Decision Notice 200/2026

Authority: Tayside Health Board

Case Ref: 202301454

The Applicant asked the Authority for a copy of the peer review report of the Authority’s investigation of Professor Eljamel and related information. The Authority disclosed some information but withheld most of the information on the grounds that it was third party personal data. 

The Commissioner investigated and found that the Authority partially complied with FOISA in responding to the Applicant’s request. He required the Authority to disclose some information to the Applicant, and to carry out additional searches and provide the Applicant with a revised review outcome.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 15 (Duty to provide advice and assistance); 17(1) (Notice that information not held); 38(1)(b) (2A), (5) (definitions of “the data protection principles”, “data subject”, “personal data”, “processing” and “the UK GDPR”) and (5A) (Personal information); 47(1) and (2) (Application for decision by Commissioner).

United Kingdom General Data Protection Regulation (the UK GDPR) Articles 4(1) (definition of “personal data” (Definitions); 5(1)(a) (Principles relating to processing of personal data); 9(1) and (2)(a) and (e) (Processing of special categories of personal data).

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data).

Background

1. On 28 March 2023, the Applicant made a request for information to the Authority.  He asked for information related to the report authored by Tracy Gillies, the Executive Medical Director of NHS Lothian, entitled “Review of NHS Tayside's Investigation of Professor Eljamel" (the Gillies Report).  A full copy of the request is included in Appendix A.
2. The Authority did not respond to the request within the statutory timescale.
3. On 31 May 2023 the Applicant wrote to the Authority, requiring a review in respect of its failure to respond.
4. The Authority notified the Applicant of the outcome of its review on 2 June 2023.  The Authority disclosed some information but withheld other information under section 38(1)(b) of FOISA, on the grounds that it was the personal data of individuals. For some parts of the request, the Authority stated that it held no information.
5. On 20 November 2023, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  The Applicant stated he was dissatisfied with the outcome of the Authority’s review because he considered that the Authority been overly liberal with the redaction of personal data and he did not accept that other information was not held.

Investigation

6. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation. 
7. On 1 February 2024, and in line with section 49(3)(a) of FOISA, the Commissioner gave the Authority notice in writing of the application and invited its comments. 
8. The Authority was also asked to send the Commissioner the information withheld from the Applicant. The Authority provided the information
9. The case was subsequently allocated to an investigating officer.

Commissioner’s analysis and findings

10. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.

Scope of the investigation

11. The Applicant confirmed that he was not challenging the Authority’s responses to parts 6 and 4(g) of the request.  Therefore, the Authority’s handling of these parts of the request was not investigated.
12. The investigation examined the Authority’s response to all of the remaining requests, in particular;

• whether the authority identified all information it held at the time of the request that fell within scope of the request; in particular, parts 2, 3(b), 4(c), 4(d), 7, 8, 11, 13, 14,
• whether the Authority was entitled to give notice under section 17(1) of FOISA that it held no information in relation to parts 3(a), 3(c), 4(e), 4(f), 9, 10, and 
• whether the information provided in response to part 14 of the request relates to and was current during the time period captured by the request, and 
• whether the Authority was entitled to withhold information under section 38(1)(b) of FOISA in relation to parts 1, 3 (all sub parts), 4 ((a) to (f)), 5 (all sub parts), 11, 12, 13 and 14 of the request.

Information captured by the request

13. Section 1(1) of FOISA provides that a person who requests information from a Scottish public authority which holds it is entitled to be given that information by the authority, subject to qualifications which, by virtue of section 1(6) of FOISA, allow Scottish public authorities to withhold information or charge a fee for it.  The qualifications contained in section 1(6) of FOISA are not applicable in this case.
14. The standard of proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities.

Part 2

The report mentions that the writer had been given "a number of documents in advance and the Terms of Reference" – can you include these in your response. I understand that these may be duplicate requests below, but it is unclear from the report if that is the case.

15. The Applicant was not satisfied that he had received a complete response to this part. He noted that within the Gillies Report it was stated that the author had been given “a number of documents in advance and the Terms of Reference".  He commented that his request sought all of the documents that had been given in advance and the Terms of Reference, but that only the Terms of Reference had been disclosed.
16. The Authority considered that it had responded to part 2 of the request.

The Commissioner’s view on part 2

17. The Commissioner considers that the terms of part 2 are stated clearly.  The author of the Gillies report had been given "a number of documents in advance and the Terms of Reference" and the request asked for this information.  The Authority responded to the Applicant in relation to the Terms of Reference only and made no attempt to address the request for the documents given in advance.
18. The Commissioner notes that the Applicant speculated in his request that it may be that the documents given to the author of the report were those which he had specifically sought in his remaining requests but that he was not clear if this was the case, or if additional material was given to the author.  The Authority has made no attempt to address this issue, whether in its communications with the Applicant or the Commissioner.
19. As the Authority has failed to address part 2 in full in responding to the Applicant, the Commissioner must find that the Authority failed to comply with section 1(1) of FOISA in handling this part of the request.
20. The Commissioner requires the Authority to carry out additional searches for the documents given to the author of the Gillies Report and provide the Applicant with a revised review outcome for part 2.

Part 4(c)

The final report from the Royal College of Surgeons dated 6th December 2013

21. The Authority stated in the review that it had disclosed this report with some redaction to maintain the confidentiality of personal information, and it maintained this position in its submissions to the Commissioner.
22. The Applicant was dissatisfied that there was so much material redacted from the information, and that whole pages were not disclosed.

The Commissioner’s view

23. The Commissioner has carefully considered the information provided to him by the Authority in relation to this part of the request, which is a 36 page report. 
24. In providing the withheld information to the Commissioner, the Authority stated that it had withheld pages 1 to 18 of this report in their entirety under section 38(1)(b) of FOISA.
25. The Commissioner notes that the Authority disclosed pages 21 to 31 of the report, with redactions for personal data, to the Applicant in its review of 2 June 2023.
26. The Commissioner has no knowledge of the Authority’s position in relation to pages 32 to 36 of this report.  However, given the Authority's approach to the remainder of this document (and given the Authority’s position regarding the same document in relation to part 11 of the request, as discussed later), he has assumed that the Authority’s intention was to withhold personal data contained therein under section 38(1)(b) of FOISA.  In taking this approach, he notes that the schedule of documents that was provided to him only lists the exemption in section 38(1)(b) as applying to information redacted from the report falling within the scope of part 4(c).   Taking all of the above into account, the Commissioner will consider the application of section 38(1)(b) to all of the information in pages 32 to 36 of the report.
27. It is apparent that the Authority has taken a piecemeal approach to consideration of the information captured by part 4(c) and that it has not considered the complete report.  For this reason, the Commissioner must find that the Authority has not complied with section 1(1) of FOISA in response to this part of the request.   He finds that the Authority’s response was incomplete.
28. As the complete report was given to the Commissioner for his consideration, the Commissioner will consider the information withheld, and that he has assumed to be withheld, under section 38(1)(b) later in this decision.

Part 7 (first element)

The report identifies that Mr Eljamel was the "Chair of the Clinical Governance Committee" can you clarify the dates he was the Chair …?

