Decision 160/2026:  Due diligence - Tata Steel and Liberty SteelApplicant: The Applicant
 

Authority: Scottish Ministers
Case Ref: 202200727
 

Summary

The Applicant asked the Authority for information about the due diligence process for the agreement with Tata Steel and Liberty Steel.  The Authority disclosed some information to the Applicant but withheld other information under various exemptions in FOISA. The Commissioner investigated and found that the Authority partially complied with FOISA in responding to the Applicant’s request. However, the Authority failed to disclose some information to the Applicant by the date of the review outcome (at the latest) and wrongly relied on certain exemptions to withhold some information.  He required the Authority to disclose some of the wrongly withheld information and to issue a revised review outcome in relation to the remainder of the wrongly withheld information.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2), (4)and (6) (General entitlement); 2(1)(b) (Effect of exemptions); 30(c) (Prejudice to effective conduct of public affairs); 36(1) (Confidentiality); 38(1)(b), (2A), (5) (definitions of “the data protection principles”, “data subject”, “personal data” and “processing”, “the UK GDPR”) and (5A) (Personal information); 47(1) and (2) (Application for decision by Commissioner)

United Kingdom General Data Protection Regulation (the UK GDPR) Articles (1)(a) (Principles relating to the processing of personal data) and 6(1)(f) (Lawfulness of processing).  

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3)(a) & (b), (4)(d), (5), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data). 

Background

1. On 15 December 2021, the Applicant made a request for information to the Authority. He asked for: 

   (1) “Any copies or internal and external correspondence discussing the due diligence process and outcome, received by the [Authority] around the Dalzell deal brokered by the [Authority] between Tata Steel and Liberty Steel.”

   (2) “Any copies of the advice since March 2021 covering due diligence of this year and any comments on the initial due diligence undertaken in 2016.”

2. The Authority responded on 10 February 2022, in the following terms:

• For part (1), it disclosed some information to the Applicant and withheld other information under the exemptions in sections 30(b)(i), 33(1)(b) and 38(1)(b) of FISA. It also informed the Applicant that some of the information requested had been released in response to a previous information request and provided him with a link to that information, which it applied the exemption in section 25(1) of FOISA to.
• For part (2), it disclosed some information to the Applicant and withheld other information under the exemptions in sections 30(b)(i), 33(1)(b), 36(1) and 38(1)(b) of FOISA. 

3. On 14 February 2022, the Applicant wrote to the Authority requesting a review of its decision. He stated that he was dissatisfied with the decision for the following reasons:

• The information withheld under the exemption in section 25(1) of FOISA had been heavily redacted in places, so he sought a fresh decision on whether these redactions were appropriate
• He considered that the public interest favoured disclosure of the vast majority of the information withheld under the exemptions in sections 30(b)(i), 33(1)(b) and 36(1) of FOISA
• While he was content to accept the redaction of names and contact details under the exemption in section 38(1)(b) of FOISA, he considered that senior civil servants and the ultimate sender/receiver should be disclosed (i.e. if the sender was from an external company and the identity of the company).

4. The Authority notified the Applicant of the outcome of its review on 23 June 2022, which upheld its original decision with modifications:

• It identified some further information that it previously withheld that it considered could be disclosed, which it provided to the Applicant
• It stated that the names of senior civil servants or their equivalents had been disclosed
• It otherwise continued to withhold the remaining withheld information for both parts (1) and (2) of the request under the exemptions in sections 30(b)(i), 33(1)(b), 36(1) and 38(1)(b) of FOISA
• It confirmed that the exemption in section 25(1) of FOISA was applied correctly and that the exemptions previously used (i.e. section 33(1)(b) and 38(1)(b)) continued to apply for the reasons it had set out in relation to the other information requested.

5. On 23 June 2022, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  He stated that he was dissatisfied with the outcome of the Authority’s review because the exemptions cited by the Authority either did not apply and, in any event, the public interest test favoured disclosure of the withheld information.

