Access to information rights in Scotland: consultation

3. Agility of the regime - maintaining and strengthening access to information rights in the context of varied models of service delivery

A key concern of the Committee was around whether the Act was sufficiently 'nimble' to adapt to the different ways in which public services are delivered. Central to this was the concern that 'outsourcing' was diluting the information rights of the public.

On its most expansive meaning, the term 'outsourcing' refers to any instance in which a public authority enters a contract with an external provider for the provision of a service, rather than tasking its own directly employed staff with the provision of that service. On that definition many examples of 'outsourcing' consist merely of routine, and uncontentious procurement decisions by public authorities.

This observation underlines the need for a proportionate approach when considering the impact of outsourcing. Outsourcing is most likely to raise concerns about potential weakening of access to information rights when the service outsourced is either:

• a public service: i.e. the direct provision of a service to members of the public, for which the authority itself is commonly regarded as having ultimate responsibility
• an ancillary service, previously delivered in house: i.e. an internal service within an authority which it has traditionally tasked its own directly employed officers or staff to deliver, but has now contracted to an external provider

The delivery of health services by NHS Boards and education services by local authorities would be clear examples of public services. The delivery of cleaning and maintenance services within the offices of a public authority might be an example of an ancillary service.

The impact of outsourcing on the realisation of access to information rights in a UK context was considered by the (UK) Information Commissioner in her report to the UK Parliament, Outsourcing Oversight?: the case for reforming access to information law in 2019.[6] The UK Cabinet Office responded to that report on 24 April 2019.[7]

The current regime within Scotland contains features intended to allow for concerns about outsourcing to be addressed. These fall into two principle categories:

a. the Scottish Ministers' powers to extend and maintain coverage of FOISA; and

b. mitigations against loss of information rights through guidance and contractual arrangements.

3.1 The Scottish Ministers' powers to extend and maintain coverage of FOISA

Section 5(2)(b) of FOISA grants Scottish Ministers the power to designate persons or bodies that:

i. appear to the Scottish Ministers to exercise functions of a public nature; or

ii. provide, under a contract with a Scottish public authority, a service whose provision is a function of that authority.

Before using the power the Scottish Ministers have a statutory obligation to consult with the organisations to be designated, or their representatives. The powers have been used in the past to extend coverage of the Act in significant ways. In 2013 the Scottish Ministers made an order extending FOISA to arms-length organisations delivering culture and leisure services on behalf of local authorities. In 2016 a further order extended to private prisons, independent special schools, grant aided schools, providers of secure accommodation and Scottish Health Innovations Ltd. Most recently, in 2019 a section 5 order extended coverage of FOISA to all registered social landlords and their subsidiaries.

In 2019 also the Scottish Government ran a consultation exercise on the future use of the section 5 power.[8] Our analysis of that consultation was published in March 2020, shortly prior to the first coronavirus lockdown.[9]

The Scottish Government recognises the Committee's concern about whether the section 5 power is a sufficient mechanism to ensure that coverage of the Act keeps pace with change. Nevertheless, it seems clear that the power has played a significant role in maintaining and broadening coverage of the Act. In her 2019 report the (UK) Information Commissioner recognised that the section 5 provisions have been used more actively in Scotland than the equivalent provisions under the UK Act.[10]

In its report the Committee proposed that it should be an 'overarching principle' that information held by non-public sector bodies which relates to the delivery of public services and/or the spending of public funds should be accessible under Freedom of Information legislation. However, the Committee also recognised the need for a proportionate approach to extension of FOISA.

The Committee supported in principle the use of a 'factors based approach' to guide decisions about extension - taking account of factors such as the extent to which a body is delivering a public function, the level of public interest in the relevant function and the cost to the public purse associated with the function.

As set out in our 2019 consultation paper this is, broadly speaking, the approach we have previously taken to the use of the section 5 power,[11] but we recognise there could be scope to increase the rigour and consistency of the approach.

In addition to the section 5 power, the Scottish Ministers also have a power under section 4 of the Act, to add further entities to schedule 1 of FOISA, as Scottish public authorities in their own right. This is a more limited power, being applicable only to bodies which meet the Scotland Act 1998 definition of a Scottish public authority.[12] However, it is also a key tool for ensuring coverage of the Act is kept up to date.

3.2 Mitigations through guidance and contractual arrangements

Section 60 of FOISA requires the Scottish Ministers to issue a code of practice for Scottish public authorities regarding the discharge of their functions under the Act. FOISA mandates the Scottish Ministers to revise the code from time to time.

