Decision 105/2023: Loans and grants advanced to companies within the GFG Alliance
Authority: Scottish Enterprise
Case Ref: 202100860
Summary
The Authority was asked for a list of loans and grants made to companies within the GFG Alliance.
The Authority disclosed some information, but withheld information about one particular loan under several exemptions, as it considered this to be, amongst other things, commercially sensitive and likely to prejudice the economic interests of all or part of the UK if it were disclosed.
The Commissioner investigated and found that not all of the withheld information was exempt from disclosure. He ordered the Authority to disclose the non-exempt information.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions; 25(1) (Information otherwise accessible); 33(1)(b) and (2)(a) (Commercial interests and the economy); 38(1)(b), (2A), (5) (definitions of “data protection principles”, “data subject”, “personal
data”, “processing” and “the UK GDPR”) and (5A) (Personal information)
United Kingdom General Data Protection Regulation (the UK GDPR) articles 5(1)(a) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness of processing)
Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and (14) (a), (c) and (d) (Terms relating to the processing of personal data)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 19 May 2021, the Applicant made a request for information to the Authority. The information requested was:
A list of loans and grants made to companies within the GFG Alliance (including but not
limited to Liberty Group companies, Liberty Steel, Alvance Aluminium and Simec Group companies).
For each loan or grant please give the description/purpose of the loan or grant, name of the recipient company, date of loan or grant, amount of loan or grant, term of loan (in months or years), current balance (if loan).
For each/any loans, please supply a copy of the loan agreement and the due diligence undertaken prior to granting the loan.
Please only consider grants and loans post 1 January 2015
2. The Authority responded on 16 June 2021. It confirmed that it held information falling within the scope of the Applicant’s request, and disclosed information to the Applicant in relation to the entity (Liberty Steel Dalzell Ltd (LSDL)) it had provided grants and loans to. The Authority provided details of the date of the loan or grant,
the amount advanced, the term of the loan or grant, its purpose and current balance. In the case of the one loan, the Authority withheld the loan term.
3. The Authority also refused to disclose full copies of the loan agreement and due diligence report relating to the loan advanced to LSDL, citing exemptions in sections 33(1)(b), 38(1)(b) and 30(b) of FOISA. The Authority provided the Applicant with explanations as to why it considered these exemptions to be applicable, together with its consideration of the public interest test, where appropriate.
4. On 17 June 2021, the Applicant wrote to the Authority, requesting a review of its decision on the basis that:
(i) some of the information that had been redacted was already in the public domain;
(ii) the FOISA exemptions used did not apply to some or all of the information withheld;
(iii) the public interest test had not properly considered reasons for disclosure.
(iv) the public interest favoured disclosure.
5. The Applicant also made it clear that they were not seeking disclosure of any personal information, other than the names of individuals at director, partner (for partnerships) or senior civil service level.
6. The Applicant also made submissions to the Authority as to why they considered some of the withheld information to be publicly available, as well as explaining, with reasons, why they did not consider the exemption in section 30(b) of FOISA to be applicable to the withheld information.
7. The Authority notified the Applicant of the outcome of its review on 15 July 2021. In doing so, it acknowledged that certain of the withheld information was publicly available (this included the interest rate and term associated with the loan), and so disclosed both the interest rate per annum and the term of the loan.
8. The Authority upheld its reliance on the exemptions in sections 38(1)(b) and 30(b) for continuing to withhold some information from the Applicant, and explained that it was also seeking to rely on the exemption in section 36(2) of FOISA (Confidentiality). The Authority acknowledged and accepted the views expressed by the
Applicant in relation to the public interest, but confirmed that it was content that it had carefully considered the application of the public interest test. It affirmed its conclusion that the public interest in disclosure was outweighed by that in withholding the information, for the reasons it had given in response to the Applicant’s request.
9. On 16 July 2021, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Applicant stated they were dissatisfied with the outcome of the Authority’s review, because they did not agree with its reasons for withholding the information and believed the public interest to
favour disclosure.
Investigation
10. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.
11. On 28 July 2021, The Authority was notified in writing that the Applicant had made a valid application. The Authority was asked to send the Commissioner the information withheld from the Applicant. The Authority provided the information and the case was allocated to an investigating officer.
12. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Authority was invited to comment on this application and to answer specific questions. These related to why it considered the exemptions it relied upon to be applicable to the information it was continuing to withhold. The Authority was also invited to provide submissions on its consideration of the application of the public interest test, where applicable.
13. Further submissions were sought and received from the Authority during the course of the investigation. In the course of its submissions, the Authority withdrew its reliance on section 36(2) of FOISA.
Commissioner’s analysis and findings
14. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both the Applicant and the Authority. He is satisfied that no matter of relevance has been overlooked.
Information covered by request
15. The information withheld in this case relates to a loan which was advanced by the Authority to LSDL.
16. LSDL operated one of the two remaining steel plate mills in Scotland, purchased from the Scottish Government on 15 April 2016. This was after it had been mothballed by the previous owner TATA steel.
