Home Decisions

Decision 172/2026

Decision 172/2026:  Number of pass users entering specified Scottish Government buildings


Authority: Scottish Ministers
Case Ref: 202600408
 

Summary

The Applicant asked the Authority for a daily breakdown of the number of pass users entering four Scottish Government buildings over a six-month period. The Authority withheld the information on the grounds that disclosure would, or would be likely to, endanger the health and safety of individuals using those buildings.  The Commissioner investigated and found that the information was properly withheld.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1)(b) (Effect of exemptions); 39(1) (Health, safety and the environment); 47(1) and (2) (Application for decision by Commissioner).

Background

  1. On 13 August 2025, the Applicant made a request for information to the Authority.  He asked for: 

“For each of the four core SG buildings – St Andrew’s House, Victoria Quay, Saughton House and Atlantic Quay … The number of unique building pass users recording entering the facility every day, Monday to Friday, in the following months of 2024 – July, August, September, October, November, December.

I’ve used this FOI response - https://www.gov.scot/publications/foi-202400446281 - to shape my request but the key difference is I would like this data for every working day, not just sample days.”

  1. The Authority responded on 10 September 2025.  It disclosed average percentage occupancy rates each Tuesday over the period specified, but issued the Applicant with a notice, under section 17(1) of FOISA, that it did not hold any recorded information in relation to the remaining days specified.
  2. Later the same day, the Applicant wrote to the Authority requesting a review of its decision on the basis that it had disclosed average occupancy rates and not “raw numbers”.
  3. The Authority notified the Applicant of the outcome of its review on 2 October 2025, which modified its original position.  It confirmed that it held the raw data requested but considered that information to be exempt from disclosure in terms of section 39(1) of FOISA.
  4. Later the same day, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  He stated that he was dissatisfied with the outcome of the Authority’s review because he disagreed that the exemption in section 39(1) of FOISA applied and considered that the public interest favoured disclosure.
  5. During the investigation of the above application, the Authority twice changed its position:
  • On 14 November 2025, the Authority informed the Applicant that it did not hold the information requested, in terms of section 17(1) of FOISA, on the basis that collating the information would require skill and complex judgement. 
  • On 24 February 2026, the Authority issued a revised review outcome to the Applicant which informed him that it had reconsidered his request and, while it held the raw data requested, it considered it to be exempt from disclosure in terms of section 39(1) of FOISA. 
  1. On 3 March 2026, the Applicant withdrew his application of 2 October 2025 and wrote to the Commissioner, applying afresh for a decision in terms of section 47(1) of FOISA in respect of the Authority’s revised review outcome of 24 February 2026. He stated that he was dissatisfied with the outcome of the Authority’s revised review because he disagreed that the exemption in section 39(1) of FOISA applied and considered that the public interest favoured disclosure.

Investigation

  1. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation. 
  2. On 31 October 2025, the Authority was notified in writing that the Applicant had made a valid application.  The Authority was asked to send the Commissioner the information withheld from the Applicant, and the case was subsequently allocated to an investigating officer. 
  3. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application and to answer specific questions related to its application of the exemption in section 39(1) of FOISA and its consideration of the public interest test. 

Commissioner’s analysis and findings

  1. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority. 
  2. As stated in previous decisions, in Scottish Ministers v Scottish Information Commissioner [2006] CSIH 8, at paragraph [18], the Court of Session recognised that:

"… in giving reasons for his decision, [the Commissioner] is necessarily restrained by the need to avoid, deliberately or accidentally, disclosing information which ought not to be disclosed."

  1. In this decision notice, the Commissioner has endeavoured to give as full account of his reasoning as he can, but, by necessity, in this case the comments of the Court of Session are applicable to some aspects.
  2. Section 45 of FOISA makes it a criminal offence for the Commissioner or a member of his staff to disclose, without lawful authority, information which he has obtained, or which has been furnished to him, under or for the purposes of FOISA if the information is not at the time of the disclosure, and has not previously been, available to the public from another source.
  3. The Commissioner is therefore unable to reproduce or summarise fully the Authority’s submissions, within this decision notice, without breaching the obligation of confidentiality in section 45 of FOISA.
  4. However, the Commissioner is himself obliged to give proper and adequate reasons for his decision in any given case.  He must therefore reflect the arguments provided by the Authority, to the extent appropriate, to allow him to fulfil this obligation.  He would also note that much of the information the Authority indicated that it wished not to be reproduced in this decision notice is not obviously sensitive. Instead, it describes, in unsurprising terms, its reasons for applying the exemption in section 39(1) of FOISA to withhold the information requested.

