The Scottish Information Commissioner - It's Public Knowledge
Share this Page
Tweet this page:
Text Size Icon

- Text Size Up | Down

Round-up iconDecisions Round-up: 31 July to 11 August 2017

There's so much learning in this week's round-up! From an unusual case where the request had a serious purpose but was still vexatious, to advice about handling sudden influxes of requests, deciding whether to ask for consent to disclose personal data, and the need to be reasonable when clarifying requests and giving advice and assistance.

Also featuring resolved cases, and one case where we got it wrong …

Learning points:

  • Handling sudden influxes of requests
    FOI requests can be like buses - you don't get one for ages, and then lots turn up at the same time. Six of the decisions issued this week deal with the failure by one, relatively small, authority (and one we rarely have appeals about) to respond on time. The authority contacted us early on to tell us that they were struggling to respond to a sudden influx of requests and we offered to give what assistance we could. It's obviously important to comply with the timescales in the FOI Act, but if, for whatever reason, you're inundated with requests, it's good practice to tell the requesters what's going on - and worth contacting us for advice too. (Decisions 118/2017, 119/2017, 120/2017, 123/2017, 124/2017, 128/2017)
  • Do authorities need to seek consent to disclose personal data?
    Authorities can disclose personal data if the person it's about consents to it being disclosed (although consent won't always be necessary). The FOI Act doesn't require authorities to seek consent, and in some cases, it won't be appropriate to do so. In Decision 117/2017 the authority sought consent during the investigation, which meant that the information was disclosed to the requester more quickly than it otherwise would have been. For more about when it's appropriate to seek consent, see our briefing.
  • EIRs timescales can only be extended for requests that are voluminous and complex
    The Environmental Information (Scotland) Regulations (EIRs) allow authorities to extend the timescale for responding to up to 40 working days, but only if the information covered by the request is both voluminous and complex. In Decision 121/2017, the authority gave itself extra time to respond, but then told the requester that, in fact, it held very little information about his request. This was a breach of the EIRs. Authorities must not give themselves extra time unless they're sure that the volume and complexity of the information means they can't respond within the normal timescales. See our guidance for more.
  • When is it reasonable for authorities to ask requesters to clarify a request?
    If an authority doesn't understand what a request is for, it can ask the requester to clarify their request, provided asking for clarification is reasonable. The 20 working days for responding to the request will only begin when clarification is received. In Decision 122/2017, the authority told the requester it wouldn't deal with his request unless he told it the time period over which he wanted the information. We didn't agree that it was reasonable for the authority to seek clarification in this case.
  • Advice and assistance - what's reasonable?
    Our round-ups regularly remind authorities about the duty to give reasonable advice and assistance to requesters. However, what's reasonable for one requester might not be reasonable for another requester. Decision 125/2017 deals with a request made by a firm of solicitors, experienced in FOI, on behalf of their client. The solicitors argued that they hadn't been given sufficient advice and assistance by the authority, but were unable to explain in any detail what advice and assistance they might reasonably have expected. We were satisfied, in the circumstances, that the level of advice and assistance given had been reasonable.
  • A request can have a serious purpose, yet still be vexatious
    The subject matter of a request can be relevant when deciding if the request is vexatious. However, sometimes the subject matter of a request can be very serious, yet the request will still be vexatious. This is what happened with Decision 126/2017, which looked at a death in police custody. In this case, we decided, taking into account previous correspondence between the requester (over 100 requests) and the amount of information already disclosed to the requester on the subject, that this latest request was vexatious. The authority had previously warned the requester that future requests on the same topic might be considered vexatious - this was good practice. There's guidance in our briefing.
  • It's not just names that can identify individuals
    If you're asking for information about an individual - even if you don't want to know their name - it's possible that the information you asked for, when put together with other information in the public domain, could lead to individuals being identified. If, as in Decision 126/2017, the information is about someone's criminal record, the information will likely be exempt from disclosure under the FOI Act.
  • Make sure your reasoning stands up
    We often remind public authorities that when refusing to disclose information, they need to fully explain their reasons for doing so, with reference to the tests in the legislation. But this doesn't just apply to authorities. Our Decision 193/2016 was appealed to the Court of Session and we agreed that our reasoning in the decision hadn't been clear enough, so we conceded the appeal. We've re-issued the decision.

