 40 working days total to provide a response.
On 13 March 2023, the Applicant informed the Authority that its email dated 13 March 2023 contained incorrect information, and he argued that it did not have more than 20 additional days beyond the legally prescribed timescales to respond to FOI requests. He also challenged the Authority’s claim that the email he sent on 9 February 2023 was blocked by its firewall.
The Authority responded to the Applicant’s email on 15 March 2023. It acknowledged that it was not entitled to extend the response time by an additional 20 working days and it apologised for this error. In this email the Authority also commented that he would receive the information he had requested as soon as possible, unless the information was not held or there was a reason for it to be withheld.
On 16 March 2023, the Authority issued the Applicant with a Fees Notice, charging him £5.00 for the provision of the information he had requested.
On 17 March 2023, the Applicant challenged the validity of the Fees Notice. He argued that a Fees Notice must be issued within 20 working days of the request being received, and he urged the Authority to provide him with the information he had requested.
The Authority responded to the Applicant’s information request on 6 April 2023. It sent him one response at 12:29 and a second response at 14:44. Both emails referred to his information request of 9 February and stated that the Authority was disclosing some information to him but was withholding the names of the attendees and minutes of the special committee meetings under sections 36 and 38 of FOISA. The Authority provided the Applicant with copies of the agendas of the meetings, with personal data redacted.
On 14 April 2023, the Applicant wrote to the Authority, stating that it had provided him with two responses to his FOI request, quoting his original reference number in both emails. He noted that each of these responses disclosed very different documents, and he sought an explanation from the Authority.
On 21 April 2023, the Applicant formally asked the Authority to review its response to his information request, and he challenged the exemptions the Authority had relied on to withhold information from him.
The Authority notified the Applicant of the outcome of its review on 28 April 2023. It reiterated its reliance on sections 36 and 38 and upheld its original decision without modification.
On 25 May 2023, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Applicant stated that he was dissatisfied with the Authority’s decision not to disclose all of the information he had asked for. He was also dissatisfied with the Authority’s handling of his information request, specifically its failure to comply with the timescales set out in FOISA, and its wrongly issued Fees Notice.

Investigation

The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
On 27 September 2023, in line with section 49(3)(a) of FOISA, the Commissioner gave the Authority notice in writing of the application and invited its comments.
The Authority was also asked to send the Commissioner the information withheld from the Applicant. The Authority provided the information and the case was subsequently allocated to an investigating officer.

Commissioner’s analysis and findings

The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.

The Authority’s change of position during the investigation

During the investigation, when asked to explain what part of the exemption in section 36 it was applying to the withheld information. The Authority confirmed that it had originally relied on the exemption contained in section 36(2) of FOISA. However, it submitted that it now considered section 30 was the more appropriate exemption, and it was no longer relying on section 36(2).
As the Authority has withdrawn its reliance on section 36(2) of FOISA, the Commissioner must find that it was not entitled to rely on this exemption.
In later correspondence, the Authority amended its views on the withheld information and the exemptions it was relying on, and it notified the Commissioner that it was now withholding information under section 30(b)(ii), 30(c), 33(1)(b) and 38(1)(b) of FOISA.
The Authority provided the Commissioner with a marked-up copy of the withheld information, indicating what information it was now willing to disclose to the Applicant.
The Commissioner asked the Authority to provide the Applicant with the information it was no longer withholding, and it disclosed this information to the Applicant on 5 March 2026.
On 5 March 2026, the Authority disclosed some agendas to the Applicant in full, without any redactions and it also disclosed information it had previously withheld under an exemption.

The Authority referred to the passage of time as a reason why it was able to disclose additional information to the Applicant. The Authority provided the Commissioner with a copy of its correspondence with the Applicant.
However, when asked for his views on the disclosed information, the Applicant maintained that he had not received any information from the Authority.
The Authority subsequently disclosed the information again to the Applicant, on 26 March 2026, and the Applicant later confirmed that he had received this information, but he remained dissatisfied with the heavily redacted documents.
The Commissioner has considered the submissions provided by the Authority, but in his view it has not clearly explained why the information was correctly withheld at the time it dealt with the request or the requirement for review. As the Authority has now disclosed information that it previously withheld from the Applicant, the Commissioner must find that the Authority was not entitled to withhold this information, and that in doing so it breached the provisions of section 1(1) of FOISA.
This rest of this decision will consider the information that the Authority is still withholding from the Applicant under sections 30(b)(ii), 30(c), 33(1)(b) and 38(1)(b) of FOISA.