The current iteration of the Section 60 Code includes advice intended to mitigate the risks that the outsourcing of services may pose to information rights:

Where a public authority is considering outsourcing any of its functions it should take steps to ensure that there is no resulting reduction in the public's rights to access information through requests and proactive publication. This may be by outsourcing to a wholly-owned company which will be subject to the regimes. Where this is not possible, the authority must take steps to ensure public access to information relating to the functions which have been outsourced, as set out in part 2, section 8 of this Code (particularly information about performance and finances). This might be through the provisions of any contract in place.[13]

Part 2, section 8 of the Section 60 Code sets out detailed guidance on the handling of procurement-related and contractual information by Scottish public authorities. This includes guidance on the categories of information which authorities should ensure is available and the basis on which commercially sensitive or confidential information might sometimes be legitimately withheld under FOISA or the EIRs.

Paragraph 8.4.10 of the Code stipulates that disclosure provisions should be included within contracts. This stipulation is specifically in relation to information provided to the public authority by the contractor during the completion phase of the contract. However, the guidance indicates that in some instances this 'may also be expanded to include the disclosing of information by the contractor'.

Whether information held by contractors is subject to FOISA and the EIRs will ultimately depend on whether that information is considered to be held by the contractor 'on behalf of' the authority in terms of section 3(2)(b) of FOISA or regulation 2(2)(b) of the EIRs. This is an issue upon which the Commissioner may occasionally be called to make determination.

A previous decision of the Commissioner in 2013 considered this issue in relation to a request for information made under the EIRs.[14] In that instance the Commissioner decided that information held by a contractor was indeed 'held on behalf' of the contracting authority. However, this does not set a precedent for all future cases.

Whether information held by a contractor is considered to be 'held on behalf' of the contracting public authority may depend on various factors relating to the nature of the relationship between the two and the nature of the service provided. The detail (or lack) of any explicit contractual provisions may not be the only relevant factor in making such determinations. Nevertheless, clear contractual provisions specifying ownership of information, and the contractor's obligations to provide information to the authority for the purposes of responding to requests, are likely to be helpful in providing clarity.

3.3 Transparency in public procurement

These matters should be seen in the context of the public sector's wider commitment to transparency in matters of contracting and procurement. Procurement legislation requires contract opportunities exceeding £50,000 in value for the provision of goods and services and exceeding £2m in value for construction projects to be advertised through Public Contracts Scotland. This ensures public access to a range of information about each opportunity including Invitation to Tender information, the terms and conditions that will apply to any resulting contract with the supplier, specification and technical requirements, the award criteria etc.

The Procurement Reform (Scotland) Act 2014 requires a wide range of public authorities to publish and maintain a public contracts register setting out such details as the name of the contractor, the subject matter of the contract and the estimated value of the contract. The Public Services Reform (Scotland) Act 2010 also requires public authorities to publish information about all payments in excess of £25,000.

In addition, the Scottish Information Commissioner's Model Publication Scheme requires all public authorities subject to FOISA to proactively publish information regarding how the authority procures goods and services from external providers.

3.4 Use of access to information rights to obtain additional information

Whenever a service is provided by an external provider under contract on behalf of a public authority, it is to be expected that substantial, detailed information regarding the delivery of that service will be provided to the authority under the terms of the agreement, to allow the delivery of the service and the performance of the contractor to be monitored by the authority. There is no ambiguity whatever that such information held by the authority is subject to FOISA and the EIRs. Any ambiguity about ownership of information for the purposes of FOISA and the EIRs can relate only to whatever information about the delivery of the service is held only by the contractor, and not directly by the public authority itself.

This point does not minimise the importance of access to information rights in relation to services delivered under contract. Nevertheless, it is important to set the issue in some perspective.

To take a robust view on the need for further development of the information rights landscape in this area we wish to gather further evidence regarding the true impact of outsourcing on access to information rights. This consultation exercise provides an opportunity to do so. As well as seeking written responses to the questions below regarding the impact of outsourcing, we will also engage proactively with journalists, activists, researchers and organisations representing civil society as well as with public authorities and third and private sector providers to seek views and further evidence on this issue.

The Scottish Government is committed to assessing the business and regulatory impact of its policies. The development of any new policy approach to information held by contractors would need to take full account of the impact on those contractors and on contracting public authorities. We would lay particular stress on the need to consider any impacts on small or medium sized organisations. Making these assessments will require engagement with public authorities and their contractors.

Question 1(a)

Do you or your organisation have direct experience of access to information rights operating in relation to 'outsourced' services?

• Yes
• No
• Not sure

Question 1(b)

If 'yes' how would you rate your experience of access to information rights in relation to such services?

• Not a problem
• Somewhat problematic
• Very problematic

Please provide any detail or context that you can, regarding your experience:

Question 2(a)

If seeking information about a public service delivered under contract by an external provider, how confident would you be that a member of the public could use their access to information rights to seek the relevant information, by making a request directly to the public authority on whose behalf the service is being delivered?