The withheld information

  1. The information being withheld from the Applicant by the Authority under the exemption in section 39(1) of FOISA is the number of unique pass users recorded entering St Andrew’s House, Victoria Quay, Saughton House and Atlantic Quay (respectively) on each day of the working week (i.e. Monday to Friday), from 1 July 2024 to 31 December 2024.
  2. When determining whether information was properly withheld, the Commissioner must make his assessment in relation to the specific circumstances of the case on each occasion and, as recognised by the Court of Session in Scottish Ministers v Scottish Information Commissioner [2006] CSIH 8 (at paragraph [31]), at the time of the review (at the latest).
  3. In this case, the review outcome under consideration is that issued by the Authority on 24 February 2026.  In what follows, the Commissioner will therefore consider whether the Authority was entitled to withhold the information requested in relation to the specific circumstances at that time.

Section 39(1) – Health, safety and the environment 

  1. Section 39(1) of FOISA states that information is exempt information if its disclosure under FOISA would, or would be likely to, endanger the physical or mental health or the safety of an individual.  This is a qualified exemption and is subject to the public interest test required by section 2(1)(b) of FOISA.
  2. As the Commissioner notes in his briefing on the exemption, section 39(1) does not contain the usual harm test.  Instead of the "substantial prejudice" test found in many other harm based exemptions in Part 2 of FOISA, this exemption refers to the "endangerment" of health or safety.  

The Applicant’s submissions

  1. The Applicant considered that the Authority had failed to evidence that disclosure of the withheld information would endanger the physical or mental health or the safety of an individual.
  2. The Applicant submitted that the Authority had not made an adequate case in respect of risks from “threat actors” outlined in its response.  He further noted that the capacities of the buildings specified were public knowledge and easily observed by such threat actors.

The Authority’s submissions

  1. The Authority stated that its response to the Applicant’s request had been informed by the risk assessment of qualified National Security experts.  It described that risk assessment as being intelligence and evidence-led and based on material not in the public domain or available to those without appropriate security clearance.
  2. The Authority referred to specific security guidance regarding hostile reconnaissance.  This guidance urged caution in respect of public disclosures (so as to deprive hostile actors of useful information), which informed the Authority’s general approach to disclosures into the public domain. 
  3. The Authority explained that it had therefore protected the number of building users per site to the extent that this information was not widely available internally and restricted to a small group of relevant personnel with the appropriate security clearance.
  4. The Authority submitted that the risk of harm from disclosure was not hypothetical.  Were the withheld information to be disclosed, a single online search would reveal the number of building users (which included civil servants and Ministers) likely to be in every main Scottish Government building in central Scotland on any given day across half a year. 
  5. In support of the risk of harm not being hypothetical, the Authority described a range of incidents which had adversely affected its staff and premises.  More specifically, it noted that over the previous year several buildings owned or leased by the Authority had been attacked by different protest groups and that there had been multiple attempts to steal assets from Authority sites, and/or gain unauthorised access.
  6. Furthermore, the Authority noted that the national current threat level was “substantial” which indicated that a terror attack was likely.  While it recognised the Applicant’s argument that the capacity of the buildings was public knowledge and that those buildings were observable from public places, it considered that no hostile reconnaissance operation would deliver information of comparable accuracy or detail to the withheld information if it were disclosed.
  7. The Authority argued that disclosure of the withheld information would therefore provide valuable intelligence for a range of threat actors (which it specified).  For example, information showing either particularly high or low occupancy levels would lead to a significant probability that the health and safety of the staff members within those buildings would be endangered, by increasing the likelihood of threat actors using that information to target vulnerabilities and to otherwise act in a criminal or otherwise harmful way (which it again specified). 
  8. The Authority also considered that disclosure of the withheld information would increase the risk of protest groups targeting staff and buildings for attack (and/or occupation) on those days likely to result in maximum publicity, but minimum risk of detection and disruption. 
  9. Given all of the above, the Authority argued that disclosure in response to the Applicant’s request would lead to the real, rather than hypothetical, endangerment to staff “caught up in/responding to” the range of adverse events described in its submissions to the Commissioner.