Withheld information

The Authority provided the Commissioner with an updated schedule that listed 22 minutes and 22 agendas. The Authority also provided the Commissioner with copies of these documents, with the exception of the minutes for the meeting on 8 August 2017. The Authority explained that this set of minutes was password protected but no one in the Authority knew the password and so it could not access these minutes.
The Commissioner is satisfied that the Authority cannot access these minutes, and that therefore, for the purposes of FOISA, the minutes of 8 August 2017 are not held. As the Authority did not give the Applicant notice that these minutes were not held, at the time of his request or his requirement for review, the Commissioner must find that the Authority failed to comply with the provisions of section 17(1) of FOISA in this respect. The Commissioner would advise authorities that use password protection, to take steps to ensure that passwords are not lost or forgotten and that they remain capable of accessing their own information.
The Commissioner will now go on to consider the information the Authority is still withholding from the Applicant. He will not consider further any information that has since been disclosed to the Applicant (see his conclusions on this information in paragraph 26 above). The focus for the remainder of this decision will be the information that is still being withheld from 17 agendas and 21 sets of minutes under the exemptions contained in sections 30(b)(ii), 30(c), 33(1)(b) and 38(1)(b) of FOISA.

Section 38(1)(b) – Personal information

As noted above, the Authority has applied the exemption in section 38(1)(b) of FOISA to information contained in the 17 agendas and 21 sets of minutes.
Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is “personal data” (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or (where relevant) in the DPA 2018.
The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption. This means that it is not subject to the public interest test in section 2(1)(b) of FOISA.
To rely on this exemption, the Authority must show that the withheld information is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles found in Article 5(1) of the UK GDPR.
The Commissioner must decide whether the Authority was correct to withhold some of the information covered by the Applicant’s request under section 38(1)(b) of FOISA.

Is the information personal data?

The Authority stated that it had redacted information which identified an individual. The Authority later commented that it had redacted identifiable personal data, including cases where there was only one person in post, and where disclosure of the job title itself would be capable of identifying a living individual.
The two main elements of personal data are that the information must “relate” to a living person, and that person must be identified – or identifiable – from the data, or from the data and other accessible information.
Information will “relate to” a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus.
An individual is “identified” or “identifiable” if it is possible to distinguish them from other individuals.
The Commissioner has reviewed the content of all of the documents with section 38(1)(b) redactions. He firstly considered the agendas, which have limited information redacted under section 38(1)(b) of FOISA. He notes that in each agenda the Authority has withheld the individual listed under the heading “Lead Officer” on the grounds that this information would identify an individual and is therefore exempt under section 38(1)(b) of FOISA.
The Commissioner is satisfied that all of the agendas contain personal data. In particular, he finds that documents 103 and 98 both contain the name of an individual. The remaining agendas refer to specific job titles or roles, which are distinctive and clearly relate to living individuals. The Commissioner is satisfied that a living individual could be identified by disclosure of the specific job titles or roles listed under the “Lead Officer” heading in these agendas.
The Commissioner has also considered the information that has been redacted from the minutes under section 38(1)(b) of FOISA. He is satisfied that all of the minutes contain personal data as they all contain names and other information that relates to living individuals. Furthermore, the majority of the minutes are signed and a number contain biographical information about living individuals, alongside opinions and views. Given this, he finds that all sets of 21 minutes contain some level of personal data.
However, the Commissioner also considers that some of the information redacted under section 38(1)(b) is not personal data. For example, in document 11, while the Authority has correctly identified the names of those nominated or elected to office bearer roles as personal data, there is other text around those names which is not personal data and has been wrongly withheld under section 38(1)(b).
Similarly, in document 26, there is information under section 1.0 Apologies which is not personal data, and document 36 has information in paragraph 5.3 which is not personal data.
Where the Commissioner has determined that the information is not personal data he requires the Authority to disclose this information to the Applicant. The Commissioner will provide the Authority with guidance clearly indicating which information is to be disclosed.
Overall, the Commissioner is satisfied that all of the documents contain information which is the personal data of identifiable individuals and, as such, is personal data in terms of section 3(2) of the DPA 2018.

Would disclosure contravene one of the data protection principles

The Authority did not specify which of the data protection principles in Article 5(1) of the GDPR would be contravened by the disclosure of the personal data, and why. However, it did comment that it did not have consent from the data subjects and so it was unlawful for the information to be shared. It also stated that:

“To disclose information about third parties, without their consent and no other lawful basis, is a breach of UK GDPR principles and on that basis is an absolute exemption.”
Based on the above submissions, the Commissioner has understood that the Authority considers that disclosure would breach the first data protection principle in Article 5(1)(a) of the UK GDPR. Article 5(1)(a) states that personal data shall be processed “lawfully, fairly and in a transparent manner in relation to the data subject.”
"Processing" of personal data is defined in section 3(4) of the DPA 2018. It includes (section 3(4)(d)) disclosure by transmission, dissemination or otherwise making available personal data. The definition therefore covers disclosing information into the public domain in response to a FOISA request.
The Commissioner must consider whether disclosure of the personal data would be lawful. In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed.
The Commissioner considers that condition (f) in Article 6(1) is the only condition which could potentially apply in the circumstances of this case.