17. The Authority withheld certain information in two documents from the Applicant. These documents are the “Project Plant” report (the due diligence report) and the “Facility Agreement” (the loan agreement between the Authority and LSDL). It is this information which is being considered by the Commissioner in what follows.
Section 33(1)(b) – Commercial interests
18. Section 33(1)(b) of FOISA provides that information is exempt information if its disclosure would, or would be likely to, prejudice substantially the commercial interests of any person (including, without prejudice to that generality, a Scottish public authority). This exemption is subject to the public interest in section 2(1)(b)
of FOISA.
19. There are a number of elements an authority needs to demonstrate are present when relying on this exemption. In particular it needs to establish:
(i) whose commercial interests would (or would be likely to) be harmed by disclosure,
(ii) the nature of those commercial interests and
(iii) how those interests would (or would be likely to) be prejudiced substantially by disclosure.
20. The prejudice must be substantial, in other words of real and demonstrable significance. Where the authority considers that the commercial interests of a third party would (or would be likely to) be harmed, it must make this clear. Generally, while the final decision on disclosure will always be one for the authority, it will assist matters if the third party has been consulted on the matters referred to above.
21. The Authority has relied on the exemption in section 33(1)(b) of FOISA for withholding certain information in both the “Project Plant (due diligence) report” and the “Facility Agreement” (loan agreement) from the Applicant.
22. The Authority explained that, in its view, disclosure of the information withheld under section 33(1)(b) in both documents would substantially prejudice the commercial interests of itself and a third party, i.e. LSDL (the company about which the report had been prepared, and with whom it had the loan agreement).
23. In seeking to explain the nature of those commercial interests, the Authority submitted that it engages in commercial activities in its own right, leveraging in private sector investment and generating significant income from its investment portfolio.
24. It also commented that it is required to engage with private companies, including through the procurement of services such as those provided by Ernst and Young (EY) in the due diligence exercise. The Authority commented that, to continue to be able to have access to the maximum choice of service providers in relation to the external services it needs to procure from the private sector, it needs to be able to assure those providers that it will appropriately handle the advice provided. It also submitted that it would be harmful to undermine its ability to carry out appropriate due diligence to inform its decision making, and threaten its ability to obtain
independent and frank assessment of investment propositions and comply with public funding rules.
25. In terms of the nature of the commercial interests relating to LSDL, the Authority commented that the concerns identified over the disclosure of the withheld information were commercial because they arose in the context of LSDL’s commercial trading activity. This trading activity included the manufacture, sale and purchase of goods and services for the generation of revenue, within a competitive environment.
26. With regard to the harm it believed would be caused to both its own and LSDL’s commercial interests by disclosure, the Authority explained that the loan to LSDL remained live, which it considered enhanced the commercial sensitivity of the requested information in relation to the ongoing relationship of lender to borrower.
27. Furthermore, the Authority expressed concern that release of some of the withheld information could impact adversely on its ongoing commercial financial management of this loan, and commercial interests in other lending and investment situations (which it considered to be part of its statutory functions). It also went
on to explain, however, that this loan related to a specific deal in a specific set of circumstances.
28. The Authority considered disclosure would substantially prejudice its ability to work in a meaningful way with companies in Scotland to explore investment opportunities and deliver the statutory functions required of it. It did not believe companies would share detailed business plans with it and its advisers if detailed consideration of these were subject to release.
29. The Authority contended that, were information in LSDL’s business plan to be disclosed, this would not only negatively impact its own commercial interest in the loan but also be likely to impact its ability to explore the provision of funding to other Scottish companies and grow the Scottish economy. It believed companies would
understandably be reluctant to share necessary commercial information with the Authority, if it might subsequently be released under FOISA at a time when it remained commercially sensitive.
30. The Authority explained that, in some markets, expertise is required and is only available from a small group of specialists. It considered its commercial interests would be prejudiced if there was any reduction in the specialists, such as EY, willing to provide the required advice services, out of concern that their views
would be disclosed into the public domain without due consideration and redaction.
31. With regard to the commercial interests of LSDL, the Authority set out, in detail (using information itself considered to be commercially sensitive), why it believed disclosure of the withheld information would substantially prejudice LSDL’s commercial interests.
32. Having considered the submissions from the Authority, the Commissioner is satisfied that both the Authority and LSDL have commercial interests in relation to the information contained in the “Project Plant Report” and the “Facility Agreement”.
33. It is evident to the Commissioner from reading the “Project Plant Report” that this was prepared by EY under contract from the Authority, in order to ensure that due diligence was carried out as part of the Authority’s decision making over whether to advance a loan to LSDL. “The Facility Agreement” is the document which sets out the terms associated with that loan.
34. Looking at the withheld information in both documents, the Commissioner will now set out his consideration of the application of section 33(1)(b) separately in relation to each document.
Information redacted from the “Facility Agreement”
35. The Commissioner is not satisfied that all of the information withheld under section 33(1)(b) is exempt.
36. In some cases, withheld information has already been disclosed to the Applicant in response to their request, so the Commissioner cannot agree that this information is commercially sensitive.
