Decision 252/2025:  Information relating to the handling of a previous information request

Authority: Edinburgh Napier University 
Case Ref: 202500150  
 

Summary

The Applicant asked the Authority for copies of any documents held in relation to a previous information request he had made.  The Authority withheld the information requested under various exemptions in FOISA.  The Commissioner investigated and found that the Authority had correctly withheld some information but wrongly withheld other information.  He required the Authority to disclose the wrongly withheld information.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1) and (2) (Effect of exemptions); 30(b) (Effective conduct of public affairs); 36(2) (Confidentiality); 38(1)(b) (Personal data); 47(1) and (2) (Application for decision by Commissioner).

United Kingdom General Data Protection Regulation (the UK GDPR) articles 5(1)(a) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness of processing) 

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data).

Background

1. On 18 September 2023, the Applicant made a request for information to the Authority.  He asked for copies of all internal and external correspondence, primary and ancillary documents, memorandums, reports, etc. which the Authority held in relation to a previous information request he had made.  He stated that this type of information request is known as a “meta request”.
2. By way of background, the Applicant’s previous request was for two documents produced by the Universities and Colleges Employers Association (UCEA) and was the subject of Decision 180/2024[1].
3. The Authority responded on 16 October 2023.  It commented that the Applicant had requested documents rather than information, and therefore it was unable to assist him.  It went on to explain that, as it considered disclosure of some of the information contained in the correspondence would, or would be likely to, inhibit substantially the free and frank exchange of views for the purposes of deliberation, it was withholding the information under section 30(b)(ii) of FOISA.
4. On 21 October 2023, the Applicant wrote to the Authority requesting a review of its decision.  He stated that he was dissatisfied with the decision because, in his view, the Authority had issued a blanket refusal of his request.  He stated that, in his view, a “meta request” was an enshrined right to scrutinise decisions taken regarding information requests.  He commented that exemptions relating to the effective conduct of public affairs were undermined if arguments were not linked to disclosure of the information requested, as opposed to the discussions around whether to release that information.
5. The Authority notified the Applicant of the outcome of its review on 16 November 2023, which fully upheld its original decision.
6. On 4 January 2024, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  He stated that he was dissatisfied with the outcome of the Authority’s review because it did not address any of the points he raised in his requirement for review. He argued that blocking a meta request under section 30 constituted a perversion of FOISA, and he reiterated the points he had made to the Authority in his review request.
7. The Commissioner investigated and issued Decision 183/2024[2], which required the Authority  to provide a new response to the Applicant’s requirement for review, in terms of section 21(4)(b) of FOISA.
8. The Authority notified the Applicant of the outcome of its revised review on 17 October 2024. 2023.  It withheld the information requested under the exemptions in sections 30(b)(i) and (ii), 36(2) and 38(1)(b) of FOISA.
9. On 27 January 2025, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  He stated he was dissatisfied with the outcome of the Authority’s review because he did not agree that the exemptions cited by the Authority applied. 

Investigation

10. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
11. On 11 February 2025, the Authority was notified in writing that the Applicant had made a valid application.  The Authority was asked to send the Commissioner the information withheld from the Applicant.  The Authority provided the information, and the case was allocated to an investigating officer.
12. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application and to answer specific questions.  These related to the Authority’s justification for applying the cited FOISA exemptions.
13. During the investigation, the Authority clarified which exemptions were applied to which specific sections of documents and the Applicant confirmed that this request was not intended to include the two UCEA documents themselves (which were the focus of a separate appeal to the Commissioner).  The Commissioner will therefore not consider these documents as part of his decision notice in this case.

Commissioner’s analysis and findings

14. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority. 

