Decision 245/2025:  First responder provision in Orkney

Authority:  Scottish Ambulance Service Board
Case Ref:  202500211

Summary

The Applicant asked the Authority for information about first responder provision in Orkney, specifically a training and development plan and correspondence on this subject.

The Authority withheld the information requested on the basis that disclosure would, or would be likely to, endanger the health and/or safety of the public and staff, or prejudice the effective conduct of public affairs, and also because some of the information comprised third party personal data, disclosure of which would breach data protection principles.

During the investigation, the Authority confirmed that it no longer wished to withhold any information on the basis that its disclosure would endanger the health and/or safety of the public, and also withdrew reliance on the personal data exemption to withhold certain information.  In addition, the Authority now considered that disclosure would also prejudice the free and frank exchange of views.

The Commissioner investigated and found that, while the Authority had correctly withheld some information on the basis that it comprised third party personal data, it had wrongly withheld the remainder of the information under the exemptions claimed (which he required the Authority to disclose to the Applicant). He also found that the Authority had failed to identify all of the information falling within the scope of the request and required the Authority to carry out a fresh review for this further information.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002[1] (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions); 30(b)(ii) and (c) (Prejudice to effective conduct of public affairs); 38(1)(b), (2A), (5) (definitions of “the data protection principles”, “data subject”, “personal data” and “processing”, “the UK GDPR”) and (5A) (Personal information); S39(1) (Health, safety and the environment); 47(1) and (2) (Application for decision by Commissioner).

United Kingdom General Data Protection Regulation[2] (the UK GDPR) articles 4(1) (definition of “personal data”) (Definitions); 5(1)(a) (Principles relating to the processing of personal data); 6(1)(f) (Lawfulness of processing).

Data Protection Act 2018[3] (the DPA 2018) sections 3(2), (3), (4)(d), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data).

Background

1. On 13 June 2024, the Applicant made the following request for information to the Authority:

   “I would like to request a document concerning first responder provision in Orkney.  On Tuesday, June 11, 2024, [the Authority’s] press office confirmed to me that a ’training and development plan‘ exists concerning first responders in Orkney's North Isles.  I was told that it ’has been active since August last year‘.  Please can I request a copy of this plan.

   I would also like to request any and all correspondence sent and received by [the Authority] (including attachments and appendices) concerning first responder provision in Orkney's isles from over the past two years.”

2. The Authority responded on 5 August 2024.  It refused to disclose the training and development plan under the exemptions in section 30(c) (as disclosure of the plan would jeopardise the essential role it provided when supporting first responders in Orkney and the wider Scottish community), section 39(1) (due to the perceived significant threat that disclosure could cause to service delivery and to the health and safety of the public and staff) and section 38(1)(b) (for third party personal data).  The Authority withheld the correspondence requested under the exemptions in section 30 and section 38(1)(b) of FOISA.  The Authority explained it had released statements through its Press Office which could be shared, but all other documents were part of meetings minuted by Orkney Council and this was not information that was held by the Authority to share.
3. On 4 September 2024, the Applicant wrote to the Authority requesting a review of its decision.  In his request for review, the Applicant referred to ongoing concerns regarding first responder provision in the ferry-linked isles, believing that the public interest favoured disclosure of the information.  The Applicant argued that the Authority had failed to explain how disclosure of the information would lead to the harm claimed for section 30(c) to apply.  For the information withheld under section 38(1)(b) and section 39(1), the Applicant argued that the Authority’s response had not explained why redacting personal information and identifying details could not ameliorate any concerns about data protection, leaving only general information about first responder provision in the isles.
4. The Authority notified the Applicant of the outcome of its review on 1 October 2024, fully upholding its original decision.  For section 30(c), the Authority acknowledged it had an obligation to uphold openness and transparency, and believed the public interest lay in ensuring it was able to maintain the essential role of supporting first responders in Orkney and throughout Scotland.  The Authority maintained that section 30(c) had been applied appropriately.  For section 38(1)(b) and section 39(1), the Authority explained that, while the information did not directly identify individuals, the small island populations and the number of first responders meant that the wider healthcare community on the islands was sufficiently small to render these individuals identifiable. It concluded that the personal data had been correctly withheld under section 38(1)(b) as disclosure would breach the first data protection principle, and section 39(1) had been correctly applied as the ability to identify these individuals and their activities would, or would be likely to, endanger their health and safety.
5. On 1 February 2025, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  The Applicant stated that he was dissatisfied with the outcome of the Authority’s review because:

   • A similar information request he had made to Orkney Islands Council had yielded relevant correspondence with minor redactions, some of which, he believed, would be held by the Authority but had not been provided to him.