[By 'public service' we mean a service which is delivered directly to members of the public, and whose provision would commonly be understood to be the responsibility of the public authority]

• Very confident
• Somewhat confident
• Somewhat doubtful
• Very doubtful
• Not sure

Please provide any reasons for your answer:

Question 2(b)

If seeking information about an ancillary service previously delivered in house - but now delivered under contract by an external provider - how confident would you be that a member of the public could use their access to information rights to seek the relevant information, by making a request directly to the public authority to which the service is being delivered?

[By 'ancillary service previously delivered in house' we mean an internal service provided to an authority which it has traditionally tasked its own directly employed officers or staff to deliver, but has now contracted to an external provider ].

• Very confident
• Somewhat confident
• Somewhat doubtful
• Very doubtful
• Not sure

Please provide any reasons for your answer:

3.5 Addressing concerns about agility of the regime and loss of information rights, within the current statutory framework

To consider options for addressing concerns about the agility of the regime within the current statutory framework it may be helpful to begin with considering the existing mitigations outlined in the section above.

Future use of the Scottish Ministers' section 4 and 5 powers

In 2019 the Scottish Government ran a consultation exercise on the future use of the section 5 power. Our analysis of that consultation was published in March 2020, shortly prior to the first coronavirus lockdown.

In our consultation analysis we indicated that we would bring forward a paper setting out the Scottish Government's approach to the future use of the section 5 power. That piece of work was subsequently delayed by the impact of the coronavirus outbreak, and is still in development. However, it would be our hope that by setting out a clearer strategic approach to the future use of the power we can go some way to addressing the Committee's concerns about the usefulness of the power to ensure coverage of the Act keeps pace with developments in models of public service delivery.

In 2015 the former Commissioner published her Special Report: FOI 10 years on: Are the right organisations covered?[15]. Many of the areas raised in that report informed the use of the section 5 power over subsequent years e.g. in relation to arms-length organisations, private prisons and registered social landlords.

In 2019, the current Commissioner provided a detailed submission to the Scottish Government's consultation on future use of the section 5 power. We have committed to consider fully all the areas for extension identified by the Commissioner:

• health and social care services provided under contract to Scottish public authorities
• services provided under PFI/PPP/NPD contract arrangements
• HubCos and services provided under contract through the HubCo model
• transport services provided on behalf of Scottish public authorities

The Scottish Government will set out its proposed approach to each of these areas in due course. We will also set out a strategy for keeping the use of the powers under review going forward.

Strengthening mitigations through guidance and contractual arrangements

Greater assurance around information rights might also be achieved by providing stronger guidance both to contractors and contracting authorities regarding when, under the existing regime, information held by a contractor ought to be considered 'held on behalf' of the relevant contracting public authority for the purposes of FOISA and the EIRs. .

One obvious vehicle for providing refreshed guidance would be the Section 60 Code. We would not envisage that the Code itself would provide detailed guidance on the drafting of contracts. However, there might be scope to revise the Code in order to provide a clearer steer regarding the circumstances in which information held by a contractor is likely to be considered 'held' by the contracting authority in terms of section 3(2)(b) of FOISA or regulation 2(2)(b) of the EIRs. Revised guidance might therefore make explicit that in such circumstances the authority should consider that it is required to obtain the relevant information from its contractor when it has received a request for the information.

It may be noted that the Public Records (Scotland) Act 2011 (PRSA) makes special provision for records held by contractors delivering services considered to be a 'function' of the contracting authority. Section 3(1) of PRSA provides that records held by a contractor carrying out an authority's functions are to be considered part of the public records of that authority.[16]

However, it should be acknowledged that concerns raised by stakeholders about the impact of 'outsourcing' on access to information rights have sometimes also related to services which might be considered 'ancillary' to the functions of the relevant authority rather than as constituting public functions in their own right. For example, in the PAPLS evidence sessions witnesses cited the case of outsourcing of ICT services by a local authority.[17] The point was made by witnesses to the Committee that the delivery of ancillary services can involve large scale expenditure of public funds, and that the transference of such ancillary functions from 'in house' providers to external providers may place outside the scope of FOISA and the EIRs some information regarding the delivery of the ancillary service and - by extension - the deployment of those public funds.

As noted in the previous section such concerns should be seen in perspective, given the substantial amount of information about such contracts, and the services delivered under them, which is likely to be either in the public domain, or able to be requested from the contracting authority under FOISA or the EIRs. Nevertheless, the concern is a legitimate one. In developing any revised approaches to contracting or guidance for authorities, consideration would need to be given to how, and whether, to make distinction between 'public' and 'ancillary' services.

Whilst ancillary services can be very significant in terms of their cost to the public purse and may play a critical role in a public authority's delivery of its functions, ancillary services can also include functions which are only indirectly related to an authority's core functions e.g. the cleaning and maintenance of office space. It seems to the Scottish Government that whether or not a hard distinction is drawn between 'public' and 'ancillary' services delivered under contract, there is a need to be mindful of proportionality in any approach taken.

