Decision 233/2025:  UCEA members’ guidance on dealing with FOI requests

Authority: Heriot-Watt University
Case Ref: 202301296
 

Summary

The Applicant asked the Authority for UCEA members’ guidance on responding to Freedom of Information (FOI) requests.  The Authority withheld the information on the grounds that it was confidential.  The Commissioner investigated and found that the information had been wrongly withheld.  He required the Authority to disclose the information.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 36(2) (Confidentiality); 47(1) and (2) (Application for decision by Commissioner).

Background

1. On 15 August 2023, the Applicant made a request for information to the Authority.  He asked for digital copies of:

   1) The UCEA (Universities and Colleges Employers Association) Members Guide to Negotiations in Higher Education

   2) Guidance on FOI requests for UCEA documents

   The Applicant provided links which made clear which specific documents he was requesting.

2. The Authority responded on 7 September 2023.  It refused to disclose the documents on the grounds that they had been received in confidence from UCEA and it withheld them under section 36 b. of FOISA [later clarified as 36(2) of FOISA].
3. On 7 September 2023, the Applicant wrote to the Authority requesting a review of its decision. The Applicant stated that he was dissatisfied with the decision because he did not agree that the information attracted the necessary quality of confidence, and he did not accept that any such disclosure would be actionable.  Furthermore, the Applicant challenged whether the exemption at section 36(2) could even be engaged, given that the Authority was itself part of UCEA.
4. The Authority notified the Applicant of the outcome of its review on 5 October 2023. It upheld its original decision to withhold the information under 36(2) of FOISA.
5. On 20 October 2023, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA in relation to request (2) (he did not wish to challenge the response to request (1)).  The Applicant stated that he was dissatisfied with the outcome of the Authority’s review because he did not agree that disclosure of the information would cause harm which would in turn motivate a court action for breach of confidence, and he provided reasons for this view.

Investigation

6. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
7. On 9 November 2023, and in line with section 49(3)(a) of FOISA, the Commissioner gave the Authority notice in writing of the application and invited its comments.
8. The Authority was also asked to send the Commissioner the information withheld from the Applicant.  The Authority provided the information and the case was subsequently allocated to an investigating officer.

Commissioner’s analysis and findings

9. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority. 

Section 36(2) of FOISA – Confidentiality

10. Under section 36(2) of FOISA, information is exempt from disclosure if it was obtained by a Scottish public authority from another person (including another such authority) and its disclosure by the authority so obtaining it to the public (otherwise than under FOISA) would constitute a breach of confidence actionable by that person or any other person.
11. Section 36(2) is an absolute exemption and is not, therefore, subject to the public interest test in section 2(1)(b) of FOISA.  However, it is generally accepted in common law that an obligation of confidence will not apply if the disclosure of the information is necessary in the public interest.
12. Section 36(2) contains a two-stage test, both parts of which must be fulfilled before the exemption can be relied upon.

Information obtained from another person

13. The first test is that the information must have been obtained by a Scottish public authority from another person.  "Person" is defined widely and means another individual, another Scottish public authority or any other legal entity, such as a company or partnership.
14. The Authority stated that it had received the requested information in confidence from UCEA.
15. The Commissioner notes that the Authority is a member of UCEA and he has considered the nature of UCEA,  a members’ organisation in corporate form.  Its 169 members (at the time of issue of this Decision Notice) are public bodies.  The UCEA website states that membership is available to UK higher education providers, which must meet the eligibility criteria, and that member organisations are encouraged to nominate as many relevant team members and specialist role-holder as they wish to have access to UCEA resources and activities.
16. It is clear that UCEA itself has its own resources which are accessible to nominated individuals from member organisations.  While it is essentially a creature of its members, established to look after their interests, it does have a distinct legal personality of its own. The Commissioner accepts, in the circumstances, that the withheld information was technically obtained by the Authority from another person and that the first part of the section 36(2) test has been fulfilled.

Actionable breach of confidence

17. The second part of the test is that the disclosure of the information by the public authority must constitute a breach of confidence actionable either by the person who gave the information to the public authority or by any other person.  Paragraph 35 of the Commissioner’s guidance on section 36(2) of FOISA [1] is clear that the fact that information is marked “confidential” will not be enough to show that its disclosure would constitute an actionable breach of confidence.  The Commissioner takes the view that “actionable” here means that the basic requirements for a successful action must appear to be fulfilled.
18. There are three main requirements which must be met before a claim for breach of confidence can be established to satisfy the second element to this test.  These are: 

    1. the information must have the necessary quality of confidence; 

    2. the public authority must have received the information in circumstances which imposed an obligation on it to maintain confidentiality; and 

    3. unauthorised disclosure must be to the detriment of the person who communicated the information.   