Article 6(1)(f) of the UK GDPR – legitimate interests

Condition (f) states that processing shall be lawful if it:

“…is necessary for the purposes of legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data...”

Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
The three tests which must be met before Article 6(1)(f) can be relied on are as follows (see paragraph 18 of South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55 - although this case was decided before the GDPR (and the UK GDPR) came into effect, the relevant tests are almost identical):
1. does the Applicant have a legitimate interest in the personal data?
2. if so, would the disclosure of the personal data be necessary to achieve that legitimate interest?
3. even if the processing would be necessary to achieve the legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects which require protection of personal data (in particular where the data subject is a child)?

Does the Applicant have a legitimate interest in obtaining the personal data?

The Authority argued that there was no condition in Article 6 which would permit it to disclose the personal data, and it did not believe that the Applicant had a legitimate interest in obtaining the personal data of third parties.
In his submissions, the Applicant clarified that he had never sought disclosure of all attendees at special management committee meetings. He stated that he understood the need to operate “restricted disclosure” to protect privacy, for example, to redact a guest name or other information that could help identify the guest. However, the Applicant argued that this did not apply to elected and Authority representatives in the public domain, who attended these special meetings.
The Applicant commented that transparency in the work of the management committee is paramount, as it enables housing authority members, shareholders and tenants to understand how the organisation is acting and performing. He claimed that reference to “special management committee meetings” had exploded since the Commissioner failed to properly sanction the Authority for its failures many years ago.
The Commissioner accepts that, in the circumstances, the Applicant does have a legitimate interest in some of the personal data (namely those of elected members and Authority representatives) contained in the minutes and agendas.
However, the Commissioner notes that some of the personal data contained in the minutes goes beyond the names of elected members and Authority representatives. He also notes that some of the minutes contain information that is significantly biographical, arguably sensitive in nature (relating to work-related performance) and also highly personal, containing opinions, views and signatures. This is in addition to the names and/or job titles of attendees that could be described as “guests”.
In relation to the type of personal data described above (in paragraph 58), the Commissioner does not consider that the Applicant has any legitimate interest in obtaining it (nor has the Applicant expressed any arguments in favour of obtaining such personal data) and he will therefore not consider it any further in this decision. He finds that this type of personal data has been correctly withheld under section 38(1)(b) of FOISA.
Having accepted that the Applicant has a legitimate interest in some of the personal data (namely the identities and participation of attendees who are elected members or Authority representatives) the Commissioner must consider whether disclosure of those personal data is necessary for the Applicant's legitimate interests. In doing so, he must consider whether these interests might be reasonably be met by any alternative means.

Is disclosure necessary to achieve that legitimate interest?

The Commissioner has considered this carefully in light of the decision by the Supreme Court in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55. In this case, the Supreme Court stated (at paragraph 27):

A measure which interferes with a right protected by Community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less.

"Necessary" means "reasonably" rather than "absolutely" or "strictly" necessary. When considering whether disclosure would be necessary, public authorities should consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the requester's legitimate interests can be met by means which interfere less with the privacy of the data subject.
The Authority was asked if disclosure was necessary to meet the Applicant’s legitimate interests, and in response it stated that “this cannot be answered”.
Having considered the arguments put forward by the Applicant and the terms of his request, the Commissioner is satisfied that the only way for the Applicant to know who attended these meetings and what their participation in the meeting was, would be for this information to be disclosed. He considers that disclosure is necessary to achieve his legitimate interests.

The data subjects’ interests or fundamental rights and freedoms

The Commissioner must balance the legitimate interests in disclosure of the information, against the data subject's interests or fundamental rights and freedoms. In doing so, it is necessary for him to consider the impact of such a disclosure.
For example, if a data subject would not reasonably expect that the information would be disclosed to the public under FOISA in response to the request, or if such disclosure would cause unjustified harm, their interests or rights are likely to override any legitimate interests in disclosure. Only if the legitimate interests of the Applicant outweigh those of the data subject could the information, be disclosed without breaching the first data protection principle.
The Commissioner's guidance on section 38 of FOISA notes factors that should be taken into account in balancing the interests of parties. He notes that Recital (47) of the General Data Protection Regulation states that much will depend on the reasonable expectations of the data subjects.

These are some of the factors public authorities should consider:
1. Does the information relate to an individual's public life (their work as a public official or employee) or to their private life (their home, family, social life or finances)?
2. Has the individual has objected to the disclosure?
3. Would the disclosure cause harm or distress?