37. In other instances, information which is publicly available on the Companies House website relating to LSDL reveals certain of the information that continues to be withheld. Given that this information is publicly available from another source (and was at the time of the Applicant’s request), the Commissioner is unable to accept that
it is commercially sensitive.
38. It is possible, because of other information which has been released from the “Facility Agreement” or in response to their request, for the Applicant to discern further information that continues to be withheld. For that reason, the Commissioner cannot accept that this other withheld information is commercially sensitive.
39. The “Facility Agreement” also contains clauses which the Commissioner considers to be of a fairly standard type, that would be expected to be included in a contract/agreement of this kind. The same is true of certain definitions contained in the agreement which relate to fairly routine practice, the definition of which is
publicly available. The Commissioner does not accept that disclosure of these would impact the commercial interests of either the Authority or LSDL.
40. Having considered the submissions from the Authority in relation to the remaining information that has been withheld, the Commissioner recognises that the interest rates recorded at point 10.3.2 of the “Facility Agreement” are commercially sensitive. Although these rates would have been negotiated between the Authority and LSDL prior to the agreement being signed, and would be a reflection of the prevailing market rate at the time, the Commissioner acknowledges that the agreement was (at the relevant time) still “live” and subject to ongoing discussion. Therefore, the Commissioner accepts that disclosure of this information would be likely to have a prejudicial effect on LSDL and the Authority.
41. The Commissioner accepts that information relating to the execution of the agreement and schedules to it would be commercially sensitive and might undermine any future negotiations in relation to the loan.
42. With regard to the remaining information in the “Facility Agreement” that has been withheld, having considered this in light of all of the submissions made by the Authority, the Commissioner accepts certain of this information would be exempt.
43. However, despite being asked to do so, the Commissioner is not satisfied that the Authority has evidenced the specific harm which it asserts would occur as a result of the disclosure of the remaining information for which it has relied on the exemption in section 33(1)(b) of FOISA. Therefore, the Commissioner finds that disclosure of this information would not be likely to prejudice substantially the commercial interests of either the Authority or LSDL. As a consequence, the Commissioner finds that the exemption in section 33(1)(b) of FOISA does not apply to this information.
Information redacted from “Project Plant” Report
44. The Commissioner is not satisfied that all of the withheld information in the “Project Plant” Report for which the Authority has relied on the exemption in section 33(1)(b) is exempt.
45. Having read the “Project Plant” Report, it is apparent that certain of the withheld information has been drawn from Liberty House Group’s full accounts and Liberty Engineering Group’s accounts, which EY acknowledged (on the same page of the report, in disclosed information) were publicly available. As such, the Commissioner
cannot accept that disclosure of this particular information would be likely to cause commercial prejudice.
46. In addition, certain of the information redacted from an organisation chart has been disclosed within the narrative on the same page. For this reason, the Commissioner is unable to agree that disclosure of this particular information would be commercially sensitive.
47. On page 4, certain information has been redacted around the scope of EY’s work in preparing the report. The Commissioner is not satisfied that the Authority has shown, within its submissions, that sufficient prejudice would be caused by disclosure to EY’s or its own commercial interests to fulfil the harm test in the exemption.
48. The Commissioner is, however, satisfied that the remaining information in the “Project Plant” Report for which the Authority has relied on the exemption in section 33(1)(b) of FOISA would be exempt from disclosure, for the reasons put forward by the Authority.
49. The Commissioner accepts that a significant amount of the withheld information relates to the content of a financial model and business plan relating to LSDL. While the withheld information may not be current, the Commissioner recognises that it would still be informative and relevant in the circumstances described in the Authority’s submissions. The Commissioner recognises that if this information were to have been disclosed in response to this request, it is highly likely that it would have affected any ongoing negotiations.
50. For reasons already set out in paragraph 40 above, the Commissioner accepts that interest rates cited in the “Project Plant” report would be exempt from disclosure, other than that disclosed to the Applicant in response to their requirement for review.
51. As the Commissioner is not satisfied that all of the information contained in the “Facility Agreement” and “Project Plant” report for which the Authority has relied on the exemption in section 33(1)(b) would be exempt from disclosure, he is not required to go on to consider the application of the public interest test in relation
to this information.
52. Given that the Commissioner has accepted that certain of the information for which the Authority has relied on the exemption in section 33(1)(b) is exempt, he is now required to go on to consider the application of the public interest test to that particular information.
Section 2(1)(b) – Public interest test
53. Consideration of the public interest test requires the Commissioner to consider whether, in all the circumstances of the case, the public interest in disclosing the withheld information is outweighed by the public interest in maintaining the exemption in section 33(1)(b).
The Applicant’s comments on the public interest test
54. The Applicant considered there to be a public interest in ensuring that the Authority undertook robust due diligence and had robust contractual terms in place in relation to the loan agreement.
55. The Applicant referred to an investigation being carried out by the Serious Fraud Office into the GFG Alliance (of which LSDL forms a part), relating to suspected fraud and money laundering. The Applicant believed this demonstrated why there was a public interest in disclosure of the withheld information.