Necessary quality of confidence

19. The Commissioner’s guidance on section 36(2)[2] of FOISA also explains that the information which can be protected by the law of confidence is wide-ranging (from personal data to information about trade and business) and there will be many relationships which give rise to duties of confidence. The guidance provides examples of some of the factors which will need to be considered when deciding whether information has the necessary quality of confidence: 

    1. the information must not be common knowledge; a member of the public would have to apply skill and labour to produce the information; 

    2. the passage of time will be relevant, particularly for contractual information relating to pricing, which often loses relevance (and any element of confidentiality) with the passage of time; 

    3. where the information can be ascertained from other information which is in the public domain with relative ease, the necessary quality of confidence may not exist, even if the information was, at one point, confidential.

20. The Applicant argued that little to no skill was required to get a broad idea of the contents of the document and stated that without substantial work he was able to draw up a list of five elements he believed would be included in the document.
21. The Commissioner has carefully considered the nature of the withheld information alongside all the submissions from the Authority and the Applicant.
22. While he accepts that it may be possible to discern certain elements which might underlie the information, the Commissioner considers that the way in which those elements are interpreted, considered, applied, or presented, means that the information is unique and not generally accessible.  In the Commissioner’s view, a member of the public, with little knowledge of UCEA or FOI legislation, would have to apply skill, labour and determination to produce an approximation of what they believed might be contained within the information.
23. The Commissioner does not consider that the passage of time is a significant factor in the circumstances of this particular case.
24. In relation to point (iii) of paragraph 19, which considers the extent to which information can be ascertained from other information which is in the public domain, the Commissioner believes that while information on the general subject of FOI is of course widely available, this particular perspective on the information is not. The Commissioner’s view, in all the circumstances of this particular case, is that the information does have the necessary quality of confidence.

Obligation to maintain confidentiality

25. The Authority stated that it had sought UCEA’s opinion on the information (as it was entitled to do) and it provided the Commissioner with copies of this correspondence.  The Authority argued that UCEA had repeatedly and unambiguously stated that it considered the requested information to be confidential and that disclosure of the document would breach its conditions of membership.   It submitted that disclosure of the information would therefore constitute an actionable breach of confidence under section 36(2) of FOISA.
26. The Applicant argued that a blanket claim of confidentiality would go against the principles of natural justice and the intent of Parliament when drafting section 36 of FOISA.  Moreover, he stated that rubberstamping the word “confidential” on information did not (automatically) confer the quality of confidentiality upon that information (as stated in the Commissioner’s guidance as already referenced in paragraph 17).

27. The Commissioner has considered all of the submissions made by the Authority and the Applicant.  He has also considered the UCEA Conditions of Membership[3], which were publicly available.  These stated that continued membership was conditional upon compliance with UCEA’s terms and conditions. Paragraph 4.2. states:

    “UCEA materials, or extracts from them, which are not publicly available on the UCEA website cannot be made public, copied or distributed to other organisations or individuals without UCEA’s explicit prior consent.”

    The Commissioner accepts that the information which is the subject of this request is not publicly available on the website and that the Authority was under an obligation of confidentiality in relation to that information.  The obligation was actionable, at least in theory: there was at least a genuine possibility that the UCEA might sue a member for breach.

Detriment to the person who provided the information

28. In its submissions to the Commissioner, the Authority argued that unauthorised disclosure without UCEA’s explicit prior consent would undermine UCEA’s role in providing specialist confidential advice to members on sectoral negotiations and collective bargaining. Furthermore, it stated that the Authority would not have access to UCEA documents if it was not a UCEA member, (i.e. if it were to breach the terms and conditions of membership which it had previously accepted and be thrown out of UCEA) having accepted the UCEA membership terms and conditions which imposed a duty of confidence on the Authority.
29. The Applicant questioned what specific detriment would result from the release of a document which explained FOI requests and how they were to be treated.
30. The Commissioner has carefully considered the submissions and the withheld information in relation to the issue of detriment.  He notes that the Authority’s submissions refer to sectoral negotiations and collective bargaining and appear to have little to no relevance to the particular withheld information under discussion. (They would appear to be more relevant to request (1), which is not part of this appeal.)  He considers that the Authority has not made relevant or particular arguments in relation to the specific withheld information which is the subject of this request (Guidance on FOI requests) let alone provided evidence of this detriment.
31. The Commissioner remains unclear as to what the Authority believed the specific detriment would be to UCEA, in relation to responding to information requests and, while the threshold for detriment for these purposes is not particularly high, he does require some relevant reasoning of some substance.  He does not consider that simply stating disclosure would be harmful or would undermine a third party in itself makes a convincing argument that this would in fact be the case.
32. In any case, the further arguments made by the Authority appear to relate to potential detriment to itself, rather than to the third party which provided the information (i.e. UCEA, in this appeal).  For example, the Authority argued that it would not have access to UCEA documents if it was no longer a UCEA member.  The Commissioner considers that this argument relates to the potential detriment to the Authority, as a result of disclosure, rather than to UCEA.
33. The Commissioner does not consider that the submissions he received on the issue of detriment, are convincing and in his view the submissions do not address the specific detriment to the third party which would result from disclosure of the information.
34. Although the Commissioner is not satisfied that this element of the second part of the section 36(2) test has been fulfilled, he will go on to consider the defences to an action for breach of confidence, which include that withholding the information would be contrary to the public interest.