29. The Applicant was not content with the response given to this part in the Authority’s review or subsequent correspondence.  
    He noted that the Gillies Report, a formal review document, stated as fact that Mr Eljamel was the Chair of the Clinical Governance Committee.  For this reason, the Applicant was concerned that the Authority had given the author inaccurate information and that this discrepancy itself pointed to a failure in the formal review process surround the activities of Mr Eljamel.
30. The Authority explained in its review and subsequent correspondence with the Applicant and the Commissioner, that Mr Eljamel was not the Chair of the Clinical Governance Committee; rather, he chaired the local Specialist Services Group Clinical Governance Committee, which was a subcommittee of the Surgery Clinical Governance meeting (which, at that time, reported up to the NHS Tayside Clinical Governance Committee).
31. The Authority submitted that the term “Clinical Governance Committee” might have been used in some contexts to refer to these committee structures.  However, the Authority stated that it was important to note that the formal Clinical Governance Committee - like all standing committees of the Board – was always chaired by a non-executive member of the NHS Tayside Board.  The Authority noted that this arrangement ensured appropriate oversight and accountability of officers and, as such, Professor Eljamel did not and would not have chaired the NHS Tayside Clinical Governance Committee.
32. The Authority explained that the Clinical Governance Committee was known as the Improvement and Quality Committee during the period 2006 to 2010 and it provided the Commissioner with links to annual reports and minutes (including records of attendance at meetings) from these committees at that time.
33. The Authority was questioned further on its searches for minutes of committee meetings or sub-committee meetings where Mr Eljamel might have been chair.  The Authority asked the Board Secretary and Information Governance Executive Lead, who explained that her team did not hold any records of clinical speciality areas’ clinical governance meetings, as these would be retained by the relevant clinical teams.  The Authority also asked the Patient Liaison Response Team, who were leading on information related to Mr Eljamel’s time at the Authority, and they confirmed that there were no meeting minutes held.
34. The Authority explained that any meeting minutes or related records that might have been created would have passed their destruction date (according to the retention policy) by the time the request was received and it believed this was the reason no such records were located despite all reasonable searches being carried out.
35. It was the Authority’s view that the first sentence of section 3 of the Gillies Report was factually inaccurate because of the statement that Mr Eljamel was chair of the Clinical Governance Committee, when in fact he chaired the local Specialist Services Group Clinical Governance meeting.  Given the length of time since the Gillies Report was commissioned, and the fact that those staff members involved in the commissioning had since retired, the Authority could not confirm whether this inaccuracy was raised with the report author during the drafting of the report.  Neither had the Authority consulted with the author regarding this issue following receipt of the Applicant’s information request.  
    Given that seven years had passed since the report was written, the Authority commented that it did not consider it appropriate to raise this matter now.

The Commissioner’s view

36. The Commissioner has considered the arguments of both parties.  While he acknowledges the Applicant’s concerns, the Commissioner is unable to comment on the accuracy (or otherwise) of the content of the Gillies Report.  That is not within his remit.
37. On the basis of the evidence presented to him, the Commissioner is satisfied that the Authority has carried out reasonable searches for the information captured by the first part of the request, and he accepts the position of the Authority that the information captured by the first element of part 7 is not held.
38. The Commissioner, therefore, finds that the Authority complied with section 1(1) of FOISA in responding to the first element of part 7.

Part 7 (second element)

The report identifies that Mr Eljamel was the "Chair of the Clinical Governance Committee" can you clarify … any other roles on the Committee he held over his time?

39. In its 2 June 2023 review outcome, the Authority had responded to the Applicant by giving an explanation of its committee structure and the role of Mr Eljamel within that; in particular, it noted that Mr Eljamel was chair of the Specialist Services Group Clinical Governance Committee from 2006 to 2010.  The Authority also provided the same links to its archive of committee minutes as discussed in paragraph 32.
40. In subsequent correspondence, on 6 September 2023, the Authority reaffirmed that Mr Eljamel was chair of the Specialist Services Group Clinical Governance Committee, but it stated that he was never chair of the Authority’s Clinical Governance Committee.  It referred to its retention schedules and commented that it did not hold any minutes of these meetings.

The Commissioner’s view

41. The Commissioner has carefully considered the information given by the Authority to part 7 of the Applicant’s request and, specifically, whether the Authority has addressed the information sought in the second element of this part.
42. Part 7 asked the Authority for information on “any other roles on the Committee he [Mr Eljamel] held over this time”.  While the Commissioner has accepted that the Authority has complied with Part 1 of FOISA in responding regarding the position of chair, he is not satisfied that the Authority has addressed whether, or not, any other roles on the Committee were held by Mr Eljamel.  Although such information could, perhaps, in theory, be pieced together from searching the archived minutes provided by the Authority, it is clear that the Authority has not given any explicit response to this element in its review outcome.
43. Given this, the Commissioner is not satisfied that the Authority has given a complete response to the second element of part 7 and, therefore, in this respect he is not satisfied that the Authority has complied with section 1(1) of FOISA.
44. The Commissioner requires the Authority to carry out fresh searches for any information falling within scope of the second element of part 7 and to provide an appropriate response to the Applicant.

Part 8

Can you provide any and all minutes of "The Clinical Governance Committee" when Eljamel held the role of Chair or other roles held on the CG Committee.

45. The Authority dealt with part 8 alongside part 7 in its review of 2 June 2023. Notwithstanding, the Commissioner will deal with each part of the request separately. 
46. In its submissions to the Commissioner the Authority explained that, while it retained all minutes and records of its standing committees permanently (including the NHS Tayside Clinical Governance Committee and its predecessor committee), minutes and records of Clinical Governance subgroups and committees, such as the Specialist Services Group, were prepared and held by the relevant operational teams.
47. The Authority stated that, between 2009 and 2020, its record retention schedules did not specify a distinct retention period for subgroup records, but the expectation and advice provided during that period aligned with the general correspondence retention period of three years.  The Authority noted that it had now introduced specific retention provisions for subgroup minutes (of six years).
48. The Applicant acknowledged that the Authority had disclosed its current and historical records retention schedules to him.  He raised his concern that the record retention schedules which were applicable to the time frame relevant to the subject of the request appeared to indicate that sub-committee minutes should be retained on a permanent basis and that this was contrary to the position put forward by the Authority.

The Commissioner’s view

49. The Commissioner has considered the records retention schedules disclosed by the Authority on 6 September 2023.  He notes that the advice given in these schedules does appear to indicate, on a plain English reading, that sub-committee minutes and meeting papers should be retained on a permanent basis.  He also notes that the Authority has since introduced a specific retention policy of 6 years for these type of minutes, but that this was not in place at the time of the request.
50. Having considered the explanations provided by the Authority and the wording of the original retention schedules, the Commissioner is not satisfied that the Authority does not hold the information requested by the Applicant, nor is he persuaded that the Authority carried out reasonable and proportionate searches for this information.  He therefore must find that the Authority failed to comply with section 1(1) of FOISA in responding to part 8 of the request.
51. The Commissioner requires the Authority to carry out fresh searches for this part of the request, and provide an appropriate response to the Applicant.   When doing so, the Commissioner would refer the Authority to section 6.2.6 of the  Scottish Ministers’ Code of Practice on the discharge of functions by Scottish public authorities under FOISA and the Environmental Information (Scotland) Regulations 2004 (the Section 60 Code), which recommends that authorities maintain a record of searches conducted.

Part 11

Whilst I understand the Royal College of Surgeons' report mentioned throughout this may have been provided under FOI before, for completeness can you provide both the "interim and final report" as mentioned in the writer's section 6.

