Tag Archives: Freedom of Information (Scotland) Act 2002

FOI in Scotland: Registered Social Landlords

Last week the Scottish Ministers laid The Freedom of Information (Scotland) Act 2002 (Designation of Persons as Scottish Public Authorities) Order 2019 (Draft) before the Scottish Parliament for the approval of the Parliament, as they are required to do in terms of the Freedom of Information (Scotland) Act 2002 (“FOISA”). This order is a long anticipated order to bring Registered Social Landlords (“RSLs”) within the scope of FOISA by designating them as Scottish public authorities. If approved (and there is nothing to suggest that the Order will not be approved by the Scottish Parliament), it will mean that RSLs (and their subsidiaries) will be designated as Scottish public authorities from 11 November 2019. Some had been hoping that they would have been designated from April this year, while others had been hoping that it would be April 2020. The Scottish Ministers appear to have split the difference and given RSLs a period of around 9 months to prepare for becoming Scottish public authorities.

RSLs have been, following a number of decisions of the Scottish Information Commissioner (which have never been appealed to the Court of Session), Scottish public authorities for the purposes of the Environmental Information (Scotland) Regulations 2004 for a number of years. There is, however, some debate about whether they remain so, following some changes to the regulatory landscape pertaining to RSLs. It has not yet, to my knowledge, been tested whether they still are Scottish public authorities for the purposes of the Environmental Information (Scotland) Regulations 2004. Whether the changes to the regulatory landscape of RSLs has had the effect of them no longer being Scottish public authorities, for the purposes of the Environmental Information (Scotland) Regulations 2004, is somewhat immaterial; designation as a Scottish public authority for the purposes of FOISA also means that they will be Scottish public authorities for the purposes of the Environmental Information (Scotland) Regulations 2004.

It should be noted that the draft order has been drafted in such a way so as to make RSLs Scottish public authorities for limited purposes only. They will be Scottish public authorities in respect of the following functions:

  1. providing housing accommodation and related services and includes anything done, or required to be done, in relation to:- (a) the prevention and alleviation of homelessness; (b) the management of housing accommodation (limited to the management of housing accommodation for which a registered social landlord has, under the Housing (Scotland) Act 2001, granted a Scottish secure tenancy as defined in section 11 or a short Scottish secure tenancy as defined in section 34 of that Act); (c) the provision and management of sites for gypsies and travellers, whatever their race or origin; and
  2. the supply of information to the Scottish Housing Regulator by a registered social landlord or a connected body in relation to its financial well-being and standards of governance.

A register of social landlords can be found on the website for the Scottish Housing Regulator.

Alistair Sloan

We are able to provide advice and assistance to public authorities and requesters in connection with matters concerning Freedom of Information laws; if you would like advice and assistance in connection with these matters, or any other information law matter, please contact Alistair Sloan on 0141 299 0880 or by E-mail. You can also follow our dedicated Information Law Twitter account.

Post-Legislative Scrutiny of the Freedom of Information (Scotland) Act 2002

For some time now the Scottish Parliament’s Public Audit and Post-Legislative Scrutiny Committee has been considering whether to undertake post-legislative scrutiny of the Freedom of Information (Scotland) Act 2002. The Committee’s decision on whether to undertake post-legislative scrutiny of FOISA was delayed while they awaited the Scottish Information Commissioner concluding his intervention in respect of the Scottish Government.

Yesterday, after hearing again from the Scottish Information Commissioner and his Head of Enforcement, the Committee took a decision (in private), as recorded in the Minutes [pdf], to undertake post-legislative scrutiny of FOISA.

It is not yet clear how the Committee will undertake its post-legislative scrutiny or what the timetable will be; but what can now be said is that there will be formal post-legislative scrutiny of FOISA by a committee of the Scottish Parliament for the first time since FOISA was enacted in 2002. Much has changed since FOISA was enacted and while the Act generally performs fairly well, there are undoubtedly some areas which are ripe for improvement.