Defences to an action for breach of confidence

35. The exemption under section 36(2) refers to an “actionable” breach of confidence.  As noted above, the Commissioner’s guidance[4] states that “actionable” means that the basic requirements for a successful legal action appear to be fulfilled.  This means that, for the exemption to apply, it should not reasonably be expected that the action would be defeated by one of the established defences to an action for breach of confidence, such as: 

    1. the obligation relates to information that is useless or trivial;

    2. it can be shown that the information in question was known to the recipient before it was communicated to him/her in confidence;

    3. the information has subsequently become public knowledge; or 

    4. withholding the information would be contrary to the public interest. 

Public interest defence 

36. The Commissioner’s guidance also notes that the exemption in section 36(2) is not subject to the public interest test in section 2(1)(b) of FOISA.  However, as can be seen from paragraph 35 (iv) above, the public interest is relevant: the law of confidence provides that an obligation of confidence cannot apply to information where the public interest requires it to be disclosed.
37. The law of confidence recognises that there is a strong public interest in ensuring that people respect confidences (and, unlike the public interest test in FOISA, there is no presumption in favour of disclosure).  However, the public interest in maintaining confidences may be outweighed by the public interest in the disclosure of information, for example if enforcing an obligation of confidence would: 

    1. cover up wrongdoing 

    2. allow the public to be misled, or 

    3. unjustifiably inhibit public scrutiny of matters of genuine public concern.

38. The Authority made no submissions on the public interest, either as it related to the disclosure of the information or indeed the withholding of that information.
39. The Applicant argued that (while he did not believe the information attracted the quality of confidence) the public interest (in the event that the information did attract the quality of confidence) was strongly in favour of the information being disclosed.
40. The Applicant stated that UCEA, a body which was not subject to FOISA, wielded enormous power in the coordination of universities and had drafted a document specifically to combat the use of access to information.  Moreover, he argued, by drafting such a document and by attempting to prevent access to it through FOISA, it was clearly and unjustifiably inhibiting public scrutiny of matters of genuine public concern.
41. The Applicant then stated that there were various concerns about the behaviour of UCEA which had been documented in multiple outlets, which the Commissioner will not detail further here.

The Commissioner’s view on the public interest defence

42. The Commissioner, in considering the public interest defence, has carefully considered the submissions, the nature of UCEA itself, and the withheld information. In what follows he must take care not to reveal the nature of the withheld information.
43. The Commissioner notes that during the investigation, the Authority referred to the third-party views of UCEA which the Authority had sought in relation to the application.  Section 7 of the Scottish Ministers’ Code of Practice on the Discharge of Functions by Scottish Public Authorities under the Freedom of Information (Scotland) Act 2002 and the Environmental Information (Scotland) Regulations 2004[5] (the Section 60 Code) gives guidance on when authorities should seek third party views, and the Commissioner is satisfied that consulting UCEA was appropriate in this case.
44. However, the Commissioner wants to make clear that the handling of an information request, and the decisions on what exemptions may or may not be applied, must be made by the authority to which the request is made, on a case by case basis.  
45. Paragraph 43 of the Commissioner’s guidance on section 36[6] states that public authorities should consider discussing with the person who provided the information whether it should still be regarded as confidential, but is clear that it is authorities themselves who must decide whether the exemption should be applied.  In other words, while authorities can take into account the views of the third party, they should not simply accept those views or delegate that decision.  While an authority may take advice, or confer with peers or a third party, on the handling of a request, it is not for anyone else, even a representative body, to direct how any given request should be handled by the authority.  
46. The Commissioner acknowledges the strong public interest in the maintenance of confidences, and he accepts that there will be situations where it is important for public authorities to have access to specialist information and advice, including where the nature of that advice might mean it should not be disclosed (either wholly or in part).  This may well apply to elements of information UCEA shares with its members, but it is equally clear to the Commissioner that members of the higher education sector cannot participate in the creation of a creature of this kind and then allow it to exclude matters of genuine public concern from the legitimate scrutiny it would otherwise enjoy under FOISA or the EIRs.
47. In this particular case, in the Commissioner’s view, the subject matter of the withheld information in this case – how authorities are expected to approach FOI requests for certain information – means there is a particular public interest to be considered. It is certainly not a matter a third party, not subject to access to information legislation, should have a general expectation of being able to exclude from the public gaze. 