52. The Applicant did not consider this request had been properly addressed by the Authority.
53. The Authority initially advised the Applicant, in its 2 June 2023 review outcome, that it had already disclosed this information in response to part 1 of the request.
54. When questioned on this during the Commissioner’s investigation, the Authority acknowledged that it might have misunderstood this part due to the volume and complexity of the request as a whole.  The Authority confirmed that the two reports that the Applicant asked for in part 11 were separate documents.
55. The Authority submitted that the Royal College of Surgeons’ report had been requested previously under FOISA and was published on its website.  The Authority commented that in accordance with Section 25 of FOISA – Information otherwise accessible – it was not required to provide information that was already publicly available.
56. The Authority was asked whether it held the interim and final reports, as sought by the Applicant in his request.  The Authority confirmed that it did hold the interim report and the final report and it provided unredacted copies of both for the Commissioner’s review.  The Authority explained that section 25 of FOISA only applied to the final version of the report and not to the interim report.
57. The Authority stated that significant volumes of personal data relating to patients and staff had been withheld from the published final version of the report under section 38 and section 30 of FOISA.

The Commissioner’s view

58. The Authority has acknowledged that it erred when it notified the Applicant, in its review outcome, that it had provided him with the information he had asked for in part 11 in its response to part 1.  It is clear that the Authority considered the wrong report when responding to the Applicant and, given this, the Commissioner is not satisfied that the Authority correctly interpreted the subject of this part in its review outcome of 2 June 2023.  Furthermore, the Commissioner is not satisfied that the Authority considered the Applicant's request for the interim report in its review outcome of 2 June 2023.
59. For the above reasons, the Commissioner finds that there has been a clear failing of section 1(1) of FOISA.
60. The Commissioner has considered the withheld information (two reports) that were provided to him, along with the Authority’s submissions.  The Authority has applied section 25 of FOISA to the final report, published on its website.  The Authority also submitted that the pages which are missing from the published version of the report are being withheld under section 38 and section 30 of FOISA.  
61. Under section 25(1) of FOISA, information which an applicant can reasonably obtain other than by requesting it under section 1(1) of FOISA is exempt from disclosure. 
    This exemption is not subject to the public interest test in section 2(1)(b) of FOISA.  Section 25(1) is not intended to prevent or inhibit access to information, but to relieve public authorities of the burden of providing information that an applicant can access readily without asking for it.
62. In this case, the Commissioner accepts that an incomplete version of the final report is published on the Authority’s website; however, this is arguably not what the Applicant requested (a plain reading of his request would be that he was seeking the full, unredacted, report).  In any case, in its review outcome, the Authority did not notify the Applicant that it was withholding the report under section 25(1), nor did it provide him with a weblink to the document; instead, its response to part 11 incorrectly referred to the report provided in response to part 1. 
63. In the circumstances, the Commissioner cannot uphold the application of section 25(1) of FOISA.
64. As noted above, the Authority advised the Commissioner that the information that was missing from the published final report was being withheld under section 30 and 38 of FOISA.  The Authority did not specify which subsection of section 30 it was relying on.
65. However, in the marked-up information provided to the Commissioner, the Authority only appears to have redacted personal data from the report (there is nothing that appears to be withheld under section 30) and in the schedule of documents provided with the report, it only states that information is being withheld under section 38 of FOISA.  Furthermore, apart from one line stating that the redactions were necessary to ensure that staff could speak freely and frankly during investigations, the Authority has not provided the Commissioner with any arguments in support of section 30. 
66. As the Authority has not identified the information that is being withheld under section 30 of FOISA, or confirmed which subsection of section 30 is being applied to the withheld information, or explained why the exemption applies and why the public interest favours withholding the information, the Commissioner cannot uphold the Authority’s reliance on section 30 of FOISA. 
67. The Commissioner also notes that while the schedule of documents indicates that the whole of the interim report is being withheld under section 38 of FOISA, the Authority has not provided any arguments explaining why it considers all of it to comprise third party personal data. 
68. In the circumstances, the Commissioner requires the Authority to carry out a revised review of its response to part 11 in respect of the interim report, and that it clearly indicates in the outcome what exemptions (if any) the Authority is relying on to withhold information.
69. The Commissioner will consider the information that has been withheld from the final report under section 38 of FOISA later in this decision.

Part 13

Regarding section 8 - the writer mentions that Eljamel applied to NHS Tayside for early retirement. Can you provide any and all documentary evidence of that application, making it clear to identify the recipients and the dates and times.

70. The Authority notified the Applicant that it was withholding this information under section 38(1)(b) of FOISA because it considered it to be the personal data of staff.
71. The Applicant disagreed with the withholding of this information.  Furthermore, he expressed concern that the Authority had not identified all of the information falling within scope of this part of the request.

The Commissioner’s view

72. The Commissioner has considered the withheld information provided to him by the Authority in relation to this part.  The withheld information provided to the Commissioner by the Authority comprised two letters, which appear to have been written after the receipt of the early retirement application referred to in the subject of the request, and one internal email which states the last date of service.  The Commissioner has not been provided with any correspondence or other communication, from Mr Eljamel to the Authority, in which he applied for early retirement, or any response in which that early retirement was formally granted.
73. The Commissioner considers that it is reasonable to assume, as the Applicant has done in making his request, that Mr Eljamel would have communicated his wish to retire to the Authority through some form of correspondence, such as a letter, email or form, and that the Authority would have granted Mr Eljamel’s request through similar means.  Additionally, the Commissioner considers it possible that there might have been some formal discussion around the possibility of Mr Eljamel’s retirement and, if so, it is a reasonable expectation that there would be records of this kept by the Authority.
74. The Commissioner cannot accept, based on the submissions and evidence provided by the Authority, that the Authority’s failure to identify this information means that it is not held.  On the contrary, the Commissioner considers it possible, even likely, that further information is held which would fall within the scope of part 13 the Applicant’s request.
75. The Commissioner is not satisfied that the Authority has identified all of the information falling within the scope of part 13, and therefore he must find that it has failed to comply with section 1(1) of FOISA.
76. The Commissioner requires the Authority to carry out additional searches for information which falls within scope of part 13 and to provide the Applicant with a revised review outcome, based on the outcome of those searches.  When conducting those searches, the Commissioner would advise the Authority to take account of section 6.2 of the Section 60 Code, which provides guidance on locating and retrieving information.
77. The Commissioner will consider the withheld information under section 38(1)(b) later in this decision.

Part 14

As a result of this report being received by Annie Ingram of NHS Tayside, can you provide any and all documents (including minutes of any meetings, memos, emails, etc) held to discuss the contents of the report, showing any actions taken or proposals for addressing the issues raised. This may include any communication with the teams at the front line of patient care who may have required assurance or correction regarding the outcomes.

