Exemptions
Responsibilities of Public Authorities
Scottish public authorities have two main responsibilities under the Scottish Act:
- They must produce a 'publication scheme', which is, in essence, a guide to the information they hold which is publicly available, such as prospectuses, almanacs. Each authority's publication scheme must be approved by the Scottish Commissioner
- They must deal with individual requests for information. Individuals already have the right to access their personal data, held on computer, and in some paper files, under the Data Protection Act 1998. This is known as the 'subject access right'. The Scottish Act permits individuals to access all other types of non-personal information that public authorities hold, subject to specific exemptions in the Scottish Act.
The Freedom of Information (Scotland) Act 2002 ('the Scottish Act') was passed by the Scottish Parliament on 24 April 2002 and received Royal Assent on 28 May 2002. The Scottish Act introduces a general statutory right of access to all types of 'recorded' information of any age held by Scottish public authorities. The UK Act does not apply to public authorities covered by the Scottish legislation. However, UK government departments operating in Scotland and cross-border public authorities (e.g. the Ministry of Defence and the Forestry Commission) are not covered by the Scottish Act but by the UK Act.
The Scottish Act applies only to 'public authorities' and not to private entities. Public authorities are, however, broadly defined in the Scottish Act, and include not only the Scottish Executive and its agencies, Local Authorities, NHS Scotland, the Police and the Scottish Parliament, but also schools, colleges and universities. Private entities - such as spin-off companies - that are wholly owned by a 'public authority' will also be subject to the Scottish Act.
The Scottish Act is enforced by the Scottish Information Commissioner ('the Scottish Commissioner'), a new office that is independent of the office of the UK Information Commissioner ('the UK Commissioner'). The UK Commissioner has responsibility for the implementation and enforcement of the UK Act in England, Wales and Northern Ireland, and for the enforcement of the Data Protection Act 1998 across the entire UK, including Scotland. As a result, the Scottish Commissioner does not have responsibility for enforcing data protection legislation.
Return to contents
The Publication Scheme
As public authorities, Scottish FE and HE institutions are required to adopt and maintain publication schemes, which must be approved by the Scottish Commissioner. Such schemes must set out:
- The classes of information the institution publishes
- The manner in which the information is published
- Details of any charges
The Scottish Act does not define what a 'class' should contain, leaving it up to public authorities to create their own formulation. The Scottish Executive Freedom of Information Implementation Group noted in their paper on publication schemes that the UK Commissioner has published extensive guidance on the preparation and content of publication schemes to be prepared under the UK Act, and that the Scottish Commissioner will also prepare advice in due course.
The UK Commissioner's guidance on this issue for the UK Act is contained in a document entitled Publication Schemes: Guidance and Methodology. Given the very different nature of the various public authorities, this guidance is necessarily rather general. However, several key points can be elicited:
- A general definition of a class is 'a group of information having one or more common characteristics'
- Including a 'class' of information within a scheme commits the public authority to publishing the information that falls within it
- A class will include as much or as little information as it defines - for example, a class might consist of a single document
- A clear class definition is advised to ensure that information that might be considered to fall within the class, but which the public authority feels should be exempt, is clearly shown to be excluded from the class
There is no prescribed manner of publication for material described in the publication scheme. Once the public authority has stated that it will publish certain information, however, it must also state the form in which it intends to publish the information.
Under the Scottish Act there are no prescribed charges for information contained in a public authority's publication scheme. A public authority may choose not to charge for any information, to charge for all of it, or to charge for selected information. The publication scheme does not have to set out precise charges, merely to indicate which material will be subject to charges.
The Scottish Act largely follows the UK Act with regard to the nature of publication schemes, but differs with regard to the public interest test that the public authority must consider when assessing the content of its publication scheme. The Scottish Act explicitly refers to two categories of information where Scottish public authorities must pay particular attention to the public interest:
- Information that relates to the provision of services by a public authority, the cost to a public authority of providing them or the standards attained by services so provided
- Information that consists of facts, or analyses, on the basis of which decisions of importance to the public have been made by a public authority
Return to contents
Approval and maintenance of the Publication Scheme
The mechanism for approval of publication schemes by the Scottish Commissioner and the proposed timetable for approvals to take place have been published. The Scottish Executive has indicated it plans to have fully implemented the Scottish Act by 1 January 2005. Publication schemes from FE and HE will have to be submitted by 31 May 2004.
Once a scheme is approved, it is in theory open to the public authority to decide how to make it available to the public. For example, it could simply publish the scheme on its website. In this case, however, the institution would still have to take into account the potential requirements of those who do not have access to the Internet, or who might require the scheme in an alternative form, such as in a foreign language or in Braille. The Scottish Executive Freedom of Information Implementation Group has stated that paper versions of an authority's publication scheme should be made available. Publication schemes will be reviewed periodically, and the initial period of approval is likely to be four years.