Once we know more about the details of the post-legislative scrutiny I will, of course, blog about it.

Alistair Sloan

We are able to provide advice and assistance in connection with a range of Freedom of Information matters, including appeals against decisions of both the Scottish and UK Information Commissioners.  If you would like to do discuss a Freedom of Information, or any other Information Law, matter with us then you can contact Alistair Sloan on 0141 229 0880.  Alternatively, you can send him an E-mail.

Information Law Review of 2018

It does not seem as though it was a year ago since I sat down to write my review of Information Law in 2017 and to have a brief look ahead into 2018; but somehow we now appear to be in 2019. It was always going to be the case that 2018 was going to be a big year for information law; with the General Data Protection Regulation becoming applicable on 25th May 2018. The 25th May 2018 came and went without the millennium bug style apocalypse that seemed inevitable from the amount of sensationalist writing that was taking place in late 2017 and early 2018.

My review of 2017 started off with the English and Welsh High Court decision on vicarious liability for data protection breaches in Various Claimants v WM Morrisons Supermarket PLC  [2017] EWHC 3113 (QB)This case rumbled on in 2018 and it was considered by the Court of Appeal. The Court of Appeal heard the appeal and (in remarkably quick time) dismissed the appeal. It is understood that Morrisons have sought permission to appeal to the Supreme Court and if permission is granted it is possible that it will feature in a review of Information law in 2019.

In February, the English and Welsh High Court issued an interesting privacy judgment when it considered an action for compensation arising out of “Can’t Pay? We’ll Take it Away’; a fly-on-the wall documentary following High Court Enforcement Officers in their work enforcing court orders relating to debt and housing cases. The Court had the tricky job of balancing the privacy rights of individuals against the rights of television companies in respect of freedom of expression; however, the High Court decided that the balance in this particular case fell in favour of the claimant’s privacy rights. The High Court’s decision was appealed to the Court of Appeal; looking specifically at the issue of quantifying the level of damages. That appeal was heard by the Court of Appeal in early December and should provide useful guidance on calculating damages in the privacy sphere.

Facebook, Cambridge Analytical and Aggregate AIQ all featured quite heavily in 2018 in terms of privacy and data protection matters. Facebook was served with a monetary penalty in the amount of £500,000 for breaches of the Data Protection Act 1998 and Aggregate AIQ was also the recipient of the first Enforcement Notice under the Data Protection Act 2018 (which was narrowed in scope by the Information Commissioner following an appeal by AIQ; which was subsequently dropped). Facebook lodged an appeal against the Monetary Penalty Notice with the First-Tier Tribunal (Information Rights) in November 2018. If and when a decision is reached by the Tribunal in respect of that appeal, it will feature on this blog.

Arising out of the same wide-ranging investigation by the ICO as the Facebook penalty and the AIQ Enforcement Notice was an Information Notice served on the United Kingdom Independence Party (UKIP), which was appealed to the First-Tier Tribunal (Information Rights). The Tribunal dismissed the appeal by UKIP in July.

In April there was yet another important decision from the English and Welsh High Court in respect of Privacy and Data Protection. A little over four years after the European Court of Justice decision on the Right to Be Forgotten in Google Spain, Mr Justice Warby handed down his judgment in NT1 & NT2 v Google; this represented the first decision of a UK Court in respect of the Right to Be Forgotten. An appeal was lodged in respect of this case and was due to be heard just before Christmas; however, it was reported that the case was settled on the day of the appeal.

The issue of compensation to identifiable third parties in the context of data protection breaches was considered by the English and Welsh Court of Appeal. This case adds to the helpful privacy and data protection case law emanating from the English and Welsh courts.

Another interesting development that we saw during the course of 2018 was a director being disqualified indirectly in connection with privacy and data protection matters. It does show that directors can be held personally liable for privacy and data protection transgressions of limited companies. This was underlined by the amendments to the Privacy and Electronic Communications (EC Directive) Regulations 2003 which now enable the Commissioner to serve a monetary penalty on directors (and others associated with companies) in certain circumstances.

