Tag Archives: Freedom of Information (Scotland) Act 2002

Information Law Review of 2019

Well, it is that time again; the beginning of a New Year and therefore time for my third annual look at what happened in the world of information law in the previous twelve months and what those with an interest in the field should be looking out for in 2020. I would like to begin by wishing all readers of the Information Law Blog, both new and old, a very happy New Year.

My reviews of 2017 and 2018 began by looking at the case of Various Claimants v WM Morrisons Supermarkets Limited. I shall keep the tradition going by looking once again at this case. In 2018, the Court of Appeal dismissed the appeal by Morrisons against the decision of Mr Justice Langstaff holding them vicariously liable for the actions of an ex-employee. This case rumbled on again in 2019, with the Supreme Court hearing an appeal by Morrisons on 6th and 7th November. By the end of 2019, the Supreme Court had not yet issued its judgment and so that will be something to look out for in 2020; the Supreme Court’s judgment (although concerned with the Data Protection Act 1998, rather than the GDPR and Data Protection Act 2018) will have ramifications for data subjects and controllers, regardless of which way it goes.

Brexit continued to be a feature of 2019 in the Information law world. We have seen the changes that will take effect in data protection law as a result of the UK’s withdrawal from the European Union, which is now scheduled to take place at the end of this month. Brexit, however, will not stop being a feature of information law at 23:00 on 31st January (assuming there are no further delays). We will be in a transition period until the end of the year, but we don’t yet know exactly what we’re transitioning to which might start to become clearer by the Summer.

Brexit also featured in the information law world in other respects as well. There are still some data protection and privacy concerns floating around from the 2016 referendum on the UK’s membership of the EU. Indirectly related to that have been proceedings in the Upper Tribunal involving UKIP and in also in the First-Tier Tribunal. If reports are anything to go by, proceedings in the First-Tier Tribunal at the end of 2019 could result in an extremely critical decision against the Commissioner, so that is something to look out for in 2020.

We also saw the first GDPR administrative fine issued in the UK by the Information Commissioner (some 19 or so months after the GDPR became applicable and quite a bit behind other regulators in other EU Member States). The Commissioner has issued two Notices of Intent against two other Controllers (that we’re aware of) both of which were due to expire this month, but it has been confirmed by the Information Commissioner that the statutory six month period has been extended by agreement (in accordance with the statutory provisions). The reasons for this have not been made public at this time.

Just before Christmas the Advocate General of the European Court of Justice gave his opinion in Data Protection Commissioner v Facebook Ireland & Schrems concerning standard contractual clauses. We can expect a decision from the European Court of Justice to follow soon, whether that is before or after “exit day” at the end of January remains to be seen.

In the wider field of privacy law, the Court of Appeal took a look at the judgment of Mr Justice Arnold in the case involving Channel 5’s fly-on-the-wall documentary ‘Can’t Pay? We’ll Take it Away’. The Court of Appeal dismissed the appeals by the Respondents in respect of liability and the cross-appeal by the Claimants on the issue of quantum of damages. Meanwhile, in Scotland, Lord Bannatyne (for the first time) declared that there exists in the law of Scotland a common law right to privacy.

In May, Information Notices were again a feature of the decisions flowing from the First-Tier Tribunal; this time, however, it was concerning the Commissioner’s powers under the Freedom of Information Act 2000. The Tribunal confirmed that the Commissioner can issue an information notice in order to obtain information as part of her process for determining whether a person is a public authority for the purposes of the Environmental Information Regulations 2004.

In 2019, the Scottish Parliament’s Public Audit and Post-Legislative Scrutiny Committee began undertaking Post-Legislative Scrutiny of the Freedom of Information (Scotland) Act 2002. In 2019, I gave both written and oral [pdf] evidence to the Committee. The Committee is expected to release its report and recommendations next month.

In 2019, we saw the expansion of FOI in Scotland with Registered Social Landlords formally being designated as Scottish public authorities for the purposes of the Freedom of Information (Scotland) Act 2002.

We also had one of those rare things: a decision from the Court of Session in an appeal against a decision of the Scottish Information Commissioner. In the sole decision in such an appeal issued by the Court of Session in 2019, my client successfully challenged (on a point of law) a finding by the Commissioner that information he had requested was not held by a local council for the purpose of the Freedom of Information (Scotland) Act 2002. This case provides some useful guidance on determining whether information is held, or not, for the purposes of the Freedom of Information (Scotland) Act 2002.

Alistair Sloan

If you would like advice or assistance with Privacy and Data Protection matters or with UK and Scottish Freedom of Information requests contact our team on 0141 229 0880.

We don’t hold it…oh yes you do!

Dr Ian Graham v The Scottish Information Commissioner [2019] CSIH 57 is a rare decision of the Court of Session in an appeal against a decision of the Scottish Information Commissioner, the last one coming almost 12 months ago. The case was considered by the Second Division (with the bench comprising of the Lord Justice Clerk, Lord Malcolm and Lord Glennie) with Lord Glennie delivering the Opinion of the Court.