48. The Commissioner notes that paragraph 4.5. of the UCEA Conditions of Membership[7] states:

    “As UCEA is not a public authority it is not subject to the Freedom of Information Act (FOI). For information relating to FOI requests and queries about UCEA’s materials and resources, and what UCEA expects from Members in this regard, Members are requested to contact UCEA.”

49. In the Commissioner’s view, the above extract made it publicly clear that UCEA:

    1. expected to be informed of any such request, and

    2. had certain expectations as to how those public bodies responded (even if it did not spell these out). 

50. The Commissioner considers that the extent to which public authorities are being guided or directed on the application of a key statutory public function by a third party is clearly a matter of legitimate public concern, particularly when that key statutory function relates to FOISA, the enforcement of which he is responsible for.
51. The Commissioner’s view is that, in circumstances where it appears that advice from any third party might act as a device for excluding guidance on an aspect of the collective interests or approach of UCEA members from legitimate public scrutiny, particularly an aspect such as this, that is clearly a matter of legitimate public concern - and all the more so where the guidance relates to a public authority’s statutory duty (and the authority’s duty of transparency at that).  The Commissioner notes in this context that all 19 of Scotland’s universities are UCEA members and therefore the guidance could have a potentially widespread influence.
52. The Commissioner considers that generally (and without making any inference as to the content of the withheld information in this case) any such exclusion of guidance from scrutiny could be effected either actively (by overtly discouraging authorities from making certain information public) or indirectly (i.e. even the existence of such guidance may result in authorities taking a more cautious approach to the disclosure of relevant information).  In his view, both scenarios would be contrary to the public interest and to the spirit of FOISA.
53. Furthermore, the Commissioner’s view is that the guidance itself has no particular sensitivity, but the extent to which a third party appears to be using it as a broad instrument to influence public bodies’ responses to members of the public exercising their right to information is also itself a matter of public concern.
54. The Commissioner considers it to be a matter of significant public interest that a private limited company, the creation of public authorities but not itself subject to FOISA, appears to believe it has the right to direct its members’ responses to FOI requests in relation to itself - but not to have these directions open to public scrutiny.  
55. He considers that the public should be informed, as far as possible, about the factors which public authorities take into account when deciding how to respond to requests under FOISA. For example, if an individual makes an information request to a university or college for UCEA materials and if the information is withheld or partially disclosed (which may itself be legitimate, depending on the circumstances), that person should be satisfied that they have been provided with a proper account of the reasoning behind the response and that no part of that reasoning (as far as possible) remains hidden from them.
56. Otherwise, in the Commissioner’s view, there is the risk of a perception that Scottish universities are being advised on FOI in a way which prevents reasonable scrutiny of that advice, which is not how FOISA was intended to be used.  
57. He would also stress that any disclosure of the withheld information would not, of course, affect the ability of any member institution to withhold information relating to UCEA by applying an appropriate exemption.  Nor would it preclude an authority from seeking this, or any, third party’s views on a request where it believed this was appropriate and nor would it prevent it from agreeing with that third party’s view after appropriate consideration.
58. Furthermore, the Commissioner considers that, were it to be the case that any reputational damage arose to either UCEA or its member institutions from the disclosure of the withheld information (and he is not stating that he believes that this would be the case, merely acknowledging the possibility), then that in itself would more than likely indicate that there was an element of the withheld information which was significant in terms of a public interest defence.  This is not an area of business on which, in the general respects covered by the withheld information, the public should be given any impression that there is something to hide.
59. In all the circumstances of this particular case, having considered the submissions and the withheld information, the Commissioner considers that there is considerable public interest in understanding the general guidance given to member public authorities by a representative body on handling information requests relating to that representative body.

Decision 

The Commissioner finds that the Authority failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant in that it wrongly withheld information under section 36(2) of FOISA which it should have disclosed. 

The Commissioner therefore requires the Authority to disclose the withheld information to the Applicant by 14 November 2025.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement 

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply. The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

David Hamilton

Scottish Information Commissioner

30 September 2025