In Scotland, the Court of Session made new rules which should make appealing decisions of the Scottish Information Commissioner in respect of requests for environmental information more financially viable.

Litigation in respect information law matters in Scotland remains limited. The majority of litigation on these areas arises out of England and Wales. Perhaps in 2019, we will begin to see more litigation in Scotland on information law matters. Hopefully the new rules in the Court of Session will see more appeals in respect of the Environmental Information (Scotland) Regulations 2004 and hopefully the introduction of Group proceedings in the Court of Session through the Civil Litigation (Expenses and Group Proceedings) (Scotland) Act 2018 will help with an increase in data protection and privacy litigation in Scotland.

In terms of 2018 Scottish cases, not long before Christmas the Court of Session treated us to a judgment in an appeal concerning vexatious requests under the Freedom of Information Scotland Act 2002. Beggs v Scottish Information Commissioner considered the correct approach to be taken when applying section 14(1) of the Freedom of Information (Scotland) Act 2002.

Looking ahead to 2019; the big issue on the horizon is Brexit. Much of what is discussed on this blog as “information law” derives from European law and so Brexit will likely have an impact upon that. We are still unsure as to the terms that we will be leaving on. A withdrawal Agreement has been negotiated between the European Union and the United Kingdom; however, there is  still a way to go with that – and it looks quite likely that the UK Parliament will rejected the Withdrawal Agreement in its current form. If we end up leaving with no Withdrawal Agreement in place then this will cause considerable difficulties for UK business which rely upon the transfer of personal data from elsewhere within the European Union; it will also cause problems for public bodies.

In terms of making the law work after Brexit, we were treated by the Government (in between Christmas and New Year) to a draft of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019. These Regulations will make changes to the GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 in light of the United Kingdom no longer being a member of the European Union. I will, of course, look at these draft Regulations in more detail soon.

I will attempt to address information law matters as they unfold in 2019 on the Information Law Blog from Inksters Solicitors.

Alistair Sloan

If you would like advice or assistance with Privacy and Data Protection matters or with UK and Scottish Freedom of Information requests contact Alistair Sloan on 0141 229 0880 or you can E-mail him.


Scottish Vexatiousness

Paragraph numbers in this blog post relate to the Court of Session’s decision in Beggs v Scottish Information Commissioner [2018] CSIH 80; unless the context requires, or it is expressly stated, otherwise.

If you’re regularly involved in the making of or responding to freedom of information requests then you are likely to be familiar with the decision of the English and Welsh Court of Appeal in Dransfield and Another v The Information Commissioner and another which deals with the meaning and application of “vexatious” within section 14 of the Freedom of Information Act 2000 (“FOIA”). In keeping with many of the provisions of FOIA, there has been considerable litigation on section 14 within the First-Tier Tribunal; however, the decision in Dransfield is the leading authority on the approach that public authorities, the UK Information Commissioner and the First-Tier and Upper Tribunals should take when applying or considering the exemption in section 14(1) of FOIA.

As with many aspects of the Freedom of Information (Scotland) Act 2002, the equivalent provisions within FOISA (also section 14) have escaped any judicial consideration; that is, until today when the First Division,  Inner House of the Court of Session (Lord President Carloway and Lords Brodie and Drummond Young) advised its opinion in an appeal under section 56 of FOISA against a decision of the Scottish Information Commissioner which upheld the decision of the Scottish Prison Service that a request for information made to it was vexatious: Beggs v Scottish Information Commissioner [2018] CSIH 80.

As with most cases involving vexatious requests, there is a history to the matter; this is briefly set out in paragraphs 5-15 of the Court’s Opinion. I am therefore not going to set it out here. There were two grounds of appeal advanced on behalf of the Appellant before the Court and these are set out, in full, by the Court in paragraph 4 of its Opinion. The grounds can  be summarised as follows: (1) that the test set out by Arden LJ (as she then was) in Dransfield should apply and that it had been incorrectly applied by the Scottish Information Commissioner (“SIC”); and (2) that the SIC’s decision was irrational as it failed to take into account a number of factors. The court ultimately rejected both grounds of appeal and refused the Appeal.