As information included in the publication scheme is exempt from requests for information, it may be in an institution's interest to consider including a wider range of documentation in its publication scheme than was previously considered necessary to make public. An institutional information database or series of databases accessible via a web-based front-end could allow the inclusion of large amounts of material in the publication scheme at low cost, and allow individuals to download information. With such a database system, those responsible for Scottish Act compliance can ensure that demand for the material in various forms, such as foreign languages and Braille, can be met.
Schemes may either be designed for particular bodies or be generic. Model schemes, for groups of similar bodies, such as FE and HE institutions, may also be approved by the Scottish Commissioner.
Universities Scotland had established an FoIA working group to provide a model publication scheme for FE and HE in Scotland. A model publication scheme has been produced for FE and HE in England, Wales and Northern Ireland. 
Return to contents
Requests for information
Although implementation dates for the Scottish Act have yet to be disclosed, it is envisaged that by 1 January 2005, at the latest, any individual will be able make a request to a Scottish public authority for information. The individual making the request does not have to be the subject of the information requested, or be affected by its holding or use. For example, on the basis of experience in other countries with similar Freedom of Information legislation, the media are likely to use the individual request procedure to obtain information for use in broadcasting or publication. However, any request for information regarding a third party must not breach the Data Protection Principles in terms of the Data Protection Act 1998.
The Scottish Act gives applicants two related rights:
- To be told whether the information is held by the institution
- To receive the information, where possible in the manner requested, e.g. as a copy or summary, or in paper or electronic format. An individual may also request to inspect records in person
Requests for information made under the Scottish Act must be made in writing (which includes electronic communications such as fax and email), or in another form with some permanency capable of being used for subsequent reference (such as a recording made on audio or video tape). The request must contain details of the applicant and the information that is being sought. An institution may ask for further information that it reasonably requires to identify and locate the information requested. Applicants will not be required to mention the Scottish Act when making a request for information. In responding to a request for information, institutions will be obliged to provide information recorded both before and after the Scottish Act was passed.
Requests for information must be dealt with promptly, and the Scottish Act sets a maximum time frame for response of 20 working days. This is rather shorter than the 40-day maximum provided for subject access requests under the Data Protection Act 1998. In certain circumstances, the Keeper of the Records of Scotland will have 30 working days to respond to requests. A fee may be charged for provision of requested information. Permissible fees will be calculated according to the Fees Regulations, which will come into force at, or prior to, the time of the implementation of the Act. Where a fee is required, the 20 working days will be extended by up to three months until the fee is paid.
There is no obligation on public authorities to comply with 'vexatious' requests, or 'repeated requests', if they have recently responded to an identical or substantially similar request from the same person. There is, however, a duty to provide advice and assistance to anyone making a request. This duty should be documented in the authority's publication scheme.
The Scottish Act requires the Scottish Ministers to issue a Code of Practice setting out practices public authorities should follow when dealing with requests for information. The draft Code of Practice includes matters such as the advice and assistance that should be given to applicants, and procedures for dealing with complaints. This is available from the Scottish Executive's website.
Return to contents
Enforcement
A person who has made a request for information may apply to the Scottish Commissioner for a decision as to whether the request has been dealt with according to the Scottish Act. In response, the Scottish Commissioner may serve a decision notice on the public authority and applicant, setting out any steps that are required for compliance with the Act.
The Scottish Commissioner also has the power to serve an information notice on a public authority requesting further information in relation to the matter. The Scottish Commissioner also has the power to negotiate between both parties in an attempt to effect settlement. In certain circumstances, the Scottish Commissioner may issue a decision or enforcement notice requiring disclosure of information in the public interest. When serving a notice of any kind, the Scottish Commissioner must include an explanation of the appeals mechanism. Where a decision notice has been served, either the complainant or the public authority may appeal, on points of law, against the decision to the Court of Session. Unlike the UK Act, there is no executive override provision in the Scottish Act, except with regard to a decision or enforcement notice given to the Scottish Administration by the Scottish Commissioner. There is also no equivalent of the UK Information Tribunal.
Return to contents
Records management
The Act requires the Scottish Ministers, after consultation with the Scottish Commissioner and the Keeper of the Records of Scotland, to issue a Code of Practice setting out how public authorities should keep, manage and destroy their records. The draft Code of Practice is designed to establish standards of good practice in relation to record-keeping. Good practice would increase the efficiency with which information can be located and retrieved by authorities in response to requests for information. The Code of Practice is available from the Scottish Executive's website.