Does the information relate to public or private life?

The Commissioner acknowledges that the withheld information relates to the public lives of individuals. He notes that the Applicant has expressed a legitimate interest in seeking the names of those who attended special management committee meetings. These meetings were not attended as part of someone’s private life but as part of their work or public role.

Has the individual objected to the disclosure?

The Authority has stated that it has not obtained consent from the data subjects. The Authority did not clarify whether the data subjects had objected to the disclosure, only that consent was not obtained.

Would disclosure cause harm of distress?

The Commissioner has also considered whether disclosure would cause any harm or distress to the data subjects. Disclosure, under FOISA, is a public disclosure. He has taken this into account when reaching his decision.
He notes that the Authority did not make any arguments or comments on this point; it has not argued that disclosure would cause harm or distress.
In any case, as the information relates to the work or public role of individuals, and as the information that would be disclosed in this case would simply be confirmation that an individual attended and participated in a meeting in their work or public role, with no more personal connotations, the Commission cannot see why disclosure of this fact would cause any distress.
In the absence of any arguments to the contrary, the Commissioner is satisfied that disclosure of the data subject’s attendance at the special committee meetings, and information about their participation in the meetings, would not cause them any harm or distress.
In the circumstances of this particular case, the Commissioner finds that condition (f) in Article 6(1) of the UK GDPR can be met in relation to the identities and participation of attendees who are elected members or Authority representatives.

Fairness

The Commissioner must also consider whether disclosure would be fair. He finds, for the same reasons as he finds that condition (f) in Article 6(1) can be met, that disclosure of the withheld information would be fair.

Conclusions on the data protection principles

In the absence of any reason for finding disclosure to be unlawful other than a breach of Article 5(1)(a) (and none has been put forward by the Authority) and given that the Commissioner is satisfied that condition (f) can be met, he must find that disclosure would be lawful in this case. The Commissioner therefore finds that disclosure of the withheld information would not breach the first data protection principle, and so the Authority was not entitled to withhold this information under the exemption in section 38(1)(b) of FOISA.
The Commissioner requires the Authority to disclose the identities of attendees of Special Management Committee Meetings where they are elected members or Authority representatives, as well as information regarding their participation in the meetings (the Commissioner will identify to the Authority the specific information to be disclosed).

Section 30(b)(ii) – free and frank exchange of views

The Authority is withholding information under section 5 of documents 91 and 96 under 30(b)(ii). The Commissioner notes that he has already found some of the information withheld under section 5 of document 96 to be exempt from disclosure under section 38(1)(b) of FOISA. Given this, in this section he will only consider the information in section 5 of document 96 that he has not already found to be exempt under section 38(1)(b) of FOISA, and which the Authority are withholding under section 30(b)(ii) of FOISA.
Section 30(b)(ii) of FOISA provides that information is exempt information if its disclosure would, or would be likely to, inhibit substantially the free and frank exchange of views for the purposes of deliberation. This is subject to the public interest test in section 2(1)(b) of FOISA. In applying the exemption in section 30(b)(ii) of FOISA, the chief consideration is not whether the information constitutes opinions or views, but whether the disclosure of that information would, or would be likely to, inhibit substantially the free and frank exchange of views. The inhibition must be substantial and therefore of real and demonstrable significance.
Each request must be considered on a case-by-case basis, taking into account the effect (or likely effect) of disclosure of that particular information on the future exchange of views.
The content of the withheld information will need to be considered, taking into account factors such as its nature, subject matter, manner of expression, and also whether the timing of disclosure would have any bearing.
As with other exemptions involving a similar test, the Commissioner expects authorities to demonstrate a real risk or likelihood that actual inhibition will occur at some time in the near (certainly the foreseeable) future, not simply a remote or hypothetical possibility.
The Authority was asked to provide its reasons for applying this exemption to the information in documents 91 and 96.

Document 91

The Authority commented that it was withholding the information under section 30(b)(ii) of FOISA “Disclosure on staffing restructure matters are not in the public interest and significantly affects the wellbeing of stuff thus prejudicing its function.”

Document 96

The Authority commented that it was withholding the information under section 30(b)(ii) of FOISA and it stated that:

“Disclosure of information at this time, since this was only three years ago is premature, and would prejudice the affairs of the organisation.”