Before a Scottish public authority is required to release information, it actually has to hold it and information will not be held, according to the law, if it is held by the Scottish public authority on behalf of a third party. The question that was considered in the appeal by Dr Graham was on this fundamental point: whether the Scottish public authority held the information or not; and in particular whether information was held by a Council on behalf of a third party (in this case, the Returning Officer).

In January 2018, Dr Graham requested the following information from Aberdeenshire Council: (1) a list of the contracts called off by the council from the framework agreement, (2) invoice and order copies for each contract, (3) payment confirmation from the council of the invoices and (4) whether the council reclaimed the input VAT on the invoice. The framework agreement in question was for the provision of electoral services to the returning officer. In terms of the contract (and of importance for this appeal), the Council assumed obligations and liabilities under the contract and also had responsibilities and liabilities in respect of the procurement process.

Whilst the Council ultimately released information in relation to parts (3) and (4) of his request, initially the Council also claimed that it did not hold this information for the purposes of the Freedom of Information (Scotland) Act 2002 (“FIOSA”). The Council’s argument was that because a returning officer, although an official from within the council, was legally a separate entity from the rest of the council when acting in their capacity as returning officer, they only held the information on behalf of the returning officer and not in their own right. Dr Graham was dissatisfied with this and applied to the Scottish Information Commissioner for a decision on whether the Council had complied with its disclosure obligations under FOISA. The Commissioner upheld the Council’s decision, determining that the Council did not hold the information for the purposes of FOISA, but rather held it on behalf of the returning officer.

Counsel for the Appellant argued that the word ‘held’ was being submitted to too much scrutiny, as well as drawing attention to the spirit in which the FOISA had been made; that being to make information available to the public. Counsel contended that a liberal approach should be taken to the interpretation of this provision. Reference was made by the Appellant’s Counsel to University and Colleges Admission Service v Information Commissioner [2014] UKUT 0557 (AAC) and Common Services Agency v Scottish Information Commissioner 2008 SC (HL) 184. Counsel for the Appellant further drew upon University of Newcastle v Information Commissioner [2011] UKUT 185 (AAC) to demonstrate how a more common-sense approach was preferable. The broader interpretation of ‘held’ was further supported  by the decision of the Upper Tribunal in Department of Health v Information Commissioner where it was held that a ministerial diary was ‘held’ by a department purely as a historical record for reference purposes. With reference to the current case, he ultimately claimed that the differentiation between the council holding the information for itself or on behalf of the returning officer was immaterial and indeed that both conditions could be fulfilled simultaneously in the present circumstances; with the fine-tooth investigation of the council election laws amounting to little more than prevaricating.

The Court allowed Dr Graham’s appeal, emphasising that “that the relevant provisions of FOISA should, so far as possible, be interpreted in a manner consistent with the policy of the Act, namely the desirability of making information available to the public, all in the interests of promoting open, transparent and accountable government.” [15] The court also held “that the words and expressions used in the Act should, so far as possible, be given their ordinary and natural meaning” and that “[t]here should be no scope for the introduction of technicalities, unnecessary legal concepts calculated to over-complicate matters and, by so doing, to restrict the disclosure of relevant information.” [15].

The Court approved of and agreed with the reasoning given by the Upper Tribunal at paragraphs 21-22 of its decision in University of Newcastle. In essence, a Scottish public authority will hold information if it has more than a de minimis interest in the information. That is to say, it will only fall outside of the scope of FOISA if it has “no (or no material) interest of its own” in the information. [18] As a result of the Court’s decision, it reduced the Commissioner’s decision and remitted the matter back to him so that he could reconsider Dr. Graham’s application in light of its opinion.

The effect of this decision should be to widen the scope of information that is available to the public under FOISA. Scottish public authorities and the Commissioner will be required to take a more holistic approach in future to deciding whether information is only held by the Scottish public authority on behalf of a third party. A more practical approach requires to be taken than simply looking at whether the Scottish public authority and the third party are separate entities from one another; consideration must be given to the underlying factual matrix. The opinion of the Court also re-iterates previous comments by the courts that the Act should be interpreted in a way that isn’t too complex or technical.

Our Alistair Sloan acted for the successful appellant in this case, instructing John MacGregor, Advocate.

Danny Cummins (Trainee Solicitor)

If you would like advice or assistance in respect of a Freedom of Information matter or a data protection/privacy issue then contact us on 0141 229 0880 or you can send us an E-mail.

Dealing with vexatious FOI Requests

The call for views by the Public Audit and Post-Legislative Scrutiny Committee of the Scottish Parliament (“the Committee”) in respect of its post-legislative scrutiny of the Freedom of Information (Scotland) Act 2002 (“FOISA”) ended on 21 June 2019 (having been extended a couple of times). One of the issues that came up on a number of occasions in the Committee’s discussions and evidence sessions prior to formally deciding to undertake post-legislative scrutiny of FOISA was the issue of vexatious requests. This issue has come up again in a number of responses to the call for views provided by Scottish public authorities (but certainly not all those Scottish public authorities that submitted responses).

It does seem as though Scottish public authorities, generally, are fairly poor at utilising section 14 of FOISA, which provides that a Scottish public authority does not need to comply with a request for information where it is vexatious. The Scottish Information Commissioner has also expressed the view that authorities are not utilising the available provisions within FOISA to deal with vexatious requests, such as at an evidence session before the Committee on 10 January 2019 [pdf].