   • For section 30(c), he did not believe the review response explained why disclosure of the information would be prejudicial to the effective conduct of public affairs.

   • For section 38(1)(b) and section 39(1), he believed that, if the names of the responders and the islands they served were redacted, this would allay any concerns about identification, and he was interested in the Authority’s handling of the first responder issue in general, as opposed to particular islands and individuals.

   • He believed the public interest in disclosure of the information on the first responder issue was overwhelmingly strong and favoured disclosure.

Investigation

6. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
7. On 12 February 2025, the Authority was notified in writing that the Applicant had made a valid application.  The Authority was asked to send the Commissioner the information withheld from the Applicant.  The Authority provided the information and the case was subsequently allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application and to answer specific questions.  These focused on the Authority’s justification for withholding the information requested under (variously) the exemptions in section 30(c), section 38(1)(b) and section 39(1) of FOISA (including consideration of the public interest test where necessary) and the searches carried out to identify whether the Authority held any further relevant information.
9. The Applicant was also invited to provide any further comments he wished to make on his legitimate interest in accessing any personal data in the information withheld, and on the public interest in disclosure of the remainder.
10. The Authority provided submissions, in which it informed the Commissioner that it wished to withdraw its reliance on section 39(1) to withhold any of the information requested, and on section 38(1)(b) to withhold certain third party personal data.  It also confirmed that it now wished to rely on the exemption in section 30(b)(ii) of FOISA.  In the interests of natural justice, the Applicant was invited to provide his comments on the public interest in disclosure of the information being withheld under section 30(b)(ii).
11. Both parties provided further submissions to the Commissioner during the investigation.

Commissioner’s analysis and findings

12. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.

Does the Authority hold any further relevant information?

13. In terms of section 1(4) of FOISA, the information to be provided in response to a request under section 1(1) is that falling within the scope of the request and held by the authority at the time the request is received.
14. The standard of proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities.  In determining where the balance of probabilities lies, the Commissioner considers the scope, quality, thoroughness and results of the searches and enquiries carried out by the public authority to identify the relevant information.  He also considers, where appropriate, any reason offered by the public authority to explain why it does not hold the information.  While it may be relevant as part of this exercise to explore expectations about what information the authority should hold, ultimately the Commissioner's role is to determine what relevant recorded information is (or was, at the time the request was received) actually held by the public authority.
15. In his application to the Commissioner, the Applicant believed that the Authority held further information which it had not disclosed to him.  In this regard, he referred to a similar information request he had made to Orkney Islands Council that had resulted in the disclosure of relevant correspondence which, he believed, would be held by the Authority (in particular, four specific letters, copies of which the Applicant furnished to the Commissioner).
16. The Authority was asked to explain the searches it had carried out to identify the information falling within the scope of the Applicant’s request, including whether it held the four letters referenced by the Applicant, whether it considered any of the press releases referred to in its initial response fell within scope, and whether it held any further information.
17. In its submissions to the Commissioner, the Authority provided a timeline of the Applicant’s request (from his initial enquiry to the Authority’s Press Team through to the Authority’s review of his FOI request) which included details of the enquiries and searches it had carried out to identify any relevant information held.  These evidenced the enquiries made with the Authority’s Communications Department, the Area Service Manager (Shetland and Orkney), the Head of Service (Resilience and Business Services), the Head of Service (North -Islands WI/NI), the Chief Executive, the Regional Director (North) and the Deputy Regional Director (North).  These enquiries resulted in the identification of correspondence between the Communications Department and the Applicant, the training plan, and three further items of correspondence.
18. The Authority submitted that it had conducted reasonable searches of the Chief Executive’s mailboxes, however none of the four letters referenced by the Applicant were returned on any of its searches.  For three of these letters, the Authority explained that, as these would have been received during the previous Chief Executive’s term, this suggested that they may have been removed with the removal of the previous Chief Executive’s account.  For the fourth letter, the Authority submitted that it had not received this document as it had been omitted from the distribution list.
19. In respect of the correspondence between the Communications Department and the Applicant, the Authority explained that its Press Team had issued a response as requested by the Applicant in relation to an article of his quoting, and had provided subsequent confirmation of the existence of the training and development plan which had been active since August last year.  The Authority submitted that, on reflection, this correspondence ought to have been considered under the Applicant’s request. It considered, however, that the exemption in section 25 (Information otherwise accessible) of FOISA would apply given that the Applicant was already in possession of that information.  The Authority confirmed that there were no further press releases falling within the scope of the request.
20. The Authority confirmed that it held no minutes from meetings attended with Orkney Islands Council.  It explained that the statement it had made regarding this in its initial response had been given as an informative statement, to advise and assist the Applicant towards another appropriate place where further information may or may not be held.
21. In respect of the further review carried out during the investigation, the Authority confirmed that it had identified a further four documents falling within scope, and confirmed that it was not willing to disclose this further information to the Applicant.  It explained that, having investigated why these documents were not returned by its initial searches, this was found to be due to the use of different “keywords” and search criteria.  The Authority stated it would continue to review this and implement any future improvements to its process as considered necessary.