Commissioner’s view on section 30(b)(ii)

The Commissioner considers the Authority’s comments on the exemption, in each document, to be exceptionally brief, cursory and lacking specification as to how disclosure would, or would be likely to inhibit substantially the free and frank exchange of views for the purposes of deliberation. Having reviewed the information that is being withheld in documents 91 and 96, he can see that it has some sensitivity, but it is not for him to create or assemble detailed arguments in support of a particular exemption. If an authority chooses to apply an exemption it must be prepared to provide substantial, detailed arguments to the Commissioner, explaining why that exemption applies and how any harm would manifest as a result of disclosure. The Authority has failed to do this (and it is not for the Commissioner to step in and create relevant arguments in their absence).
Given the Authority’s failure to provide coherent, persuasive and specific submissions, the Commissioner cannot uphold the application of section 30(b)(ii) of FOISA.
As he has found that the exemption in section 30(b)(ii) of FOISA does not apply, he is not required to consider the public interest test contained in section 2(1)(b) of FOISA.
The Commissioner requires the Authority to provide the Applicant with the information it is withholding under section 30(b)(ii) of FOISA.

Section 30(c) – Prejudice to effective conduct of public affairs

The Authority has applied the exemption in section 30(c) of FOISA to some of the information in section 2 of document 106.
Section 30(c) of FOISA exempts information if its disclosure “would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs”. This exemption is subject to the public interest test in section 2(1)(b) of FOISA.
The use of the word “otherwise” distinguishes the harm required from that envisaged by the exemptions in sections 30(a) and (b) of FOISA. This is a broad exemption, and the Commissioner expects any public authority citing it to show what specific harm would (or would be likely to) be caused to the conduct of public affairs by disclosure of the information, and how that harm would be expected to follow from disclosure.
The standard to be met in applying the tests contained in section 30(c) is high: the prejudice in question must be substantial and therefore of real and demonstrable significance. The Commissioner expects authorities to demonstrate a real risk or likelihood of substantial prejudice at some time in the near (certainly foreseeable) future, not simply that such prejudice is a remote or hypothetical possibility. Each request should be considered on a case-by-case basis, taking into consideration the content of the information and all other relevant circumstances (which may include the timing of the request).

Document 106

In its submissions, the Authority stated that:

“Disclosure of the risk register can significantly prejudice how the organisation functions, prejudice its relationship with suppliers, staff and tenants, and affect how risk is managed and mitigated. Risk registers are classed as confidential on that basis until the appropriate time has elapsed to disclose, in this case 15 years.”

Commissioner’s view on section 30(c)

As noted above, for this exemption to be upheld, an authority must demonstrate the harm that would be caused by disclosure, and it should evidence how disclosure would result in the likelihood of substantial prejudice at some time in the foreseeable future. The Authority has argued that risk registers are sensitive, and it has argued that they should be withheld for 15 years before disclosure.
While the Commissioner can see that there may be arguments to be made in favour of withholding parts of risk registers, he does not consider that the Authority has made those arguments. The Commissioner needs to be persuaded of the specific harm that would be caused by disclosure, and the impact of that harm on the effective conduct of public affairs.
As with the Authority’s comments on section 30(b)(ii), the Commissioner finds the Authority’s arguments on section 30(c) to be exceptionally brief, lacking in specification and unpersuasive. There may be arguments that can be made in favour of withholding the information in document 106, but the Authority has failed to make them. In the absence of such arguments, it is not for the Commissioner to create them.
Given the Authority’s failure to provide coherent, persuasive and specific submissions, the Commissioner cannot uphold the application of section 30(c) of FOISA.
As he has found that the exemption in section 30(c) of FOISA does not apply, he is not required to consider the public interest test contained in section 2(1)(b) of FOISA.
The Commissioner requires the Authority to provide the Applicant with the information it is withholding under section 30(c) of FOISA.

Other information withheld under section 30

In documents 51 and 71, the Authority appears to have withheld some information under section 30. It has not specified the particular subsection of section 30 it has applied, and it has not included any reference to section 30 in the schedule of documents provided to the Commissioner. In both cases, the Commissioner has presumed, from its comments that section 30(c) is being applied, but he cannot be sure that this is the case.
Given the Authority’s failure to correctly specify the exemption and provide supporting evidence in support of the exemption (the comments provided in each document are, again, brief and lacking detail) he has no choice but to find the information in paragraphs 5.1 of document 51 and paragraph 5.1.20 of document 71 has been wrongly withheld and he requires it to be disclosed to the Applicant.

Section 33(1)(b) – Commercial interests and the economy

The Authority is withholding some information in documents 71, 81 and 101 under section 33(1)(b) of FOISA.
Section 33(1)(b) of FOISA provides that information is exempt information if its disclosure would, or would be likely to, prejudice substantially the commercial interests of any person (including, without prejudice to that generality, a Scottish public authority). This exemption is subject to the public interest test in section 2(1)(b) of FOISA.
There are several elements a Scottish public authority needs to demonstrate are present when relying on this exemption. It needs to establish:
1. whose commercial interests would (or would be likely to) be harmed by disclosure
2. the nature of those commercial interests, and
3. how those interests would (or would be likely to) be prejudiced substantially by disclosure.
The prejudice must be substantial, in other words of real and demonstrable significance. Where the authority considers that the commercial interests of a third party would (or would be likely to) be harmed, it must make this clear. Generally, while the final decision on disclosure will always be one for the authority, it will assist matters if the third party has been consulted on the elements referred to above.