The Court makes some “preliminary comment” about the English and Welsh Court of Appeal’s decision in Dransfield. It notes that the decision is “an English case concerning English legislation” (para 26). This is not a wholly accurate statement by the Court: Dransfield concerns section 14 of FOIA, which cannot properly be said to be English legislation. FOIA covers UK-wide public bodies (such as UK Government departments, the BBC, UCAS, the British Transport Police and other); it can be used by people living in Scotland. There is also no separate Norther Irish FOI law and FOIA applies to bodies such as departments of the Northern Irish Government and the Police Service of Northern Ireland. Furthermore, it is possible for appeals against the Upper Tribunal to be taken to the Court of Session and the UK Commissioner can, for example, under section 54, make certifications to the Court of Session.

It appears that what the Court meant by “English legislation” is that the decision in Dransfield was not binding upon the SIC as the SIC is concerned with the enforcement of FOISA – an Act of the Scottish Parliament – rather than FOIA – an Act of the UK Parliament. I may, of course, be entirely wrong and the Court of Session has fundamentally misunderstood FOIA and the distinction between FOIA and FOISA. However, this is not really a matter upon which anything of substance in Beggs can be said to turn. It appears that the Court has essentially adopted the reasoning of Arden LJ and supplemented it with some of its own.

Also by way of preliminary comment the Court notes that Arden LJ expressly declined to offer a definition of or test for “vexatious” or “vexatiousness” (para 26) and so it was incorrect to argue that Dransfield set out a “test” for vexatious requests. The court went on (also at para 26) to state that “[i]t would be remarkable if the word “vexatious” when found in section 14(1) of the English Act of 2000 meant something different from the same word when found in section 14(1) of the Scottish Act of 2002; the terms of the two subsections are essentially identical.”

However, the Court of Session found that there was much in the judgment of Arden LJ that they would agree with and quote paragraph 68 of the judgment of Arden LJ with approval. The Court of Session, perhaps importantly, appears to have approved of the view that Arden LJ took that the rights in FOIA were constitutional in nature (para 28). The court also held that when assessing whether a request is vexatious or not, it must be viewed objectively. In the decision under challenge, the SIC had concluded that when viewed objectively the information sought was of no value to the Appellant. The First Division held that had the SIC followed Dransfield (which she was not obliged to do so) then she would have correctly reached the same conclusion: that Mr Beggs’ request was vexatious (para 30).

In terms of the irrationality ground of appeal, this was dealt with more swiftly by the Court. Counsel for the Appellant had characterised the three matters which the Appellant argued had been overlooked by the Court, were material.

The first matter was the Appellant’s express disavowal of any direct and personal attack. The Appellant had expressly disavowed in his request that there was any such attack. However, the Solicitor Advocate for the SIC argued that the contents of a letter sent to one of the SIC’s officers revealed the Appellant’s purpose; the Appellant’s purpose was “not to obtain information as such” (para 33) rather it was with a view to pursuing complaints about their conduct.” (also at para 33).

The court held that “the presence of a malicious motive may point to a request being vexatious the absence of a malicious motive does not point to a request not being vexatious” (para 33). In essence, while the Court appears to have been sceptical of the Appellant’s express disavowal of personal attack it seems that even if it had not been sceptical, the disavowal may not have assisted the Appellant anyway. The Court again expressed the objective nature of assessing whether a request is vexatious and agreed with the SIC that a request may be harassing even if that is not what is intended by the requester.

The second consideration referred to the past conduct of the authority; these requests appear to have been the result of the Scottish Prison Service putting forward inaccurate information in earlier proceedings before the Court of Session. The Court approved of the view of Arden LJ in respect of vengeful motives – such a motive might itself be an indicator that a request is vexatious. The court’s position here is fairly broad, but it does not appear to close off legitimate use of FOISA to uncover evidence of wrongdoing within a Scottish public authority. However, it is fairly clear that if a requester is using

The third consideration related to the importance of the information requested; the court concluded that the information was objectively of no value and this was therefore not a material consideration.