The Commissioner's view

  1. The Commissioner has carefully considered the withheld information, together with the submissions from both parties.
  2. For the Commissioner to uphold section 39(1) of FOISA, he must be satisfied that disclosure of the information would, or would be likely to, endanger the physical or mental health or the safety of a living individual (or group).  This requires evidence that demonstrates that not only is it possible that disclosure would cause such harm, but that such an eventuality was at least likely to occur.
  3. The word "endanger" is broad enough to apply where there is a threat, direct or indirect, to the safety of a person.  Since the exemption in section 39(1) of FOISA does not specify that any threat should be imminent before it applies, the threat may be either immediate, or one which would foreseeably arise in the future.  The Commissioner believes that for endangerment to be considered likely, however, there must be some well-founded apprehension of danger, such that the prospect of harm could be regarded as a distinct possibility.
  4. The Commissioner recognises that the Authority has raised serious concerns in relation to the health and safety of building users.  It bases these concerns on a range of recent, specific, incidents as well as on a more general apprehension resulting from the current security climate.   
  5. The Commissioner also notes the Authority’s submission that its response to the Applicant’s request was informed by the assessment of qualified individuals in the field of national security.  However, the Commissioner has not – beyond links to a number of publicly available documents – been provided with these assessments. 
  6. The Commissioner agrees that disclosure of the information withheld in this case would undoubtedly provide a level of granular detail not readily achieved – if even possible to achieve to the same level of detail – through reconnaissance by hostile actors.  However, he is not persuaded that disclosure of the withheld information would serve to increase the likelihood of most of the types of risk claimed by the Authority. 
  7. In the Commissioner’s view, these risks are either likely to exist already, through local or public knowledge of the general busy and quiet times of the working premises, or could be created without disclosure of the withheld information as a consequence of even crude estimation of the general busy and quiet times of working premises (which – particularly given information in the public domain on the post-pandemic hybrid working world – could be made without the need for sophisticated surveillance).  He also notes that attacks on Authority premises, alongside attempts at unauthorised access, have occurred without the withheld information in this case being in the public domain. 
  8. However, having carefully inspected the withheld information and the submissions from the Authority, the Commissioner accepts, though he considers the arguments to be very finely balanced, that it would serve to increase the likelihood of some of the types of risk claimed by the Authority.  Specifically, he accepts that the withheld information would comprise actionable intelligence for hostile actors wishing to attack (and/or occupy) those buildings on particularly busy or quiet days, gain unauthorised access to the buildings specified or commit crime, including theft, in relation to these buildings.
  9. While the Commissioner must be careful not to reveal the specific content of the withheld information, it indicates dates, across a sizeable period, which identify Scottish Government buildings which contain a high (or low) number of individuals, with both situations associated with different kinds of risk.  He also recognises that Scottish Government buildings possess a particular value to hostile actors as “targets”.
  10. In the Commissioner’s view, disclosure of the withheld information in this case would – given its granularity and the period covered – be likely to encourage hostile actors intent on engaging in the acts described in paragraph 40 above.  He accepts that this would, or would be likely to, endanger the health (including mental health) and safety of building users caught up in in such acts, whether they were “successful” or not.
  11. In all the circumstances, the Commissioner is satisfied – but only just – that the disclosure of the information would, or would be likely to, endanger the physical or mental health or the safety of the individuals (being building users) concerned.  Consequently, he must conclude that the exemption in section 39(1) of FOISA was correctly applied by the Authority.
  12. As stated above, the Commissioner considered the arguments in this case as to the applicability of the exemption in section 39(1) of FOISA to be finely balanced.  In all cases, he expects to receive focused submissions specific to the harm that would, or would be likely, to result from disclosure from the particular information being withheld.
  13. The Commissioner is aware that some information relating to the occupancy of Scottish Government buildings is now in the public domain via media reporting.  As stated above, the Commissioner must in this case consider the circumstances as at the date of the review outcome.  However, he notes that the information now in the public domain is not identical to that being withheld in this case. 

Public interest test

  1. Section 39(1) is a qualified exemption, which means that its application is subject to the public interest test in section 2(1)(b) of FOISA.  Therefore, having decided that the information is exempt under section 39(1), the Commissioner must go on to consider whether, in all the circumstances of the case, the public interest in disclosing the information is outweighed by the public interest in maintaining the exemption.  If it is not, he must order the Authority to disclose the information.