Document 81

The Authority commented that disclosure of the information it was withholding in document 81 would prejudice negotiations and commercial position, affecting costs and the ability to retender or borrow money in future.

Document 71

The Authority explained why it had withheld parts of this document. It commented that it had withheld the name of housing software as “knowing the housing system in use for the organisation puts it at risk technically and commercially”. It submitted that disclosure of the land cost would affect the negotiations to buy that land. The Authority stated that it had withheld other information as disclosing information on the loans, the cash in the bank and the surplus, would affect the operations of the business. Furthermore, it argued that disclosing information about work costs would also affect the operations of the business and its negotiating position.

Document 101

The Authority withheld the names of two companies who had submitted a tender. It argued that it was not in the public interest;

“…to disclose interim discussions on possible tender awards this will make new tenders more difficult to do due to trust issues over disclosure.”

Commissioner’s view on section 33(1)(b)

"Commercial interests" are not defined in FOISA, but the Commissioner’s guidance on the exemption in section 33(1)(b)[1] states that an organisation's commercial interests will usually relate to the commercial trading activity they undertake.
In order to rely on this exemption, an authority must also evidence why disclosure would, or would be likely to, substantially prejudice the commercial interests of any person (including its own commercial interests).
The Commissioner has considered previous cases where he has upheld that an authority had commercial interests in relation to tenders or contracts, or that disclosure of the price of land or property would, or would be likely to, prejudice substantially the commercial interests of an authority or a third party. However, in each case where he has upheld the exemption contained in section 33(1)(b), the authority involved has provided him with detailed, focused answers to the questions outlined in paragraph 97.
In his view, while the Authority’s submissions raise general points, they lack the necessary detail and they fail to draw a direct link between the particular information withheld in this case and the substantial prejudice which would, or would be likely to, result. Furthermore, the Authority has failed to confirm whose commercial interests would be harmed by disclosure.
Taking account of the submissions received from the Authority in relation to the actual information being withheld in this case, the Commissioner does not believe he has any option but to find that the Authority has not evidenced the required substantial prejudice for section 33(1)(b) of FOISA to be engaged.
The Commissioner would note that it is for the Authority to provide the required evidence of harm, not for him to go out and find it or make the case on behalf of the Authority. Consequently, in this case, the Commissioner is not satisfied that the information requested was properly withheld under this exemption. Having reached that conclusion, the Commissioner is not required to consider the public interest test in section 2(1)(b) of FOISA.

Section 36(1) - Confidentiality

The Authority is withholding information in documents 76 and 86 under section 36(1) of FOISA.
Section 36(1) of FOISA exempts from disclosure information in respect of which a claim to confidentiality of communications could be maintained in legal proceedings. This includes communications which are subject to legal professional privilege.

Document 86

The Authority submitted that it was withholding information in document 86 because it comprised “discussions in relation to legal advice and legal proceedings”.

Document 76

The Authority commented that it was withholding information in document 76 because some of the information comprised “discussions in relation to legal advice and legal proceedings”, and other information was “legal actions in relation to information provided from solicitors”.

Commissioner’s view on section 36(1) of FOISA

The Commissioner’s briefing on section 36(1) of FOISA explains that legal professional privilege can be split into two main types – legal advice privilege and litigation privilege. The Authority has not indicated whether it considers some or all of the withheld information to be subject to legal advice privilege or litigation privilege.
Legal advice privilege applies to communications in which legal advice is sought or provided. For legal advice privilege to apply, certain conditions must be fulfilled:
1. The information must relate to communications with a professional legal adviser, such as a solicitor or advocate
2. The legal adviser must be acting in their professional capacity, and
3. The communications must occur in the context of the legal adviser’s professional relationship with their client.
Litigation privilege is different and covers documents created in contemplation of litigation (also known as communications post litem motam). Communications post litem motam are granted confidentiality to ensure that any person or organisation involved in or contemplating a court action can prepare their case as fully as possible, without the risk that their opponent, or prospective opponent, will gain access to the material generated by their preparations. The privilege covers communications at the stage when litigation is pending or in contemplation.
Whether a particular document was prepared in contemplation of litigation will be a question of fact, the key question generally being whether litigation was actually in contemplation at a particular time.
Litigation privilege will apply to documents created by the party to the potential litigation, expert reports prepared on their behalf and legal advice given (and sought) in relation to the potential litigation.
However, the communication need not involve a lawyer and the litigation contemplated need never actually happen for the privilege to apply. It will continue to apply after any litigation has been concluded.
The Authority has not provided any submissions or evidence to support its view that legal advice privilege or litigation privilege applies to these documents. The Commissioner considers that a case may be able to be made (based on the information that has been withheld) but he cannot uphold the exemption if the Authority has not provided him with adequate submissions explaining why the exemption applies.
As noted previously, it is not for the Commissioner to create arguments that support the application of an exemption, that is the responsibility of the authority who is seeking to withhold the information.
Given the Authority’s failure to explain why the withheld information falls within the scope of the exemption contained in section 36(1) of FOISA, the Commissioner must find that the exemption cannot be upheld. As the Commissioner has concluded that section 36(1) cannot be upheld, he is not required to consider the application of the public interest test in section 2(1)(b) of FOISA. The Commissioner requires the Authority to disclose the information that has been withheld under section 36(1) of FOISA.
The Commissioner will provide the Authority with guidance on the specific information he requires to be disclosed.