Comment
This is the first time that the vexatious requests provision in FOISA has been considered by the Scottish courts and will now be the leading case in applying section 14(1) of FOISA. The decision essentially approves of the approach set out by the English and Welsh Court of Appeal in Dransfield. It is important to remember that a request must be considered objectively. There is no express test for vexatious requests either under FOIA or FOISA, but it will be important for Scottish public authorities to keep in mind the constitutional nature of the rights in FOISA. With this in mind, the threshold for applying the provision in section 14(1) of FOISA is a high one.

The Court of Session considers that, when Arden LJ used the phrase “no reasonable foundation for thinking that the information sought would be of value”, it appears that Arden LJ was trying to encapsulate an idea of “gross disproportion as between much trouble inevitably caused and little benefit possibly gained.” How much traction this comment of the Court of Session will have in terms of the application of section 14 of FOIA (given that the Court of Session’s judgments in FOISA cases are of only persuasive authority to the Tribunals and English and Welsh Courts) remains to be seen. Of course, should Beggs seek permission (and be granted permission) to appeal to the Supreme Court we may get a definitive view from(the now)  Lady Arden on whether the Court of Session has correctly interpreted what she meant when sitting in the English and Welsh Court of Appeal.

For the time being, whether or not the Court of Session was right in what it said, this is now (subject to any appeal) the law as it applies in Scotland vis-à-vis FOISA. When considering whether a requester has a reasonable foundation for thinking that the information sought would be of value, it is necessary to look (objectively) at what value there is in the information (a mere assertion by the Applicant that it is of value will not itself be sufficient) and balance that against the inevitable burden that answering the request will place on the authority: they are inversely proportional to one another.

From the perspective of requesters, it is likely to be of little assistance to include express statements in requests that the request is not a personal attack on the authority or a member of its staff and even if you have no intent to cause harassment your request might well have that effect. Your request will be considered objectively in light of its facts and circumstances (and comments made in later correspondence may well be seen as tending to show the opposite).

The decision in Beggs is not likely to have much, if any, impact upon the way in which the vexatious requests provisions in FOISA operate in practice. The Court has essentially approved of the approach to the identical provisions under FOIA. In the absence of any previous authority from the Scottish courts in respect of section 14, the SIC and Scottish public authorities have historically found Dransfield to be persuasive and used it as a basis for understanding what section 14 means.

In short, to decide whether a request is vexatious it is necessary to consider the request objectively on its own facts and circumstances. There is no formula or checklist that can be followed which will give you a definitive answer.

Alistair Sloan

If you would like advice or assistance in respect of a Freedom of Information matter or a data protection/privacy issue then contact Alistair Sloan on 0141 229 0880 or you can send him an E-mail.

Scottish Information Commissioner’s 2017/18 Annual Report

Friday 28 September 2018 was International right to Know Day, a day designed to highlight the public’s right to know and to campaign for FOI laws. Scotland has had Freedom of Information laws in place since January 2005 and a similar statutory regime entered into force on the same date for information held by UK public bodies. The Scottish Information Commissioner used International right to Know Day to launch his office’s annual report [pdf].

In 2017/2018 the Commissioner’s office received a total of 507 appeals, up from 425 in 2016/2017 (but not the highest number received in any one year). Of the appeals that were received the vast majority (75%) were classed by the commissioner’s office as coming directly from individuals with the media accounting for 11% and commercial/private enterprises accounting for 3%.

In terms of which public authorities have their responses appealed to the Commissioner; local authorities still make up the largest percentage (although there was a fairly significant decrease in the percentage share of appeals from the previous year). Local authorities are followed the Scottish Government and its agencies and the police.