Investigation

6. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation. 
7. On 5 July 2022, the Authority was notified in writing that the Applicant had made a valid application.  The Authority was asked to send the Commissioner the information withheld from the Applicant.  The Authority provided the information (other than that it had withheld under the exemption in section 25(1) of FOISA), and the case was subsequently allocated to an investigating officer. 
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application and to answer specific questions related to its reasons for withholding the information requested from the Applicant.  
9. On 13 September 2023, the Authority revised its position and disclosed some further information to the Applicant and otherwise revised its position in the following terms:

• It confirmed that it was no longer relying on the exemptions in sections 30(b)(ii) and 33(1)(b) of FOISA
• It stated that it was now relying on the exemption in section 30(c) of FOISA for most of the withheld information
• It considered that some of the information was exempt under section 36(1) of FOISA as it constituted legal advice
• It maintained its reliance on the exemption in section 38(1)(b) of FOISA to withhold third-party personal data

Commissioner’s analysis and findings

10. The Commissioner has considered all the submissions made to him by the Applicant and the Authority. 
11. As stated in previous decisions, in Scottish Ministers v Scottish Information Commissioner [2006] CSIH 8, at paragraph [18], the Court of Session recognised that:

"… in giving reasons for his decision, [the Commissioner] is necessarily restrained by 
the need to avoid, deliberately or accidentally, disclosing information which ought not 
to be disclosed."

12. In this decision notice, the Commissioner has endeavoured to give as full account of his reasoning as he can, but, by necessity, in this case the comments of the Court of Session are applicable to some aspects.
13. When determining whether information was properly withheld, the Commissioner must make his assessment in relation to the specific circumstances of the case on each occasion and, as recognised by the Court of Session in Scottish Ministers v Scottish Information Commissioner [2006] CSIH 8 (at paragraph [31]), at the time of the review (at the latest).  In this case, the time of the review was 23 June 2022.

Information disclosed during the investigation

14. As stated above (at paragraph 9), the Authority disclosed some information to the Applicant during the Commissioner’s investigation that it accepted it should have been disclosed earlier.
15. As the Authority disclosed further information to the Applicant during the investigation that it either accepted it had not been entitled to withhold or that it should have disclosed sooner, the Commissioner must find that the Authority failed to comply with section 1(1) of FOISA in this respect.

Background

16. By way of background, the Authority explained that in March 2016 the Scottish Government facilitated the transfer of ownership of the Dalzell and Clydebridge steelworks from Longs Steel UK (then a subsidiary of Tata Steel) to Liberty House, part of GFG, to ensure the sites remained open and save jobs. 
17. The symmetrical (back–to-back) sale saw the Scottish Government buy the sites for £1 and immediately sell them to Liberty House on identical terms. The original transaction was reported to the Scottish Parliament in 2016, with a follow up statement to the Scottish Parliament on 15 December 2021.

Section 30(c) - substantial prejudice to the effective conduct of public affairs 

18. Section 30(c) of FOISA provides that information is exempt information if its disclosure “would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs”.  This exemption is subject to the public interest test in section 2(1)(b) of FOISA. 
19. The word “otherwise” distinguishes the harm required from that envisaged by the exemptions in sections 30(a) and (b).  This is a broad exemption, and the Commissioner expects a public authority applying it to show what specific harm would (or would be likely to) be caused to the conduct of public affairs by the disclosure of the information, and how that harm would be expected to follow from disclosure.
20. There is no definition of “substantial prejudice” in FOISA, but the Commissioner considers – as stated in previous Decisions – that the harm in question would require to be of real and demonstrable significance.  The authority must also be able to satisfy the Commissioner that the harm would, or would be likely to occur, therefore the authority needs to establish a real risk of likelihood of actual harm occurring as a consequence of disclosure at some time in the near (certainly foreseeable) future, not simply that the harm is a remote or hypothetical possibility.