Return to contents
Freedom of Information and Data Protection
Data protection is a reserved matter and responsibility for enforcement of the Data Protection Act 1998 lies with the UK Information Commissioner. The Scottish Commissioner does not have any responsibility for enforcing data protection legislation. Both the Scottish Act and the Data Protection Act 1998 relate to aspects of information policy. They overlap where personal information is considered for disclosure.
The UK Act makes a number of amendments to the Data Protection Act 1998. One of the most significant is that the definition of 'data' is extended, as far as public authorities are concerned, to cover all personal information held. This includes 'structured' and 'unstructured' manual records. However, only the right of subject access, the right to correct and limited compensation rights will apply to the new category of unstructured data. This amendment will be extended to Scottish public authorities by means of an order under s.104 of the Scotland Act 1998 following full implementation of the Scottish Freedom of Information regime.
Access rights which already exist under the Data Protection Act 1998 will therefore be extended in terms of the UK Act. A request by an individual for information about himself/herself will be exempt under the Scottish Act and will continue to be handled as a 'subject access request' under the Data Protection Act 1998.
Where an applicant specifically requests information about a third party, or where responding to a request would involve the disclosure of personal information about a third party, the request falls within the remit of the Scottish Act. However, the authority must apply the Data Protection Principles when considering the disclosure of information relating to living individuals. An authority must not disclose third-party information if to do so would mean breaching one of the Principles.
Return to contents
Exemptions
The Scottish Act creates a general right of access to information held by public bodies, but also sets out 17 exemptions where that right is either disapplied or qualified. This is a smaller number of exceptions than found in the UK Act. The exemptions relate to issues such as national security, law enforcement, commercial interests, and data protection. In particular, information is exempt from the Scottish Act if it is accessible to the applicant by other means, for example, from the Funding Councils or Department for Education. Therefore information already accessible under an institution's publication scheme need not be provided in response to an individual request.
Apart from vexatious or repeated requests, to which an institution need not respond, there are two general categories of exemption: those where, even though an exemption exists, an institution has a duty to consider whether disclosure is required in the public interest, and those where there is no duty to consider the public interest.
The 'public interest' test in s.2(1) of the Scottish Act requires an institution to consider whether the public interest in withholding the exempt information outweighs the public interest in releasing it, by considering the circumstances of each particular case and the exemption that covers the information. The balance will lie in favour of disclosure, because information may only be withheld if the public interest in withholding it is greater than the public interest in releasing it, for example where disclosure of institutional information would harm a police investigation.
Return to contents
Exemptions where the public interest test applies
Exemptions where the institution has a duty to consider whether disclosure is required in the public interest are listed below. Where an institution considers that the public interest in withholding the information requested outweighs the public interest in releasing it, the institution must inform the applicant of its reasons, unless providing the reasoning would effectively mean releasing the exempt information.
| s27 |
Information intended for future publication |
| s28 |
Relations within the United Kingdom |
| s29 |
Formulation of Scottish Administration Policy |
| s30 |
Prejudice to effective conduct of public affairs |
| s31 |
National security and defence |
| s32 |
International relations |
| s33 |
Commercial interests and the economy |
| s34 |
Investigations by Scottish public authorities and proceedings arising out of such investigations |
| s35 |
Law enforcement |
| s36 (1) |
Confidentiality |
| s38 (1)(b) |
Personal information 1 |
| s39 |
Health, safety and the environment |
| s40 |
Audit functions |
| s41 |
Communications with her Majesty and honours |
1 If the institution believes that disclosure would not breach any of the data protection principles, and is not personal census information, or a deceased person's health record, but the individual who is the subject of the information has properly served notice under s.10 DPA 1998 that disclosure would cause unwarranted substantial damage or distress, or the individual who is the subject of the information would not have a right to know about it or a right of access to it under the DPA 1998, there is no absolute exemption, and the institution should consider the public interest in deciding whether to release the information
Return to contents
Absolute exemptions
These are the exemptions where, if the exemption applies, it is not necessary to go on to consider disclosure in the public interest.
| s25 |
Information accessible to applicant by other means |
| s26 |
Information of which disclosure is prohibited by law |
| s36 (2) |
Information provided in confidence |
| s37 |
Court records, etc |
s38 (1)
(a),(b),(c) |
Personal information 2 |
2 There is an absolute exemption from the provisions of the Scottish Act if an applicant making a request for information under the Scottish Act is the subject of the information requested and they already have the right of 'subject access' under the Data Protection Act 1998, or if the information is personal census information, or a deceased person's health record. There is also an exemption from the provisions of the Scottish Act if the information requested under the Scottish Act concerns a third party and disclosure by the institution would breach one of the eight Data Protection Principles.