The Authority’s comments on the public interest test
56. The Authority acknowledged the general public interest in providing background advice and information, in order to understand official decisions and provide public accountability in respect of those decisions, as one route of accountability available to the public.
57. It also recognised the general public interest in enabling public scrutiny of a due diligence exercise undertaken to manage risk in relation to the potential use of public funds for a commercial enterprise.
58. The Authority acknowledged a public interest in ensuring transparency in the use of public funds and providing information to confirm that a robust due diligence exercise had been undertaken, but only to a certain extent and limited by the extent to which disclosure could reduce the robustness of future due diligence exercises and reports of them made to public bodies. The Authority considered it to be in the public interest for it to be known that due diligence was carried out in respect of LSDL, that it was conducted by a reputable expert company and that the due diligence was comprehensive and detailed. The Authority was of the view that the information already disclosed to the Applicant provided confirmation on these points.
59. Against the public interest in disclosure, the Authority asserted that there is a strong public interest in it being able to maintain the ability to access free and frank professional advice, to inform its own decision making on sensitive and commercial matters. It also considered there to be a strong public interest in ensuring high quality in the decisions it reached, and in the effective use of public funds when procuring appropriate advice in a due diligence exercise.
60. The Authority considered there to be a specific public interest in it being able to obtain access to unqualified expert opinion regarding the investment of public money, and in obtaining its own value for money in due diligence services procured as a necessary part of its public functions, at a cost to the public purse. The Authority submitted that actions reducing the quality and value of due diligence were not in the public interest.
61. The Authority also submitted that transparency should not be at the detriment of any third party’s current commercial viability, or other protected interests, caused by the release of confidential information, as this would not be in the public interest.
62. The Authority concluded that there is a significant public interest in public bodies maintaining confidentiality and protecting the legitimate economic interests of commercial companies with whom it is required to interact to carry out its functions effectively.
The Commissioner’s conclusions on the public interest test
63. The Commissioner has considered all of the relevant arguments in this case. The Commissioner acknowledges the general public interest in transparency and accountability, particularly in relation to the spending of public funds. He notes that the information already disclosed by the Authority goes some way towards this. He also considers the information that he has not found to be exempt under section 33(1)(b) of FOISA would further inform the public interest in transparency and accountability.
64. There has been (and is) a lot of coverage in the media relating to the finances of the GFG Alliance (of which LSDL is a part), particularly since the collapse of Greensill Capital, who were a major financial backer. The impact of the collapse of Greensill Capital on the business of the GFG Alliance has also been the subject of discussion in the UK Parliament. Therefore, the Commissioner acknowledges the significant public interest in the circumstances surrounding the provision of this loan.
65. That said, set against this clear public interest is the public interest in ensuring that commercially sensitive information which could negatively impact LSDL’s continuing financial viability (certainly at the time of the request and requirement for review) is not made public. It is also in the public interest to allow the Authority to seek and receive robust expert views on whether it is appropriate to invest public money in particular companies or industries. Furthermore, given that the loan in question remained “live” and the subject of ongoing discussion at the relevant time, the Commissioner finds that the balance of the public interest lies in favour of maintaining the exemption in section 33(1)(b) of FOISA in this case.
Section 33(2)(a) – Prejudice to economic interests of the whole or part of the UK.
66. Section 33(2)(a) provides that information is exempt information if its disclosure under FOISA would, or would be likely to, prejudice substantially the economic interests of the whole or part of the United Kingdom.
67. Authorities seeking to rely on the exemption in section 33(2)(a) will need to demonstrate that disclosure would, or would be likely to, prejudice substantially the economic interests contained in the exemption. The damage caused by disclosing information would have to be real or very likely, not hypothetical and would have to be significant, not marginal. It would also have to occur in the very near future, not in
some distant time.
68. The Authority has relied on the exemption in section 33(2)(a) of FOISA for withholding information that it also relied on the exemptions in sections 30(b)(i), 30(c) and 33(1)(b) of FOISA for.
69. Where the Commissioner has upheld the exemption in section 33(1)(b) to information for which the Authority is also relying on section 33(2)(a), that information will not be considered here.
70. The Authority has argued that disclosure of the information withheld in both remaining documents would adversely impact the economic interests of Scotland, as well as the economic interests of a local region of Scotland in which LSDL operated and other regions where a decline in the steel industry had had a significant impact. The Authority made representations to the Commissioner to this effect.
71. In particular, The Authority highlighted the action taken by the Scottish Government to support the purchase by LSDL of the previously mothballed steel plate mills. The Authority also highlighted the number of jobs supported by the UK steel industry, and the importance of the financial contribution of that industry to the UK
economy.
72. The Authority argued that the economic interest of Scotland maintaining a steel industry was directly linked to the commercial interests of LSDL as the owners of the last steel plant in Scotland. The Authority contended that disclosure of some of the withheld information in this case would be likely to significantly prejudice the
commercial interests of LSDL, for the reasons already outlined in consideration of the exemption in section 33(1)(b) above. This significant prejudice to the commercial interests of LSDL would, the Authority submitted, lead to significant prejudice in the orm of significant detriment to the economic interests of the North Lanarkshire area,
as well as those of the country as a whole.