The Authority’s submissions

21. The Authority stated that it was essential that it has a productive relationship with companies, like GFG, who run businesses of national and local importance to Scotland. It noted that the Dalzell steel works is a significant employer in the local area.
22. The Authority provided two key reasons for withholding the information under the exemption in section 30(c) of FOISA, as follows:

Point (a) – Disclosure would make businesses less likely to engage with the Authority’s support

23. The Authority said that it had been made aware by colleagues in enterprise agencies that businesses were “extremely hesitant” to consider intervention sponsored by the Authority and its agencies because of the considerable risk that the fact of such an intervention would become public knowledge.  This would alert customers and suppliers to the fact that the business was utilising last resort funding to continue to trade. 
24. In turn, the Authority argued that this would adversely affect the relationship between such a business and its suppliers and customers, as suppliers and customers would be less willing to deal with the business for fear of wasted costs (e.g. if materials were ordered, but the business were subsequently unable to meet its payment obligations), leading to ever-greater difficulties in trading.
25. The Authority submitted that disclosure of the withheld information would exacerbate the issue by underscoring not only the fact of the intervention by the Authority, which here was publicly known, but the underlying basis on which decisions are made about sensitive business operations and situations, which is not a risk that arises where a business secures support from a third party which is not a Scottish public authority.  It argued that this would exacerbate concerns about seeking support from the Authority, making such support less effective. 
26. The Authority stated that these companies had not consented to the disclosure of the information, meaning that disclosure would be likely to undermine trust in the Authority.  This made it likely that these, and similar businesses, would be reluctant to engage with the Authority on such matters in the future, to the detriment of the Scottish economy and employment.  Therefore, disclosure of the information will substantially prejudice the Authority from taking similar action to secure the future of employers and jobs.
27. The Authority stated that it must be able to assure businesses that sensitive information about their financial position and future plans will not be released because of their involvement with the Authority.  Maintenance of trust was important to allow the Authority to engage with businesses in the best interests of Scotland, with the aim of preserving employment and growing the economy.  It submitted that it must be able to work in partnership with commercial actors such as GFG, and the release of the information jeopardises that possibility for the future.

Point (b) – Disclosure would remove the private space for consideration that is required by the Authority to make decisions in relation to a significant contract with implications for jobs and the economy

28. The Authority considered disclosure of this information would substantially prejudice the Authority’s relationship with GFG as disclosure of the content of the due diligence, to which GFG was not privy but which was about them, could negatively impact on GFG’s financial operations in terms of their ongoing global refinancing, challenging cash flow position and ongoing legal cases with its creditors. 
29. If disclosed, the Authority argued that GFG would be likely to consider that the Authority had revealed sensitive details that were shared on a confidential basis with Ernst & Young in the process of carrying out the due diligence ahead of the transaction. This would be detrimental to GFG and to their ongoing relationship with the Authority. 

Source of legal advice

30. The Authority also explained that it was also withholding the source of its legal advice under section 30(c) of FOISA.
31. The Authority argued that it would be likely to substantially prejudice the effective conduct of public affairs to reveal who the Authority seeks its legal advice from on any particular topic (both in terms of the organisation and the specific individuals) and who those lawyers consult in preparing their advice.  
32. The Authority submitted that revealing who the Authority seeks its legal advice from on a particular matter, would be likely to lead to conclusions being drawn from the fact that any particular lawyer or group of lawyers has, or has not, been asked to provide advice, which in turn would be likely to impair the Authority’s ability to take forward its work on issues relating to due diligence and the Dalzell steel works.
33. The Authority argued that the release of details of who’s advice was sought would also significantly harm the conduct of public affairs by breaching the Law Officer Convention as it would reveal whether or not advice on this topic had been sought from the Law Officers.   
34. The Authority submitted that revealing whether or not Law Officers had been asked to advise on this matter would encourage people to draw conclusions regarding the importance placed by the Authority on the subject of due diligence and the Dalzell steel works and also whether or not there were uncertainties regarding the Authority’s position.  It argued that disclosure of this information would significantly harm the effective conduct of public affairs by placing undue pressure on Ministers and officials in future to consider these factors before deciding to consult Counsel and/or the Law Officers.
35. The Authority contended that all of these factors would be likely to significantly harm the effective conduct of government business by putting officials and/or Ministers off requesting legal advice as and when they need it, for fear of information about the source of the advice being divulged and subjected to public and media speculation.

The Applicant’s submissions

36. The Applicant argued that the Authority had itself admitted that the agreement with Tata Steel and Liberty Steel may have breached state aid laws.  He considered that this trumped the vast majority of the application of exemptions claimed by the Authority, which he considered were already weakened as a result of the passage of time.