The Commissioner’s views on the information held by the Authority

22. Having fully considered all relevant submissions and the terms of the request, the Commissioner is satisfied that, by the end of the investigation, the Authority took adequate, proportionate steps in the circumstances to establish whether it held any further information falling within the scope of the request.  He has considered the explanations and supporting evidence provided by the Authority setting out the searches and enquiries carried out to identify the information held.
23. In respect of the four letters referenced by the Applicant in his application, the Commissioner accepts that, on the balance of probabilities, the Authority does not hold three of these letters, which were addressed to the Authority’s previous Chief Executive.  He accepts the Authority’s explanation that these would likely have been removed at the time the previous Chief Executive’s account was closed.  He can see no reason to doubt that the Authority’s enquiries and searches would have been capable of identifying this information, had it been held at the time of the Applicant’s request.  For the fourth letter, the Commissioner is satisfied that the Authority does not hold this information, as evidenced by the distribution list in the letter itself, which did not list any Authority staff.  As such, the Commissioner is satisfied that the Authority does not (and did not at the time of the Applicant’s request) hold the four letters referenced by the Applicant in his application.
24. Turning to the correspondence from the Authority’s Communications Department to the Applicant prior to the submission of his FOI request, the Commissioner agrees with the Authority’s revised position that this information does indeed fall within scope.  Notwithstanding the fact that the Applicant may already be in possession of this information, the Commissioner has no option but to find that, in failing to identify this information as falling within scope, the Authority failed to comply with section 1(1) of FOISA.
25. For any information held in minutes of meetings attended with Orkney Islands Council, referred to by the Authority in its initial response, the Commissioner is satisfied that, on the balance of probabilities, the Authority does not hold this information.  Even it if were the case that such information had been held, given its nature, the Commissioner considers it unlikely that it would have fallen within scope, as it would likely not have satisfied the type of information sought in the Applicant’s request.
26. The Commissioner is concerned to note, however, that during the investigation, the Authority identified four additional items of correspondence falling within the scope of the Applicant’s request.  In the Commissioner’s view, this further information ought to have been identified by the close of the Authority’s review, at the latest.  In failing to identify this information at an earlier stage, the Commissioner finds that the Authority failed to comply with section 1(1) of FOISA.
27. The Commissioner therefore requires the Authority to carry out a fresh review in respect of the correspondence between its Communications Department and the Applicant, and the four additional documents identified during the investigation, and to issue a revised review outcome to the Applicant in respect of this particular information.  The Commissioner would urge the Authority, when doing so, to seriously consider the Commissioner’s views set out below relating to the in-scope information which it withheld at review stage.

The Authority’s change of position during the investigation

28. During the investigation, the Authority informed the Commissioner that it had changed its position in relation to the exemptions applied to withhold the information requested.
29. For the training and development plan, the Authority withdrew reliance on section 39(1) of FOISA to withhold certain information in the training and development plan.  It confirmed it was now relying on the exemptions in section 30(b)(ii), section 30(c) and section 38(1)(b) to withhold (variously) all of the information in that document.
30. For the three items of correspondence considered at review stage, the Authority withdrew reliance on section 38(1)(b) to withhold any third party personal data in these documents.  It confirmed it was now relying on the exemptions in section 30(b)(ii) and section 30(c) to withhold all of the information in those documents.