78. The Authority initially disclosed some information in response to this part in the 2 June 2023 review outcome. The information partially disclosed comprised of one undated document titled “NHS Tayside response to Ms Tracey Gillies report into Professor Eljamel (received 24 June 2019)”, Clinical Risk Management Terms of Reference (dated March 2019), Adverse Event Management Policy (dated March 2019) and an undated document which appears to belong to University of Dundee Medical School called “Raising Concerns Policy”. 
79. The Authority withheld some information from the NHS Tayside response document under section 38(1)(b) of FOISA because it considered that to be the personal data of staff.
80. The Applicant raised concern that the documents provided to him were not contemporary with the issues surrounding Mr Eljamel.  He noted that that the dates of the Clinical Risk Management Terms of Reference and the Adverse Events Management Policy, in particular, stated that the versions which had been disclosed were both dated March 2019, suggesting this was prior to the Gillies Report.  The Applicant also raised his concern about undated documents.
81. The Applicant asked the Commissioner to investigate whether there was more contemporary information which fell within the scope of this part held by the Authority.
82. In its submissions, the Authority stated that there was one document which fell within scope of part 14 and that document had three appendices, hence the disclosure (with redaction) of four documents.
83. The Authority argued that the four documents related to the request as they showed the action plan and supporting policies that addressed the actions required as a result of the investigation.
84. The Authority stated that the information disclosed was what was identified and held at the time of the request.

The Commissioner’s view

85. The Commission cannot reconcile the Authority's position on this part of the request with the information that has been provided.  It seems reasonable to interpret, as the Applicant clearly did, given the version date of the Clinical Risk Management document and the Adverse Events Management Policy is March 2019, that these documents pre-date the issue of the Gillies Report in June 2019.  As a consequence, it is difficult to understand how these documents could possibly meet the terms of part 14 which asks for “all documentation” which discusses the content of the Gillies Report.
86. The Commissioner is not satisfied that the Authority took adequate steps to identify and locate all recorded information held that fell within the scope of part 14. He therefore finds that the Authority failed to respond to part 14 of the request in accordance with section 1(1) of FOISA.
87. The Commissioner requires the Authority to carry out and document adequate, proportionate searches (following the guidance in the section 60 Code) to determine what recorded information it holds falling within the scope of the part 14, thereafter providing the Applicant with a revised review outcome. 
88. The Commissioner will consider the information withheld under section 38(1)(b) of FOISA later on in this decision.

Whether information is held

89. In its review outcome of 2 June 2023, the Authority notified the Applicant that it did not hold information falling within the scope of parts 3(a), 3(c), 4(e), 4(f), 9 and 10 of the request.
90. The information to be given is that held by the authority at the time the request is received, as defined in section 1(4) of FOISA.  This is not necessarily to be equated with information an applicant believes the authority should hold, although an applicant’s reasons may be relevant to the investigation of what is actually held.  If no such information is held by the authority, section 17(1) of FOISA requires it to give the applicant notice in writing to that effect.

Part 3(a)

A spreadsheet of patients involved in the recall exercise.

91. In its 2 June 2023 review outcome, the Authority stated that it did not hold this information and it maintained this position in subsequent correspondence with the Applicant.
92. The Applicant considered the Authority's position was not credible.  The Applicant noted that it was explicitly stated in the Gillies Report that the author was given this information.  He argued that the spreadsheet was a key piece of evidence relating to the patient recall exercise and it was his view that the Authority held it.
93. During the investigation, the Authority appeared to change its position and, having further considered the request, the Authority identified a list of patients that might have been relevant to the information requested.  The Authority explained that the patient list it had identified was not complete and was not saved with other material relating to the Gillies Report.
94. The Authority was asked to clarify its position and to clearly state whether it held the information requested and whether it was withholding any of it.  The Authority was also asked to provide the information it had identified for the Commissioner’s consideration.

95. The Authority neglected to provide any clarification, repeating verbatim its previous comments in relation to this request, but it did provide the information for the Commissioner’s consideration and indicated that it was withholding it under section 38(1)(b) of FOISA because it was the personal data of patients.

    The Commissioner’s view

96. Although the Authority is unable to conclusively confirm whether the information identified was, in fact, the spreadsheet given to the author of the Gillies Report, the Commissioner is clear that the Authority considers the information contained in this spreadsheet would have been similar (if not the same) as the information contained in the spreadsheet given to the author; it appears to be a list of patients involved in the recall exercise.
97. In these circumstances, as the Authority has now identified this information and is withholding it under an exemption (section 38(1)(b) of FOISA) it is clear that the Authority was incorrect in stating that it did not hold the information in its review of 2 June 2023.
98. The Commissioner therefore finds that in failing to take adequate steps to identify and locate the requested information in responding to the Applicant, the Authority failed to comply with section 1(1) of FOISA.  In these circumstances, the Authority was incorrect to give the Applicant notice, in terms of section 17(1) of FOISA, that it held no information falling within the scope of this part of the request.
99. The Commissioner will consider the Authority’s updated position to withhold this information when considering section 38(1)(b) later in this decision.

Part 3(c)

Details of the adverse events contained within the Datix system printed in October 2018.

100. In its 2 June 2023 review outcome, the Authority stated that it did not hold this information and it maintained this position in subsequent correspondence with the Applicant.
101. The Applicant commented that it was stated in the Gillies Report that this information was provided to the author.  It was his view that the specific dated printout from an official system such as Datix, created for the purpose of a formal review, should absolutely be held by the Authority and would form a key part of the Authority’s defence in potential litigation.  He considered the Authority’s claim that this information was not held to be highly questionable and required investigation by the Commissioner.
102. When questioned on the searches it had carried out on the Datix system, the Authority submitted that it did not recall how the original searches of the Datix system were carried out as these original searches took place more than two years previously.
103. The Authority stated that it had carried out new searches of the Datix system for the information requested and these searches had not returned any information within scope of the request.
104. The Authority explained that the Datix system was a risk management and incident reporting system widely used within healthcare and the purpose of the system was to improve patient safety by capturing data, enabling investigation and to support learning from incidents.  The Datix system was in use at the time of the request and currently. The Authority explained that the retention period for information on the Datix system was ten years for non-serious (category 2 and 3) adverse events and permanent retention for serious (category 1) adverse events.
105. The Authority submitted that if any of the patients listed in the spreadsheet (discussed in part 3(a) of the request) were involved in an adverse event, it would have been recorded in the Datix system and the reports from each of these events would likely have been provided to the author of the Gillies Report. However, the Authority was unable to confirm this because it did not have any record of what was printed from the Datix system in October 2018.
106. The Authority acknowledged that the underlying data was, likely, still within the Datix system (unless deleted under retention policies) but the Authority submitted that it did not hold the printed record requested or any copy of it.

The Commissioner’s view

107. The Commissioner has considered the Authority’s position on this part of the request carefully.
108. The Commissioner notes that the Authority has no corporate memory of how the Datix system searches were carried out and no written record of which adverse events were contained in the printout mentioned in the request.  Section 6.2.3 of the Scottish Ministers’ Code of Practice on the Discharge of Functions by Scottish Public Authorities under the Freedom of Information (Scotland) Act 2002 and the Environmental Information (Scotland) Regulations 2004, (the Section 60 Code (1 December 2016) – the version which applied at the time of the request) states that authorities should maintain a record of searches conducted in order to provide helpful evidence for reviewers and, in the event of an appeal, to the Commissioner.  It is evident from the Authority’s submissions that no records have been kept of those searches that were carried out on the Datix system at the time of the request.
109. Notwithstanding, the Authority has acknowledged that the information contained in the printout requested is, most likely, still held within the Datix system; it simply does not know which of those records were contained in the printout.
110. As the information is held by the Authority, albeit not in the printout from October 2018, the Commissioner cannot accept that section 17(1) of FOISA applies in these circumstances.  He finds that the Authority was incorrect in giving notice to the Applicant that it did not hold this information and, as a consequence, failed to comply with section 1(1) of FOISA.
111. The Commissioner considers that the Authority, instead, should have given advice and assistance to the Applicant to help him specify the information he wants. Given that the Authority did not offer any advice or assistance to the Applicant in relation to this, the Commissioner finds that the Authority did not comply with its obligation under section 15(1) of FOISA.
112. The Commissioner requires the Authority to give advice and assistance to the Applicant to help him specify the information he requires.