Question 3(a)

Would you welcome further assurance about the future use of the Scottish Government's section 5 power to maintain and extend access to information rights in Scotland?

• Yes
• No
• Not sure

Question 3(b)

What, if anything, would provide you with greater assurance that the power can be used consistently to ensure coverage of the Act can keep pace with any changes in the delivery of public services?

[by 'public services' we mean any service provided directly to members of the public, for which the authority itself is commonly regarded as having ultimate responsibility]:

Question 4(a)

Would stronger guidance for Scottish public authorities about the status of information held by contractors, give you greater confidence that information about outsourced services remains accessible under FOISA and the EIRs, where this relates to the provision of a public service? i.e. the direct provision of a service to members of the public, for which the authority itself is commonly regarded as having ultimate responsibility.

• Yes
• No
• Not sure

Please give any reasons for your answer:

Question 4(b)

Would stronger guidance for Scottish public authorities about the status of information held by contractors, give you greater confidence that information about outsourced services remains accessible under FOISA and the EIRs where this relates to the provision of an ancillary service, previously delivered in house? i.e. an internal service provided to an authority which it has traditionally tasked its own directly employed officers or staff to deliver, but has now contracted to an external provider.

• Yes
• No
• Not sure

Question 5

Do you agree that it is relevant to make a distinction in guidance between public services (i.e. those provided directly to members of the public, for which the authority itself is commonly regarded as having ultimate responsibility) and ancillary services (i.e. internal services provided to an authority which it has traditionally tasked its own directly employed officers or staff to deliver, but has now contracted to an external provider)?

• Yes
• No
• Not sure

Please provide any thoughts you may have on the relevance, appropriateness and implications of such a distinction:

3.6 Assessing the need for primary legislation

The 'Gateway Clause' proposal

In its report the Committee expressed its view that 'the current legislation is insufficiently nimble to keep pace with the changing nature of the public sector landscape', and made the general recommendation that changes to FOISA itself are required to address this. However, as noted above the Committee also recognised the need to take a proportionate approach.

The Committee indicated that it was attracted to the concept of a 'gateway clause' for bringing bodies within the scope of FOISA automatically on the basis of their functions or receipt of public funds:

11. The Committee is also attracted to the idea of the legislation being amended to introduce a "gateway clause" which brings bodies carrying out public functions or in receipt of significant public funds within the scope of FOISA in relation to those elements of the organisation concerned with the provision of those services or spending of such funds. As such, the Committee recommends that the Scottish Government consults on amending FOISA to introduce a mechanism by which relevant elements of non-public sector bodies would automatically fall within the scope of FOISA if they fulfilled certain criteria relating to the provision of public services or functions and/or receipt of significant public funds.

The Committee thereby suggested two principal bases on which organisations might be designated automatically via the operation of a 'gateway clause':

1. the body fulfils particular criteria relating to the provision of public services

2. the body is in receipt of significant public funds

A 'gateway clause' could be constructed around either one of the above bases. Alternatively, it could refer to both bases, stipulating that organisations are to be subject to FOISA if they fulfil a set criteria under either basis, or that criteria under both bases would need to be fulfilled. Regardless of which of these options were deemed most favourable, it would be necessary to set clear criteria to define the bases for automatic designation.

In the Scottish Government's response to the Committee's report we highlighted what we see as significant challenges which would be associated with the 'gateway clause' approach.[18] The principal challenge is in constructing a provision which would be sufficiently broad to add meaningfully to the coverage of the legislation but which would also provide clarity about which organisations were covered by the Act.

There is a fundamental tension between these two goals. As our response to the Committee noted a similar issue is already present in the operation of section 3(1)(b) and section 6 of FOISA, which together provide that any company wholly owned by a Scottish public authority is automatically subject to FOISA. This means that companies may fall in or out of FOISA as a result of changes in ownership arrangements. Companies subject to the legislation can also be created or wound up at any time.

Consequently, it is very difficult to state definitively at any given time which companies are subject to FOISA by virtue of being wholly owned by Scottish public authorities. A 'gateway clause' would seem to raise the prospect of introducing similar uncertainty about the FOISA status of a much wider range of organisations.

In the 2019 Scottish Government paper, Freedom of Information International Review: Scope of Bodies Included, Douglas Jack noted research indicating that those jurisdictions in which access to information laws rely principally on a defined list of bodies subject to the legislation - as opposed to a statutory definition - generally have stronger records on compliance. The paper suggests that this likely to be because of the greater certainty provided by a defined list.[19]

The Scottish Government would also have concerns about a 'gateway clause' in terms of its potential impact on the third and private sector partners of public authorities, particularly where these are small or medium-sized organisations. The Scottish Government has a clear policy commitment to reduce barriers for small and medium-sized enterprises (SMEs) to doing business with the public sector in Scotland. We would have concerns about the impact of any measure which might lead to uncertainty on the part of SMEs bidding for public contracts regarding whether fulfilment of the relevant contract would bestow duties on the SME as a public authority under FOISA in its own right.