Section 39(1) - Health, safety and the environment

31. At both initial response and review stages, the Authority withheld some of the information requested under section 39(1) of FOISA.  Section 39(1) provides that information is exempt if its disclosure under FOISA would, or would be likely to, endanger the physical or mental health or the safety of an individual.
32. The Authority submitted that [at that time] it had considered there to be a real risk due to the small island populations involved and the number of first responders.  In the Authority’s view, this meant that the wider healthcare community on the islands was sufficiently small to be able to identify the individuals and their activities in an identifiable location, which would, or would be likely to, endanger their health and/or safety.
33. As stated above, during the investigation, the Authority withdrew its reliance on section 39(1) of FOISA to withhold information that documented training dates, locations and the number of individuals involved.  The Authority explained that, due to time sensitivity, these times and events had concluded and no longer posed a risk.  It also believed that the use of the other exemptions was more appropriate to cover the entirety of the information held.
34. Having considered the Authority’s submissions on its change of position, the Commissioner has no option but to find that disclosure of the information would not have had the substantially prejudicial impact required for section 39(1) of FOISA to be engaged.  Consequently, in this case, the Commissioner is not satisfied that the information requested was properly withheld under this exemption at review stage.  Having reached this conclusion, he is not required to consider the public interest test in section 2(1)(b) of FOISA.
35. The Commissioner concludes, therefore, that the Authority had not been entitled to rely upon section 39(1) of FOISA to withhold the information in question at review stage and, by so doing, breached Part 1 of FOISA.
36. The Commissioner cannot stress enough the importance of giving full and proper consideration to the tests which require to be met for an exemption under FOISA (or an exception under the Environmental Information (Scotland) Regulations 2004 (the EIRs)) to apply, when considering requests under both FOISA/the EIRs. He would urge the Authority, and indeed all Scottish public authorities, to ensure that, when responding to information requests, thorough consideration is given to whether any applicable test of substantial prejudice can actually be met in the circumstances.
37. As the Authority is withholding all of the information requested under other exemptions in FOISA, the Commissioner will now go on to consider these.

Section 30(c) – Prejudice to effective conduct of public affairs (otherwise prejudice)

38. Section 30(c) of FOISA provides that information is exempt information if its disclosure would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.  This exemption is subject to the public interest test in section 2(1)(b) of FOISA.
39. The word "otherwise" distinguishes the harm required from that envisaged by the exemptions in sections 30(a) and (b).  This is a broad exemption and the Commissioner expects any public authority applying it to show what specific harm would (or would be likely to) be caused to the conduct of public affairs by disclosure of the information, and how that harm would be expected to follow from disclosure.
40. There is no definition of "substantial prejudice" in FOISA, but the Commissioner considers the harm in question would require to be of real and demonstrable significance.  The authority must also be able to satisfy the Commissioner that the harm would, or would be likely to, occur: therefore, the authority needs to establish a real risk or likelihood of actual harm occurring as a consequence of disclosure at some time in the near (certainly the foreseeable) future, not simply that the harm is a remote possibility.

The Applicant's submissions on section 30(c)

41. In his application to the Commissioner, the Applicant stated that he did not believe that the Authority’s review outcome specifically explained why disclosure of any of the information requested would be prejudicial to the effective conduct of public affairs.  In his view, no reasoning or examples had been offered to explain how disclosure of the information could jeopardise this, even hypothetically.

The Authority's submissions on section 30(c)