73. The Authority again remarked on ongoing discussions and negotiations in relation to LSDL’s business, which would, it submitted, be substantially prejudiced if some of the withheld information was disclosed. This would, the Authority claimed, jeopardise the economic interests of both North Lanarkshire and Scotland as a whole.
74. Having considered The Authority’s submissions in relation to this exemption, the Commissioner accepts, that were certain information in the “Project Plant Report” to have been disclosed in response to this information request, would have been likely to have a significant impact on the Scottish steel industry and jobs in a specific
local area.
75. However, for the same reasons expressed under consideration of the exemption in section 33(1)(b) of FOISA above, the Commissioner is not satisfied that other information which has been withheld in both the “Project Plant Report” and “Facility Agreement” would be exempt from disclosure under section 33(2)(a) of FOISA. The
Commissioner is unable to accept that the anticipated harm claimed by the Authority would be caused by release of that specific information.
76. The Commissioner therefore upholds the application of the exemption in section 33(2)(a) to certain of the withheld information as he is satisfied that disclosure of certain of the information would, or would be likely to, prejudice substantially the economic interests of Scotland as a whole and North Lanarkshire as a region. As a
consequence, the Commissioner is now required to go on to consider the application of the public interest test in section 2(1)(b) of FOISA.
Section 2(1)(b) – Public interest test
77. Consideration of the public interest test requires the Commissioner to consider whether, in all the circumstances of the case, the public interest in disclosing the withheld information is outweighed by the public interest in maintaining the exemption in section 33(2)(a).
The Applicant’s comments on the public interest test
78. In their submissions, the Applicant explained that they consider there to be a public interest in ensuring that the Authority undertook robust due diligence and have robust contractual terms in place in relation to the loan agreement.
79. The Applicant referred to an investigation being carried out by the Serious Fraud Office into the GFG Alliance (of which LSDL forms a part), relating to suspected fraud and money laundering. The Applicant considers this to demonstrate why there was a public interest in disclosure of the withheld information.
The Authority’s comments on the public interest test
80. The Authority acknowledged the general public interest in providing background advice and information in order to understand official decisions and provide public accountability in respect of those decisions. It also recognised the general public interest in enabling public scrutiny of a due diligence exercise, undertaken in order to manage risk in relation to the potential use of public funds for a commercial enterprise.
81. Against this, however, the Authority considered that disclosing information about ongoing negotiations, beyond those parties involved at the time, carried a real risk of causing detriment to those negotiations by undermining the position of one or more parties.
82. Furthermore, the Authority argued that transparency should not be to the detriment of any third party’s current commercial viability, or other protected interests, caused by release of its confidential information. The Authority commented that this would not be in the public interest, due to the effect on the willingness of
that party and future parties in such negotiations to share the most sensitive and critical information for the purposes of a deal.
83. It is the Authority’s view that there is a significant public interest in it protecting the legitimate economic interests of commercial companies with whom it is required to interact, to carry out its functions effectively.
84. Overall, the Authority submitted that the public interest in disclosure was outweighed by the public interest in maintaining the exemption in section 33(2)(a) of FOISA.
The Commissioner’s conclusions on the public interest test
85. The Commissioner has fully considered the public interest test arguments made by both the Applicant and the Authority. As noted earlier in this decision, the Commissioner recognises and acknowledges the significant public interest that exists in transparency and accountability in relation to the loan advanced to LSDL in this case.
86. However, against this, the Commissioner recognises the public interest (at the time of the request and requirement for review) in protecting Scotland’s economic interests through the support of a business which brings employment to an area of low employment, and reinvigorates an important industry. This, together with the need to protect commercially sensitive information relating to a specific business, at a time when discussions were ongoing with both the Authority and other entities around refinancing, pushes the balance of the public interest in favour of maintaining the exemption in section 33(2)(a) of FOISA.
87. As a consequence, the Commissioner finds that the public interest lies in maintaining the exemption in section 33(2)(a) of FOISA in this case.
88. Because the Commissioner has found that all of the information for which the Authority is relying on the exemptions in sections 30(b)(i) and 30(c) would be exempt from disclosure under section 33(2)(a) of FOISA, he is not required to consider the application of these exemptions separately.
Section 38(1)(b) – Personal information
89. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is “personal data” (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK General Data Protection
Regulations (UK GDPR).
90. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption. This means that it is not subject to the public interest test in section 2(1)(b) of FOISA.
Is the withheld information personal data?
91. The first question the Commissioner must address is whether the information is personal data for the purposes of section 3(2) of the DPA 2018.
92. “Personal data” is defined in section 3(2) of the DPA 2018 as “any information relating to an identified or identifiable living individual”. Section 3(3) of the DPA 2018 defines “identifiable living individual” as a living individual who can be identified, directly or indirectly, in particular by reference to-
(i) an identifier such as a name, an identification number, location data, or an online identifier, or
(ii) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
93. Information will “relate to” a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.
94. The Court of Justice of the European Union looked at the question of identification in Breyer v Bundesrepublik Deutschland. The Court took the view that the correct test to consider is whether there is a realistic prospect of someone being identified. When making that determination, account can be taken of the information in the hands of a third party. However, there must be a realistic causal chain – if the risk of identification is insignificant, the information will not be personal data.