Validity of the request

15. Section 8(1) of FOISA sets down the basic requirements for a valid request for information made in terms of section 1(1).  Section 8(1)(c) specifies that a request must describe the information requested.  The interpretation of section 8(1)(c) must be consistent with the overall aim of FOISA, which is to achieve openness with a minimum of formal requirements.  Accordingly, the only requirement is that the description is clear enough to allow the information to be identified and located.
16. The Authority suggested to the Applicant that his request was invalid because he had requested documents, instead of requesting information.
17. The Commissioner has published guidance[3] on whether FOI law gives a right to information or to copies of documents.  His guidance is clear that, where a request refers to a document which may contain the relevant information, it may nonetheless be reasonably clear in the circumstances that it is the information recorded in the document that is relevant.  In these circumstances, the request will be valid for the purposes of section 8(1)(c) of FOISA.
18. In this case, the Commissioner is satisfied that the Applicant made a valid request under FOISA.  During the investigation, the Authority reconsidered its position and agreed the request was valid.

Section 38(1)(a) – Personal information (requester’s own personal data)

19. During the investigation, the Commissioner identified some withheld information that appeared to be the personal information of the Applicant.
20. The Authority confirmed that this information constituted personal information of the Applicant and said that it wished to rely upon the exemption in section 38(1)(a) of FOISA to withhold this information.
21. However, the Authority disclosed this information to the Applicant under the UK GDPR/DPA 2018 in response to a subject access request. The Applicant confirmed that he therefore did not require a decision on the information the Authority withheld under the exemption in section 38(1)(a) of FOISA.  Consequently, the Commissioner will not consider the application of this exemption further in his decision notice.

Section 36(2) – Confidentiality 

22. The Authority withheld some correspondence with the UCEA under the exemption in section 36(2) of FOISA.
23. Section 36(2) of FOISA provides that information is exempt from disclosure if it was obtained by a Scottish public authority from another person (including another such authority) and its disclosure, by the authority obtaining it, to the public (otherwise than under FOISA) would constitute a breach of confidence actionable by that person or any other person.
24. Section 36(2) is an absolute exemption and is not, therefore, subject to the public interest test in section 2(1)(b) of FOISA.  However, it is generally accepted in common law that an obligation of confidence will not be enforced to restrain disclosure of information which is necessary in the public interest. 

Information obtained from another person 

25. Section 36(2) of FOISA therefore contains a two-stage test, both parts of which must be fulfilled before the exemption can be relied upon.  The first is that the information must have been obtained by a Scottish public authority from another person.  “Person” is defined widely and means another individual, another Scottish public authority or any other legal entity, such as a company or partnership.
26. Having inspected the information withheld under section 36(2) of FOISA, the Commissioner is satisfied that this was received from UCEA, as it either consists of correspondence from the UCEA or correspondence restating information from correspondence with the UCEA.
27. The Commissioner is also satisfied that, notwithstanding the Authority’s membership of the UCEA, the UCEA is a separate legal person from the Authority.
28. The Commissioner therefore accepts that the information withheld under section 36(2) of FOISA was received from another person.

Actionable breach of confidence 

29. The second part of the test is that disclosure of the information by a public authority must constitute a breach of confidence actionable either by the person who gave the information to the public authority or by any other person.  The Commissioner takes the view that “actionable” means that the basic requirements for a successful action must appear to be fulfilled.
30. There are three main requirements which must be met before a claim for breach of confidence can be established to satisfy the second element to this test. These are: 

    1. The information must have the necessary quality of confidence; 

    2. The public authority must have received the information in circumstances which imposed an obligation on it to maintain confidentiality; and 

    3. Unauthorised disclosure must be to the detriment of the person who communicated the information.

31. The Applicant explained that he did not believe there was any express or implied agreement of confidentiality and considered that “no rational actor” could demonstrate damage as a consequence of disclosure.

Necessary quality of confidence

32. Having considered the withheld information, the Commissioner is satisfied that some of this information fulfils the criteria of having the necessary quality of confidence.  This information is not common knowledge and could not readily be obtained by the Applicant by any other means.
33. However, some of the information withheld is clearly standard “boilerplate” text that does not convey a substantive view on the specific circumstances of the correspondence.  The Commissioner does not agree that this information has the necessary quality of confidence.

Obligation to maintain confidentiality 

34. The Authority confirmed that the information was shared in an explicit expectation of confidence.  It was marked as “confidential” and, for at least some correspondence, contained a request to limit distribution within the Authority.
35. While confidentiality markings do not, in themselves, mean information is exempt from disclosure, the Commissioner has taken these markings into account in considering whether there is an express or implied obligation to maintain confidentiality.
36. In all the circumstances, the Commissioner accepts that the withheld information (that he has found has the necessary quality of confidence) was received in the context of a clearly expressed obligation to maintain confidentiality.  He therefore accepts that there was an obligation to maintain confidentiality.

Unauthorised disclosure would cause detriment

37. The Authority explained that the detriment caused would largely be a breakdown in the relationship between the Authority and UCEA, e.g. loss of trust on the part of UCEA.
38. The Applicant did not consider that this detriment would arise, as disclosure of other UCEA documents through FOI requests had not triggered a breakdown in relationships between the institutions involved and the UCEA.
39. The Commissioner considers it clear that the UCEA, and its members, benefit from a private channel to communicate.  However, the Commissioner is not satisfied that disclosure of most of the information withheld under the exemption in section 36(2) of FOISA would undermine these channels as the views conveyed are high level and general.
40. The Commissioner therefore does not accept that disclosure of this information would be to the detriment of the UCEA and does not agree this was appropriately withheld under section 36(2) of FOISA.  Some of this information was also withheld under other exemptions in FOISA and will be considered the appropriate headings, below.
41. However, there are certain occasions where the UCEA shared a specific view on this specific request.  The Commissioner agrees that disclosure of these more targeted views would diminish the expectation of confidence attached to these discussions and inhibit the ability of the UCEA and Authority to privately discuss freedom of information requests (to the extent that third parties have a right to be consulted on individual requests affecting them).
42. The Commissioner acknowledges the Applicant’s view that no detriment has occurred as the result of other disclosures.  However, each case needs considered upon its own merits and the Commissioner is satisfied that, in the circumstances of this case, the diminishment of this private channel entailed by disclosure would be to the detriment of the UCEA.
43. The Commissioner also notes that the detriment risked here, of a reduction in privacy of communications and thereby less effective use of these channels, may not be easily observed from outwith the organisations affected.
44. The Commissioner is therefore satisfied that the tests for an actionable breach of confidence are met in this case, in relation to some of the information being withheld under section 36(2) of FOISA.
45. For the other information withheld under section 36(2) of FOISA, the Commissioner does not accept that the information meets the tests for an actionable breach of confidence and requires this information to be disclosed, except insofar as it is appropriately withheld under another exemption.  He will consider whether other exemptions under FOISA apply to the information under the appropriate headings, below.

Public interest defence – section 36(2)

46. As noted above, the exemption in section 36(2) of FOISA is an absolute exemption in terms of section 2(2) of FOISA and not subject to the public interest test in section 2(1)(b).
47. However, the law of confidence recognises that, in certain circumstances, the strong public interest in maintaining confidences may be outweighed by the public interest in disclosure of the information. In deciding whether to enforce an obligation of confidentiality, the courts are required to balance these competing interests, but there is no presumption in favour of disclosure. This is generally known as the public interest defence.
48. The courts have identified a relevant public interest defence in cases where withholding information would cover up serious wrongdoing, and where it would lead to the public being misled on, or would unjustifiably inhibit public scrutiny of, a matter of genuine public concern.

The Authority’s submissions

49. In this case, the Authority did not agree there was any public interest in disclosure.  While it considered there to be an interest in openness and accountability, it was not satisfied that disclosure would assist in pursuing these ends given the lack of specificity in the Applicant’s request.

The Applicant’s submissions

50. The Applicant submitted that it is in the public interest for all the “arguments and procedures” relating to a FOI request to be available for scrutiny.  He argued that this is particularly pronounced in a case such as this, where the Commissioner had already identified issues in the Authority’s handling of the case.

The Commissioner’s view 

51. Although the Commissioner welcomes transparency around decision making, including in the handling of FOI requests, he recognises it is sometimes necessary to withhold some information regarding this decision making – otherwise the exemptions set out in FOISA could be undermined.
52. In the circumstances, the Commissioner is satisfied that any inhibition of scrutiny resulting from the withholding of the information he accepts was properly withheld under section 36(2) of FOISA is insufficient to give rise to a public interest defence in disclosure. He is aware of no other sufficiently compelling reason for the withheld information (which he has accepted meets all the tests for an actionable breach of confidence) to be disclosed into the public domain on public interest grounds.
53. Consequently, the Commissioner finds that the Authority was correct to withhold the information under section 36(2) of FOISA (except the information that he found did not have the necessary quality of confidence).

Section 30(b)(ii) – Free and frank exchange of views

54. The Authority withheld some information under the exemption in section 30(b)(ii) of FOISA.
55. The Commissioner has already found that some material withheld under the exemption in section 30(b)(ii) of FOISA was correctly withheld under the exemption in section 36(2).  He will therefore not consider this information again under this exemption.
56. Section 30(b)(ii) of FOISA provides that information is exempt information if its disclosure would, or would be likely to, inhibit substantially the free and frank exchange of views for the purposes of deliberation. This exemption is subject to the public interest test in section 2(1)(b) of FOISA.
57. In applying the exemption in section 30(b)(ii) of FOISA, the chief consideration is not whether the information constitutes opinion or views, but whether the disclosure of that information would, or would be likely to, inhibit substantially the free and frank exchange of views.  The inhibition must be substantial and therefore of real and demonstrable significance.
58. Each request must be considered on a case-by-case basis, taking into account the effect (or likely effect) of disclosure of that particular information on the future exchange of views.  The content of the withheld information will require to be considered, taking into account factors such as its nature, subject matter, manner of expression, and also whether the timing of disclosure would have any bearing.  It is important to bear in mind that the exemption, where applicable, will apply to particular information and not inherently to a process (such as drafting).
59. As with other exemptions involving a similar test, the Commissioner expects authorities to demonstrate a real risk or likelihood that actual inhibition will occur at some time in the near future, not simply a remote or hypothetical possibility.

The Authority’s submissions on section 30(b)(ii)

60. The Authority argued that it needs a space for free, full and frank exchange of views and advice.  It considered that disclosure was likely to constrain this exchange and lead to those involved being less willing to provide such full and frank views in future, which would be to the detriment of open discussion and advice provision.
61. The Authority explained that there is an element of fear in having communications disclosed into the public domain, particularly when they are provided in a candid and less formal manner than the final outcomes of these exchanges. Therefore staff, believing their communications could be disclosed in future, would be less willing to record views in a written form. 

The Applicant’s submissions on section 30(b)(ii)

62. The Applicant referred to guidance issued by the UK Information Commissioner’s Office (UK ICO).  He submitted that this guidance recommended that public authorities, when handling a meta request, should not generically withhold information to protect a safe space.
63. The Applicant did not consider that any inhibition would be significant, explaining that, in another context, the UK ICO had found[4] there to be limited public interest in protecting such a safe space, given that any such advice must be given within the statutory framework of FOI law.

The Commissioner’s view

64. Having considered the content of the withheld information, the Commissioner notes that some of the information consists of draft replies and frank discussions of approach. He agrees that public authorities generally benefit from a private space to prepare and draft responses, and to discuss their approach to FOI requests.
65. The Commissioner agrees that disclosure of this information would, or would be likely to, result in substantial inhibition to the free and frank exchange of views for the purposes of deliberation, as argued by the Authority.  
66. As such, he is satisfied that this information is exempt from disclosure in terms of section 30(b)(ii) of FOISA.
67. However, in the Commissioner’s view, some of the withheld information is not expressed in a particularly free or frank fashion. On balance, he is not persuaded, from the submissions he has received, or the content of the information itself, that disclosure of this information would result in the harm claimed by the Authority.
68. Consequently, the Commissioner cannot agree that this information is exempt from disclosure in terms of section 30(b)(ii) of FOISA.  Given this conclusion, he is not required to go on to consider the public interest test in section 2(1)(b) in relation to this information.  
69. However, as the Commissioner is satisfied that the Authority was entitled to rely on the exemption in section 30(b)(ii) of FOISA to withhold some of the withheld information, he is required to go on to consider the public interest test in section 2(1)(b) of FOISA in relation to this information.

Public interest test

70. As noted above, section 30(b)(ii) is subject to the public interest test required by section 2(1)(b) of FOISA. As the Commissioner has found that the exemption in section 30(b)(ii) was correctly applied to some of the withheld information, he is now required to consider whether, in all the circumstances of the case, the public interest in disclosing the information is outweighed by the public interest in maintaining the exemption.
71. The "public interest" is not defined in FOISA but has been described as "something which is of serious concern and benefit to the public", not merely something of individual interest.  The public interest does not mean "of interest to the public" but "in the interest of the public", i.e. disclosure must serve the interests of the public.

The Authority’s submissions

72. The Authority argued that the public interest favoured protecting its ability to hold free and frank discussions to allow its management to consider available options and make robust decisions for the benefit of the Authority.
73. The Authority also submitted that it was in the public interest to ensure staff are not inhibited from recording information of this sort, to maintain proper evidence of how particular cases have been handled and facilitate the proper handling of future cases. 

The Applicant’s submissions

74. As outlined above, the Applicant considered that it would be in the public interest to disclose information to facilitate scrutiny of the Authority’s decisions and decision-making.

The Commissioner’s view

75. The Commissioner has considered all of the arguments presented to him in relation to the public interest in withholding or disclosing the withheld information, along with the withheld information itself.
76. The Commissioner agrees that there is a public interest in scrutinising the decisions of public authorities, including with regards their discharge of duties under FOI law.  However, the Commissioner also recognises the public interest in ensuring that public authorities can reach, and record, robust and informed decisions.
77. On balance, therefore, the Commissioner finds that the public interest in disclosing most of the withheld information is outweighed by that in maintaining the exemption in section 30(b)(ii) of FOISA.  Consequently, he finds that the Authority was entitled to maintain the exemption for this information.
78. However, there is a single section of information withheld under section 30(b)(ii) of FOISA that describes the approach the Authority took at that stage of the underlying request. The Commissioner considers that disclosure of this information, given it takes the form of a decision (on a matter the Authority was obliged to make a decision on), will provide a greater insight into the Authority’s decision making, to the extent that the public interest favours disclosure.
79. While disclosure of this information still carries with it a risk of inhibition (which is why he found that this information engaged the exemption in section 30(b)(ii), the Commissioner is satisfied that the risk of inhibition is diminished relative to the other information withheld under this exemption.
80. In the circumstances, the Commissioner finds that, for this single section of information, the interests served by disclosure would outweigh the prejudice to the effective conduct of public affairs entailed by disclosure.  He therefore requires the Authority to disclose this information to the Applicant.

Section 30(b)(i) – Free and frank provision of advice

81. The Authority applied the exemption in section 30(b)(i) of FOISA to several passages of the withheld information, including passages to which the Authority had also applied the exemptions in sections 36(2) and 30(b)(ii).  
82. The Commissioner need not, and will not, consider whether the exemption in section 30(b)(i) of FOISA applies to the information properly withheld under the exemptions in either sections 36(2) or 30(b)(ii).  His consideration under this heading will therefore be limited to the information solely withheld under the exemption in section 30(b)(i) of FOISA and to the information that he has already found could not be withheld under the other exemptions he has already considered.
83. Section 30(b)(i) of FOISA provides that the information is exempt if its disclosure would, or would be likely to, inhibit substantially the free and frank provision of advice.  The exemption is subject to the public interest test in section 2(1)(b) of FOISA.
84. In applying this exemption, the chief consideration is not whether the information constitutes advice, but whether the disclosure of that information would, or would be likely to, inhibit substantially the provision of advice.  The inhibition in question must be substantial and therefore of real and demonstrable significance.

The Applicant’s submissions

85. For the same reasons he provided in relation to the applicability of the exemption in section 30(b)(ii) of FOISA, the Applicant did not believe that any inhibition should be considered sufficiently substantial to engage the exemption in section 30(b)(i).

The Authority’s submissions

86. The Authority submitted that disclosure of this information would deprive it of a safe space for the exchange of free and frank advice and deliberation for decision making, which it argued would severely impact its ability to effectively conduct its affairs.  If there was reluctance to engage in this exchange of free and frank advice, it argued that this would make it very difficult to conduct the necessary business. 

The Commissioner’s view

87. While it will, as the Commissioner has already noted above, sometimes be appropriate for public authorities to withhold information relating to the handling of FOI requests, this does not mean a blanket withholding of information relating to the handling of specific requests is justified.
88. In this case, having carefully considered the relevant withheld information, the Commissioner does not consider the withheld information to be expressed in a particularly free or frank fashion, to represent rough drafts or to otherwise represent anything more than routine exchanges in the Authority’s case handling process.
89. On balance, the Commissioner is not persuaded, from the submissions he has received, or the content of the information itself, that disclosure of this information would result in the harm claimed by the Authority.
90. Consequently, the Commissioner cannot agree that this information is exempt from disclosure in terms of section 30(b)(i) of FOISA.  Given this conclusion, he is not required to go on to consider the public interest test in section 2(1)(b) in relation to this information.  He requires the Authority to disclose this information to the Applicant. 

Section 38(1)(b) - Personal information

91. The Authority withheld some information on the grounds that it comprised the personal information of employees of both the Authority and UCEA.
92. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is “personal data”, as defined in section 3(2) of the DPA 2018 and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR.
93. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption.  This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
94. To rely on the exemption in section 38(1)(b) of FOISA, the Authority must show that the information is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles in Article 5(1) of the UK GDPR. 

Is the information personal data? 

95. The first question the Commissioner must address is whether the information is personal data for the purposes of section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable individual.  “Identified living individual” is defined in section 3(3) of the DPA 2018.  (This definition reflects the definition of personal data in Article 4(1) of the UK GDPR.)
96. The Commissioner is satisfied that the majority of the information withheld under the exemption in section 38(1)(b) of FOISA is personal data: the data comprises the names and contact details of identified individuals.
97. However, the Commissioner does not accept that a small amount of information withheld under the exemption in section 38(1)(b) of FOISA is personal data.  This information, which includes pronouns and a short passage expressing the opinion of an employee, relates to employees whose names and contact details (as will be set out below) were appropriately withheld under the exemption in section 38(1)(b) of FOISA.  In the absence of these names and contact details, the Commissioner does not consider the individuals to whom the small amount of information relates to be identifiable.
98. The Commissioner therefore concludes that the majority of the information withheld under the exemption section 38(1)(b) of FOISA is personal data for the purposes of section 3(2) of the DPA 2018, but a small amount of information is not.  He requires the Authority to disclose to the Applicant the information he has found is not personal data.

Would disclosure contravene one of the data protection principles? 

99. The Authority argued that disclosing the personal data would breach the first and second data protection principles:

• The first data protection principle requires personal data to be processed "lawfully, fairly and in a transparent manner in relation to the data subject" (Article 5(1)(a) of the UK GDPR) 

• The second data protection principle requires personal data to be “collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes” (Article 5(1)(b) of the UK GDPR). 

100. The definition of "processing" is wide and includes (section 3(4)(d) of the DPA 2018) "disclosure by transmission, dissemination or otherwise making available".  For the purposes of FOISA, personal data are processed when disclosed in response to a request.  This means that personal data could only be disclosed if disclosure would be both lawful (i.e. it would meet one of the conditions of lawful processing listed in Article 6(1) of the UK GDPR) and fair. 

Lawful processing: Article 6(1)(f) of the UK GDPR 

101. In considering lawfulness, the Commissioner must consider whether any of the conditions in Article 6(1) of the UK GDPR would allow the personal data, to be disclosed.
102. The Commissioner considers that condition (f) of Article 6(1) of the UK GDPR is the only one which could potentially apply. This condition states that processing shall be lawful if it is "necessary for the purposes of the legitimate interest pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data…"
103. Although Article 6(1) of the UK GDPR states that this condition cannot apply to processing carried out by a public authority in performance of its tasks, section 38(5)(a) of FOISA makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
104. The three tests which must be met before Article 6(1)(f) of the UK GDPR can be met are as follows: 

• Does the Applicant have a legitimate interest in the personal data? 

• If so, would the disclosure of the personal data be necessary to achieve that legitimate interest? 

• Even if the processing would be necessary to achieve the legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects which require protection of personal data? 

Does the Applicant have a legitimate interest in the personal data?

105. The Applicant confirmed that he did not need the names and contact details of junior staff but did not provide specific submissions on his legitimate interest in the remaining personal data (i.e. the name(s) and contact detail(s) of senior staff).
106. The Authority did not agree that the Applicant had a legitimate interest in this information.
107. However, the Commissioner considers that the public, including the Applicant, has a legitimate interest in understanding the Authority’s handling of FOI requests.  He also considers that information on the identities of the individuals involved in these exchanges would assist in understanding these exchanges (especially when these individuals are senior).  He therefore accepts that the Applicant has a legitimate interest the name(s) of senior officials.
108. Having reviewed the information withheld under section 38(1)(b) of FOISA, the Commissioner notes that there is only one official senior enough to clearly expect their identity to be routinely disclosed under FOISA.
109. However, the Commissioner is unaware of any legitimate interest that the Applicant has in the obtaining that senior official’s contact details. This information would not assist the Applicant in understanding how his request was processed, and he has not provided the Commissioner with any other specific need for this information. The Commissioner therefore does not consider that the Applicant has a legitimate interest in that senior official’s contact details.

Is disclosure of the personal data necessary? 

110. Having accepted that the Applicant has a legitimate interest in some of the personal data, the Commissioner must consider whether disclosure of that personal data is necessary for the Applicant's legitimate interest.  In doing so, he must consider whether that legitimate interest might be reasonably be met by any alternative means.
111. "Necessary" means "reasonably" rather than "absolutely" or "strictly" necessary. When considering whether disclosure would be necessary, public authorities must consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the requester's legitimate interests can be met by means which interfere less with the privacy of the data subject.
112. The Commissioner accepts that disclosure of the senior official’s name would be necessary to satisfy the Applicant’s legitimate interest.  He can identify no other viable means of meeting the Applicant’s legitimate interest than providing this withheld information.

Interests of the data subject 

113. The Commissioner has acknowledged that disclosure of the information in question would be necessary to achieve the Applicant’s legitimate interests.  This must be balanced against the interests or fundamental rights and freedoms of the third party.  Only if the legitimate interests of the Applicant outweigh those of the data subject could personal data be disclosed without breaching the first data protection principle.
114. The Commissioner’s guidance on section 38 of FOISA[5] lists certain factors that should be taken into account in balancing the interests of the parties.  He makes it clear that much will depend on the reasonable expectations of the data subjects and that these are some of the factors public authorities should consider: 

     1. whether the information relates to an individual's public life (their work as a public official or employee, wherein their seniority and whether their role is public-facing is a factor) or to their private life (their home, family, social life or finances) 

     2. whether the individual objected to the disclosure 

     3. the potential harm or distress that may be caused by disclosure. 

115. Disclosure under FOISA is not simply disclosure to the person requesting the information – it is effectively placed into the public domain. This must always be borne in mind when considering the effects of disclosure.
116. Given the seniority of the senior staff member, who possesses a degree of public profile by virtue of their role, the Commissioner considers that this individual would reasonably anticipate that their involvement in this work would be disclosed.
117. Having carefully balanced the legitimate interests of the Applicant against the interests or fundamental rights or freedoms of the data subject, the Commissioner finds that the legitimate interests served by disclosure of the personal data would not be outweighed by any unwarranted prejudice that would result to the rights and freedoms and legitimate interests of the data subject.

Fairness

118. The Commissioner must also consider whether disclosure would be fair. He finds, for the same reasons as he finds that condition (f) in Article 6(1) can be met, that disclosure of the name of this senior individual would be fair.

The second data protection principle

119. As set out above, the second data protection principle requires personal data to be “collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes”.
120. In this case, the Authority argued that this information was not shared for the purposes of making the material public.
121. As the Commissioner found in Decision 007/2018[6], processing information for the purposes of complying with FOI requests shall not normally be incompatible with the purpose for which it was originally collected or created.
122. The Commissioner is aware of no reason why, in the circumstances of this case, he should diverge from this approach.  In the circumstances, therefore, he is not satisfied that the Authority was entitled to claim that the second data protection principle would be breached by disclosure of the withheld personal data.
123. As he is not satisfied that disclosure of the withheld personal data would breach either the first or the second data protection principle, the Commissioner must find that the Authority was not entitled to withhold this information under section 38(1)(b) of FOISA.

Information to which no exemption applies

124. During the investigation, as rehearsed above, the Authority clarified what exemptions applied to specific information falling in scope of the request.  As a result, there is some information falling in scope of the request that has been withheld from the Applicant but to which the Authority is no longer claiming an exemption under FOISA.

125. The Commissioner notes the 2016 judgment of the First Tier Tribunal (Information Rights) in Paul Boam and the (UK) Information Commissioner and Ofsted.[7]  In that case, the Tribunal accepted that there are limits to reasonable redaction, for example in cases where:

     “the excisions required … must be so drastic that what remains in incoherent or even meaningless, meaning that it is reasonable to redact entire documents.”

126. Having considered the remaining information to which no exemption has been applied, the Commissioner does not agree that this information would be meaningless if disclosed.
127. While the Commissioner welcomes the Authority’s reappraisal of this material, it should have identified that no exemption applied to this material by the time of the review outcome at the latest and disclosed this information to the Applicant.  By failing to do so the Authority failed to comply with section 1(1) of FOISA.  The Commissioner requires the Authority to disclose this information to the Applicant.

Handling

128. In the circumstances, the Commissioner considers that he should address one further issue regarding the Authority’s handling of this request.
129. During the investigation, the Authority indicated that it wished to withhold one document under section 27(1) of FOISA.  However, it did not notify the Applicant of this fact.
130. While public authorities are entitled to apply a new exemption (or exemptions) during the investigation, the Commissioner notes that he has already found (in Decision 183/2024) that the Authority’s failure to inform the Applicant of the exemptions it considered applicable had deprived the Applicant of the opportunity to provide specific comments on these exemptions.
131. The Commissioner is therefore disappointed that the Authority appears to have repeated this failure. He would take this opportunity to remind the Authority of the importance of informing applicants, in terms of section 16(1)(c) and 16(1)(d) of FOISA, of the exemption(s) claimed and the reason(s) for their applicability.
132. The Commissioner notes that the exemption may have been applied in error.  This was raised with the Authority, but it did not clearly or specifically confirm whether it considered this exemption had been applied in error.
133. As the Commissioner has found that this document was properly withheld under section 30(b)(ii) of FOISA, he will not go on to consider whether the exemption under section 27(1) of FOISA was correctly applied to this information.

Decision 

The Commissioner finds that the Authority partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant. 

The Commissioner finds that by withholding certain information under the exemptions in sections 30(b)(ii), 36(2) and 38(1)(b), the Authority complied with Part 1 of FOISA.

However, the Commissioner finds that the Authority failed to comply with Part 1 (and, in particular, section 1(1)) of FOISA by:

•  wrongly withholding certain other information under the exemptions sections 30(b)(i), 30(b)(ii), 36(2) and 38(1)(b) of FOISA

•  failing to disclose information to the Applicant to which the Authority identified no applicable exemption(s) in FOISA.  

The Commissioner therefore requires the Authority to disclose the incorrectly withheld information to the Applicant by 8 December 2025.  He will specify the information to be disclosed by the Authority.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement 

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply.  The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

Euan McCulloch 

Head of Enforcement 

23 October 2025