The Commissioner's view

37. The Commissioner has considered carefully the information that the Authority is withholding under section 30(c) of FOISA, together with the submissions of the Applicant and the Authority.  
38. Information can only be exempt under section 30(c) of FOISA if its disclosure would prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.  
39. As stated above, when determining whether information was properly withheld, the Commissioner must make his assessment in relation to the specific circumstances of the case on each occasion and at the time of the review (at the latest).  In this case, the time of the review was 23 June 2022.  He considers that the arguments advanced by the Authority were pertinent when the Authority issued its review outcome.
40. Having considered the nature and content of the withheld information, together with the Authority’s submissions, the Commissioner accepts that disclosure of the withheld information (with the exception of the source of legal advice, which is considered later) would be likely to cause substantial prejudice to the effective conduct of public affairs.
41. More specifically, the Commissioner finds that disclosure of the withheld information in question would, or would be likely to, have a detrimental impact on the Authority, GFG and the other commercial companies’ ability to continue in a competitive environment, which, in turn, would, or would be likely to, impede the Authority’s ability to engage with businesses in the best interests of Scotland. He cannot expand on his reasoning here, as to do so would risk revealing the information being withheld.
42. As stated above, the Commissioner has also considered the Authority’s arguments on withholding the source of its legal advice.  The Commissioner notes that the Law Officers Convention is reflected in the Scottish Ministerial Code, and that it prevents the Authority from revealing whether Law Officers have or have not provided legal advice on any matter.  
43. However, the Commissioner notes that the Authority has withheld the name of the private law firm that advised the Authority, arguing that to disclose whether one legal firm was approached for advice, and not another, would lead to conclusions being drawn.   The Commissioner did not accept this argument in Decision 218/2024.  In this case, he is also not satisfied that the Authority has explained why disclosure of a private law firm’s name would cause the harm claimed.  He therefore requires the Authority to disclose the name of the private legal firm withheld under section 30(c) of FOISA.   
44. Where the Commissioner has not upheld the application of section 30(c) of FOISA (i.e. for the source of the legal advice), he is not required to consider the public interest test in section 2(1)(b) of FOISA.
45. The Commissioner will now go on to consider the public interest test in relation to the information that he has found to be correctly withheld under section 30(c) of FOISA.

Public interest test

46. The exemption in section 30(c) is a qualified exemption, which means that it is subject to the public interest test set out in section 2(1)(b) of FOISA.  This means that exemption can only be upheld if the public interest in disclosing the information is outweighed by the public interest in maintaining the exemption.

The Authority’s submissions on the public interest

47. The Authority recognised that there was a public interest in disclosure of the withheld information in question as part of an open, transparent and accountable government and to inform public debate.  It also recognised the public interest in the Dalzell steel works, and in how the Authority worked with companies such as GFG when public funds were involved.
48. However, given the importance of the steel works to Scotland, the Authority believed that the public interest it recognised in the preceding paragraph was outweighed by the public interest in protecting the trust of GFG in their relationship with the Authority.  It submitted that it was of vital importance to Scotland, and the people of Scotland, that the Scottish Government can intervene to protect jobs and the wider economy – and the public interest lay in protecting the withheld information, which was sensitive, in the service of allowing future interventions. 
49. Ultimately, the Authority stated that the aim of the intervention in this case was to protect jobs.  It argued that it was clearly in the public interest to withhold information that will jeopardise such future action and that the public interest lay in protecting their interests, given the importance not only to the individuals employed at the sites but to the wider economy of the local area.

The Applicant’s submissions on the public interest

50. As stated above, the Applicant argued that the Authority had itself admitted that the agreement with Tata Steel and Liberty Steel may have breached state aid laws. He considered that the public interest in disclosure of the information requested therefore trumped the vast majority of the application of exemptions claimed by the Authority and that the public interest test overwhelmingly favoured disclosure.