42. In its submissions to the Commissioner, the Authority considered that disclosure of the information could potentially be used to misrepresent the status of healthcare on the Orkney Islands.  It explained that it had considered the documents in their entirety and also in isolation, but had concluded they could not be considered in isolation in terms of the potential impact of misuse of information on the Authority.
43. The Authority explained that the responder model could differ depending on location, due to services provided by other agencies or agreements with other providers.  It believed that, if information about the responder model was to be made public, this had the potential to impact the ability to (1) recruit and retain volunteers both in Orkney and throughout Scotland, and (2) adequately represent the Authority’s interests in discussions with other providers to ensure the provision of care in Orkney. In the Authority’s view, disclosure of information about the delivery of training on each island would prejudice its ability to provide a service to the people of Orkney, other islands and mainland Scotland.
44. The Authority believed that the information, if disclosed, could be used misleadingly, and for the purposes of placing misinformation into the public domain while deliberations between stakeholders were ongoing.  In the Authority’s view, this had the potential to lead to misunderstanding of the Authority’s discussions, processes and the contribution of the first responder community, thereby inhibiting such discussions in future. The Authority argued that those involved would be reluctant to provide full and frank views in the belief that these would be made public, particularly while discussions were still ongoing and decisions had not been taken.
45. Were these discussions to break down due to the provision of misinformation and a misrepresentation of the current situation, the Authority believed that this could lead to a significant misunderstanding by the public and the first responder community about the role and value of first responders.  In the Authority’s view, there was a substantial risk that first responders would step down from their volunteering positions – which would potentially lead to the folding of first responder schemes in Orkney and elsewhere in Scotland, thereby risking patients’ lives.
46. The Authority submitted that the provision of the first responder model in Orkney was a topic under intense discussion between the Orkney Partnership Group.  It believed that any information released into the public domain without appropriate context would likely harm those negotiations and impact the recruitment and retention of responders, who provide an important part of the response to patients across Scotland.
47. In the Authority’s view, a decrease in the availability of community first responders on both island and mainland communities would prejudice substantially its ability to provide life-saving responses to patients in a life-threatening emergency. It also believed that disclosure of the information would limit, and otherwise prejudice substantially, its ability to carry out a statutory obligation and provide fair and equitable unscheduled care ambulance services, thereby discriminating against patients and service users who required its service, which would lead to a reduction in health and treatment outcomes for patients impacted.

The Commissioner's view on section 30(c)

48. The Commissioner has carefully considered the submissions from both parties, along with the withheld information itself.
49. The Commissioner notes the Authority’s claim that disclosure would lead to misinformation being placed in the public domain while deliberations remained ongoing with stakeholders, and that this would substantially prejudice such discussions in future.  He has also considered the Authority’s belief that disclosure would substantially prejudice its ability to recruit and retain volunteers, and to carry out its statutory obligations to provide a fair and equitable emergency response to the people of Scotland.
50. Having considered the content of the withheld information itself, the Commissioner cannot accept that disclosure of this particular information would directly lead to such situations developing, as claimed by the Authority.  He notes that there is nothing to stop public authorities from providing contextual information when disclosing information under FOISA, in line with section 9.9.2 of the Scottish Ministers' Code of Practice on the Discharge of Functions by Scottish Public Authorities under FOISA and the Environmental Information (Scotland) Regulations 2004 (the "Section 60 Code")[4], to help alleviate any concerns an authority may have regarding any possible misinterpretation or misunderstanding, by members of the public, of the information being disclosed.
51. In addition, the Commissioner notes that some of the information withheld is included as part of the Authority’s reasoning in its response to the Applicant’s information request.  In light of this, he fails to see any harm in disclosure of that particular information.
52. For the information in the training plan withheld under section 30(c), the Commissioner considers it relevant to note that, given the training plan is a bespoke “live” document, the information contained therein is a reflection of the situation at a specific point in time, and is one which will inevitably evolve as circumstances require.  In his view, it therefore cannot be taken to represent what any future plan might look like.
53. In conclusion, the Commissioner fails to accept that the harm claimed by the Authority in disclosure of the information would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of the Authority’s public affairs.
54. The Commissioner therefore finds that the Authority was not entitled to withhold any of the information requested under section 30(c) at review stage.
55. As the Commissioner is not satisfied that disclosure of the information would, or would be likely to, prejudice substantially the effective conduct of public affairs he is not required to go on to consider the application of the public interest test in section 2(1)(b) of FOISA.
56. However, as the Authority is also relying on additional exemptions (i.e. section 30(b)(ii) and section 38(1)(b)) to withhold the information requested, he will now go on to consider whether the Authority was correct to rely on these exemptions.