Part 4(e)

A letter from Dr Andrew Russell to Professor John Connelly in his University role dated 17th February 2014.

113. In its 2 June 2023 review outcome, the Authority stated that it did not hold this information and it maintained this position in subsequent correspondence with the Applicant.
114. The Applicant did not accept that the Authority did not hold this correspondence.  He submitted that this letter was a formal communication between two senior figures (the Medical Director of NHS Tayside and a Professor at the University of Dundee) regarding a serious employment matter.  He argued that it was not credible that such a letter would not be retained. 
115. During the Commissioner’s investigation, the Authority identified this information. stating that it had discovered it within Mr Eljamel’s HR file when examining this file prior to digitising it for the Public Inquiry.  The Authority stated that it was now withholding this information under section 38(1)(b) of FOISA because it was private and confidential and formed part of an employee’s personal file.

The Commissioner’s view

116. It is a matter of fact that the Authority held this information at the time of the Applicant’s request but failed to identify it.
117. For this reason, the Commissioner must find that the Authority has failed to comply with section 1(1) of FOISA in responding to part 4(e).
118. The Commissioner will consider the Authority’s updated position to withhold this information under his comments on section 38(1)(b) later in this decision.

Part 4(f)

A letter from Dr Russell date~ 17th February 2014 to the GMC explaining that in view of Professor EI-Jamel's notification of intention to retire, NHS Tayside was not pursuing a formal investigation.

119. The Authority stated in its review of 2 June 2023 that it did not hold this information and it maintained this position in its initial comments to the Commissioner.
120. The Applicant refuted the Authority’s view that the information was not held.  He submitted that this was arguably one of the most critical documents he had requested, as it communicated a decision that allowed Professor Eljamel to avoid a full GMC fitness-to-practice hearing.  The Applicant argued that the idea that the Authority held no record of such a momentous communication to a regulatory body was unbelievable. 
121. During the investigation, the Authority explained that it had no knowledge of how the search for this information was carried out, given the time that had passed since the request was made.  However, a new search had been carried out and a letter, dated 20 February 2014, which otherwise appeared to match the letter referred to in the request, was located within a folder containing GMC correspondence.  The Authority noted that this letter was unsigned and it was, therefore, not possible to confirm with certainty who authored it or whether it was the letter requested.
122. The Authority provided the Commissioner with a copy of the letter for his consideration.

The Commissioner’s view

123. The Commissioner has considered the letter that has been identified by the Authority.  The Commissioner agrees with the Authority that, while the subject matter is clearly relevant, there is no certainty that the letter identified is the one referred to in the Applicant’s information request.
124. During his investigation, the Commissioner identified a timeline of correspondence disclosed by the Scottish Ministers for a separate (unrelated) information request (202300372703).  This timeline appeared to refer to the same document sought by the Applicant (page 12, column 5) and it also appeared to indicate the location of this document (MD1 Office).
125. As the Authority may hold the information requested, but simply cannot locate it, the Commissioner cannot be satisfied that the Authority has complied with section 17(1) of FOISA in giving notice to the Applicant that it does not hold the information that falls within scope of part 4(f) of the request.
126. The Commissioner requires the Authority to carry out additional searches for the information captured by part 4(f) and to provide the Applicant with a revised review outcome, based on the results of these new searches.

Part 9

The report states that "Professor Eljamel attended the Significant Adverse Review into the wrong site surgery of patient [redacted]" - can you provide the minutes of any Significant Adverse Review meetings regarding this case at which Eljamel attended or held a role?

127. In its review outcome on 2 June 2023, the Authority notified the Applicant that it did not hold the information requested, but that even if the information was held, it would be withheld under section 38(1)(b) of FOISA, as the Authority did not release personal information about people’s health.
128. The Applicant did not accept that the information was not held.  He commented that it was vital for public understanding to see the minutes of this meeting and he could not understand the Authority’s position that it held no record of this.
129. In submissions to the Commissioner, the Authority explained that it interpreted this request as seeking any notes/minutes written or typed draft or final of the meeting held regarding the Significant Adverse Review.
130. The Authority stated that the Patient Liaison Response Team files had been searched and no minutes were located.

The Commissioner’s view

131. The Commissioner has considered the wording of this part of the request carefully, alongside the submissions from both parties.  While he is satisfied that the Authority’s interpretation of this part and its searches for information were reasonable, he has some concerns about the Authority’s lack of advice and assistance to the Applicant.
132. It is the Commissioner’s view that the Authority should have considered the context of this request, given that the Applicant’s full request sought information that had been given to the author of the Gillies Report.  The statement quoted in the request (that "Professor Eljamel attended the Significant Adverse Review into the wrong site surgery of patient [redacted]” suggests that the author was given some form of record of the Significant Adverse Review that was carried out.  While it was reasonable for the Applicant to call such a record “minutes”, the Authority should have given advice on the nature of this record, including whether this recorded information was captured by any of the Applicant’s other requests.
133. While the Commissioner is satisfied that the Authority complied with section 17(1) of FOISA in giving the Applicant notice that it did not hold information calling within scope of this request, he also finds that the Authority failed to comply with section 15(1) of FOISA in failing to give the Applicant advice and assistance on the nature of the recorded information that he was seeking.
134. Although the Commissioner is not of the view that the Applicant’s request was so ambiguous as to fail to adequately specify the information requested, he considers that it would have been helpful for the Authority to have sought clarification of the request.
135. The Commissioner therefore requires the Authority to engage with the Applicant, in terms of section 15(1) of FOISA, to offer him advice and assistance to enable him to more clearly describe the information he is seeking in part 9.

Part 10

The report refers to a "a patient recall exercise of approximately 150 patients" – can you provide the report of 150 patients?  I understand some redaction for privacy / patient confidentiality will be required, but you should be able to show the types of activities/operations performed, the dates and other relevant data whilst hiding data such as the full patient name (note that the writer of this report uses initials to refer to patients) and date of birth.

136. In its review outcome of 2 June 2023, the Authority stated that it did not hold the information requested.
137. The Applicant commented that his request related to a major, large-scale patient safety exercise referred to in the Gillies Report.  He considered that the Authority’s position (that it did not hold this information) was not credible.
138. The Authority submitted that there was no over-arching report of the patient recall exercise written up and the exercise related to separate reviews of patient care on an individual basis.
139. The Authority acknowledged that the information captured by part 10 and that sought in part 3(a) was the same material, with part 3(a) asking specifically for the spreadsheet of patients involved in the patient recall exercise and part 10 asking for details of types of activities or operations performed and any other relevant data. 
140. The Authority also acknowledged that while it did hold this information (at the time it received the request), it did not know that the list of names was the list of people involved in the 2014-2015 look back of patients (i.e. it did not know that it held it).  It noted that it only discovered this at a later date, after speaking to one of the members of staff who helped to pull the list together.  It added that the list was not saved with the Tracey Gillies report, and it was held in another area, therefore it was not clear what the list actually was.  It noted that that list it held did not contain the names of all of the patients involved in the review, only most of them. 