We would have similar concerns in regard to the impact on third sector partners of public authorities, particularly where these are organisations of small or medium size. Under current arrangements SMEs, third sector partners or other organisations fulfilling public contracts may sometimes have obligations to assist their contracting public authority with fulfilling its own FOI obligations. However, that is quite a different matter from the organisation becoming a public authority subject to FOISA in its own right with the full set of statutory obligations which accompany such a designation.

There are examples of SMEs and third sector bodies which are already subject to the legislation as public authorities in their own right – notably in the primary care, educational and social housing sectors. Nevertheless, the Scottish Government regards proportionality as an important consideration in decisions about extension of FOISA and we would have concerns about any approach which could automatically bestow public authority status on small or medium sized organisations, without the requirement for consultation with the relevant sector as at present.

We consider therefore that if a gateway clause provision were to be included in legislation there would be merit in considering an exclusion for SMEs and/or third sector organisations, so that the requirement to consult with them prior to any designation would be retained. However, we acknowledge also that any differential treatment of SMEs or third sector organisations may add to the complexity of the provision and could exacerbate the uncertainty associated with any gateway clause.

As noted in the introduction to this paper, it has been the longstanding position of the Scottish Government that we seek to operate within FOISA rather than proposing significant alterations to it. This is because we regard the current legislative regime as fundamentally sound and as working well. The introduction of a gateway clause, unless very narrowly defined, would represent a significant departure from the approach originally taken in the legislation. The Scottish Government is yet to be convinced that such a significant departure would be beneficial, but we remain open to considering it further, subject to assurance that it could be capable of operating in a clear and proportionate way.

3.7 Alternative legislative approaches

This consultation seeks to gather a range of views on the necessity of, and possible approaches to, future legislative change. At Question 9 below we have provided an open opportunity for respondents to advance any views on alternatives to the 'gateway clause' proposal advanced by the Committee.

However, it seems to the Scottish Government that if primary legislation to improve the agility of the regime to developments in the public service landscape were considered necessary, then the development of alternative approaches to reform might begin by considering how the existing features - intended to address concerns about the impact of outsourcing and ensure the agility of the legislation - might be strengthened.

Whilst the Scottish Government is not, at the current time, persuaded of the necessity of new primary legislation in this area, we have nevertheless sketched out in broad terms some possible alternative approaches. We hope that this will help to inform responses to this consultation.

3.8 Broadening of the section 5 extension power

As discussed above, the current power to extend coverage of FOISA to new entities requires the Scottish Ministers to identify either a 'function of a public nature' being exercised or a service being delivered under contract which can be considered a 'function' of the contracting authority. Either way, the concept of public function is central to the operation of the current section 5 power.

This constrains the use of the power in some circumstances, since it is not sufficient merely to demonstrate that a particular organisation is in receipt of significant public funds or has a long term, high value contract with a public authority. If designating under section 5(2)(a) Scottish Ministers require to be able to demonstrate that the function for which the relevant body is to be designated is in fact 'public' in nature. If designating under section 5(2)(b) it is necessary to demonstrate that the service being provided by the contracted body is in fact a 'function' of the contracting public authority. In practice, this has usually been taken to mean that the service is part of the statutory functions of the contracting public authority.

Broadening the basis on which the power can be exercised, so as to move away from a strictly 'public function' based approach might give greater latitude to extend FOISA to other bodies. In its report the Committee specifically raised the issue of whether being in 'receipt of significant public funds' ought in itself to serve as a basis for designation under FOISA. Currently, extent of public funding is one of the factors used by the Scottish Ministers when considering the application of the existing section 5 power. However, it is not a basis for designation in its own right.

The addition of a specific power to extend FOISA to a person or body purely on the basis that the body is in receipt of significant, and ongoing funding from a Scottish public authority, might make it easier for the Scottish Ministers to extend FOISA in certain circumstances. Of course, there would be a need in the course of designing any such power to define what was meant by 'significant' funding.

An alternative approach might look to amend the legislation to empower Ministers to extend FOISA to persons providing services under contract where the service provided had traditionally been delivered by the authority's own directly employed staff. This may help to address the concern about the status of 'ancillary' services previously delivered in house.

These possible options for broadening the section 5 power are intended to be illustrative rather than comprehensive. Other approaches to broadening the section 5 power may well have merit, and Question 7 below provides an opportunity for respondents to submit other suggestions.

Providing a clearer legislative steer on when information is 'held on behalf' of an authority

The section above, Strengthening mitigations through guidance and contractual arrangements, discusses the scope for providing greater clarity in guidance around when information held by a contractor should be considered 'held on behalf' of the contracting authority in terms of section 3 of FOISA. It is suggested this may provide greater assurance that information about 'outsourced' services will remain accessible through the provisions of FOISA and the EIRs.