Section 30(b)(ii) – Prejudice to effective conduct of public affairs (free and frank exchange of views)

57. As rehearsed above, during the investigation, the Authority informed the Commissioner that it also now wished to rely on section 30(b)(ii) of FOISA.
58. Section 30(b)(ii) of FOISA provides that information is exempt information if its disclosure would, or would be likely to, inhibit substantially the free and frank exchange of views for the purposes of deliberation. The inhibition must be substantial, in other words of real and demonstrable significance.  It must also be at least likely, not simply a remote or hypothetical possibility.  This exemption is subject to the public interest test in section 2(1)(b) of FOISA.

The Applicant's submissions on section 30(b)(ii)

59. In his submissions to the Commissioner, the Applicant referred to information disclosed by Orkney Islands Council in response to a similar request, some of which, he believed, would be the same material held by the Authority.  He could see nothing in the information disclosed by Orkney Islands Council that could be construed as being prejudicial to the effective conduct of public affairs, arguing that this was not sensitive information.
60. This led the Applicant to believe that there was unlikely to be anything in the information held by the Authority that could lead to a “significant probability” that “substantial inhibition would occur” (as set out in the Commissioner’s guidance on section 30 of FOISA[5]).  He further questioned whether the Authority would be able to establish that any inhibition caused by disclosure was “of real and demonstrable significance, rather than simply marginal", noting that the Commissioner did not accept the validity of the "chilling effect".  In the Applicant’s view, if the Authority was applying this exemption in these very general terms, he did not believe this should be accepted.

The Authority’s submissions on section 30(b)(ii)

61. The Authority submitted that the exemption in section 30(b)(ii) recognised the need for staff to have a private space within which to discuss issues and options with stakeholders.
62. In the Authority’s view, disclosing the content of these discussions, on the issue of provision of first responder services in Orkney’s isles, would substantially inhibit any such future discussions.  The Authority considered this to be the case as it submitted that those involved would be reluctant to provide their views fully and frankly in the belief that those views would likely be made public, particularly while discussions were still ongoing and decisions not yet taken.
63. As these discussions related to sensitive information, the Authority believed that disclosure would restrain, decrease or suppress the freedom with which opinions or options were expressed.

The Commissioner's view on section 30(b)(ii)

64. The Commissioner has carefully considered the submissions from both parties, along with the withheld information itself.
65. The Commissioner notes the Authority’s claim that disclosure would inhibit the free and frank exchange of views, particularly while discussions with stakeholders remained ongoing.
66. Having considered the content of the withheld information itself, the Commissioner fails to see how disclosure of this particular information would adversely impact any future discussions with stakeholders.  As he has stated previously, an authority may provide contextual information when disclosing information under FOISA, in line with the Section 60 Code of Practice, should it have any concerns regarding the interpretation of the information being disclosed.
67. Again, as before, the Commissioner notes that some of the information withheld forms part of the Authority’s response to the Applicant’s information request and, as such, he fails to see how disclosure of that particular information would be harmful.
68. The Commissioner would also reiterate here his comments in paragraph 52 above for the information in the training plan which has also been withheld under section 30(b)(ii).
69. In conclusion, the Commissioner fails to accept that the harm claimed by the Authority in disclosure of the information would, or would be likely to, inhibit substantially the free and frank exchange of views for the purposes of deliberation.
70. As the Commissioner is not satisfied that disclosure of the information would, or would be likely to, prejudice substantially the free and frank exchange of views for the purposes of deliberation, he is not required to go on to consider the application of the public interest test in section 2(1)(b) of FOISA.
71. The Commissioner therefore finds that, by the end of his investigation, the Authority was not entitled to withhold any of the information requested under section 30(b)(ii).
72. As stated above, the Commissioner has already found that the Authority was not entitled to withhold any of the information requested under section 30(c).  The Commissioner notes that the Authority also relied on section 38(1)(b) to withhold certain of that information, and so he will now go on to consider whether the Authority was correct to rely on this exemption for that particular information.
73. However, for any information (withheld under section 30(b)(ii) and section 30(c)) which he has found to have been wrongly withheld, and for which section 38(1)(b) is not also being relied on by the Authority, the Commissioner requires the Authority to disclose that information to the Applicant.

Section 38(1)(b) – Personal information

74. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is "personal data" (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR.
75. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption.  This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
76. To rely on this exemption, the Authority must show that the information withheld is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Article 5(1) of the UK GDPR.
77. At both initial response and review stages, the Authority withheld some of the information in the training plan, and all of the correspondence identified at that time, under section 38(1)(b) on the basis that it was third party personal data, disclosure of which would breach data protection principles.
78. The Commissioner must decide whether the Authority was correct to withhold the information requested under section 38(1)(b) of FOISA.

