Scottish Government policy on redaction of names: FOI release

Information requested

How the Scottish Government decides on the names to be redacted from documents released under a FOI request. In addition for any names left, does permission to publish need to be sought from the named individuals.

Response

FOISA provides a general right to the information held by public authorities, providing that the information is not exempt from disclosure.

The UK GDPR and the Data Protection Act 2018 govern how the personal data of living people should be handled by organisations, while also providing individuals with a number of rights, including the right to access their own personal data and the right to object to organisations processing their personal data.

Section 38 of FOISA is where the UK GDPR, the DPA 2018 and FOISA meet. It tells us when personal data can and can’t be disclosed in response to an FOI request.

The answer to your question is that the Scottish Government withholds names (and other personal information) from documents released in response to an FOI request if those names are exempt from disclosure under the provisions set out in FOISA.

As noted above, section 38 of FOISA sets out when personal information is exempt from disclosure under FOISA. The most common exemption under which names may be withheld is the exemption in section 38(1)(b) of FOISA (personal information). Information is exempt if it constitutes personal information and one of the conditions set out in section 38(2A) to (3A) is satisfied.The condition that is usually satisfied when information is exempt is the first condition (that disclosure would contravene any of the data protection principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act 2018.

The Scottish Government takes the Scottish Information Commissioner’s guidance on the application of section 38 of FOISA into account when applying this exemption, and that guidance is available to view here.

As noted, in most cases, the lawful basis for processing (disclosing) personal information, including names is likely to be condition (f), the legitimate interests gateway. Condition (f) allows personal data to be processed where processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

In considering whether personal information, including names are exempt from disclosure, the Scottish Government will consider the criteria under which personal data can be lawfully processed, including under condition (f) of Article 6 of the GDPR.

The Scottish Government has a general policy about the disclosure of staff names (as mentioned in paragraph 83 of the Commissioner’s guidance) which is to withhold the names of officials below Senior Civil Service level, although the appropriateness of relying on this general policy will be considered afresh in responding to each request.

As set out in section 7 of the Code of Practice, we may consult an individual, including third party individuals who have a material interest in the information being requested. Where appropriate, as part of that consultation we can ask for a view on disclosure of information, including personal data, to help inform our decision on disclosure or legitimate interest considerations.

However, in responding to requests, or subsequently publishing information disclosed under FOISA, we do not seek the permission to publish the names of individuals. This is because the Scottish Government does not rely on consent as a lawful basis for processing personal information in response to FOI requests, in light of the guidance set out in paragraph 54 of the Commissioner’s guidance. However, if, in the process of consulting interested third parties, someone objects to the disclosure of their personal information, we would consider that carefully as part of deciding whether an exemption applies.

About FOI
The Scottish Government is committed to publishing all information released in response to Freedom of Information requests. View all FOI responses at http://www.gov.scot/foi-responses.