95. Although this decision was made before the UK GDPR and the DPA 2018 came into force, the Commissioner considers that the same rules will apply. In accordance with Recital 26 of the GDPR (the source of the UK GDPR), the determination of whether a natural person is identifiable should take account of all means reasonably likely to be used to identify the person, directly or indirectly. In considering what is reasonably likely, the Recital states that all objective factors should be taken into account, such as the costs and amount of time required for identification, taking into consideration the available technology at the time of processing and technological
developments.
96. The Authority submitted that certain of the information withheld in both the “Project Plant Report” and the “Facility Agreement” was personal data, from which a living individual could be identified.
97. Having considered the withheld information (names, signatures, job titles, telephone numbers and addresses), the Commissioner accepts that it “relates to” identifiable living individuals. The Commissioner therefore concludes that the withheld information is personal data, for the purposes of section 3(2) of the DPA
2018.
Which of the data protection principles would be contravened by disclosure?
98. The Authority stated that disclosure of the personal data would contravene the first data protection principle (Article 5(1)(a) of the UK GDPR). Article 5(1)(a) states that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.
99. In terms if section 3(4) of the DPA 2018, disclosure is a form of processing. In the case of FOISA, personal data is processed when it is disclosed in response to a request for information.
100. The Authority concluded that it could not identify a lawful basis for disclosure under Article 6 of the UK GDPR. The only condition the Authority felt was potentially applicable was the condition in Article 6(1)(f), but it argued that it could not be met in the circumstances of this case.
101. The Commissioner must now consider if disclosure of the personal data would be lawful (Article 5(1)(a)). In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed. The Commissioner considers condition (f) in Article 6(1) to be the only one which could potentially apply in the circumstances of this case.
Condition (f): legitimate interests
102. Condition (f) states that the processing will be lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data (in
particular where the data subject is a child).
103. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA (see Appendix 1) makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
104. The tests which must be met before Article 6(1)(f) can be met are as follows:
(i) Does the Applicant have a legitimate interest in obtaining the personal data?
(ii) If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?
(iii) Even if processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?
Does the Applicant have a legitimate interest in obtaining the personal data?
105. In submissions to the Commissioner, the Applicant explained that they were only seeking disclosure of personal information belonging to senior people in this case. By senior people, the Applicant stated that they meant directors, senior public officials and partners of partnerships.
106. The Applicant commented that there was a strong public interest in the activities and interests of Mr Sanjeev Gupta of the GFG Alliance. The Applicant noted that Mr Gupta had obtained a loan of public funds, so there was a public interest in who he interacted with in order to obtain those funds.
107. In determining whether the Applicant had a legitimate interest in obtaining the personal data, the Authority focused on the Applicant’s view that there was a public interest in ensuring that the Authority undertook robust due diligence and had robust contractual terms in place in relation to this loan agreement. In doing so, the
Authority submitted that the details of the individual staff involved, from itself, EY and LSDL, were irrelevant and added nothing to the Applicant’s understanding of the matters on which they were seeking information. The Authority explained that it was the participating organisations themselves who were the focus in the Applicant’s
request, not the identities of the persons who were fulfilling duties as part of their professional roles, acting as representatives of their respective organisations. The Authority commented that it had commissioned a company (EY) to undertake due diligence, not a person.
108. Having fully considered the submissions from both parties, the Commissioner accepts that, given the significant public interest there is (and was) in the financial position and probity of the GFG Alliance (of which LSDL forms a part), the Applicant, and the public as a whole, have a legitimate interest in understanding who was involved in carrying out due diligence and entering into the loan agreement between the Authority and LSDL. The Commissioner is therefore satisfied that the Applicant has a legitimate interest in the personal data.
Is the disclosure of the personal data necessary?
109. The Commissioner will now consider whether disclosure of the personal data requested is necessary for the Applicant’s identified legitimate interest. In doing so, he must consider whether these interests might reasonably be met by any alternative means.
110. The Commissioner has considered this carefully in light of the decision of the Supreme Court in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55. In this case, the Supreme Court stated (at paragraph 27):
A measure which interferes with a right protected by Community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less.
111. “Necessary” means “reasonably” rather than “absolutely” or “strictly” necessary. When considering whether disclosure would be necessary, public authorities should consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the requester’s legitimate interests can be
met by means which interfere less with the privacy of the data subjects.
112. In its submissions, the Authority argued that details of individual staff involved from itself, EY and LSDL were irrelevant and added nothing to the applicant’s understanding of the matters upon which he was seeking information. The Authority noted that it was the participating organisations themselves that were the focus in the Applicant’s request, not the identity of persons who were fulfilling duties as part of their professional roles, and acting as representatives of their respective organisations. The Authority commented that it had commissioned a company (EY) to undertake the due diligence, not a person.
113. In this case, the Commissioner must consider the information requested against the legitimate interest he has identified (in relation to the names, signatures, job titles, phone numbers and addresses), and whether disclosure of that information is necessary to achieve the Applicant’s legitimate interest.