The Authority’s change of position on section 38(1)(b) for the correspondence considered at review stage

79. As stated above, during the investigation, the Authority withdrew its reliance on section 38(1)(b) of FOISA to withhold any information in the correspondence considered at review stage.  It submitted that it had withdrawn reliance on this exemption for that particular information, due to consideration of the information contained therein and, upon review, the application of an additional exemption [i.e. section 30(b)(ii)] which it considered to be more appropriate and which, it believed, covered the entirety of the information held.
80. Having considered the Authority’s submissions on its change of position here, the Commissioner has no option but to find that the Authority was not entitled to withhold this particular information (i.e. in the correspondence) under the exemption in section 38(1)(b) of FOISA.
81. The Commissioner concludes, therefore, that the Authority had not been entitled to rely upon section 38(1)(b) of FOISA to withhold the information in question and, by so doing, breached Part 1 of FOISA.
82. As set out above, the Commissioner has already found that the Authority had wrongly withheld that same information under the exemptions in section 30(b)(ii) and section 30(c) of FOISA.  As the Authority is not relying on any other exemptions to withhold the correspondence considered at review stage, he requires the Authority to disclose it to the Applicant.

The Authority’s reliance on section 38(1)(b) for certain information in the training plan

83. The Commissioner will now go on to consider the Authority’s reliance on section 38(1)(b) to withhold certain information in the training plan.

Is the withheld information personal data?

84. The first question that the Commissioner must address is whether the withheld information is personal data for the purposes of section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable living individual. "Identifiable living individual" is defined in section 3(3) of the DPA 2018 as “a living individual who can be identified, directly or indirectly, in particular with reference to –

    1. an identifier such as a name, an identification number, location data or an online identifier, or

    2. one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.”

    This definition reflects the definition of personal data in Article 4(1) of the UK GDPR.

85. Information which could identify individuals will only be personal data if it relates to those individuals.  Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.
86. In his submissions to the Commissioner, the Applicant did not dispute that some of the information requested could comprise personal data, for example where individuals were named.  He disputed, however, that general descriptions of the first responders situation in Orkney’s islands could be considered to be personal data.
87. In its submissions to the Commissioner, the Authority stated that the information in the training plan identified individuals directly and indirectly.  It acknowledged the error in its initial response to the Applicant which ought to have read “The information does not always directly identify individuals…”.
88. The Authority submitted that, where the information indirectly identified individuals or gave information about their status within the first responder team, it had given consideration to the size of the island populations and the likelihood of identification.  The Authority explained that, in the training plan, the information was split by individual island and, as the islands’ populations and the pool of responders were sufficiently small, the risk of identification was high.
89. The Commissioner has carefully considered the remaining information being withheld under section 38(1)(b).  Having done so, it is clear that certain of this information "relates to" identifiable living individuals.  The Commissioner is therefore satisfied that this particular information comprises personal data for the purposes of section 3(2) of the DPA 2018.
90. However, the Commissioner does not take this view for the rest of this information. In his view, disclosure of this information would not lead to the identification of individuals, even taking into account the low numbers of first responders and the small island populations.  He therefore does not accept that this particular information comprises personal data for the purposes of section 3(2) of the DPA 2018.
91. The Commissioner concludes, therefore, that the Authority was not entitled to rely upon section 38(1)(b) of FOISA to withhold certain of the information withheld under this exemption and, by so doing, breached Part 1 of FOISA.  As the Authority is not relying on any other exemption to withhold this particular information, he requires the Authority to disclose it to the Applicant.  The information to be disclosed will be indicated on a marked-up copy of the training plan to be provided to the Authority along with this Decision Notice.
92. The Commissioner will now go on to consider the Authority’s reliance on section 38(1)(b) to withhold the remaining information in the training plan which, he is satisfied, is third party personal data.

Which of the data protection principles would be contravened by disclosure?