30% of the appeals made to the Scottish Information Commissioner were deemed to be invalid appeals; that is to say they were appeals that the Commissioner’s office could not investigate. The annual report reveals that among the most common reasons why an appeal was not valid are that the applicant had not made a request for review to the Scottish public authority (an appeal can only be made to the Scottish Commissioner after the Scottish public authority has reviewed its initial decision or failed to carry out a review of its initial decision that has been requested) and that the timescales for making FOI appeals within the Act had not been met. Requesters should remember that they should make requests for review within 40 working days of the date that the authority issued its response or the date that it should have responded where no response has been received. Furthermore, it should be remembered that appeals to the Commissioner should normally be made within 6 months of the date on which the authority responded to the review request or, where no response has been recieved to a request for an internal review, within 6 months of the date that the authority should have responded to the internal review.

Failure to respond appeals, that is an appeal which concerns a failure by an authority to respond to a request and/or request for review, continue to be a problem. In 2017/18 19% of the appeals handled by the Commissioner concerned a failure to respond; this is down slightly from the 20% it was in 2016/17, but is up from the 16% figure in 2015/16. These are fairly clear-cut appeals as an authority has either responded within the statutory timeframe not and they should be appeals that authorities can avoid fairly easily. No authority can be perfect 100% of the time and there will be cases where the inflexibility of the 20 working-day rule, in particular cases where the public interest is finely balanced or where third party consultation is required, will mean that breaches will occur; however, staying in contact with the requester can help to avoid these appeals even where the authority is technically in breach of the law.

Of the decisions made by the Commissioner in response to appeals under section 47 of the Freedom of Information (Scotland) Act 2002, 65% resulted in a decision which was wholly or partially in favour of the requester.

Some interesting enforcement matters from within the report which are worthy of mention include:

  • Highland Council was issued with an Information Notice when it delayed in providing information to the Commissioner’s Office which was required in order to enable the Commissioner to investigate an appeal made to him by a requester.
  • The Commissioner also highlights that his office considered referring East Dunbartonshire Council to the Court of Session for failing to comply with one of his decisions (but in the end, it would appear that, such a step ultimately proved unnecessary).
  • The Commissioner refers to his high profile level 3 intervention in respect of the Scottish Government’s performance and culture in respect of FOI, which is still ongoing.
  • A less profile level 3 intervention by the Commissioner was the ongoing intervention in Police Scotland, which is now in the monitoring phase after an action plan was agreed between Police Scotland and the Commissioner. There were concerns about searching for and locating information to respond to information requests as well as concerns around record-keeping.
  • Two independent schools (which had become subject to FOI following the last extension of the Act by the Scottish Ministers) were subject to level 4 interventions where they had failed to adopt publication schemes as required by section 23 of the Freedom of Information (Scotland) Act 2002.

The Commissioner’s report makes reference to three Court of Session cases in respect of decisions that it had made, one of which Inksters were instructed in by one of the parties. The number of appeals against decisions of the Scottish Information Commissioner remain particularly low (both appeals taken by requesters and Scottish public authorities); whether this is because the Commissioner’s office is doing a good job in terms of interpreting the Freedom of Information (Scotland) Act 2002 and the Environmental Information (Scotland) Regulations 2004, or whether it has more to do with the significant costs to be faced by requesters and Scottish Public Authorities who decide to take an appeal to Scotland’s highest civil court is a matter which is very much open for debate.

There is lots of other useful information with the Commissioner’s annual report, but at the risk of this blog post becoming too unwieldy I shall leave it there.

Alistair Sloan

Whether you are a requester or a public authority we can provide you with advice and assistance on Freedom of Information matters. Contact Alistair Sloan on 0141 229 0880 or you can send him an E-mail. You can also follow our dedicated twitter account on information law matters.

 

Information Law Review of 2017

2018 is now upon us and this is a big year in the field of Information Law, the General Data Protection Regulation will at last become applicable in the United Kingdom.  If you are a data controller or a data processor, your preparations for the GDPR should be well under way; however, if you have not yet started to prepare for these regulations then it is not yet too late.  The lesser known brother of the GDPR also kicks in this year, the Law Enforcement Directive, which governs the processing of personal data by law enforcement agencies.