In her 2019 report Outsourcing Oversight?: The case for reforming Freedom of Information Law in the UK looking at the impact of 'outsourcing' on Access to Information Rights the (UK) Information Commissioner suggested amending section 3 of the UK Act and regulation 3 of the UK EIR Regulations to provide 'a clearer legislative steer on what information about a public contract is 'held' for the purpose of the legislation'.[20]

The provisions of section 3 of the UK Act and regulation 3 of the UK EIR Regulations as they relate to information held on behalf of public authorities are substantively similar to the equivalent provisions within section 3 of FOISA and regulation 2(2) of the EIRs. The (UK) Information Commissioner's suggestion is therefore germane also to the discussion about the Scottish legislation.

The (UK) Information Commissioner's report does not elaborate on how such a 'clearer legislative steer' might be provided, or the basis on which legislation might distinguish between information held on behalf of the contracting authority and information held by the contractor purely on its own behalf.

In its response to the report the UK Government indicated that it did not see a need for new primary legislation in this area.[21] The UK Government response considered the relevant guidance in the UK Government's Freedom of Information Code of Practice[22] revised in 2018, along with wider guidance on public sector contracting and the (UK) Information Commissioner's oversight in these matters to be sufficient.

The Irish Freedom of Information Act 2014 provides an interesting model in regard to the relationship between authorities and their contractors - or 'service providers' as the Irish legislation calls them. Section 11(9) of the Irish Act explicitly provides that information held by a 'service provider', relating to the provision of the relevant service, is to be considered 'held' by the contracting FOI body for the purposes of the Act. Furthermore, it places an explicit duty on service providers to provide such information for the purposes of fulfilling the FOI body's obligations under the Act.

The Irish legislation is constructed differently to FOISA. The wider legal environment and public sector landscape within which the legislation operates is also different, so it is not possible to straightforwardly replicate the effect of the Irish provisions within FOISA. The Scottish Government understands that the Irish Information Commissioner may occasionally be called upon to make determination on whether bodies meet the definition of 'service provider' in terms of the legislation. However, the Scottish Government also understands there is no distinction made within the Irish regime between 'service providers' directly delivering public services and those delivering ancillary services to FOI bodies. Information relevant to the provision of such services is considered 'held' by the FOI body for the purposes of the access to information regime.

The Scottish Government would have some concerns about introducing any similarly broad provision within the Scottish regime. Principally, before moving in such a direction we would wish to be assured that the impact on private and third sector partners of public authorities would be proportionate and not unduly burdensome - particularly for small and medium sized organisations. Any undue burden would present a barrier to firms winning public contracts. It is also the case that any associated costs would ultimately be recovered through the contract (i.e. from the public purse).

Any new provisions to provide a clearer legislative steer within FOISA would require to be clearly defined so as to provide maximum clarity regarding the circumstances in which information held by contractors is to be considered 'held on behalf' of the contracting authority. Equivalent amendments may also be required to the EIRs, to ensure consistency between the two regimes.

In principle, if this could be achieved, it might represent a somewhat more manageable and proportionate approach to building a greater element of automatic agility into the legislation than a 'gateway clause' seeking to designate contractors as authorities subject to the legislation in their own right, on the basis of a statutory definition.

At the current time the Scottish Government has no clear proposal for how such a clearer legislative steer might be provided in a way which takes appropriate account of considerations about proportionality. Nevertheless, we remain open to considering these issues further.

Question 6(a)

What are your views on the introduction of a Gateway clause as a means of making the Act more 'nimble'?

• I support the introduction of a Gateway Clause
• I oppose the introduction of a Gateway Clause
• Not sure/have no view

Please provide more information about your views below, including any thoughts you have on how any 'gateway clause' might relate to:

a) outsourced public services (i.e. any service provided directly to members of the public, for which the authority itself is regarded as having ultimate responsibility):

b) ancillary services, previously delivered in house (i.e. any internal service within an authority which it has traditionally tasked its own directly employed officers or staff to deliver, but has now contracted to an external provider):

Question 6(b)

If a Gateway clause were introduced into the legislation, what would your views be on a specific exclusion for small and medium-sized enterprises (SMEs)? (the Scottish Ministers would still retain the power to extend to such organisations by order under section 5, following consultation, where they are considered to be delivering functions of a public nature)

• I would favour a specific exclusion for SMEs
• I would oppose a specific exclusion for SMEs
• Not sure/have no view

Please provide more information about your views below:

Question 6(c)

If a Gateway clause were introduced into the legislation, what would your views be on a specific exclusion for third-sector organisations? (the Scottish Ministers would still retain the power to extend to such organisations by order under section 5, following consultation, where they are considered to be delivering functions of a public nature)

• I would favour a specific exclusion for third-sector organisations
• I would oppose a specific exclusion for third-sector organisations
• Not sure/have no view

Please provide more information about your views below, including your thoughts on whether a distinction should be made between large and small/medium sized third sector bodies (e.g. those employing fewer than 250 staff members):

Question 7

What are your views on the desirability of broadening the section 5 power to enable Scottish Ministers to extend FOISA to a wider range of bodies?