The response of by Glasgow City Council [pdf] provides an example of a single requester who has made around 100 FOI requests on a related topic. It strikes me that requests from this particular requester on this particular topic could very well fall within the ambit of section 14 (although, I make that comment with only that information which is available from Glasgow City Council in its response). While the law requires the request to be vexatious, rather than the requester themselves, it is permissible to look at the requester’s conduct towards, previous correspondence with and previous requests to the authority in determining whether a particular request that has come in is, in fact, vexatious. This is something that Scottish public authorities seem to struggle with and often seem look at a particular request in isolation and not necessarily consider the wider background and context.

The leading case on section 14 of FOISA, Beggs v Scottish Information Commissioner, was only decided at the end of 2018 and therefore prior to that there was no authoritative guidance on the application of section 14 of FOISA. However, the Scottish Information Commissioner and Scottish public authorities have looked to Dransfield v Information Commissioner to help with the application of section 14 of FOISA. In Beggs the Inner House of the Court of Session essentially approved of the decision of the Court of Appeal in Dransfield. The decision in Beggs is, subject to any appeal to the UK Supreme Court, binding authority on the operation of section 14 of FOISA. Scottish public authorities can therefore look to both the Judgment of the Court of Appeal in Dransfield and the opinion of Lord Brodie in Beggs for guidance on section 14 of FOISA and how to apply it in appropriate cases.

The Court of Appeal and the Inner House of the Court of Session have both stressed that the right of access to information is a constitutional one and so the bar for engaging section 14 is a high one. However, it is clear that the bar is not so high so as to be impossible to meet in practice.

Section 14 of FOISA allows Scottish public authorities to consider matters that would not normally be relevant to FOI requests, such as the identity of the requester and their motives. Scottish public authorities (and indeed, public authorities working under the Freedom of Information Act 2000) should remember that they can look at a requester’s motives; for example, a malicious motive can be an indicator that a request is vexatious (but is not necessarily evidence that the request is, in fact, vexatious): Beggs at paragraph 33. Equally, the absence of a malicious motivation is not necessarily evidence that the request is not vexatious.

A person’s previous dealings with an authority can be relevant as can their other FOI requests: if a person is showing signs of obsessive behaviour, then that could be an indicator that the request is vexatious. The authority needs to look at the request objectively, in the surrounding circumstances, and come to a judgement as to whether the request is vexatious. However, it will need to remember to have evidence to support its conclusion in case the requester makes an application to the Commissioner challenging the application of section 14 by the authority.

Perhaps there is concern within authorities about getting it wrong and having a section 14 refusal overturned by the Commissioner; however, we can only learn from doing and from our mistakes. There are 96 decision notices on the Scottish Information Commissioner’s website relating to section 14(1) of FOISA (the specific part of section 14 that deals with vexatious requests). This number does seem to be rather small given that wide opinion coming from Scottish public authorities over many years that vexatious requests are a particular problem. Over 50 of those decision notices find entirely in favour of the authority and a good number are classified as partially upheld (many of which appear to have included technical defaults by the authority). It is clear that where a Scottish public authority appropriately deploys section 14 in respect of vexatious requests, the Commissioner will uphold that decision.

It certainly does seem to be the case that Scottish public authorities are reticent to utilise section 14 of FOISA. Perhaps, it is because they do not fully understand the scope of section 14 or are unsure about its precise application – it can potentially be used in a wide variety of circumstances. Scottish public authorities could certainly be using section 14 much more frequently than what they are at present and they should seek to become much more confident in using section 14. Indeed, a majority of the examples that I have seen emanate from Scottish public authorities, which they put forward as examples of problems that they are facing which cannot be dealt with by the application of section 14; most probably could, in fact, have been dealt with by the application of section 14. The same level of reluctance is not obviously present in respect of those authorities subject to the Freedom of Information Act 2000.

Alistair Sloan

If you are a requester or a public authority who would like advice or assistance in regards to freedom of information law then contact our team on 0141 229 0880 or by E-mail. We are also able to assist with a range of other information law matters.

Post-legislative scrutiny of the Freedom of Information (Scotland) Act 2002

The Public Audit and Post-Legislative Scrutiny Committee of the Scottish Parliament is currently calling for views on the operation of the Freedom of Information (Scotland) Act 2002 (“FOISA”) as part of its post-legislative scrutiny of FOISA. I have submitted a response to the Committee, which addresses five issues in respect of FOISA (and also touches, where applicable, on the Environmental Information (Scotland) Regulations 2004 (“the Scottish EIRs”)). You can read my full submission here [pdf], but below is a summary of what I have discussed in my submission to the Committee.

The first thing that I have suggested is a possible change to the code of practice issued by the Scottish Ministers under section 60 of FOISA to deal with concerns raised about the processing of personal data in connection with FOI requests. I have covered this issue in more detail on this blog before. In my response I have suggested that this issue is probably best addressed through the code of practice rather than through a change to the wording of the Act.