114. Having done this, and bearing in mind the Applicant’s indication that they are only interested in receiving the personal data of directors, senior public officials and partners of partnerships, the Commissioner does not consider it necessary for the personal data relating to the individuals within EY who were asked to undertake the due diligence to be disclosed. The Commissioner agrees with the submission made by the Authority that its relationship in relation to the due diligence report was with EY as a company, and not the individual employees who prepared the report. Furthermore, there is sufficient information within the version of the due diligence report that has been disclosed to allow the Applicant (and the public) to know which service area of EY was involved in preparing the report.
115. The Commissioner also does not consider it necessary for the job titles attributed to particular staff of the Authority to be disclosed in response to the Applicant’s request. The Commissioner is satisfied, on the basis of the submissions received from the Authority, that these individuals do not (and did not at the time of the Applicant’s request) occupy senior positions within the Authority.
116. With regard to the remaining personal data that has been withheld, the Commissioner considers that both of the data subjects concerned occupy/occupied senior roles and therefore it would be necessary for this information to be disclosed in order to satisfy the Applicant’s legitimate interest. Only then would the Applicant be aware of who from the GFG Alliance was involved in entering into the loan agreement with the Authority. The Commissioner can see no other way in which the Applicant would be able to access this information which would interfere less with the data subject’s legitimate rights and freedoms.
117. Having considered the scope of the Applicant’s legitimate interests, therefore, the Commissioner accepts that disclosure of certain of the withheld personal data is necessary to achieve the Applicant’s legitimate interests.
The data subjects’ interests or fundamental rights and freedoms (and balancing exercise)
118. The Commissioner has concluded that the disclosure of certain of the information is necessary to achieve the Applicant’s legitimate interests. However, this must be balanced against the fundamental rights and freedoms of the data subjects. Only if the legitimate interests of the Applicant outweighed those of the data subject could personal data be disclosed without breaching the first data protection principle.
119. The Commissioner has considered the submissions from both parties carefully, in the light of the decision by the Supreme Court referred to in paragraph 110.
120. The Commissioner’s guidance on section 38 of FOISA notes that, in carrying out the balancing exercise, much will depend on the reasonable expectations of the data subjects. Factors which will be relevant in determining reasonable expectations include:
- whether the information relates to the individual’s public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)
- the potential harm or distress that may be caused by disclosure
- whether the individual objected to the disclosure
121. The Commissioner accepts that, in relation to one of the data subjects, while the personal data concerns their public role, it would not be within their reasonable expectation that their name would be disclosed into the public domain in relation to their role and involvement in the loan agreement with the Authority. Furthermore, the Commissioner acknowledges the concerns expressed by the Authority in respect of the harm that may be caused to that data subject, should their personal data be disclosed in response to this request. The Commissioner therefore concluded that, on balance, the likely harm to the data subject’s interests, fundamental rights or freedoms would outweigh the fulfilment of the Applicant’s legitimate interests in this case.
122. However, in considering the personal data of the remaining data subject, the Commissioner notes that their personal data is included in the “Facility Agreement” in relation to their public role. He also recognises that within that role the data subject occupies a senior position and has a significant public presence. In its
submissions, the Authority has not explained specifically why disclosure of this data subject’s personal data would cause harm to their interests, fundamental rights or freedoms. Therefore, given the seniority of the data subject and the significant public profile they have in relation to their role, the Commissioner considers that it
would be within their reasonable expectation that their involvement in the loan agreement would be made public. As a consequence, the Commissioner finds that fulfilment of the legitimate interests of the Applicant in this case outweighs any harm to the data subject’s interests, fundamental rights or freedoms.
123. Therefore, in all the circumstances of this particular case, the Commissioner concludes that condition (f) in Article 6(1) of the UK GDPR could only be met in relation to the personal data of one of the data subjects.
Fairness and transparency
124. Given that the Commissioner has concluded that the condition of processing in Article 6(1)(f) of the UK GDPR would permit the processing of certain of the personal data in response to the Applicant’s request, he has concluded that disclosure of that personal data would also be fair and transparent in relation to the data subject
concerned.
125. Given that the Commissioner has concluded that the processing of the personal data of the other data subjects would be unlawful, he is not required to go on to consider whether disclosure of such personal data would otherwise be fair and transparent in relation to the data subjects.
Conclusion on the data protection principles
126. For the reasons set out above, the Commissioner is satisfied that disclosure of the personal data of one of the data subjects would not breach the data protection principle in Article 5(1)(a) of the UK GDPR. The Commissioner therefore finds that these personal data are not exempt from disclosure under section 38(1)(b) of FOISA.
127. However, also for the reasons set out above, the Commissioner is satisfied that disclosure of the personal data of the remaining data subject whose data have been withheld would breach the data protection principle in Article 5(1)(a) of the UK GDPR. The Commissioner therefore finds that these personal data are exempt from disclosure under section 38(1)(b) of FOISA.