However, before I get stuck into what is coming this year in the field of Information law, I want to take a moment to look back at some of the things that happened in 2017.  At the tail end of 2017 the High Court in England issued its anticipated judgment in the case of Various Claimants v WM Morrisons Supermarket PLC  [2017] EWHC 3113 (QB)This represented a significant development in the data protection field and opens up a much wider range of circumstances in which data subjects can sue a data controller under Section 13 of the Data Protection Act 1998.

In October 2017, the Irish High Court made a reference to the Court of Justice of the European Union at the request of the Irish Data Protection Commissioner seeking a preliminary ruling on “Privacy Shield”, the successor to the Safe Harbour rules which had previously been held to be unlawful by the European Court.

In September 2017, the Grand Chamber of the European Court of Human Rights issued a decision concerning the application of the right to a private and family life contained in Article 8 of the European Court of Human Rights to the monitoring of a person’s communications by their employer.

Also in September 2017, the UK Government published its Data Protection Bill which will replace the Data Protection Act 1998, extends GDPR standards to areas not within the competence of the European Union and implements the Law Enforcement Directive, among other things.

Now looking ahead to 2018, it is possible that we might see a decision from the English Court of Appeal in the Morrisons case referred to above, the judge having granted permission to Morrisons to appeal his findings in relation to vicarious liability.  We may also see claims for compensation being made based upon the Morrisons decision.

In Scotland, we will be expecting to see some more progress made by the Scottish Parliament in its consideration of the Children and Young People (Information Sharing) (Scotland) Bill.  I provided written evidence to the Education and Skills Committee on this Bill last year.  The Committee has had some difficulty in completing its Stage 1 consideration of the Bill and the previous deadline of 22 November 2017 for completion of Stage 1 was removed by the Scottish Parliament.

It is also possible that we will see the Scottish Parliament’s Public Audit and Post-Legislative scrutiny Committee begin to undertake a post-legislative inquiry into the operation of the Freedom of Information (Scotland) Act 2002 (or announce that such an inquiry will take place in due course).  If such an inquiry does take place, it will be the first time that there will have been a complete review of the Scottish FOI Act and how it is operating.

Staying on the subject of Freedom of Information in Scotland, we are likely to see the outcome of the Scottish Information Commissioner’s formal intervention in respect of the Scottish Government’s compliance with the Freedom of Information (Scotland) Act 2002.  We are also likley to see an Order being made under Section 5 of the Freedom of Information (Scotland) Act 2002 designating Registered Social Landlords as scottish public authorities with effect from 1st April 2019.

By the end of 2018 we should also hopefully have a much better idea as to what the UK’s relationship with the European Union will be after it leaves, and in particular what impact this will have on data protection and privacy law in Scotland and the rest of the UK.

There will no doubt be a raft of new court decisions in relation to both Privacy/Data Protection and Freedom of Information over the course of the next 12 months and I will attempt to address the most important and unusual decisions here on the Information Law Blog from Inksters Solicitors.

Alistair Sloan

If you would like advice or assistance with Privacy and Data Protection matters (including GDPR preparation) or with UK and Scottish Freedom of Information requests contact Alistair Sloan on 0345 450 0123 or you can E-mail him.

Registered Social Landlords and FOI

Yesterday, the Scottish Government began a consultation on legislation to formally designate Registered Social Landlords (RSLs) as Scottish public authorities for the purposes of the Freedom of Information (Scotland) Act 2002 (“FOISA”).  The draft Order being consulted on proposes a commencement date of 1st April 2019.

This is not an unexpected development in the field of information law.  In December 2016 the Scottish Government consulted on the principle of designating RSLs as public authorities for the purposes of FOISA.  It has been widely anticipated that RSLs would be designated as a public authority for the purposes of FOISA.