 

Decisions issued:

  • Decision 117/2017 Mark Irvine and Glasgow City Council (the Council)
    Mr Irvine asked the Council about an ex-employee's remuneration package. The Council withheld some information, but disclosed it during the investigation after it obtained the ex-employee's consent. We decided that, although the Council did not have consent at an earlier stage (and was not obliged to contact the employee to ask for consent), it should have been disclosed because condition 6 of Schedule 2 to the Data Protection Act was met.
  • Decision 121/2017 Stephen Sloper and Falkirk Council (the Council)
    The Council was asked about planning issues at a specific site. The Council disclosed some information, but it became clear during the investigation that it had interpreted the scope of the request far too narrowly. We ordered the Council to provide Mr Sloper with advice and assistance (with the aim of clarifying the scope of the request) and to issue a new response.
  • Decision 122/2017 James McEnaney and the Scottish Ministers (the Ministers)
    This concerned communications between the Ministers and the Hometown Foundation, a Scottish charity. We agreed the Ministers were correct to withhold some third party personal data, but ordered them to disclose other information, including information which they had argued would substantially prejudice the commercial interests of independent schools.
  • Decision 125/2017 Company X and Dumfries and Galloway Council (the Council)
    Company X asked the Council for a range of information about waste management, including contracts, invoices and statistical data. The Council originally refused to comply with the request on the basis that the request was manifestly unreasonable. We previously disagreed and ordered the Council to respond. The case came back to us on appeal - this time we were satisfied that the Council responded in line with the EIRs.
  • Decision 126/2017 Mr X and Police Scotland (the Police)
    This case was about problems with the CCTV system at Kittybrewster police station. Someone died at the station, but, because the system wasn't working properly, there was no CCTV footage of what happened. We agreed that the request was vexatious. While it was a serious matter, we had to take account of the number of requests and complaints the requester had already made about the CCTV system, and the information the Police had already disclosed.
  • Decision 127/2017 Mark Howarth and Glasgow City Council
    Mr Howarth asked the Council for about two Initial Case Reviews referred to in Glasgow Community Justice Authority's MAPPA (Multi-Agency Public Protection Arrangements) annual report. Although Mr Howarth didn't ask for the names of the individuals involved, we were satisfied that disclosing the information he wanted would lead to the individuals being identified. In this case, disclosure would breach the Data Protection Act.
  • Decision 118/2017 Jennifer Foy and the Scottish Further and Higher Education Funding Council (the SFC)
  • Decision 120/2017 Hattie Wilde and the SFC
  • Decision 123/2017 Elaine Miller and the SFC
  • Decision 124/2017 Anna Hamilton and the SFC
  • Decision 128/2017 Ashton King and the SFC

All six of these cases deal with failures by the SFC to respond to requests and/or requests for review within the timescales set down by the FOI Act. Half of the requests were about the financial difficulties being faced by Edinburgh College.

 

 Decision re-issued:

  • Decision 193/2016 Mr X and NHS Lothian
    This decision was initially issued last September. Mr X appealed the decision to the Court of Session on the basis that we had not given proper and adequate reasons as to why third party personal data should not be disclosed. We agreed that the reasoning was not adequate and conceded the appeal. The decision was set aside by the Court of Session and sent back to us to carry out further investigation and give adequate reasons. This decision replaces the original decision issued last year. We found that some of the personal data should still not be disclosed, but expanded our reasoning as to why this was the case.

 

Resolved cases

We also resolved 12 cases in July without the need for a formal decision.

  • In three quarters of the cases resolved in July, the public authority disclosed information to the requester after the requester had appealed to us. The requesters were all happy to withdraw their appeals, even where the authorities had only disclosed some of the information they had asked for. If the authorities had disclosed the information when they first got the request, it would have saved them - and us - a lot of time and effort.
  • In one case, the requester appealed to us because they hadn't received a response to their request. When they did get a response, they withdrew the appeal and submitted a new one dealing with the issues raised in the response.
  • In one case, a requester was unhappy that a public authority had refused to confirm or deny (under section 18 of the FOI Act) whether it held the requester's personal data. We explained to the requester why section 18 was the appropriate response and suggested that they make a subject access request under the Data Protection Act.
  • In another case, the authority told the requester where they could find the information they were looking for after the requester had appealed to us. The appeal was withdrawn. Again, if advice and assistance had been given at an earlier stage, the appeal wouldn't have been necessary.
  • In a final case, the requester failed to clarify why they were dissatisfied with the response from the public authority. This led to us treating the request as abandoned.

Back to Top