The Applicant’s view on the public interest

  1. The Applicant submitted that disclosure of the withheld information was of keen public interest given that this information related to buildings and the cost of their upkeep, which was funded by taxpayers.
  2. The Applicant considered that the Authority’s position that the public interest was satisfied by its disclosure of average occupancy rates on a Tuesday was “nonsensical”, given information relating to one of five working days each week, solely, was not meaningful.

The Authority’s submissions on the public interest test

  1. The Authority accepted that there was a public interest in disclosure of the withheld information for reasons of openness, transparency and accountability.  It also accepted that there was a public interest in disclosure for the reasons specified by the Applicant.
  2. The Authority stated that it understood the Applicant’s purpose in seeking the information was to publish an article highlighting the number of civil servants working in its offices.  However, it considered that the public interest was satisfied by its disclosure to the Applicant of average occupancy data on a Tuesday over the period specified. It stated that it had provided this to the Applicant in an attempt to meet his needs but without compromising the safety of Authority staff and others working in the buildings specified.
  3. The Authority further argued that the public interest in occupancy rates of the specified buildings was also satisfied by its publication of percentage occupancy data on a quarterly basis and its published responses to statutory requests which provided information on occupancy and cost of building upkeep.
  4. In respect of the publication of percentage occupancy data on a quarterly basis, the Authority stated that this data represented building occupancy rates across all weekdays across several months for the buildings in question.  It also commented that it was more accurate and recent than the information requested by the Applicant. 
  5. The Authority also submitted that disclosure would provide “little further evidence” of trends of office occupancy.  However, it argued that it would in real terms – and as assessed by security experts within National Security – significantly increase the level of risk to Scottish Government staff.
  6. In all of the circumstances, the Authority considered that the public interest lay in favour of withholding the information sought on the basis that there was a much stronger public interest in protecting the physical safety of Authority employees, and others attending Scottish Government buildings, by not putting information likely to endanger their safety into the public domain.

The Commissioner's view on the public interest

  1. The Commissioner has carefully considered the submissions of both parties.
  2. The Commissioner has found that disclosure of the information would, or would be likely to, lead to the endangerment of individuals claimed by the Authority.  This means the public interest arguments in favour of disclosure must be strong, to outweigh the public interest in ensuring that individuals are not endangered as a result of such disclosure.
  3. The Commissioner recognises that there is a public interest in transparency around the Authority’s expenditure of public funds, particularly where that expenditure relates to buildings which might reasonably be perceived as underutilised, and in the public debate on that matter which would likely follow.
  4. Having considered the withheld information in question, the Commissioner recognises that disclosure of this information would provide a precise picture of the occupancy levels of four main Scottish Government buildings over an extended period of time. In that way, disclosure would undoubtedly contribute to the public debate described in the preceding paragraph.
  5. However, the Commissioner acknowledges that the information already published by the Authority (as described in paragraphs 51 and 52) was publicly available at the time of the Authority’s review outcome in this case.  While this information is not the same as the withheld information in this case, the Commissioner considers that it provides significant insight into the “current” occupancy levels of the buildings concerned. 
  6. In the Commissioner’s view, it is self-evident from information already in the public domain at the time of the Authority’s review outcome that occupancy of some of the buildings concerned is, periodically, low.  In that respect, he considers that the information already in the public domain goes a significant way to satisfying the public interest arguments made by the Applicant in this case.
  7. In all of the circumstances of the case, therefore, Commissioner finds that the public interest arguments put forward by the Applicant are not strong enough to outweigh the public interest in ensuring that individuals are not endangered by the information he has found to be exempt under section 39(1) of FOISA.  Consequently, he is satisfied that the Authority correctly withheld that information under section 39(1) of FOISA.
  8. In this case, the Commissioner has found that the information was properly exempt from disclosure under FOISA, in view of the circumstances at the time of the Authority’s review.  However, this should not be taken to imply that information of a particular type (i.e. associated with the number of users of buildings) will be routinely withheld in future.
  9. It is important for public authorities to treat each request for information on a case by case basis.  The circumstances of each case, including the content of the specific information under consideration and information already available in the public domain, must be taken into consideration and (where required) the public interest in each case assessed on its own merits.

Decision 

The Commissioner finds that the Authority complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by the Applicant.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

 

 

Euan McCulloch 

Head of Enforcement 

 

3 July 2026

  1. ^

  2. ^

  3. ^

  4. ^

  5. ^