• I support broadening the section 5 power to enable Scottish Ministers to extend FOISA to a wider range of bodies
• I oppose broadening the section 5 power to enable Scottish Ministers to extend FOISA to a wider range of bodies
• Not sure/have no view

Please provide more information about your views, including any thoughts you have on how a broadened section 5 power might operate:

Question 8(a)

What are your views on the necessity of amending legislation to provide a clearer legislative steer about when information held by contractors about the delivery of public services (i.e. any service provided directly to members of the public, for which the authority itself is regarded as having ultimate responsibility) is to be considered 'held' by the contracting authority for the purposes of FOISA and the EIRs:

• I consider it necessary to amend the legislation
• I do not consider it necessary to amend the legislation
• Not sure/have no view

Please provide more information about your view, including any thoughts you have on how any such approach might work:

Question 8(b)

What are your views on the necessity of amending legislation to provide a clearer legislative steer about when information held by contractors about the delivery of ancillary services previously delivered in house (i.e. any internal service within an authority which it has traditionally tasked its own directly employed officers or staff to deliver, but has now contracted to an external provider) is to be considered 'held' by the contracting authority for the purposes of FOISA and the EIRs:

• I consider it necessary to amend the legislation
• I do not consider it necessary to amend the legislation
• Not sure/have no view

Please provide more information about your view, including any thoughts you have on how any such approach might work:

Question 9

Do you have other thoughts on how the Committee's general concern about the agility of the legislation, in terms of its ability to keep pace with developments in the way public services are delivered, might be addressed? This could be either through non-legislative or legislative means:

3.9 Additional issues concerning agility of FOISA in the context of varied models of public service delivery

The Committee made two other recommendations relating to the agility of the legislation in the context of varied models of public service delivery and the relationships between public authorities and contractors delivering services on their behalf:

1) Amending FOISA to prevent reliance on confidentiality clauses between public authorities and contractors providing public services.

The issues discussed in this section are distinct from those discussed in the previous section in relation to information held by contractors. The issues here relate narrowly to the question of when and whether Scottish public authorities should be able to rely on the fact of a 'confidentiality clause' in an agreement with a contractor as a basis for withholding information under FOISA.

The use of 'confidentiality clauses' should not be confused with the application of the commercial interests exemption. Under section 33(1)(b) of FOISA an authority may withhold information if disclosure would 'prejudice substantially the commercial interests of any person'. This may apply whether there is a confidentiality agreement in place or not, and may be used to protect the legitimate commercial interests of any person or organisation, not only organisations delivering services to the authority.

However, the commercial interests exemption is subject to the public interest test. When applying it authorities are required firstly to determine that the relevant information would indeed be likely to prejudice substantially the commercial interests of some person or organisation. Secondly, they are required to balance the public interest in avoiding that substantial prejudice against the public interest in release of the information. When any request is appealed, it will be open to the Commissioner to take a different view from that taken by the authority, and to require release of the information.

The Scottish Government has a clear view that it is appropriate, and of significant importance to the effective operation of the access to information rights regime that there are measures within the legislation to allow for the protection of commercial interests, subject to the public interest test. The Section 60 Code of Practice is clear about the importance authorities should attach to respecting legitimate commercial interests.

By contrast, a confidentiality clause in the relevant sense is a contractual provision intended to create a legally binding requirement to maintain confidentiality around particular information, where no such requirement may have existed otherwise. Where disclosure of information is prohibited by a confidentiality clause, such disclosure may give a contractor potential grounds for legal action in the event of disclosure. In that case an authority may have grounds to apply the exemption at section 36(2) of FOISA which provides that information is exempt from disclosure if its release would constitute an 'actionable' breach of confidence i.e. if the basic requirements for a successful legal action against the disclosure appear to be fulfilled.

The Scottish Government considers that the use of confidentiality clauses, of a type which would affect the discharge of a public authority's functions under FOISA, is in fact rare. As the Commissioner's written evidence to the Committee pointed out, the Section 60 Code specifically discourages the use of such clauses. Indeed, standard Scottish Government and wider public sector contracts contain standard clauses which make specific reference to the public authority's requirement to comply with its obligations under FOISA.

Nevertheless, there is nothing in the legislation to prevent the use of confidentiality clauses between authorities and contractors. Therefore, wherever such a clause were in place, it could have effect as a barrier to the release of information under FOISA. Nevertheless, the Scottish Government would need to be satisfied that there were real world incidences of such clauses acting as an unjustifiable barrier to the release of information before we would be inclined to make any changes in primary legislation to address this issue.