The Commissioner's view on the public interest

51. The Commissioner has taken account of all of the relevant submissions from both parties, together with the withheld information in question.  As rehearsed above, he has already accepted that disclosure of the withheld information in question would, or would be likely to, cause substantial prejudice to the effective conduct of public affairs.
52. Given its significance and those potentially affected by the circumstances surrounding it, the Commissioner accepts that there is clear and substantial public interest in understanding the finer details of the due diligence process for the agreement with Tata Steel and Liberty Steel. 
53. However, the Commissioner recognises that this must be carefully balanced against any impact that disclosure of the withheld information in question would have had at the time when the Authority issued its review outcome. 
54. In the circumstances, the Commissioner finds that the public interest lies in the Authority maintaining good working relations with commercial parties in order to negotiate deals for the benefit of the Scottish economy.  He cannot find any counter argument that is so powerful that it would merit disadvantaging the Authority in its negotiations with third parties, to the extent that jobs may be lost and businesses may refuse to engage with the Authority for fear that the specific details of their negotiations and agreements would be made public
55.  The Commissioner therefore finds that the Authority was entitled to withhold the information in question under the exemption in section 30(c) of FOISA. 

Section 36(1) - Confidentiality

56. Section 36(1) of FOISA exempts from disclosure information in respect of which a claim to confidentiality of communications could be maintained in legal proceedings.
57. Legal advice privilege applies to communications in which legal advice is sought or provided. For legal advice privilege to apply, certain conditions must be fulfilled:
    1. The information must relate to communications with a professional legal adviser, such as a solicitor or advocate
    2. The legal adviser must be acting in their professional capacity, and
    3. The communications must occur in the context of the legal adviser’s professional relationship with their client.
58. Before information can attract legal advice privilege, it must be information for which a claim to confidentiality of communications could be maintained in legal proceedings.  The claim must be capable of being sustained at the time the exemption is claimed: the information must possess the quality of confidence at that time, and so cannot have been made public, either in full or in a summary substantially reflecting the whole.
59. The Commissioner has considered the content of the information and the circumstances in which it was created.  He is satisfied that the information meets the conditions for legal advice privilege to apply.  All the conditions stated above apply: the information involves communications with a legal adviser (a solicitor), who is acting in their professional capacity, and the communications occur in the context of the legal adviser's professional relationship with their client.

The public interest test

60. The exemption in section 36(1) is a qualified exemption, which means that it is subject to the public interest test set out in section 2(1)(b) of FOISA.  The exemption can only be upheld if the public interest in disclosing the information is outweighed by the public interest in maintaining the exemption. 

The Authority’s submissions on the public interest

61. The Authority again recognised that there was a public interest in disclosure of the withheld information as part of open, transparent and accountable government and that there was a public interest in relation to the subject of the involvement of the Authority in the Dalzell steel works.
62. However, the Authority argued that there was a very strong public interest in maintaining the exemption in section 36(1) of FOISA in order to ensure confidentiality of communications, for the following reasons:

• It remained important in all cases that lawyers can provide free and frank legal advice which considers and discusses all issues and options without fear that that advice may be disclosed and, as a result, potentially taken out of context
• In areas such as this, which are the subject of public scrutiny, an expectation that legal advice could be released would inevitably lead to the legal advice being much more circumspect and therefore less effective
• There is a strong public interest in protecting the confidentiality of this information in order to ensure that the Authority was able to discuss and take policy decisions in full possession of thorough and candid legal advice
• It would ensure that the Authority could take decisions in a fully informed legal context, having received legal advice in confidence as any other client would.

63. On balance, the Authority concluded that the public interest in maintaining the exemption outweighs that of disclosure, given the overriding public interest in maintaining the confidentiality of communications between lawyers and their clients and the public interest in allowing for full and detailed internal consideration of the legal issues in relation to the consideration of policy actions in relation to the operation of the Dalzell steel works.

The Applicant’s submissions on the public interest

64. While the Applicant acknowledged that the exemption in section 36(1) of FOISA may have some limited applicability, he considered – for the reasons set out above (at paragraph 36) – that the public interest test overwhelming favoured disclosure.