Section 25(1) of FOISA – Information otherwise accessible
128. Under section 25(1) of FOISA, information which a requester can reasonably obtain, other than by requesting it under section 1(1) of FOISA, is exempt information. The exemption in section 25 is absolute, in that it is not subject to the public interest test in section 2(1)(b) of FOISA.
129. The information requested by the Applicant in this case included:
For each/any loans, please supply a copy of the loan agreement and the due diligence undertaken prior to granting the loan.
130. During the investigation, when asked by the Commissioner whether it would disclose certain of the withheld information in the “Facility Agreement” which appeared to be publicly available, the Authority sought to rely on the exemption in section 25(1) of FOISA for that information.
Submissions from the Authority
131. The Authority argued that, in so far as any of the information requested by the Applicant is already reasonably obtainable by them, as identified in a question raised by the Commissioner, it wished to rely on section 25(1).
132. The Authority went on to say that, in relying on section 25(1), it would not provide this information in response to the Applicant’s request, on the basis that the Applicant could reasonably obtain it otherwise than by requesting it under section 1(1).
The Commissioner’s conclusions
133. Section 25(1) is one of the few provisions in FOISA that is not “applicant blind”: whether the exemption in section 25(1) applies depends on the ability of the individual requester to be able to obtain the information other than under section 1(1) of FOISA.
134. As noted above, within his information request, the Applicant asked for a copy of the loan agreement and the due diligence undertaken prior to granting the loan.
135. Whilst the Commissioner recognises that certain of the information contained within the “Facility Agreement” can be drawn from information available in the public domain, the Applicant would have to know what specific information this was and how to access it.
136. Furthermore, as the Applicant’s request was for a copy of the loan agreement as a whole, and not just certain parts of it, the Commissioner is unable to accept that information which would fulfil the Applicant’s request is reasonably accessible to them without the need for them to make a request under section 1(1) of FOISA.
137. The Commissioner therefore finds that the Authority was not entitled to rely on the exemption in section 25(1) of FOISA.
Decision
The Commissioner finds that the Authority partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.
The Commissioner finds that by relying on the exemptions in section 33(1)(b), 33(2)(a) and 38(1)(b) of FOISA for withholding certain information from the Applicant, the Authority complied with Part 1.
However, the Commissioner finds that the Authority was not entitled to rely on the exemptions in sections 25(1), 33(1)(b), 33(2)(a) and 38(1)(b) of FOISA for withholding other information from the Applicant and, in doing so, it failed to comply with section 1(1).
The Commissioner therefore requires The Authority to disclose the information highlighted in the marked up versions of the “Project Plant Report” and the “Facility Agreement” which will be provided to the Authority with this decision by 27 November 2023.
Appeal
Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Enforcement
If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply. The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.
Daren Fitzhenry
Scottish Information Commissioner
13 October 2023
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
…
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that –
(a) the provision does not confer absolute exemption; and
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption –
…
(e) in subsection (1) of section 38 –
…
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied.
…
25 Information otherwise accessible
(1) Information which the applicant can reasonably obtain other than by requesting it under section 1(1) is exempt information.
…
33 Commercial interests and the economy
(1) Information is exempt information if-
…
(b) its disclosure under this Act would, or would be likely to, prejudice substantially the commercial interests of any person (including, without prejudice to that generality, a Scottish public authority).
(2) Information is exempt information if its disclosure under this Act would, or would be likely to, prejudice substantially-
(a) the economic interests of the whole or part of the United Kingdom; or
…
38 Personal information
(1) Information is exempt information if it constitutes-
…
(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);
…
(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act -
(a) would contravene any of the data protection principles, or
(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.
…
(5) In this section-
"the data protection principles" means the principles set out in –
(a) Article 5(1) of the UK GDPR, and
(b) section 34(1) of the Data Protection Act 2018;
"data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
…
“personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act);
“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).
(5A) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information, Article 6(1) of the UK GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public
authorities) were omitted.
…
UK General Data Protection Regulation
Article 5 Principles relating to processing of personal data
1 Personal data shall be:
a. processed lawfully, fairly and in a transparent manner in relation to the data subject(“lawfulness, fairness and transparency”)
…
Article 6 Lawfulness of processing
1 Processing shall be lawful only if and to the extent that at least one of the following applies:
…
f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.
Data Protection Act 2018
3 Terms relating to the processing of personal data
…
(2)“Personal data” means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).
(3)“Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to –
(a)an identifier such as a name, an identification number, location data or an online identifier, or
(b)one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
(4) “Processing”, in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as –
…
(d) disclosure by transmission, dissemination or otherwise making available,
…
(5) “Data subject” means the identified or identifiable living individual to whom personal data relate.
…
(10) “The UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal)
Act 2018 (and see section 205(4)).
…
(14) In Parts 5 to 7, except where otherwise provided –
(a) references to the UK GDPR are to the UK GDPR read with Part 2;
…
(c) references to personal data, and the processing of personal data, are to personal data and processing to which Part 2, Part 3 or Part 4 applies;
(d) references to a controller or processor are to a controller or processor in relation to the processing of personal data to which Part 2, Part 3 or Part 4 applies.
…