Section 36(2) - Confidentiality

Under section 36(2) of FOISA, information is exempt from disclosure if it was obtained by a Scottish public authority from another person (including another such authority) and its disclosure by the authority so obtaining it to the public (otherwise than under FOISA) would constitute a breach of confidence actionable by that person or any other person.
Section 36(2) is an absolute exemption and is not, therefore, subject to the public interest test in section 2(1)(b) of FOISA. However, it is generally accepted in common law that an obligation of confidence will not apply if the disclosure of the information is necessary in the public interest.
Section 36(2) contains a two-stage test, both parts of which must be fulfilled before the exemption can be relied upon.

Document 46

The Authority commented that it was withholding one paragraph on page 5 of document 46 because disclosure would result in an actionable breach of confidence.
The Authority has not provided the Commissioner with any submissions or arguments explaining why it applied section 36(2) to this information, nor did it list this exemption in the schedule of documents provided to the Commissioner.
As noted above, there is a two-stage test required by this exemption. In order for the Commissioner to uphold section 36(2), the Authority must demonstrate that the information was obtained from another person, and that disclosure of the information would result in an actionable breach of confidence. In meeting these tests, the Authority must be able to evidence that the information has the necessary quality of confidence, that there was an obligation upon the Authority to maintain confidentiality, and that there would be detriment to the person who provided the information.
Given the complete lack of submissions, the Commissioner must find that the Authority has not met these tests and that it has not demonstrated why an actionable breach of confidence would result from disclosure. He considers that the exemption has been misapplied and he requires the Authority to disclose this information to the Applicant.

Statutory timescales

Section 10(1) of FOISA gives Scottish public authorities a maximum of 20 working days following the date of receipt of the request to comply with a request for information. This is subject to qualifications which are not relevant in this case.
It is a matter of fact that the Authority did not provide a response to the Applicant’s request for information dated 9 February 2023 within 20 working days, so the Commissioner finds that it failed to comply with section 10(1) of FOISA.

Fee Notice

In his application to the Commissioner, the Applicant expressed dissatisfaction with the Authority’s decision to issue a fees notice in response to his request.
Section 9 of FOISA states that a Scottish public authority receiving a request which requires it to comply with section 1(1) may, within the time allowed by section 10 for so complying, give the applicant a notice in writing (a "fees notice") stating that a fee of an amount specified in the notice is to be charged by the authority.
The Commissioner notes that the Applicant made his request for information on 9 February 2023, and the Authority issued a fees notice on 16 March 2023. Section 9 of FOISA makes it clear that any fees notice issued by a Scottish public authority must be issued within 20 working days of receiving the request.
In this case, by issuing a fees notice outwith the time allowed by section 10, the Authority failed to comply with the provisions of section 9 of FOISA.