The Commissioner’s view on the public interest 

65. The Commissioner acknowledges the public interest in the transparency and accountability expected of all authorities and that disclosure of the information requested would go some way towards satisfying that interest.  However, the Commissioner also acknowledges that there is a strong inherent public interest, recognised by the courts, in maintaining the right to confidentiality of communications between legal adviser and client on administration of justice grounds.
66. In a freedom of information context, the strong inherent public interest in maintaining legal professional privilege was emphasised by the High Court (of England and Wales) in  Department for Business, Enterprise and Regulatory Reform v Information Commissioner and O'Brien [2009] EWHC 164 (QB).  Generally, the Commissioner will consider the High Court's reasoning to be relevant to the application of section 36(1) of FOISA.
67. The Commissioner acknowledges that there will be occasions where the significant public interest in favour of withholding legally privileged communications may be outweighed by a compelling public interest in disclosing the information. For example, disclosure may be appropriate where (the list is not exhaustive): 

• the privileged material discloses wrongdoing by/within an authority 
• the material discloses a misrepresentation to the public of advice received 
• the material discloses an apparently irresponsible and wilful disregard of advice 
• the passage of time is so great that disclosure cannot cause harm. 

68. Having examined the withheld information, while the Commissioner accepts that the contents of the advice would be of interest to the Applicant and to the general public, he does not consider that any of the above categories would apply.
69. The Commissioner accepts that there is a public interest in the subject matter of the advice.  He also accepts that there is a public interest in disclosure of the legal advice, in terms of accountability and transparency, with regard to the significant amount of public funds that are involved.   However, having reviewed the information along with the arguments put forward by the Authority and the Applicant, he is not convinced that in this instance the public interest in disclosure outweighs that in maintaining the exemption.
70. The Commissioner must take account of the important public interest in legal professional privilege itself and the public interest in allowing public authorities to obtain confidential legal advice.  
71. On balance, the Commissioner considers that greater weight should be afforded to the arguments which would favour maintaining the exemption.  He accepts that there is a strong public interest in a Scottish public authority being able to receive full, unhindered legal advice.  Without such comprehensive advice being available to the Authority, its ability to come to fully-formed decisions would be restricted, which would not be in the public interest.
72. Given this, the Commissioner does not find the public interest in disclosure of this information is sufficiently compelling to outweigh the strong public interest in maintaining the confidentiality of communications between legal adviser and client.
73. The Commissioner is therefore satisfied that the Authority correctly withheld this information under section 36(1) of FOISA.

Section 38(1)(b) – Personal information

74. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is "personal data" (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or (where relevant) in the DPA 2018.
75. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption.  This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
76. To rely on this exemption, the Authority must show that the information withheld is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Article 5(1) of the UK GDPR.
77. The Commissioner must decide whether the Authority was correct to withhold some of the information requested under section 38(1)(b) of FOISA.

Is the withheld information personal data?

78. The first question that the Commissioner must address is whether the remaining information is personal data for the purposes of section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable individual. "Identifiable living individual" is defined in section 3(3) of the DPA 2018. 
79. Information which could identify individuals will only be personal data if it relates to those individuals.  Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.
80. The Authority stated that the information withheld under the exemption in section 38(1)(b) of FOISA consisted of the names and contact details of individuals. As such, those individuals could be identified from this information, and it therefore constituted personal data as defined by section 3(2) of the DPA 2018. 
81. Having considered the withheld information, the Commissioner would note that – in addition to names and contact details – it also includes instances of the job titles of individuals being withheld.  Nevertheless, it is clear to the Commissioner that the majority of the withheld information “relates to” identifiable living individuals.  He therefore concludes that this information is personal data for the purposes of section 3(2) of the DPA 2018.
82. However, the Commissioner does not accept that some of the withheld information relates to an identified or identifiable individual.  In places, the Authority has redacted the names of companies and email address suffixes (e.g. “…@exampledomain.com”) as third-party personal data.
83. The Commissioner’s guidance on section 38 of FOISA states (at paragraph 87) that:

“… it’s important to keep redactions to the minimum necessary to remove the risk of identification.  This is particularly relevant where valuable context would be lost otherwise – consider, for example, whether the full email address needs to be redacted or just that part with the employee’s name (the rest is still likely to help the requester understand where the communications in question originated and were sent to).” 

84. The Commissioner must therefore find that the Authority was not entitled to withhold the specific information identified at paragraph 82 under the exemption in section 38(1)(b) of FOISA.  He requires the Authority to disclose that information to the Applicant.
85. For the information that he is satisfied is personal data, the Commissioner considers this further below.