A designation as a public authority for the purposes of FOISA will have ramifications for RSLs beyond the obvious need to comply with FOISA and being under the regulatory oversight of the Scottish Information Commissioner.  It will also have implications for RSLs in respect of how they implement the General Data Protection Regulation (“GDPR”), which becomes applicable from 25th May 2018.

There are a number of aspects of the GDPR which are directed towards public bodies.  The Data Protection Bill currently before the UK Parliament defines what a public body is for the purposes of the GDPR.  Clause 6 of the Bill provides that a body which is designated as a Scottish public authority for the purposes of the FOISA is a public body.  This will mean that RSLs will have to appoint a Data Protection Officer; even although many of them would not have had to before this decision was taken by the Scottish Government.

It also has implications for the grounds upon which they can legitimately process personal data.  Processing of personal data for the purpose of pursuing a legitimate interest of the controller is permissible under the GDPR.  However, the GDPR goes on to provide that public bodies cannot rely upon legitimate interest as a ground of processing in performance of their tasks.  Therefore, any RSL that has been preparing for the GDPR on the basis that they will be able to process personal data on the legitimate interests ground will have to re-evaluate its processing of personal data ahead of its designation as a public authority for the purposes of FOISA.

It is worthy of note, simply for interest, that the Data Protection Bill proposes giving the Secretary of State the power to make regulations which state that a public body is not in fact a public body for the purposes of the GDPR.  However, there has been no indication that the Secretary of State intends on making use of this power or how the power is intended to be used; therefore, it is probably advisable not to work on the basis that a RSLs will be declared not to be public bodies for the purposes of the GDPR.

Another possible implication for RSLs is in relation to the Environmental Information (Scotland) Regulations 2004 (“the EIRs”).  The Scottish Information Commissioner has already previously decided that RSLs are public authorities for the purpose of these regulations, which govern access to environmental information.  The Housing (Amendment) (Scotland) Bill may have implications for the basis upon which the Commissioner concluded that RSLs were a public authority for the purposes of the EIRs.  If it does, there may be a gap where RSLs are not public authorities for the purposes of EIRs.  Once they become designated as a public authority for the purposes of FOISA, they will automatically become a public authority for the purposes of the EIRs as well.

Alistair Sloan

If you would like advice or assistance in respect of a freedom of information or data protection matter then contact Alistair Sloan on 0345 450 0123.  Alternatively, you can send him an E-mail.

FOISA Vexatious decision notice appealed to Court of Session

Section 14 in both the Freedom of Information Act 2000 (“FOIA”) and the Freedom of Information (Scotland) Act 2002 (“FOISA”) enable an authority not to comply with a request for information that is vexatious.  What is meant by vexatious in Section 14 of FOIA has been the subject of litigation all the way to the Court of Appeal and the leading authority is Dransfield and another v The Information Commissioner and others [2015] EWCA Civ 454; [2015] 1 WLR 5316.  However, there has not yet been any litigation in Scotland on the meaning of vexatious within Section 14 of FOISA; the Scottish Information Commissioner’s guidance [pdf] on the subject appears to draw heavily on the Dransfield decision.

Those who make a point of reading the Scottish Information Commissioner’s regular round-ups of decisions will note that the most recent one informs us of an appeal to the Court of Session against a decision of the Scottish Information Commissioner which upheld the authority’s use of Section 14.  If the appeal proceeds, it will be the first time that the Scottish courts will have considered Section 14 of FOISA.

It will be interesting to see whether the Court of Session adopts the Dransfield position, or whether it takes a different approach to vexatious requests in Scotland.  If the Court of Session does publish an Opinion, we will of course cover it on this blog.

Alistair Sloan

We are able to provide advice and assistance in connection with a range of Freedom of Information matters, including appeals against decisions of both the Scottish and UK Information Commissioners.  If you would like to do discuss a Freedom of Information, or any other Information Law, matter with us then you can contact Alistair Sloan on 0345 450 0123.  Alternatively, you can send him an E-mail.