93. The Authority stated that disclosure of this personal data would contravene the first data protection principle (Article 5(1)(a)). Article 5(1)(a) states that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.
94. In terms of section 3(4) of the DPA 2018, disclosure is a form of processing.  In the case of FOISA, personal data is processed when it is disclosed in response to a request.
95. The Commissioner must now consider if disclosure of the personal data would be lawful (Article 5(1)(a)).  In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed.  The Commissioner considers condition (f) in Article 6(1) to be the only one which could potentially apply in the circumstances of this case.

Condition (f): legitimate interests

96. Condition (f) states that the processing shall be lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data (in particular where the data subject is a child).
97. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
98. The tests which must be met before Article 6(1)(f) can be met are as follows:

    1. Does the Applicant have a legitimate interest in obtaining the personal data?

    2. If so, would disclosure of the personal data be necessary to achieve that legitimate interest?

    3. Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?

Does the Applicant have a legitimate interest in obtaining the personal data and is disclosure necessary to meet that legitimate interest?

99. In both his request for review and in his application to the Commissioner, the Applicant commented that the Authority’s response did not explain why redacting personal information and identifying details could not ameliorate any worries the Authority had about data protection.  He stated that his interest was in the Authority’s handling of the first responder issue in general, and not as it related to particular islands and individuals.
100. In the Applicant’s view, removing any third party personal data would leave only general information about first responder provision in the isles.  He believed that information could be provided, redacted as necessary.
101. The Authority acknowledged the Applicant’s stated legitimate interest, and the wider, general legitimate interest, as set out in his request for review, i.e. that disclosure of the information would:

     • enhance scrutiny of decision-making processes and thereby improve accountability and participation;

     • keep the public adequately informed of any danger to public health or safety;

     • ensure that any public authority with regulatory responsibilities is adequately discharging its functions, and

     • contribute to a debate on a matter of public interest.

102. The Authority recognised that the topic of health care provision on Orkney’s islands was one of significant importance to residents. However, it did not agree that disclosure of the information was necessary, or would fit the purpose of satisfying the factors listed by the Applicant in his request for review (above). As such, the Authority did not consider the Applicant had a legitimate interest in obtaining the personal information.
103. The Commissioner accepts that there is clearly a legitimate interest in public awareness, scrutiny, accountability and debate, on the matter of first responder provision on Orkney’s islands, which is clearly of significant importance to local residents, as a minimum.  He also accepts that the Applicant has a legitimate interest in the Authority’s handling of the provision of first responder services on Orkney’s islands.
104. However, the Commissioner cannot ignore the fact that the Applicant has clearly stated he would be happy for any personally-identifying information to be redacted from the information requested.  Accordingly, the Commissioner cannot accept that the Applicant has a legitimate interest in obtaining the remaining third party personal data being withheld under section 38(1)(b).
105. The Commissioner does not consider that disclosure of this remaining personal data would advance, to any extent, the wider legitimate interests he has identified.  As such, he does not consider disclosure of the information which, he is satisfied, constitutes third party personal data is necessary in this case.
106. In the circumstances, therefore, the Commissioner therefore finds that the Authority properly withheld these third party personal data under section 38(1)(b) of FOISA.

Decision

The Commissioner finds that the Authority partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.

The Commissioner finds that the Authority was entitled to withhold some information, on the basis that it comprised third party personal data, under section 38(1)(b) of FOISA and, in doing so, complied with Part 1.

However, the Commissioner also finds that the Authority failed to comply with Part 1 (and, in particular, section 1(1)) by:

• failing to comply with section 1(1) of FOISA by failing to identify all of the information held falling within the scope of the request;
• wrongly withholding certain information under (variously) section 30(c), section 38(1)(b) and section 39(1)(b) at review stage, and
• wrongly applying section 30(b)(ii) during the investigation to withhold some information.

The Commissioner therefore requires the Authority to:

• carry out a fresh review in respect of the correspondence between its Communications Department and the Applicant, and the four additional documents identified during the investigation, and to issue a revised review outcome to the Applicant in respect of this particular information, and

• disclose to the Applicant the information he has found to have been wrongly withheld under the exemptions in section 30(b)(ii), section 30(c) and section 38(1)(b) of FOISA, i.e. all of the correspondence considered at review stage and certain information in the training plan (to be identified by the Commissioner in a marked-up copy to be provided with this Decision Notice).

He requires the Authority to take these steps by 21 November 2025.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply.  The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

Euan McCulloch

Head of Enforcement

7 October 2025