Other Handling matters

As detailed above, the Authority’s handling of the Applicant’s information request was notably poor. The Authority failed to respond to the original request within 20 working days, it then attempted to extend the response time to 40 working days. When the Applicant notified the Authority that it was not entitled to extend the response time, it attempted to issue a fees notice, outwith the time allowed. After the Applicant informed the Authority that a fees notice must be issued within 20 working days of receiving a request, the Authority provided the Applicant with two responses to his information request, both issued on 6 April 2023, but at different times (one at 12:29 and another at 14:44). Each of these responses contained different information.
In its submissions, the Authority explained that it had sent the response on 12:29 but recalled it at 12:31 and then resent it at 14:44. It noted that the original response of 12:29 was incorrect as it was missing two documents, therefore it was resent at 14:44 with the two additional documents included.
The Commissioner notes the Authority’s explanation, and he is satisfied that it clarifies its actions in relation to the two responses sent fifteen minutes apart. However, he considers that this explanation should have been provided to the Applicant when it resent the correct response at 14:44. This failure to clearly explain why it was resending the response led to confusion and added to the Applicant’s concerns regarding the Authority’s handling of his request.
Furthermore, section 16(1) of FOISA, provides that if an authority refuses to disclose information it must specify the exemption that is being relied on and it must also state why the exemption applies. In its responses to the Applicant on 6 April 2023, the Authority referred to section 36 of FOISA, but if failed to specify which part of section 36 applied to the information. In doing so, it failed to comply with section 16(1) of FOISA.
The Commissioner notes the Authority’s persistent failings in how it handled the Applicant’s information request, which appear to demonstrate a lack of knowledge of FOISA and its duties under the Act. He would strongly recommend the Authority to takes steps to address these shortcomings as a priority: a good starting point would be to complete the Commissioner’s self-assessment toolkit (all modules are likely to be helpful, in the Authority’s situation, but Modules 1 and 6 would appear to be the most appropriate initially). The Commissioner will continue to monitor the Authority’s performance and may select it for further action and support under his Interventions Procedures.

Engagement with the Commissioner’s office

As noted above, in this case the Authority initially refused to provide the Commissioner with a copy of the information it had previously disclosed to the Applicant. In order to obtain this information (which was necessary to fully understand the case) the Commissioner had to issue an Information Notice to legally compel the Authority to provide him with the information that it had provided to the Applicant in its review outcome.
The Commissioner would like to remind all authorities that whenever information is disclosed under FOISA it is considered to have been disclosed into the public domain and should be made available to any other person who requests it.

Furthermore, if a member of the Commissioner’s office asks an authority for a copy of information that has already been disclosed to a requester, this should be provided in order to enable him to exercise his functions under the Act. The Commissioner notes that such a request is essentially a request for recorded information, as described in section 1(1) of FOISA, and there is an obligation upon the authority to comply with such a request.
During the investigation, and in light of the Authority’s change of submissions, the Commissioner asked the Authority to provide him with a marked-up copy of the documents clearly identifying which information was being withheld under each exemption; the Authority refused to provide this. Furthermore, the Authority also refused to provide the Commissioner with a revised schedule of documents. In addition, the Authority’s response to the investigating officer’s questions were brief, unhelpful and lacked specification. The Authority failed to clearly identify which of the exemptions in section 30 of FOISA it was relying on to withhold information.
In light of these failings, when the Commissioner issued an Information Notice to compel copies of the documents that had previously been disclosed to the Applicant; he also required the Authority to provide him a marked up copy of the documents, identifying what information was being withheld under each exemption, along with a schedule of documents.
When it responded to the Information Notice, the Authority also notified the Commissioner of new exemptions it was applying to the information, and it provided very brief arguments in support of those exemptions (as detailed above).
The Commissioner would note that when he seeks comments from authorities, his investigating officers ask specific questions relating to the exemptions that have been applied. If an authority is relying on multiple exemptions, or if it is not clear which particular subsection of an exemption has been applied, his investigating officers may have to ask numerous questions to clarify the authority’s position, in order to enable him to reach a decision on the application.
All of these questions are designed to help authorities assess whether they have met all of the relevant tests required by each exemption. They enable an authority to explain, in detail, why they consider information to be sensitive and why the exemption applies.
If an authority chooses not to engage with these questions, then the Commissioner will have to base his decision on the information he does have, which in this case, was brief, poorly expressed and lacking in detail.

Decision

The Commissioner finds that the Authority partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA), in responding to the information request made by the Applicant.

The Commissioner finds that by withholding some information under section 38(1)(b) of FOISA, the Authority complied with Part 1 of FOISA.

However, he also finds that the Authority failed to comply with Part 1 of FOISA by:

failing to respond to the request within 20 working days and wrongly claiming that it was entitled to take 40 working days to respond, contrary to section 10(1) of FOISA
wrongly issuing a fees notice, outwith the 20 working days specified in section 10(1) of FOISA, in breach of section 9(1) of FOISA
failing to notify the Applicant, under section 17 of FOISA, that it did not hold minutes for 8 August 2017

and, in breach of section 1(1),

wrongly withholding information under section 36(2) of FOISA
wrongly withholding information under section 36(1) of FOISA
wrongly withholding information under section 30(b)(ii) of FOISA
wrongly withholding information under section 30(c) of FOISA
incorrectly withholding the names of elected members or authority representatives under section 38(1)(b) of FOISA

The Commissioner therefore requires the Authority to disclose the information that he has found to have been wrongly withheld by 31 July 2026.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply. The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

Euan McCulloch

Head of Enforcement

16 June 2026