The Commissioner’s view

141. The Commissioner has significant concerns about the Authority’s handling of this part of the request.  In particular, the Commissioner considers that the Authority has taken a very narrow interpretation of part 10 of the request.  The Applicant has clearly described the information he is seeking and the Authority should have been able to interpret part 10 reasonably, given that what is described is essentially what is contained within the spreadsheet captured by part 3(a).
142. The Commissioner notes that the Authority’s position appears to be that while it now accepts that it did hold a list of the patients (albeit not a complete list) at the time it received the request, it did not know that the information was held, as it was not filed where it would have expected it to be filed.  This suggests poor records management, and the Commissioner would urge the Authority to ensure it is complying with the Code of Practice on Records Management (the Section 61 Code).
143. In the circumstances, as the Authority has now identified information falling within the scope of part 10 of the request (which is being withheld under section 38(1)(b) of FOISA) it is clear that the Authority was not entitled to give the Applicant notice, under section 17(1) of FOISA, that the information was not held. The Commissioner must find that the Authority did not comply with section 1(1) of FOISA, in relation to part 10.
144. The Commissioner will consider the Authority’s updated position to withhold this information under section 38(1)(b), later in this decision.

Section 38(1)(b) – personal information (in relation to staff)

145. The Authority applied section 38(1)(b) in withholding the personal information of individuals in relation to parts 1, 3(a) and (b), 4(a) to (f), 5 (all sub parts), 10, 11, 12, 13 and 14 of the request.
146. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is “personal data” (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or (where relevant) in the DPA 2018.
147. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption.  This means that it is not subject to the public interest test in section 2(1)(b) of FOISA.
148. To rely on this exemption, the Authority must show that the withheld information is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles found in Article 5(1) of the UK GDPR.
149. Article 9 of the UK GDPR describes personal data that falls within the special categories of personal data, including where it reveals information about an individual’s health.

Is the withheld information personal data?

150. The first question that the Commissioner must address is whether the withheld information is personal data for the purposes of section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable individual. "Identifiable living individual" is defined in section 3(3) of the DPA 2018.  (This definition reflects the definition of personal data in Article 4(1) of the UK GDPR.)
151. Information which could identify individuals will only be personal data if it relates to those individuals.  Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.
152. During the investigation the Authority was asked to explain, for each part of the request, in relation to the information that it was withholding under section 38(1)(b) of FOISA, why it considered that specific information to be personal data. The Authority declined to do so, and instead responded generally, for all of the information it had withheld under the exemption.
153. The Authority submitted that it considered information relating to its staff to be personal data for the purposes of section 3 of the DPA 2018 because individuals could be identified from their names and email addresses.
154. The Authority also submitted that some of the withheld information related to patients and that information about an individual’s health was that individual’s personal data.
155. The Applicant challenged the Authority’s withholding of third party personal data. He suggested that the Authority had redacted more than just personal data. 
156. The Applicant raised specific concern in relation to the Authority’s withholding of names, job titles and positions of junior staff.  It was his view that where this information was already publicly available it should be disclosed in response to his request.  The Applicant stated that even if names were redacted, the individual’s title or position should be disclosed, given the importance of the information captured by his request.
157. The Commissioner is satisfied that most of the information identified by the Authority is personal data for the purposes of the DPA 2018.  In particular, he finds that names, contact details and health information are all personal data.
158. In guidance on the application of the UK GDPR, the UK Information Commissioner states that “personal data is information that relates to an identified or identifiable individual”.
159. In relation to job titles or position, the Commissioner notes that only a very small amount of the withheld information relates to a specific individual’s job title or position and the Commissioner has considered this information carefully.
160. Given the number of staff employed by the Authority, the generic description of most of the job titles, and the passage of time since the subject of the request, the Commissioner is not persuaded that this particular information is personal data for the purposes of the UK GDPR. He does not accept that disclosure of most of the job titles of junior members of staff would identify a living individual. As the Commissioner has determined that most of the job titles of junior staff are not personal data, he requires this information to be disclosed. 
161. The Commissioner notes that there is one instance of a job title of a junior staff member which appears to be unique and which the Commissioner considers could identify a living individual and, therefore, is personal data.  He will consider this alongside the remainder of the withheld third party personal information in question (i.e. the names and contact details of staff and other information about staff and patients).  The Commissioner is satisfied that this remaining information “relates to” identifiable living individuals and is therefore personal data, for the purposes of section 3(2) of the DPA 2018. 
162. He also considers that some of the withheld information (patient health information) is special category data.

Special category data

163. Article 9 of the UK GDPR sets out special categories of data, which are personal data which is considered to need further protection because of its particular sensitivity.  This includes health information. 
164. The Commissioner is satisfied that some of the information in the spreadsheet identified for parts 3(a) and 10, and some of the information captured by parts 1, 3(b) and 5(b) would, if disclosed, reveal health information about individuals within the Authority’s care.  He considers that these data, therefore, meet the definition of special category data.

Lawfulness (special category data)

165. The Commissioner has accepted that the information would be special category data for the purposes of Article 9(1) of the UK GDPR.  Special category personal data is afforded more protection by the UK GDPR.  To be lawful, their processing must meet one of the conditions in Article 9(2) of the UK GDPR.
166. The Commissioner’s guidance on section 38 of FOISA notes that Article 9 of the UK GDPR only allows special category personal data to be processed in very limited circumstances.  He considers that the only situations where it is likely to be lawful to disclose special category personal data in response to an information request under FOISA is where the condition in Article 9(2)(e) of the UK GDPR applies.

Article 9(2)(e): Manifestly made public

167. Article 9(2)(e) of the UK GDPR allows special category personal data to be processed where the personal data have manifestly been made public by the data subjects.
168. “Processing" of personal data is defined in section 3(4) of the DPA 2018.  It includes (section 3(4)(d)) disclosure by transmission, dissemination or otherwise making available personal data. The definition therefore covers disclosing information into the public domain in response to a FOISA request.
169. Neither the Authority nor the Applicant has suggested that the personal data have manifestly been made public by the data subjects.
170. The Commissioner is satisfied that the information would not have been made public as a result of steps deliberately taken by the data subjects, and so condition 2(e) could not be met in this case.  It is not information of a kind it would be reasonable to expect would be made public in such a manner.
171. In the circumstances, the Commissioner must conclude that, in the absence of a condition in the UK GDPR allowing the special category personal data to be processed, that disclosure of patient data held in relation to parts 1, 3(a), 10, 3(b) and 5(b) of the request would be unlawful.  Consequently, he is satisfied that the personal data of patients in these documents was correctly withheld under section 38(1)(b) of FOISA.

Personal data (that is not special category data) - Will disclosure contravene one of the data protection principles?

172. The Authority stated that disclosure of personal data related to its staff would contravene the first data protection principle (Article 5(1)(a)).  Article 5(1)(a) states that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.
173. The Authority also stated that disclosure of personal data related to patients would contravene Article 9(1) of the UK GDPR because it was the health data of those individuals.  The Commissioner has considered these data above.
174. The Commissioner will now consider the processing of data under Article 5(1)(a) of the UK GDPR separately, as follows.