Which of the data protection principles would be contravened by disclosure?

86. The Authority stated that disclosure of this personal data would contravene the first data protection principle (Article 5(1)(a) of the UK GDPR).  Article 5(1)(a) states that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.
87. In terms of section 3(4)(d) of the DPA 2018, disclosure is a form of processing.  In the case of FOISA, personal data is processed when it is disclosed in response to a request.
88. The Commissioner must now consider if disclosure of the personal data would be lawful (Article 5(1)(a)).  In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed.
89. In its submissions, the Authority concluded that the only condition that would allow it to process the data, in order to answer the Applicant’s request, was condition 6(1)(f) in Article 6 of the UK GDPR.
90. The Commissioner agrees that condition (f) in Article 6(1) of the UK GDPR is the only condition which could potentially apply in the circumstances of this case.

Condition (f): legitimate interests

91. Condition (f) states that the processing will be lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.
92. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
93. The tests which must be met before Article 6(1)(f) can be met are as follows:
    1. Does the Applicant have a legitimate interest in obtaining the personal data?
    2. If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?
    3. Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?

Does the Applicant have a legitimate interest in obtaining the personal data?

94. The Applicant’s requirement for review stated that, while he was content to accept the redaction of names and contact details under the exemption in section 38(1)(b) of FOISA, he considered that senior civil servants and the ultimate sender/receiver should be disclosed (i.e. if the sender was from an external company and the identity of the company). 
95. In what follows, the Commissioner will therefore only consider whether the Applicant has a legitimate interest in that information.  He accepts that the Applicant does not have a legitimate interest in information that does not match that description.
96. The Authority stated that it was not aware of any legitimate interests that the Applicant had in the names and direct contact details of officials or that identifying these individuals would aid in his understanding of the withheld information. 
97. The Commissioner has considered the public interest arguments provided by the Applicant (as set out above) to the extent that they are relevant to his legitimate interest in obtaining the personal data. 
98. Having reviewed the withheld information, the Commissioner accepts that the Authority has by and large only withheld the names of more junior civil servants.  He therefore does not consider that the Applicant has a legitimate interest in obtaining this personal data.
99. To the extent that the Authority has withheld the names of individuals whose job titles indicate a level of responsibility that might fall within the Applicant’s definition of a senior civil servant or that would otherwise appear to match the description of a senior civil servant, the Commissioner agrees with the Authority that disclosure of this information would not aid in the Applicant’s understanding of the information.  This is particularly so given the Commissioner’s requirement – that will aid the Applicant’s understanding of the information – that the Authority disclose the names of companies and email address suffixes that he found the Authority had wrongly withheld under the exemption in section 38(1)(b) of FOISA. He therefore also does not consider that the Applicant has a legitimate interest in obtaining this personal data.
100. As the Commissioner has concluded that the Applicant does not have a legitimate interest in obtaining the withheld personal data in question, he finds that condition (f) of Article 6(1) of the GDPR cannot be satisfied.  Accordingly, he accepts that making the personal data available would be unlawful.
101. Given that the Commissioner has found that the processing (i.e. making the information available, in response to the Applicant's request) would be unlawful, he is not required to go on to consider separately whether disclosure of the withheld personal data in question would be necessary to fulfil any legitimate interest, or consider the data subject's interests or fundamental rights and freedoms, and balance them against any legitimate interest in disclosure.
102. In all the circumstances of the case, in the absence of a condition in Article 6(1) of the GDPR being met, the Commissioner must conclude that making the withheld personal data in question available would be unlawful and would breach the data protection principle in Article 5(1)(a) of the GDPR.  Consequently, he is satisfied that disclosure of the personal data is not permitted by section 38(1)(b) of FOISA.