Notwithstanding that need to test whether there is a requirement for legislative change in this area, the Scottish Government notes with interest the Committee's reflections on how such concerns might be addressed. Reflecting the Commissioner's evidence, the Committee notes that there is specific provision within Irish FOI legislation which has the effect of preventing reliance on confidentiality clauses between FOI bodies and 'service providers'.

It is important to understand that provision within the wider context of the Irish legislation which, as noted in the previous section, takes an expansive approach to bringing information held by contractors to FOI bodies within scope of the law. Section 35 of the Irish Freedom of Information Act 2014 provides that FOI bodies (i.e. public authorities subject to the Act) may refuse to disclose information if it has been provided to the FOI body by a third party with an expectation of confidentiality and if the FOI body considers that releasing the information would prejudice the likelihood of similar information being shared in the future or if there is a legally binding agreement which prevents disclosure.

However, it further stipulates that this provision will not apply to recorded information created by an FOI body or a service provider unless the release would infringe a duty of confidentiality owed to some third party i.e. some person other than an FOI body or their service provider.[23]

There is no direct equivalent within FOISA to these provisions of the Irish Act. However, as discussed above, section 36(2) of FOISA provides an absolute exemption for information whose disclosure would constitute an actionable breach of confidence (i.e. where the basic requirements for a successful legal action against the disclosure would appear to be fulfilled).

One scenario which could give rise to an 'actionable breach of confidence' would be where release would be in contravention of a legally binding confidentiality agreement. It is in the context of applications of 36(2) therefore that the issue of 'confidentiality clauses' is most likely to be of relevance.

In principle, an amendment to FOISA could specify that the provisions of 36(2) are only applicable where an actionable breach of confidence would arise in relation to a party other than a contractor, in relation to services delivered under contract. This would have a similar effect - in respect of confidentiality clauses with contractors - to the section 35(2) provisions in the Irish Act.

For the reasons explained earlier, Scottish Government is sceptical about the extent to which such a change would have a significant real world effect on the handling of requests under FOISA. We believe the use of confidentiality clauses is rare.

Nevertheless, we acknowledge that restricting the use section 36(2) could be of some value in reducing the risk of any inappropriate reliance on confidentiality clauses by authorities.

Question 10

Do you have any experience of a confidentiality clause agreed between a Scottish public authority and its contractor - as opposed to a wider concern to respect commercial interests - acting as a barrier to the release of information under FOISA?

• Yes, I am aware of at least one such instance
• No, I am not aware of any such instances I do not consider it necessary to amend the legislation
• I don't know/would prefer not to say

Please provide details or any further reflections:

Question 11

Do you favour amending FOISA to prevent Scottish public authorities from relying on confidentiality clauses with contractors as a basis for withholding information?

• Yes, I would favour making this amendment
• No, I would not favour making this amendment
• I don't know/have no view

Please explain your reasons for either supporting or opposing such a change or your reasons for being unsure:

2) Address 'anomaly' around jointly owned bodies

In the Scottish Government's own written evidence to the Committee we suggested that the 'loophole' whereby companies wholly owned by a combination of authorities do not fall within the definition of a 'publicly-owned company' within section 6 of FOISA should be closed.

In our response to the Committee's report we clarified that this appears only to be an issue in relation to jointly-owned companies where one of the owning authorities is the Scottish Ministers. There are in fact various examples of companies wholly-owned by a combination of Scottish public authorities (e.g. companies owned by two or more local authorities), which are generally understood to be subject to the Act by virtue of the provisions of section 6.

The structure of section 6(1) does however suggest that companies wholly-owned by a combination of the Scottish Ministers and other schedule 1 authorities would be outwith the definition.

We have already expressed our view that this anomaly in the legislation should be rectified when an opportunity presents itself. It is the Scottish Government's starting point therefore that if taking forward wider legislative change to FOISA, we would seek to make change in this area. However, we still wish to consult in order to seek the views of stakeholders and to gauge the level of concern about this issue.

Until such time as an appropriate legislative opportunity arises, we will seek to use Scottish Ministers' powers under sections 4 and 5 of the Act to ensure that any companies wholly owned by a combination of the Scottish Ministers and other authorities are made subject to FOISA.

Question 12

Are you aware of any specific instances where access to information through FOISA has been frustrated as a consequence of the current structure of the section 6 provisions?

• Yes, I am aware of at least one such instance
• No, I am not aware of any such instances
• I don't know/would prefer not to say

Please provide details or other comments below:

Question 13

Do you agree that the wording of section 6 of FOISA should be amended so as to ensure all companies wholly-owned by any combination of schedule 1 authorities, including the Scottish Ministers, fall within the definition of a 'publicly-owned company'?

• Yes, I would favour making this change
• No, I would not favour making this change
• I don't know/have no view

Please explain your reasons for either supporting or opposing such a change or your reasons for being unsure: