Decision 294/2025:  Peer review of a specified criminal investigation

Authority:  Chief Constable of the Police Service of Scotland
Case Ref:  202500828

Summary

The Applicant asked the Authority for information relating to a peer review of the investigation into the murder of Shamsuddin Mahmood.  The Authority identified two reports falling within scope of the Applicant’s request and it withheld both reports under a number of exemptions.

The Commissioner investigated and found that the Authority was wrong to withhold the information under the exemptions specified. He required the Authority to disclose the withheld information to the Applicant, with personal data redacted.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 34(1)(b) (Investigations by Scottish public authorities and proceedings arising out of such investigations); 35(1)(a) and (b) (Law enforcement); 39(1) (Health, safety and the environment); 47(1) and (2) (Application for decision by Commissioner).

Background

1. On 29 January 2024, the Applicant made a request for information to the Authority.  He asked for information in relation to a peer review carried out into the investigation into the murder of Shamsuddin Mahmood in Orkney on 2 June 1994.  He asked:

   1. Who requested that the review take place (please provide their name and rank)? 

   2. When was the review started (please provide the month and year)?

   3. How many weeks did it take for the review to be completed? 

   4. Who is the independent Chief Inspector who carried out the review, and which force are they from? 

   5. How many officers, in total, carried out the review? 

   6. Was a report compiled on the findings of the review? 

   7. If so, how many pages long is this report? 

   8. If a report was compiled about the findings of the review, please can Police Scotland provide a copy of it.  If this is unavailable in its entirety due to one of the exemptions listed in the Freedom of Information Act (Scotland) 2002, then please provide any sections summarising the findings of the peer review, such as an executive summary, introduction, or conclusion. 

   9. Please can you also provide a copy of any and all correspondence regarding the request that the peer review take place (including any attachments to said correspondence) 

2. The Authority responded on 26 February 2024.  It withheld information relating to requests (i), (ii), (iii), (v), (vi), (vii) and (ix) under section 12(1) of FOISA (excessive cost of compliance).  It withheld information relating to request (iv) under section 38(1)(b) (personal data) of FOISA.  It also withheld information relating to request (viii) under sections 34(1)(b) (Investigations by Scottish public authorities and proceedings arising out of such investigations), 35(1)(a) and (b) (Law enforcement) and 39(1) (Health, safety and the environment) of FOISA.
3. On 3 March 2024, the Applicant wrote to the Authority requesting a review of its decision. The Applicant stated that he was dissatisfied with the Authority’s response because he believed the public interest favoured disclosure of the information.  He also questioned whether section 34(1)(b) applied to the information and stated that the Authority had not properly explained why sections 35(1)(a) and 39(1) applied.  He suggested that sensitive personal data could be redacted.
4. The Authority notified the Applicant of the outcome of its review on 29 July 2024. It maintained that section (12)(1) of FOISA applied to requests (i), (ii), (iii), (v), (vi), (vii) and (ix) and it notified the Applicant that it also now considered that section 12(1) applied to requests (iv) and (viii).  The Authority withdrew its reliance on sections 34(1)(b), 35(1)(a) and (b), 38(1)(b) and 39(1) of FOISA. 

5. On 27 January 2025 (and following an appeal to the Commissioner which resulted in the issue of Decision 292/2024[1]) the Authority issued a revised review outcome to the Applicant, withdrawing its reliance on section 12(1) of FOISA.  The Authority gave the Applicant notice, under section 17(1) of FOISA, that information was not held for requests (i), (ii), (iii) and (ix).  The Authority responded to requests (v), (vi) and (vii), providing the information asked for and, for request (iv), the Authority disclosed the name of the force but withheld the name of the reviewing officer under section 38(1)(b) of FOISA.

   The Authority withheld two reports falling within the scope of request (viii) in their entirety under sections 30(b)((ii), 34(1)(b), 35(1)(a) and 35(1)(b) and 39(1) of FOISA and it withheld personal data within the reports under section 38(1)(b) of FOISA.

6. On 25 May 2025, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  The Applicant stated that he was dissatisfied with the outcome of the Authority’s review of request (viii) because he did not agree that the exemptions applied and even if they did, he considered that the public interest favoured disclosure.

Investigation

7. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
8. On 23 June 2025, the Authority was notified in writing that the Applicant had made a valid application.  The Authority was asked to send the Commissioner the information withheld from the Applicant. The Authority provided the information and the case was allocated to an investigating officer.
9. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Authority was invited to comment on this application and to answer specific questions. These related to its reasons for applying the exemptions and its consideration of the public interest test.

Commissioner’s analysis and findings

10. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority. 

Scope of the investigation

11. The Applicant has not challenged the Authority’s decision to withhold personal data under section 38(1)(b) of FOISA.  In his application, he stated that he was not seeking any personal data and he requested that any names or details that would clearly identify individuals should be redacted.  Given this, the Commissioner will not consider section 38(1)(b) in this decision notice.
12. The Applicant only challenged the Authority’s handling of request (viii) in his requirement for review.  Therefore, the scope of the Commissioner’s investigation is limited to the two reports identified as falling within the scope of request (viii).

The Authority’s change of position during the investigation

13. Part 5 of FOISA (Historical records) makes it clear that not all of the exemptions in Part 2 of FOISA can be applied after a certain period.  For example, many exemptions (such as those in section 30 of FOISA) cannot be applied to a historical record which is more than 15 years old (as defined in section 57(1) of FOISA).
14. The information captured by request (viii) was recorded on 1 September 1994 and 1 September 1995 and is therefore over 29 years old.  For this reason, during the investigation, the Authority withdrew its reliance on section 30(b)(ii) of FOISA in withholding the information.
15. Having considered the Authority’s submissions on its change of position here, the Commissioner has no option but to find that the Authority was not entitled to withhold the information under the exemption in section 30(b)(ii) of FOISA.
16. As the Commissioner has concluded that the Authority was not entitled to rely upon section 30(b)(ii) of FOISA to withhold the information, he must find that, by doing so, it breached Part 1 of FOISA. 

Section 34(1)(b) - Investigations by Scottish public authorities and proceedings arising out of such investigations

17. The Authority withheld all of the information in the two reports under section 34(1)(b) of FOISA.
18. The exemption in section 34(1)(b) of FOISA provides that information is exempt from disclosure if it has at any time been held by a Scottish public authority for the purposes of an investigation, conducted by the authority, which in the circumstances may lead to a decision by the authority to make a report to the procurator fiscal to enable it to be determined whether criminal proceedings should be instituted.
19. The exemptions in section 34 are described as “class-based” exemptions.  This means that if information falls within the description set out in the exemption, the Commissioner is obliged to accept it as exempt. There is no harm test: the Commissioner is not required or permitted to consider whether disclosure would, or would be likely to, prejudice substantially an interest or activity, or otherwise to consider the effect of disclosure in determining whether the exemption applies.  The exemptions are, however, subject to the public interest test contained in section 2(1)(b) of FOISA.

The Applicant’s comments on section 34(1)(b)

20. The Applicant was not persuaded that the exemption applied.  He referred to the Authority’s revised review outcome which stated, “the review [i.e. the peer review reports being withheld] itself was clearly not a criminal investigation” but that “much of the content” – “much” meaning of course, not all – “discusses elements” of the murder investigation.  He did not accept the Authority’s position. He was unclear why these arguments have been put forward by the Authority in this case, when those same arguments apply to the press releases and other materials which have already been made public by one of the Authority’s own legacy forces.  He argued that many documents which “discuss elements of the criminal investigation” have already been disclosed.  In the circumstances, the Applicant did not consider this to be a reasonable argument for withholding the two review reports.

The Authority’s comments on section 34(1)(b)

21. The Authority submitted that the information held within the two reports [the subject of request (viii)] was held as a result of the investigation into the murder of Shamsuddin Mahmood.
22. The Authority argued that it could not comment on what had already been placed into the public domain by its legacy force or by other public authorities.  It stated that information relating to criminal investigations and subsequent prosecutions would only be released during the associated criminal justice proceedings or where there was an overwhelming public interest consideration for doing so.

The Commissioner’s view on section 34(1)(b)

23. The Commissioner has carefully considered the content and purpose of the two reports comprising the withheld information.  The preamble of the request states:

    “On June 20, 2022, the campaign group Justice 4 Michael Ross submitted a 360-page complaint about the investigation to Police Scotland's Professional Standards Department. The complaint was then responded to by Chief Inspector Stephen Rosie — of Professional Standards Department (North) — in a letter dated December 13, 2023. The response has a reference number of: CO/1830/22. On the top line of page 4, the response says:  "In addition, an independent Chief Inspector reviewed the SIO policies as part of a peer review of the enquiry."”

    Request (viii) asks for a copy of the report that was compiled about the findings of that peer review.

24. It is clear that the reports captured by request (viii) are related to the findings of the peer review, and that the peer review examined the enquiry of the circumstances surrounding the death of Shamsuddin Mahmood; the peer review was not part of that enquiry.  The Commissioner is not satisfied that the peer review was, in any way, part of the murder investigation which was subsequently reported to the procurator fiscal to determine whether criminal proceedings should be instituted.  In these circumstances, he cannot accept that the legal test for the application of the exemption has been met.
25. The Commissioner finds, therefore, that the information was not held for the purposes of an investigation which may lead to a decision to make a report to the procurator fiscal to enable it to be determined whether criminal proceedings should be instituted and, as such, the Authority was not entitled to apply section 34(1)(b) of FOISA.
26. As the Commissioner has found that the exemption is not engaged, he is not required to consider the public interest test in section 2(1)(b) of FOISA.
27. As the Commissioner is not satisfied that the Authority was entitled to rely on the exemption in section 34(1)(b) of FOISA for withholding all of the information covered by the Applicant’s request, he will now go on to consider the remaining exemptions that were relied upon by the Authority in withholding the two reports.

Section 35(1)(a) and (b) – Law enforcement 

28. Section 35(1)(a) exempts information if its disclosure would, or would be likely to, prejudice substantially the prevention or detection of crime.  The term "prevention or detection of crime" is wide ranging.  It encompasses actions taken to anticipate and prevent crime, or to establish the identity and secure prosecution of people suspected of being responsible for committing a crime.  This could mean activities in relation to specific (anticipated) crime or wider strategies for crime reduction and detection.
29. Section 35(1)(b) exempts information if its disclosure would, or would be likely to, prejudice substantially the apprehension or prosecution of offenders. There is likely to be an overlap between information relating to "the apprehension or prosecution of offenders" and that relating to "the prevention or detection of crime".  Section 35(1)(b) is narrower and focusses on the process of identifying, arresting or prosecuting those suspected of being responsible for unlawful activity. Again, this term could refer to the apprehension or prosecution of specific offenders or to more general techniques such as investigative processes used, information received, or guidance given, and strategies designed for these purposes.
30. There is no definition of "substantial prejudice" in FOISA, but the Commissioner's view is that authorities have to be able to identify harm of real and demonstrable significance.  The harm would also have to be at least likely, and more than simply a remote possibility.
31. The exemptions in section 35(1) are subject to the public interest test in section 2(1)(b) of FOISA.

The Applicant’s comments on section 35(1)(a) and (b)

32. The Applicant was dissatisfied that the Authority had not explained how disclosure of the information he had asked for would prejudice law enforcement activity.
33. He submitted that that the criminal investigation resulted in a conviction in 2008; and that there had been no law enforcement activity related to the murder for over 15 years.  The Applicant commented that given that three decades had elapsed since the reports were written, he considered it unlikely that either document was likely to hamper law enforcement activity by revealing excessive details about the inner working of the investigation, or police investigations more broadly (given how policing would have advanced and changed over the past three decades).
34. In his view, the exemption was applied in a hypothetical way with no evidence to support any suggestion that there was a “significant probability” any damage would be done to law enforcement by disclosure of these two specific reports. He argued that far greater damage to law enforcement was caused by a loss of public confidence when controversial investigations failed to receive the scrutiny that was merited.

The Authority’s comments on section 35(1)(a) and (b)

35. The Authority submitted that disclosure of the information would prejudice the integrity of its role, the integrity of the Crown Office and Procurator Fiscal Service (COPFS) and the integrity of the associated criminal justice process.
36. The Authority argued that the forum for establishing guilt or innocence was through criminal prosecution and trial.
37. The Authority submitted that the peer review reports contained information about witnesses that the public would expect to be treated with due confidentiality.  It argued that disclosure of the information would, therefore, undermine public trust and confidence in its handling of personal information and lead to an unwillingness to co-operate with police investigations.  The Authority submitted that information was key to any police investigation, and any detriment to that flow of information would substantially prejudice the Authority’s ability to investigate crime and apprehend and prosecute offenders.

The Commissioner’s view on section 35(1)(a) and (b)

38. Again, the Commissioner has carefully considered the withheld information in the context of these exemptions.  At the time the request was made, the information was almost 30 years old and it related to a peer review of an enquiry carried out by an officer of a legacy force.  Given the passage of time, the Commissioner considers it is highly likely that modern law enforcement methods bear little resemblance to the methods discussed in the peer review reports.  The Commissioner, therefore, cannot understand why disclosure of these reports would have any impact of current law enforcement practices, or the integrity of the roles of public authorities involved in law enforcement, and he is not persuaded that there would be prejudice, let alone substantial prejudice, arising from disclosure.
39. The Commissioner acknowledges the Authority’s remarks about the confidentiality of information about witnesses.  He notes that the reports themselves do not contain any witness statements, but they do refer to particular witnesses.  He is not however persuaded that any of the comments or observations made would result in any significant detriment that would substantially prejudice the Authority’s ability to carry out its functions.  The Commissioner considers that the age of the documents is a significant factor here, combined with the fact that a conviction has already been made, and this is, essentially, a closed case.
40. Having considered the Authority’s submissions and the withheld information in detail, the Commissioner is not satisfied that the harm that the Authority claims would follow disclosure of the withheld information is of real and demonstrable significance.
41. In all the circumstances, the Commissioner concludes that the exemptions in section 35(1)(a) and (b) of FOISA are not engaged because disclosure of the withheld information would not, or would not be likely to, prejudice substantially the prevention or detection of crime or the apprehension or prosecution of offenders.  
42. As the Commissioner has found that the exemptions in section 35(1)(a) and (b) were incorrectly applied to the withheld information, he is not required to go on to consider the public interest test in section 2(1)(b) of FOISA.
43. As the Commissioner is not satisfied that the Authority was entitled to rely on the exemptions in section 35(1)(a) and (b) of FOISA for withholding all of the information covered by the Applicant’s request, he will go on to consider the Authority’s application of section 39(1) of FOISA.

Section 39(1) – Health, safety and the environment

44. Section 39(1) of FOISA states that information is exempt information if its disclosure under FOISA would, or would be likely to, endanger the physical or mental health or the safety of an individual (which may include a group of people). This is a qualified exemption and is subject to the public interest test required by section 2(1)(b) of FOISA.
45. As the Commissioner notes in his briefing on the exemption[2], section 39(1) of FOISA does not contain the usual harm test.  Instead of the "substantial prejudice" test found in many other harm-based exemptions in Part 2 of FOISA, this exemption refers to the "endangerment" of health or safety.  This test is less demanding than the "substantial prejudice" test.

The Applicant’s comments on section 39(1)

46. The Applicant strongly disputed the Authority’s application of this exemption, in particular the Authority’s assertion in the review outcome that “disclosure would endanger the mental health of an individual by causing unwarranted distress to the friends and relatives of the deceased in this case”.
47. The Applicant commented that the victim’s family had appeared on documentaries about the case after the conviction and had also called for the Authority’s handling of the case to be the subject of an inquiry, calling for answers that they had never received about alleged failings in the criminal investigation.
48. The Applicant argued that, given the withheld reports are of peer reviews into the criminal enquiry, disclosure would go a long way to satisfying those calls for scrutiny from the family of the victim, and from the supporters of the convicted person who maintains his innocence.
49. The Applicant submitted that the Authority had not reached the evidentiary threshold set out by the Scottish Information Commissioner; that is, not just that physical or mental harm “is within the bounds of possibility,” but that it has “some realistic prospect or degree of likelihood of occurring.”  The Applicant argued that no evidence had been provided by the Authority to justify the Authority’s view that such harm has a “realistic prospect” of occurring in this case.

The Authority’s comments on section 39(1)

50. The Authority commented that it hadn’t consulted the family of the victim to seek their views on the matter because it considered that it would have been inappropriate to do so, but it submitted that having the death of your loved one be subject to media speculation and scrutiny, in circumstances where the matter was concluded, could only be upsetting and, as such, would give rise to the endangerment to mental health required for the exemption to be engaged.
51. The Authority confirmed its view that the family and friends of the deceased would, or would be likely to, be endangered by the disclosure of the information.
52. The Authority noted that in this case, a police investigation identified an accused individual and that same individual was tried, found guilty and subsequently lost an appeal against his conviction.  The Authority stated that the matter was now closed.  It noted that it could not comment on whether the deceased’s family obtained any sense of closure as a result of the conviction, but it suggested that such a reaction would be normal. 

The Commissioner’s view on section 39(1)

53. The phrase "endanger" is broad enough to apply where there is a threat, direct or indirect, to the safety of a person.  Since the exemption does not specify that any threat should be imminent before it applies, the threat may be either immediate, or one which would foreseeably arise in the future.  However, the Commissioner believes that for endangerment to be considered likely, there must be some well-founded apprehension of danger, such that the prospect of harm could be regarded as a distinct possibility.
54. The central question when considering the application of the exemption in section 39(1) of FOISA is whether disclosure of the specific information in question would, or would be likely to, endanger the physical or mental health or the safety of an individual (or group).
55. The Commissioner recognises that the subject matter of the Applicant’s request and the criminal investigation carried out by the Authority at that time is a matter of debate which attracts media interest.  He accepts that disclosure of any information relating to this criminal case may result in increased attention or speculation, which may be negative, regarding certain individuals believed to have been involved in the referral process.
56. The Commissioner has no doubt that the loss of Mr Mahmood must have caused (and will continue to cause) mental anguish and distress to his family.  He accepts that any press coverage about his death, or the investigation into his death will only serve to remind the Mahmood family of the loss they have suffered, thus adding to their stress and anguish.
57. However, having considered the withheld information and the submissions provided by the Authority, the Commissioner is not satisfied that disclosure of the withheld information would, or would be likely to, increase the distress experienced by the family and friends of the victim.  The Authority correctly points out that the individual convicted for Mr Mahmood’s death has appealed his conviction.  There has been media coverage since, before, during and after the conviction, and there is a current online campaign against the conviction.
58. The Authority has not explained why disclosure of the two reports would add to the family’s distress, over and above that caused by the existing media coverage and appeals brought by the man convicted of the murder.  The Authority has provided no evidence to suggest that withholding the requested information would, in any way, prevent media coverage of Mr Mahmood’s murder, nor has it demonstrated that this media attention is endangering the mental health of members of Mr Mahmood’s family.  Indeed, the Authority has confirmed that it has not contacted the family and so is unaware of their mental state.
59. In all of the circumstances, the Commissioner finds that disclosure would not be likely to endanger the physical or mental health or the safety of any individual (or group).  He therefore finds that the exemption in section 39(1) of FOISA has been wrongly applied by the Authority.
60. Given that the exemption in section 39(1) of FOISA was wrongly applied, the Commissioner is not required to consider the public interest test in section 2(1)(b) in terms of section 39(1).

Information to be disclosed

61. As the Commissioner has not upheld the Authority’s application of the exemptions contained in section 34(1)(b), 35(1)(a) and (b) and 39(1) of FOISA, he now requires Authority to disclose the two reports to the Applicant, with only personal data redacted under section 38(1)(b) of FOISA.

Decision 

The Commissioner finds that the Authority failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.

The Commissioner finds that the Authority failed to comply with Part 1 of FOISA by incorrectly withholding information under the exemptions in sections 30(b)(ii), 34(1)(b), 35(1)(a) and 35(1)(b) and 39(1) of FOISA.

The Commissioner therefore requires the Authority to disclose this information to the Applicant, subject to the redaction of personal data, by 26 January 2026.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply.  The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

David Hamilton

Scottish Information Commissioner

10 December 2025