Home Decisions

Decision 207/2025

Decision 207/2025: Rail Settlement Plan ticket specification and public keys


Authority: ScotRail Trains Ltd
Case Ref: 202500407
 

Summary

The Applicant asked the Authority for Rail Settlement Plan ticket specification and public keys. The Authority informed the Applicant that it did not hold the information requested.  During the investigation, the Authority accepted that it held the information requested and withheld it under exemptions in FOISA.  The Commissioner required the Authority to issue the Applicant with a new review outcome in which it confirmed it held the information requested and notified them of the exemptions it was now relying on.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 17(1)(Notice that information is not held); 47(1) and (2) (Application for decision by Commissioner).

Background

  1. On 22 November 2024, the Applicant made a request for information to the Authority. They asked for:

  • Rail Settlement Plan Aztec ticket type "06" specifications - ordinary travel tickets

  • Rail Settlement Plan Aztec ticket type "08" specifications - digital railcards

  • Any other Rail Settlement Plan specifications you hold on the issuance of Aztec barcodes and/or digital tickets for the railways

  • Public RSA keys/certificates used by you to issue such Aztec barcodes, in either X.509, PKCS#1, PKCS#12, or other appropriate format for conveying the public half of an encryption key

  • The same public keys of any other issuer who can issue digital tickets valid on rail services under your purview. 

  1. The Authority responded on 18 December 2024.  It issued the Applicant with a notice, in terms of section 17(1) of FOISA that it did not hold the information requested and explained why.
  2. Later that same day, the Applicant wrote to the Authority requesting a review of its decision. They stated that they were dissatisfied with the Authority’s decision because they did not believe that it did not hold the information requested.
  3. The Authority responded on 20 December 2024.  It said that it was treating the Applicant’s previous email as a request for clarification of its original decision.  It further explained why it did not hold the information requested.
  4. On 17 February 2025, the Applicant wrote to the Authority requesting a review of its decision. They again stated that they were dissatisfied with the Authority’s decision because they did not believe that it did not hold the information requested.
  5. The Authority notified the Applicant of the outcome of its review on 13 March 2025, which fully upheld its original decision.
  6. On 17 March 2025, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  They were dissatisfied with the outcome of the Authority’s review because:

  • they did not believe that the Authority did not hold the information requested.

  • the Authority’s review outcome had failed to address the second part of their request.

  1. Following contact from the Commissioner’s office, the Authority responded again to the Applicant on 21 March 2025.  In terms of the Applicant’s concern that it had failed to address the second part of their request, the Authority confirmed that it was also issuing a notice, in terms of section 17(1) of FOISA, in relation to this part of their request.
  2. On 5 April 2025, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  They stated that they were dissatisfied with the outcome of the Authority’s review because they did not believe that the Authority did not hold the information requested.  
  3. The Applicant also said that they disagreed with the Authority’s decision to refuse their request “on grounds of prevention of crime” for the reasons they had set out in a related application to the Commissioner.  However, at this stage, the Authority had not applied any exemptions in FOISA to withhold information from the Applicant: its position was that it did not hold the information requested.

Investigation

  1. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
  2. On 9 April 2025, the Authority was notified in writing that the Applicant had made a valid application.  The case was subsequently allocated to an investigating officer.
  3. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application and to answer specific questions.  These related to how the Authority had established that it did not hold the requested information. 

Commissioner’s analysis and findings

  1. The Commissioner has considered all the submissions made to him by the Applicant and the Authority. 

Section 17(1) – Notice that information is not held

  1. Section 1(1) of FOISA provides that a person who requests information from a Scottish public authority which holds it is entitled to be given that information by the authority, subject to qualifications which, by virtue of section 1(6) of FOISA, allow Scottish public authorities to withhold information or charge a fee for it.  The qualifications contained in section 1(6) are not applicable in this case.
  2. The information to be given is that held by the authority at the time the request is received, as defined by section 1(4). If no such information is held by the authority, section 17(1) of FOISA requires it to give the applicant notice in writing to that effect.
  3. During the investigation, the Authority reconsidered its position and confirmed that it held the information requested for the purposes of FOISA.   It said that the information requested was held by the Rail Delivery Group on behalf of its members, of which it was one.
  4. As the Authority has accepted that it does hold the information requested for the purposes of FOISA, the Commissioner must find that the Authority was not entitled to issue the Applicant with a notice, in terms of section 17(1) of FOISA, that it did not hold the information requested.
  5. The Authority stated that it now considered the information requested to be exempt from disclosure under the exemptions in sections 33(1)(b) (substantial prejudice to commercial interests) and 35(1)(a) (prevention or detection of crime) of FOISA.
  6. The grounds for dissatisfaction set out in the Applicant’s application are largely restricted to their disagreement with the Authority’s position that it did not hold the information requested, although they did – intentionally or otherwise – pre-empt the Authority’s reliance on the exemption in section 35(1)(a) of FOISA.  However, as stated above, the Authority is also withholding the information requested under the exemption in section 33(1)(b) of FOISA – an exemption the Applicant has not had the opportunity to consider or challenge in their application.
  7. Given this, the Commissioner requires the Authority to provide the Applicant with a revised review outcome (in terms of section 21(4)(b) of FOISA), which lists the exemptions that the Authority is now seeking to apply, and which explains, in detail, why the Authority considers these exemptions to be relevant.  This will enable the Applicant to make a new application in which they can fully challenge the Authority’s reasons for withholding information from them.

Decision 

The Commissioner finds that the Authority failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant. 

Specifically, the Commissioner finds that the Authority was not entitled to issue the Applicant with a notice, in terms of section 17(1) of FOISA, that it did not hold the information requested.

The Commissioner requires the Authority to issue the Applicant with a new response to their requirement for review, in terms of section 21(4)(b) of FOISA, by 16 October 2025. 

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement 

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply.  The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

 

Euan McCulloch 

Head of Enforcement 


1 September 2025