I have also suggested that any concerns around a failure to make or keep records would not be an appropriate issue to address in the context of FOISA; however, it might be worthy of its own legislative project in the event that Parliament considered that this was an issue. This arises out of concerns expressed that FOISA has resulted in records not being made or kept so as to avoid the need to disclose them. I argue that it is inappropriate to bring this into FOISA; as FOISA has a different focus. FOISA is about giving a right of access to information that exists at the time it is requested and not about what information should be kept by Scottish public authorities. Furthermore, to introduce potentially detailed and technical rules around the making and keeping of records into FOISA could over-complicate FOISA.

I have also suggested that section 48 of FOISA be repealed; or, at least, amended. There is no equivalent provision within the UK Act and there doesn’t seem to be any issues under that legislative scheme that would suggest an outright ban on the Scottish Information Commissioner being able to look these requests is appropriate. Furthermore, it has a significant effect on requesters appeal rights and the alternatives available are not a proper substitute for an investigation by the Commissioner. In this context I also raised concerns about whether section 48 is compatible with our EU obligations as it also extends to requests made under the Scottish EIRs.

I have also suggested amending section 56 of FOISA so that appeals against decisions no longer go directly to the Court of Session. For quite a long time I have considered that this appeal route is prohibitive to most requesters and also to Scottish public authorities (especially smaller authorities with less in the way of financial resources). I’ve also suggested that this has affected the development of the law and Scotland lacks the same level of judicial authority in terms of what different parts of FOISA mean that exists under the UK Act. I’ve suggested, at the very least, appeals should be made to the new Upper Tribunal for Scotland in the first instance. I contrasted the Scottish appellate structure with that which applies under the UK Act. I have also suggested that the present appellate structure may mean that the law doe snot comply with EU law in respect of the Scottish EIRs.

Finally, I’ve also suggested that FOISA be updated to take account of advances in technology and in particular to allow the Scottish Information Commissioner to serve formal notices by E-mail rather than requiring them to be served by recorded delivery post (as is currently the case).

Alistair Sloan

If you would like advice or assistance in respect of freedom of information matters or any other information law matter then contact Alistair Sloan on 0141 229 0880 or by E-mail. You can also follow our dedicated information law twitter account.

Call for Views: Post-legislative scrutiny of the Freedom of Information (Scotland) Act 2002

In January it was announced that the Scottish Parliament’s Public Audit and Post-Legislative Scrutiny Committee would undertake formal post-legislative scrutiny of the Freedom of Information (Scotland) Act 2002. The Committee is now seeking views on the Freedom of Information (Scotland) Act 2002 and is inviting submissions to reach it by 5pm on Friday 10th May 2019. The call for views asks the following five questions:

  1. In your view, what effects has the Freedom of Information (Scotland) Act 2002 (FOISA) had, both positive and negative?
  2. Have the policy intentions of FOISA been met and are they being delivered? If not, please give reasons for your response.
  3. Are there any issues in relation to the implementation of and practice in relation to FOISA? If so, how should they be addressed?
  4. Could the legislation be strengthened or otherwise improved in any way? Please specify why and in what way.
  5. Are there any other issues you would like to raise in connection with the operation of FOISA?

It is not necessary to answer all five questions and the Committee is also inviting other information relevant to the remit.

Once the Committee has received the written evidence, it will consider it all and will thereafter decide who it wishes to take oral evidence from. It is expected that the oral evidence sessions will take place towards the end of the year.

Alistair Sloan

We are able to provide advice and assistance in connection with a range of Freedom of Information matters, including appeals against decisions of both the Scottish and UK Information Commissioners.  If you would like to do discuss a Freedom of Information, or any other Information Law, matter with us then you can contact Alistair Sloan on 0141 229 0880.  Alternatively, you can send him an E-mail.

Personal data and FOI: the conflict continues

The interaction between freedom of information and data protection laws is one which often results in conflict. On the one hand there is a legislative scheme that operates to promote transparency, while on the other there is a legislative scheme that operates to protect personal data. FOI law essentially provides that information should be released unless there is a good reason not to; while data protection law says that personal data should not be processed unless there is a good reason to. Both have their complexities and those brief explanations do not adequately encapsulate them.

The decision of the Upper Tribunal in Information Commissioner v Halpin [2019] UKUT 29 (AAC) is an example of where the First-Tier Tribunal got it badly wrong when dealing with the legitimate interests ground for processing under the Data Protection Act 1998. The Respondent in this appeal, Mr. Halpin, had requested information from Devon Partnership NHS Trust concerning the training that two named social workers had undergone in respect of the Care Act 2014. When deciding whether to release personal data under FOI law there is essentially a three staged test which must be satisfied before the personal data can be disclosed; this test was set out clearly by the Supreme Court in South Lanarkshire Council v Scottish Information Commissioner.

Firstly, is a legitimate interest or interests being pursued by the controller, third party or parties to whim the personal data is to be disclosed? Secondly, if a legitimate interest has been identified, is the processing (by way of disclosure under FOI law) necessary for the purposes of those interests? Finally, if there is a legitimate interest and the processing is necessary for that legitimate interest, then the processing cannot be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

The first ground of appeal for which permission was granted was in respect of the FTT’s treatment of the effect of disclosure of the information to the world at large; in particular that the FTT had not deal with this matter in substance. This is an issue that needs to be carefully considered: disclosure under FOI is not simply a disclosure to the individual requester; it is a disclosure to the whole world. This is an important factor in determining the necessity of the processing in pursuance of the legitimate interest concerned. It is also important in considering whether the processing (by releasing the information under FOI) is unwarranted.

Once the information is disclosed under FOI law it is disclosed in circumstances where the public authority loses control of the information concerned; there is no duty of confidentiality owed. Therefore, there is nothing that can be done in order to prevent further dissemination of the information.

Upper Tribunal Judge Markus QC states, at paragraph 20, that Mr Halpin’s lack of motivation to publicise the information is irrelevant to the question of assessing the potential impact of disclosure to the world at large. The motivation of the requester is only relevant to the first of the three stages of the test set out in South Lanarkshire Council v Scottish Information Commissioner (whether a legitimate interest exist); it is not relevant to the question of necessity or the final question of balancing the legitimate interests against the rights, freedoms and legitimate interests of the data subject.

Public authorities, and those advising them, should therefore ensure that, when considering the release of personal data in response to a FOI request, they do not become focused on the individual requester; it is essential to consider the wider world when undertaking this assessment. The motivations of the requester might well be wholly benign, but there are others whose motivation may not be so benign and will utilise the information for other purposes. Requesters should also bear this in mind; an individual requester might have a perfectly legitimate interest in the personal data and the necessity test might very well be met in their individual case; that is not enough. Due consideration has to be given to the wider impact of releasing information to the world; this is why consideration has to be given to whether the personal data can be obtained in another way as part of the necessity test (although, the existence of other means of obtaining personal data, other than by way of a FOI request, will not necessarily be determinative of the issue).

Alistair Sloan

We are able to provide advice and assistance to public authorities and requesters in connection with matters concerning Freedom of Information laws; if you would like advice and assistance in connection with these matters, or any other information law matter, please contact Alistair Sloan on 0141 299 0880 or by E-mail. You can also follow our dedicated Information Law Twitter account.

FOI in Scotland: Registered Social Landlords

Last week the Scottish Ministers laid The Freedom of Information (Scotland) Act 2002 (Designation of Persons as Scottish Public Authorities) Order 2019 (Draft) before the Scottish Parliament for the approval of the Parliament, as they are required to do in terms of the Freedom of Information (Scotland) Act 2002 (“FOISA”). This order is a long anticipated order to bring Registered Social Landlords (“RSLs”) within the scope of FOISA by designating them as Scottish public authorities. If approved (and there is nothing to suggest that the Order will not be approved by the Scottish Parliament), it will mean that RSLs (and their subsidiaries) will be designated as Scottish public authorities from 11 November 2019. Some had been hoping that they would have been designated from April this year, while others had been hoping that it would be April 2020. The Scottish Ministers appear to have split the difference and given RSLs a period of around 9 months to prepare for becoming Scottish public authorities.

RSLs have been, following a number of decisions of the Scottish Information Commissioner (which have never been appealed to the Court of Session), Scottish public authorities for the purposes of the Environmental Information (Scotland) Regulations 2004 for a number of years. There is, however, some debate about whether they remain so, following some changes to the regulatory landscape pertaining to RSLs. It has not yet, to my knowledge, been tested whether they still are Scottish public authorities for the purposes of the Environmental Information (Scotland) Regulations 2004. Whether the changes to the regulatory landscape of RSLs has had the effect of them no longer being Scottish public authorities, for the purposes of the Environmental Information (Scotland) Regulations 2004, is somewhat immaterial; designation as a Scottish public authority for the purposes of FOISA also means that they will be Scottish public authorities for the purposes of the Environmental Information (Scotland) Regulations 2004.

It should be noted that the draft order has been drafted in such a way so as to make RSLs Scottish public authorities for limited purposes only. They will be Scottish public authorities in respect of the following functions:

  1. providing housing accommodation and related services and includes anything done, or required to be done, in relation to:- (a) the prevention and alleviation of homelessness; (b) the management of housing accommodation (limited to the management of housing accommodation for which a registered social landlord has, under the Housing (Scotland) Act 2001, granted a Scottish secure tenancy as defined in section 11 or a short Scottish secure tenancy as defined in section 34 of that Act); (c) the provision and management of sites for gypsies and travellers, whatever their race or origin; and
  2. the supply of information to the Scottish Housing Regulator by a registered social landlord or a connected body in relation to its financial well-being and standards of governance.

A register of social landlords can be found on the website for the Scottish Housing Regulator.

Alistair Sloan

We are able to provide advice and assistance to public authorities and requesters in connection with matters concerning Freedom of Information laws; if you would like advice and assistance in connection with these matters, or any other information law matter, please contact Alistair Sloan on 0141 299 0880 or by E-mail. You can also follow our dedicated Information Law Twitter account.

Post-Legislative Scrutiny of the Freedom of Information (Scotland) Act 2002

For some time now the Scottish Parliament’s Public Audit and Post-Legislative Scrutiny Committee has been considering whether to undertake post-legislative scrutiny of the Freedom of Information (Scotland) Act 2002. The Committee’s decision on whether to undertake post-legislative scrutiny of FOISA was delayed while they awaited the Scottish Information Commissioner concluding his intervention in respect of the Scottish Government.

Yesterday, after hearing again from the Scottish Information Commissioner and his Head of Enforcement, the Committee took a decision (in private), as recorded in the Minutes [pdf], to undertake post-legislative scrutiny of FOISA.

It is not yet clear how the Committee will undertake its post-legislative scrutiny or what the timetable will be; but what can now be said is that there will be formal post-legislative scrutiny of FOISA by a committee of the Scottish Parliament for the first time since FOISA was enacted in 2002. Much has changed since FOISA was enacted and while the Act generally performs fairly well, there are undoubtedly some areas which are ripe for improvement.

Once we know more about the details of the post-legislative scrutiny I will, of course, blog about it.

Alistair Sloan

We are able to provide advice and assistance in connection with a range of Freedom of Information matters, including appeals against decisions of both the Scottish and UK Information Commissioners.  If you would like to do discuss a Freedom of Information, or any other Information Law, matter with us then you can contact Alistair Sloan on 0141 229 0880.  Alternatively, you can send him an E-mail.

Information Law Review of 2018

It does not seem as though it was a year ago since I sat down to write my review of Information Law in 2017 and to have a brief look ahead into 2018; but somehow we now appear to be in 2019. It was always going to be the case that 2018 was going to be a big year for information law; with the General Data Protection Regulation becoming applicable on 25th May 2018. The 25th May 2018 came and went without the millennium bug style apocalypse that seemed inevitable from the amount of sensationalist writing that was taking place in late 2017 and early 2018.

My review of 2017 started off with the English and Welsh High Court decision on vicarious liability for data protection breaches in Various Claimants v WM Morrisons Supermarket PLC  [2017] EWHC 3113 (QB)This case rumbled on in 2018 and it was considered by the Court of Appeal. The Court of Appeal heard the appeal and (in remarkably quick time) dismissed the appeal. It is understood that Morrisons have sought permission to appeal to the Supreme Court and if permission is granted it is possible that it will feature in a review of Information law in 2019.

In February, the English and Welsh High Court issued an interesting privacy judgment when it considered an action for compensation arising out of “Can’t Pay? We’ll Take it Away’; a fly-on-the wall documentary following High Court Enforcement Officers in their work enforcing court orders relating to debt and housing cases. The Court had the tricky job of balancing the privacy rights of individuals against the rights of television companies in respect of freedom of expression; however, the High Court decided that the balance in this particular case fell in favour of the claimant’s privacy rights. The High Court’s decision was appealed to the Court of Appeal; looking specifically at the issue of quantifying the level of damages. That appeal was heard by the Court of Appeal in early December and should provide useful guidance on calculating damages in the privacy sphere.

Facebook, Cambridge Analytical and Aggregate AIQ all featured quite heavily in 2018 in terms of privacy and data protection matters. Facebook was served with a monetary penalty in the amount of £500,000 for breaches of the Data Protection Act 1998 and Aggregate AIQ was also the recipient of the first Enforcement Notice under the Data Protection Act 2018 (which was narrowed in scope by the Information Commissioner following an appeal by AIQ; which was subsequently dropped). Facebook lodged an appeal against the Monetary Penalty Notice with the First-Tier Tribunal (Information Rights) in November 2018. If and when a decision is reached by the Tribunal in respect of that appeal, it will feature on this blog.

Arising out of the same wide-ranging investigation by the ICO as the Facebook penalty and the AIQ Enforcement Notice was an Information Notice served on the United Kingdom Independence Party (UKIP), which was appealed to the First-Tier Tribunal (Information Rights). The Tribunal dismissed the appeal by UKIP in July.

In April there was yet another important decision from the English and Welsh High Court in respect of Privacy and Data Protection. A little over four years after the European Court of Justice decision on the Right to Be Forgotten in Google Spain, Mr Justice Warby handed down his judgment in NT1 & NT2 v Google; this represented the first decision of a UK Court in respect of the Right to Be Forgotten. An appeal was lodged in respect of this case and was due to be heard just before Christmas; however, it was reported that the case was settled on the day of the appeal.

The issue of compensation to identifiable third parties in the context of data protection breaches was considered by the English and Welsh Court of Appeal. This case adds to the helpful privacy and data protection case law emanating from the English and Welsh courts.

Another interesting development that we saw during the course of 2018 was a director being disqualified indirectly in connection with privacy and data protection matters. It does show that directors can be held personally liable for privacy and data protection transgressions of limited companies. This was underlined by the amendments to the Privacy and Electronic Communications (EC Directive) Regulations 2003 which now enable the Commissioner to serve a monetary penalty on directors (and others associated with companies) in certain circumstances.

In Scotland, the Court of Session made new rules which should make appealing decisions of the Scottish Information Commissioner in respect of requests for environmental information more financially viable.

Litigation in respect information law matters in Scotland remains limited. The majority of litigation on these areas arises out of England and Wales. Perhaps in 2019, we will begin to see more litigation in Scotland on information law matters. Hopefully the new rules in the Court of Session will see more appeals in respect of the Environmental Information (Scotland) Regulations 2004 and hopefully the introduction of Group proceedings in the Court of Session through the Civil Litigation (Expenses and Group Proceedings) (Scotland) Act 2018 will help with an increase in data protection and privacy litigation in Scotland.

In terms of 2018 Scottish cases, not long before Christmas the Court of Session treated us to a judgment in an appeal concerning vexatious requests under the Freedom of Information Scotland Act 2002. Beggs v Scottish Information Commissioner considered the correct approach to be taken when applying section 14(1) of the Freedom of Information (Scotland) Act 2002.

Looking ahead to 2019; the big issue on the horizon is Brexit. Much of what is discussed on this blog as “information law” derives from European law and so Brexit will likely have an impact upon that. We are still unsure as to the terms that we will be leaving on. A withdrawal Agreement has been negotiated between the European Union and the United Kingdom; however, there is  still a way to go with that – and it looks quite likely that the UK Parliament will rejected the Withdrawal Agreement in its current form. If we end up leaving with no Withdrawal Agreement in place then this will cause considerable difficulties for UK business which rely upon the transfer of personal data from elsewhere within the European Union; it will also cause problems for public bodies.

In terms of making the law work after Brexit, we were treated by the Government (in between Christmas and New Year) to a draft of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019. These Regulations will make changes to the GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 in light of the United Kingdom no longer being a member of the European Union. I will, of course, look at these draft Regulations in more detail soon.

I will attempt to address information law matters as they unfold in 2019 on the Information Law Blog from Inksters Solicitors.

Alistair Sloan

If you would like advice or assistance with Privacy and Data Protection matters or with UK and Scottish Freedom of Information requests contact Alistair Sloan on 0141 229 0880 or you can E-mail him.


Scottish Vexatiousness

Paragraph numbers in this blog post relate to the Court of Session’s decision in Beggs v Scottish Information Commissioner [2018] CSIH 80; unless the context requires, or it is expressly stated, otherwise.

If you’re regularly involved in the making of or responding to freedom of information requests then you are likely to be familiar with the decision of the English and Welsh Court of Appeal in Dransfield and Another v The Information Commissioner and another which deals with the meaning and application of “vexatious” within section 14 of the Freedom of Information Act 2000 (“FOIA”). In keeping with many of the provisions of FOIA, there has been considerable litigation on section 14 within the First-Tier Tribunal; however, the decision in Dransfield is the leading authority on the approach that public authorities, the UK Information Commissioner and the First-Tier and Upper Tribunals should take when applying or considering the exemption in section 14(1) of FOIA.

As with many aspects of the Freedom of Information (Scotland) Act 2002, the equivalent provisions within FOISA (also section 14) have escaped any judicial consideration; that is, until today when the First Division,  Inner House of the Court of Session (Lord President Carloway and Lords Brodie and Drummond Young) advised its opinion in an appeal under section 56 of FOISA against a decision of the Scottish Information Commissioner which upheld the decision of the Scottish Prison Service that a request for information made to it was vexatious: Beggs v Scottish Information Commissioner [2018] CSIH 80.

As with most cases involving vexatious requests, there is a history to the matter; this is briefly set out in paragraphs 5-15 of the Court’s Opinion. I am therefore not going to set it out here. There were two grounds of appeal advanced on behalf of the Appellant before the Court and these are set out, in full, by the Court in paragraph 4 of its Opinion. The grounds can  be summarised as follows: (1) that the test set out by Arden LJ (as she then was) in Dransfield should apply and that it had been incorrectly applied by the Scottish Information Commissioner (“SIC”); and (2) that the SIC’s decision was irrational as it failed to take into account a number of factors. The court ultimately rejected both grounds of appeal and refused the Appeal.

The Court makes some “preliminary comment” about the English and Welsh Court of Appeal’s decision in Dransfield. It notes that the decision is “an English case concerning English legislation” (para 26). This is not a wholly accurate statement by the Court: Dransfield concerns section 14 of FOIA, which cannot properly be said to be English legislation. FOIA covers UK-wide public bodies (such as UK Government departments, the BBC, UCAS, the British Transport Police and other); it can be used by people living in Scotland. There is also no separate Norther Irish FOI law and FOIA applies to bodies such as departments of the Northern Irish Government and the Police Service of Northern Ireland. Furthermore, it is possible for appeals against the Upper Tribunal to be taken to the Court of Session and the UK Commissioner can, for example, under section 54, make certifications to the Court of Session.

It appears that what the Court meant by “English legislation” is that the decision in Dransfield was not binding upon the SIC as the SIC is concerned with the enforcement of FOISA – an Act of the Scottish Parliament – rather than FOIA – an Act of the UK Parliament. I may, of course, be entirely wrong and the Court of Session has fundamentally misunderstood FOIA and the distinction between FOIA and FOISA. However, this is not really a matter upon which anything of substance in Beggs can be said to turn. It appears that the Court has essentially adopted the reasoning of Arden LJ and supplemented it with some of its own.

Also by way of preliminary comment the Court notes that Arden LJ expressly declined to offer a definition of or test for “vexatious” or “vexatiousness” (para 26) and so it was incorrect to argue that Dransfield set out a “test” for vexatious requests. The court went on (also at para 26) to state that “[i]t would be remarkable if the word “vexatious” when found in section 14(1) of the English Act of 2000 meant something different from the same word when found in section 14(1) of the Scottish Act of 2002; the terms of the two subsections are essentially identical.”

However, the Court of Session found that there was much in the judgment of Arden LJ that they would agree with and quote paragraph 68 of the judgment of Arden LJ with approval. The Court of Session, perhaps importantly, appears to have approved of the view that Arden LJ took that the rights in FOIA were constitutional in nature (para 28). The court also held that when assessing whether a request is vexatious or not, it must be viewed objectively. In the decision under challenge, the SIC had concluded that when viewed objectively the information sought was of no value to the Appellant. The First Division held that had the SIC followed Dransfield (which she was not obliged to do so) then she would have correctly reached the same conclusion: that Mr Beggs’ request was vexatious (para 30).

In terms of the irrationality ground of appeal, this was dealt with more swiftly by the Court. Counsel for the Appellant had characterised the three matters which the Appellant argued had been overlooked by the Court, were material.

The first matter was the Appellant’s express disavowal of any direct and personal attack. The Appellant had expressly disavowed in his request that there was any such attack. However, the Solicitor Advocate for the SIC argued that the contents of a letter sent to one of the SIC’s officers revealed the Appellant’s purpose; the Appellant’s purpose was “not to obtain information as such” (para 33) rather it was with a view to pursuing complaints about their conduct.” (also at para 33).

The court held that “the presence of a malicious motive may point to a request being vexatious the absence of a malicious motive does not point to a request not being vexatious” (para 33). In essence, while the Court appears to have been sceptical of the Appellant’s express disavowal of personal attack it seems that even if it had not been sceptical, the disavowal may not have assisted the Appellant anyway. The Court again expressed the objective nature of assessing whether a request is vexatious and agreed with the SIC that a request may be harassing even if that is not what is intended by the requester.

The second consideration referred to the past conduct of the authority; these requests appear to have been the result of the Scottish Prison Service putting forward inaccurate information in earlier proceedings before the Court of Session. The Court approved of the view of Arden LJ in respect of vengeful motives – such a motive might itself be an indicator that a request is vexatious. The court’s position here is fairly broad, but it does not appear to close off legitimate use of FOISA to uncover evidence of wrongdoing within a Scottish public authority. However, it is fairly clear that if a requester is using

The third consideration related to the importance of the information requested; the court concluded that the information was objectively of no value and this was therefore not a material consideration.

Comment
This is the first time that the vexatious requests provision in FOISA has been considered by the Scottish courts and will now be the leading case in applying section 14(1) of FOISA. The decision essentially approves of the approach set out by the English and Welsh Court of Appeal in Dransfield. It is important to remember that a request must be considered objectively. There is no express test for vexatious requests either under FOIA or FOISA, but it will be important for Scottish public authorities to keep in mind the constitutional nature of the rights in FOISA. With this in mind, the threshold for applying the provision in section 14(1) of FOISA is a high one.

The Court of Session considers that, when Arden LJ used the phrase “no reasonable foundation for thinking that the information sought would be of value”, it appears that Arden LJ was trying to encapsulate an idea of “gross disproportion as between much trouble inevitably caused and little benefit possibly gained.” How much traction this comment of the Court of Session will have in terms of the application of section 14 of FOIA (given that the Court of Session’s judgments in FOISA cases are of only persuasive authority to the Tribunals and English and Welsh Courts) remains to be seen. Of course, should Beggs seek permission (and be granted permission) to appeal to the Supreme Court we may get a definitive view from(the now)  Lady Arden on whether the Court of Session has correctly interpreted what she meant when sitting in the English and Welsh Court of Appeal.

For the time being, whether or not the Court of Session was right in what it said, this is now (subject to any appeal) the law as it applies in Scotland vis-à-vis FOISA. When considering whether a requester has a reasonable foundation for thinking that the information sought would be of value, it is necessary to look (objectively) at what value there is in the information (a mere assertion by the Applicant that it is of value will not itself be sufficient) and balance that against the inevitable burden that answering the request will place on the authority: they are inversely proportional to one another.

From the perspective of requesters, it is likely to be of little assistance to include express statements in requests that the request is not a personal attack on the authority or a member of its staff and even if you have no intent to cause harassment your request might well have that effect. Your request will be considered objectively in light of its facts and circumstances (and comments made in later correspondence may well be seen as tending to show the opposite).

The decision in Beggs is not likely to have much, if any, impact upon the way in which the vexatious requests provisions in FOISA operate in practice. The Court has essentially approved of the approach to the identical provisions under FOIA. In the absence of any previous authority from the Scottish courts in respect of section 14, the SIC and Scottish public authorities have historically found Dransfield to be persuasive and used it as a basis for understanding what section 14 means.

In short, to decide whether a request is vexatious it is necessary to consider the request objectively on its own facts and circumstances. There is no formula or checklist that can be followed which will give you a definitive answer.

Alistair Sloan

If you would like advice or assistance in respect of a Freedom of Information matter or a data protection/privacy issue then contact Alistair Sloan on 0141 229 0880 or you can send him an E-mail.