Article 5(1)(a) of the UK GDPR

175. The remaining information withheld under section 38(1)(b) comprises the personal data of staff and is the remaining information captured by parts 1, 3(a) and (b), 4((a) to (f)), 5 (all sub parts), 11, 12, 13 and 14.
176. In terms of section 3(4)(d) of the DPA 2018, disclosure is a form of processing.  In the case of FOISA, personal data is processed when it is disclosed in response to an information request.
177. The Commissioner must now consider if disclosure of the personal data would be lawful (Article 5(1)(a)).  In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed.  The Commissioner considers condition (f) in Article 6(1) to be the only one which could potentially apply in the circumstances of this case.

Condition (f) - legitimate interests

178. Condition (f) states that the processing shall be lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.
179. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
      
180. The tests which must be met before Article 6(1)(f) can be met are as follows:
     1. Does the Applicant have a legitimate interest in obtaining the personal data?
     2. If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?
     3. Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?

Does the Applicant have a legitimate interest in obtaining the personal data?

181. The Authority acknowledged that requesters might have a legitimate interest in accessing information held by public authorities.  However, the Authority argued that in this case, the Applicant had not explicitly stated a legitimate interest that would justify the disclosure of personal data relating to staff conduct or disciplinary matters.
182. It was the Authority’s view that, even if a legitimate interest were established, it did not consider that disclosure of the personal data was necessary to achieve that interest.  The Authority argued that the requested information related to sensitive employment matters, and there were no compelling grounds to override the data subjects’ rights and freedoms.
183. The Applicant stated that he fundamentally disagreed with the extensive redactions made under section 38(1)(b) of FOISA.  It was his view that the redactions went far beyond protecting personal data and served to obscure critical findings about systemic failures.
184. In regard to the names of staff members, the Applicant stated that senior staff members of any NHS Health Board or NHS Scotland body, whose details were already in publicly available documents, should have their names, titles, and positions disclosed.  He argued that their details were permitted for public disclosure in other contexts, and he did not consider that typical legal considerations regarding personal data or commercial sensitivities applied.  He gave an example that, if a name appeared in a public NHS Tayside policy or board minutes, it should be listed in this investigation.
185. The Applicant argued that, given the importance [and context] of the Gillies Report, even if names were lawfully withheld, he considered that the individual's title or position should still be published.
186. The Commissioner accepts that the Applicant, and the wider public have a legitimate interest in scrutinising the response of the Authority to the conclusions of the Gillies Report and in the wider context surrounding the employment of Mr Eljamel.  These are undoubtedly matters of significant public concern.  The Commissioner is therefore satisfied that the Applicant has a legitimate interest in obtaining the personal data.

Is disclosure necessary to achieve that legitimate interest?

187. The next question is whether disclosure of the personal data would be necessary to achieve the legitimate interest in the information.  “Necessary” means “reasonably” rather than “absolutely” or “strictly” necessary.  
      
188. When considering whether disclosure would be necessary, public authorities must consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the Applicant’s legitimate interest could reasonably be met by means which interfered less with the privacy of the data subject.
189. The Commissioner is not aware of any other means by which the Applicant’s legitimate interest could be met.  The Applicant would not be able to obtain this information in any other way, and it is not information which is obviously in the public domain.  In all the circumstances, the Commissioner agrees that disclosure would be necessary to achieve the Applicant’s legitimate interest in this case
190. The Commissioner will now consider whether the Applicant’s legitimate interest in obtaining the withheld information outweighs the rights and freedoms of the data subject(s).

The data subject(s) interests or fundamental rights and freedoms (and balancing exercise)

191. The Commissioner has concluded that the disclosure of the information would be necessary to achieve the Applicant’s legitimate interest.  However, the Commissioner must balance the legitimate interests in disclosure of the information, against the data subjects interests or fundamental rights and freedoms.  In doing so, it is necessary for him to consider the impact of such a disclosure.  For example, if a data subject would not reasonably expect that the information would be disclosed to the public under FOISA in response to the request, or if such disclosure would cause unjustified harm, their interests or rights are likely to override any legitimate interests in disclosure.  Only if the legitimate interests of the Applicant outweigh those of the data subject could the information be disclosed without breaching the first data protection principle.
192. The Commissioner's guidance on section 38 of FOISA notes factors that should be taken into account in balancing the interests of parties.  He notes that Recital (47) of the General Data Protection Regulation states that much will depend on the reasonable expectations of the data subjects.  
193. The Authority submitted that the personal data in question was held for employment-related purpose and to support the delivery of healthcare services.  It considered that disclosure under FOISA would represent a repurposing of that data, which was incompatible with the original purpose and that there lacked a lawful basis for disclosure under Article 6 of UK GDPR. 
194. The Authority argued that its policy outlined a consistent approach to the handling of personal data, including restrictions on the disclosure of staff names below Band 8b. It noted that while senior staff names might be disclosable in some contexts, the content of the information requested in this case related to sensitive employment matters and that, therefore, disclosure would breach the first data protection principle.
195. The Authority submitted that staff members had a reasonable expectation of privacy, particularly in relation to disciplinary matters, and disclosure could result in distress, reputational harm or other adverse consequences.
196. The Authority argued that the requested information related to sensitive employment matters, and there were no compelling grounds to override the data subjects’ rights and freedoms.
197. The Commissioner has considered the submissions from the Applicant and the Authority carefully alongside the content of the withheld information and the remaining personal data that is under consideration.  He has reached his view only after thinking very carefully about the circumstances of the case, and he will consider each type of personal data in turn.

Personal data of junior staff

198. A discussed earlier, there is a very small amount of personal data relating to junior members of staff that requires consideration, including the job title of one member of staff.  The Commissioner recognises that junior employees would not have had any reasonable expectation that their names, contact details or job titles would be made public. 
199. After carefully balancing the legitimate interest of the Applicant against the interests or fundamental rights or freedoms of the data subjects, the Commissioner finds that the legitimate interest served by disclosure of any information held would be outweighed by the unwarranted prejudice that would result to the rights and freedoms or legitimate interests of the data subjects (junior members of staff).
200. Having found that the legitimate interest served by disclosure of the personal data is outweighed by the unwarranted prejudice that would result to the rights and freedoms or legitimate interests of the data subjects, the Commissioner finds that condition (f) in Article 6(1) of the UK GDPR cannot be met in this case and that disclosure of the information in question would be unlawful.
201. Given that the Commissioner has concluded that the processing of the personal data would be unlawful, he is not required to go on to consider whether disclosure of the personal data would otherwise be fair and transparent in relation to the data subjects.
202. The Commissioner is satisfied, in the absence of a condition in Article 6 of the UK GDPR which would allow the data to be disclosed, that disclosure of the personal data of junior staff would be unlawful.  He therefore finds that the personal data of junior staff is exempt from disclosure under section 38(1)(b) of FOISA.

Personal data of senior staff

203. The Commissioner notes that many of the names that have been withheld by the Authority are the names of senior members of staff within the Authority or at other organisations, many of whom are known in their positions within the public domain and who are also known, publicly, for their involvement in the investigation surrounding Mr Eljamel.  He has borne in mind that the focus of that investigation was Mr Eljamel rather the other named individuals.  In the circumstances, he considers that these individuals must have had some expectation that their names would be disclosed in relation to their involvement with Mr Eljamel, given the extensive media coverage which has been ongoing for several years (prior to the Applicant making his request). 
204. In the circumstances, the Commissioner finds that condition (f) in Article 6(1) of the UK GDPR can be met in relation to the personal data of senior staff. 