Section 25(1) of FOISA – Information otherwise accessible

103. Under section 25(1) of FOISA, information which a requester can reasonably obtain, other than by requesting it under section 1(1) of FOISA, is exempt information. The exemption in section 25 is absolute, in that it is not subject to the public interest test in section 2(1)(b) of FOISA.
104. Section 25(1) is not intended to prevent or inhibit access to information, but to relieve public authorities of the burden of providing information that an applicant can access readily without asking for it.
105. As stated above, the Authority relied on the exemption in section 25(1) of FOISA in respect of some information for part (1) of the Applicant’s request.  It provided the Applicant with a link to redacted information it had disclosed in response to a previous request. 
106. In response to the Applicant’s requirement for review, which expressed dissatisfaction with the redactions made to that information, the Authority confirmed that the exemption in section 25(1) of FOISA was “applied correctly”.  Having consulted with relevant officials, it also confirmed that the exemptions applied to redact information from the information disclosed in response to a previous request continued to apply.
107. The Commissioner accepts that the Authority was entitled to apply the exemption in section 25(1) of FOISA to the information that was actually disclosed in response to the previous information request and that remained reasonably accessible via the link it provided to the Applicant.
108. However, the Commissioner cannot accept that the exemption in section 25(1) of FOISA applied to the information redacted from the information disclosed in response to the previous request.  That information, given it has been redacted, cannot be said to be reasonably obtainable from the link the Authority provided to the Applicant.
109. The Commissioner acknowledges that the Authority, at the same time it confirmed the exemption in section 25(1) of FOISA was properly applied, confirmed that the exemptions applied to redact information from the information disclosed in response to a previous request continued to apply.  However, the Authority did not provide the Commissioner with an unredacted copy of the information it withheld under the exemption in section 25(1) of FOISA.  He is therefore unable to determine whether any other exemptions were properly applicable to that information as part of this decision notice.
110. In the circumstances, the Commissioner finds that the Authority was not entitled to rely on the exemption in section 25(1) of FOISA in respect of the information redacted from the information it disclosed in response to the previous information request.
111. The Commissioner therefore requires the Authority to issue a revised review outcome to the Applicant in respect of the information redacted from the information it disclosed in response to the previous information request.  In doing so and given the passage of time since the date of the original review outcome, he requires the Authority to provide the Applicant with advice and assistance to ask him to consider whether he would instead wish to make a fresh request for this information rather than a revised review outcome.  This would allow the Authority to consider that information for disclosure in light of present-day circumstances, which may mean that disclosure under FOISA may be more likely.

Decision 

The Commissioner finds that the Authority partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant. 

The Commissioner finds that the Authority complied with Part 1 of FOISA by correctly withholding information under the exemptions in sections 30(c) (with the exception of the source of the legal advice), 36(1) and 38(1)(b) of FOISA.

However, the Commissioner finds that the Authority failed to comply with Part 1 of FOISA (in particular section 1(1)) by:

• wrongly withholding the source of the legal advice under the exemption in section 30(c) of FOISA
• by disclosing further information to the Applicant that it should have disclosed by the date of the review outcome (at the latest)
• by wrongly relying on the exemption in section 25(1) of FOISA in respect of certain information

The Commissioner therefore requires the Authority to disclose the source of the legal advice to the Applicant and, unless the Applicant confirms to the Authority that he instead wishes to proceed with a fresh information request, to issue him with a revised review outcome with respect to the information wrongly withheld under the exemption in section 25(1) of FOISA, by 10 August 2026.  

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement 

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply.  The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

David Hamilton

Scottish Information Commissioner

25 June 2026

1. ^

   https://www.gov.scot/publications/foi-202100204021/

2. ^

   https://www.bailii.org/scot/cases/ScotCS/2008/CSIH_08.html

3. ^

   https://webarchive.nrscotland.gov.uk/20240713015729/https:/scotcourts.gov.uk/search-judgments/judgment?id=a94886a6-8980-69d2-b500-ff0000d74aa7

4. ^

   https://www.gov.scot/publications/update-dalzell-historical-industrial-transaction-ministerial-statement/

5. ^

   https://www.foi.scot/decision-2182024

6. ^

   https://www.bailii.org/cgi-bin/format.cgi?doc=/ew/cases/EWHC/QB/2009/164.html&query=(title:(+o%27brien+))

7. ^

   https://www.foi.scot/sites/default/files/2025-04/FOISA_Exemption_Guidance_Section_38_Personal_Information_v04_CURRENT_ISSUE_Access_Checked.pdf