Return to contents
Whole category exemptions
These are exemptions where the institution concerned must consider whether particular information falls within a particular category (or class) of information, such as:
| s29 |
Formulation of Scottish Administration Policy |
| s32 (2) |
International relations - confidential information |
| s33 (1)(a) |
Commercial interests and the economy - trade secrets |
| s34 |
Investigations by Scottish public authorities and proceedings
arising out of such investigations |
| s36 |
Confidentiality |
| s37 |
Court records, etc |
| s38 |
Personal information |
| s39 (2) |
Health, safety and the environment |
| s41 |
Communications with her Majesty and honours |
If information falls into the category described in one of these exemptions, the institution is not required to release it unless the public interest so dictates. There is no requirement to consider whether releasing the particular information requested would substantially prejudice a particular activity or interest.
Return to contents
Prejudice Test Exemptions
These are exemptions where the institution concerned must consider whether disclosure of particular information would, or would be likely to, cause 'substantial prejudice'. It should be noted that the Scottish Act is thus stricter than the UK Act, which requires that the disclosure of particular information would, or would be likely to, cause 'prejudice'. Scottish public authorities may thus find themselves required to reach a higher standard than authorities in England, Wales and Northern Ireland before availing themselves of an exemption.
| s27 (2) |
Information intended for future publication - research
information |
| s28 |
Relations within the United Kingdom |
| s30 |
Prejudice to effective conduct of public affairs |
| s31 |
National security and defence |
| s32 (1) |
International relations |
| s33 (1)(b) |
Commercial interests and the economy |
| s33 (2) |
Commercial interests and the economy |
| s35 |
Law enforcement |
| s39 (1) |
Health, safety and the environment |
| s40 |
Audit functions |
For these exemptions, information only becomes exempt if disclosing it would, or would be likely to, substantially prejudice the activity or interest described in the exemption.
Return to contents
Applying exemptions
An institution wishing to rely upon a specific exemption must therefore ask itself a series of questions:
- Is the information potentially covered by an exemption?
- Does the exemption apply to all or part of the information requested?
- If an exemption does apply, does it require consideration of whether disclosure should be made in the public interest, irrespective of the exemption?
- If an exemption does apply, does it require consideration of whether disclosure would be substantially prejudicial to a particular activity or interest?
The Scottish Act does not necessarily prevent public authorities releasing information in cases where exemptions apply. Public authorities may decide that they will release information although they could successfully argue that it was exempt.
FE and HE institutions are advised to read the exemptions with care when determining whether they can be relied on. Only the information to which an exemption applies can be withheld. For example, if a requested document contains some exempt information, only those specific pieces of exempt information can be withheld and the rest of the document has to be released.
Where an institution decides an exemption applies and withholds information, it must give reasons for its decision and inform the applicant of his right to complain to the Scottish Commissioner. Where an exemption applies, but an institution is then required to release the information by the Scottish Commissioner because it is in the public interest to do so, it must disclose the information requested 'within a reasonable time'.
Guidance as to how exemptions might apply in particular circumstances will be developed by the office of the Scottish Commissioner over time and in the light of case by case experience.
Return to contents
Timetable
As noted above, the Scottish Executive intends the Scottish Act to be brought fully into force by 1 January 2005 at the latest. It is likely that the duty to adopt a publication scheme will come into force first. All public authorities will be required to deal with individual requests when the general right of access to information held by public authorities comes into force, again, in theory, by 1 January 2005.
Return to contents
Further information
Corresponding briefing paper
Return to contents
There is a JISCmail mailing list set up to discuss issues relating the Freedom of Information Act. To join this list, please send the message "join freedom-of-information firstname lastname" to: jiscmail@jiscmail.ac.uk
About this paper
This paper is one of a pair, and is aimed at those responsible for implementation and practice. A corresponding briefing paper, providing an outline of the FoIA aimed at senior managers and those responsible for strategy and policy, is also available. Copies are distributed by and available from JISC Marketing and Communications.
The information in these papers is taken from a much longer paper on the FoIA commissioned by the JISC Legal Information Service. JISC Legal Information Service was set up in response to the concern, in FE and HE, about the increasing impact of new legislation on ICT and related areas. JISC Legal Information Service is a consortium of two university 'centres' and a firm of solicitors. The service provides information through its website, discussion group(s), email, workshops and other appropriate dissemination channels. It carries out research, commissions work from academics, practitioners and users, and monitors cases and legislation. JISC Legal Information Service cannot give professional legal advice but aims to provide information and alert institutions to the fact that such advice may be required. The service focuses on areas such as Intellectual Property, Data Protection, Human Rights and ISP liability and does not attempt to cover areas such as employment law. www.jisclegal.ac.uk
Return to contents