Personal data of Mr Eljamel

205. The Commissioner has considered the personal data relating to the employment of Mr Eljamel and in relation to the investigation about his conduct while employed at the Authority. There is evidently an overwhelming public interest in these matters (for the patients affected and the wider local and Scottish public as users or potential users of health services), as evidenced by the ongoing criminal investigation, Public Inquiry and Independent Clinical Review (and the matter, including his departure from the Authority’s employment, has been the subject of extensive media coverage).  In these contexts, taking into consideration the content of the data in question, the Commissioner is not persuaded that Mr Eljamel could suffer from any additional reputational harm if the personal data related to him that are being withheld were to be disclosed.
206. Having carefully balanced the legitimate interests of the Applicant against the interests or fundamental rights or freedoms of the data subject, the Commissioner finds that the legitimate interests served by disclosure of the vast majority of the personal data would not be outweighed by any unwarranted prejudice that would result to the rights and freedoms and legitimate interests of the data subject.
207. The Commissioner does not accept that either the consequences, or the distress to the data subject, identified by the Authority would occur as a necessary consequence of disclosure of the withheld information, or that disclosure would make their occurrence more likely.  Therefore, he cannot accept that these concerns are sufficient to override the legitimate interests of the Applicant.
208. In the circumstances of this particular case, the Commissioner finds that condition (f) in Article 6(1) of the UK GDPR can be met in relation to these withheld personal data.

Fairness

209. The Commissioner must also consider whether disclosure of Mr Eljamel’s personal data or the personal data of senior staff would be fair.  He finds, for the same reasons as he finds that condition (f) in Article 6(1) can be met, that disclosure of Mr Eljamel’s personal data and the personal data of senior staff would be fair.

Conclusion on the data protection principles

210. Having carefully balanced the legitimate interests of the Applicant against the interests or fundamental rights or freedoms of the data subjects, the Commissioner finds that the legitimate interests of the Applicant served by disclosure of Mr Eljamel’s personal data and the personal data of senior staff outweigh any unwarranted prejudice that would result to the rights and freedoms and legitimate interests of the data subjects. 
211. The Commissioner’s conclusions in respect of the personal data of junior employees are set out at paragraphs 198 to 202.
212. The Commissioner requires the Authority to disclose the incorrectly withheld information to the Applicant and he will provide the Authority with a marked up copy of the information he requires it to disclose.

Decision 

The Commissioner finds that the Authority partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.

The Commissioner finds that by giving notice that information was not held for part of parts 7 and 9 of the request, and by correctly withholding some personal data for parts 1, 3(a) and (b), 4((a) to (f)), 5 (all sub parts), 10, 11, 12, 13 and 14 the Authority complied with Part 1.

However, the Authority failed to comply with Part 1 of FOISA by:

• failing to provide a complete response to parts 2, 4(c), 7, 11, 13 and 14,
• informing the Applicant that it did not hold information for parts 3(a), 3(c), 4(f), 8 and 10,
• incorrectly withholding some personal data for parts 1, 3(a) and (b), 4((a) to (f)), 5(all sub parts), 10, 11, 12, 13 and 14, under section 38(1)(b) of FOISA.

The Commissioner therefore requires the Authority to

• disclose the information incorrectly withheld under section 38(1)(b) of FOISA
• contact the Applicant and offer him advice and assistance, under section 15(1) of FOISA, to help him identify the information he is seeking in parts 3(c) and 9
• carry out a revised review of its responses to parts 2, 4(f), 7, 8, 11, 13 and 14 (which must include new searches for information, evidence of which must be retained and sent to the Commissioner)

by 17 September 2026.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply. The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

David Hamilton

Scottish Information Commissioner

3 August 2026

Appendix A:  The request

Regarding the report by Tracey Gillies (Executive Medical Director, NHS Lothian) from 8th April 2019 instigated by Annie Ingram of NHS Tayside at the time entitled "Review of NHS Tayside's Investigation of Professor Eljamel". Can you:

1.Include the full report in your response.

2.The report mentions that the writer had been given "a number of documents in advance and the Terms of Reference" – can you include these in your response. I understand that these may be duplicate requests below, but it is unclear from the report if that is the case.

3.The report mentions that the writer was provided the following documents - can you provide these? (I understand some redaction may be necessary due to patient confidentiality, but it would be helpful to know enough to allow understanding of the scale of the problems)

       a) "A spreadsheet of patients involved in the recall exercise."

       b)"The significant. clinical event analysis (2012, case 33) and the tabular timeline used as part of the root cause analysis."

       c)"Details of the adverse events contained within the Datix system printed in October 2018."

4. The report mentions that the writer was provided the following documents - can you provide these?

a) "A letter from Mr Philip. McLaughlin to Professor Eljamel dated 21st June 2013."

b) The interim letter from the Royal College of Surgeons dated 4th October 2013."

c) "The final report from the Royal College of Surgeons dated 6th December 2013."

d) "A letter from Dr Andrew Russell to the GMC (Mr Willie Paxton) dated 20 th December 2013."

e) "A letter from Dr Andrew Russell to Professor John Connelly in his University role dated 17th February 2014."

f) "A letter from Dr Russell date~ 17th February 2014 to the GMC explaining that in view of Professor EI-Jamel's notification of intention to retire, NHS Tayside was not pursuing a formal investigation."

g) "Details of the GMC entry and conditions place on the registration of Professor El~Jamel from 26th February 2014."

5. The report mentions that the writer was provided the following documents, regarding "NHS Tayside's reflections and learning" - can you provide these?

a) "A letter from Dr Lee Jordan concerning his initial and final observations."

b) "The SBAR briefing provided to the Chief Executive and Chairman dated 1st August 2018."

6. Can you define, in the context of the document request in 4 - what 'SBAR' means?

7. The report identifies that Mr Eljamel was the "Chair of the Clinical Governance Committee".  Can you clarify the dates he was the Chair, and any other roles on the Committee he held over his time?

8. Can you provide any and all minutes of "The Clinical Governance Committee" when Eljamel held the role of Chair, or other roles held on the CG Committee.

9. The report states that "Professor Eljamel attended the Significant Adverse Review into the wrong site surgery of patient [redacted]” - can you provide the minutes of any Significant Adverse Review meetings regarding this case at which Eljamel attended or held a role?

10.The report refers to a "a patient recall exercise of approximately 150 patients" – can you provide the report of 150 patients? I understand some redaction for privacy / patient confidentiality will be required, but you should be able to show the types of activities/operations performed, the dates and other relevant data whilst hiding data such as the full patient name (note that the writer of this report uses initials to refer to patients) and date of birth.

11.Whilst I understand the Royal College of Surgeons' report mentioned throughout this may have been provided under FOI before, for completeness can you provide both the "interim and final report" as mentioned in the writer's section 6.

12. Again, regarding section 6. Can you provide the emails mentioned between Mr Mowle and Eljamel.

13. Regarding section 8 - the writer mentions that Eljamel applied to NHS Tayside for early retirement. Can you provide any and all documentary evidence of that application, making it clear to identify the recipients and the dates and times.

14. As a result of this report being received by Annie Ingram of NHS Tayside, can you provide any and all documents (including minutes of any meetings, memos, emails, etc) held to discuss the contents of the report, showing any actions taken or proposals for addressing the issues raised. This may include any communication with the teams at the front line of patient care who may have required assurance or correction regarding the outcomes.