Breakdown of number of request made by journalist: FOI review

Information requested

1. The number of Freedom of Information requests sent to the Scottish Government by journalist Conor Matchett in the period 1 May 2021 to 31 May 2021.

2. Please give a rough breakdown of requests by subject matter.

3. Please give a breakdown of how many were appealed and reviewed internally and externally with a breakdown of the verdicts of the appeals.

Response

In your request for a review, you indicated that you were dissatisfied with our response because you do not agree that the requested information is personal information. I have therefore reviewed our application of the exemption in section 38(1)(b) (personal information) of FOISA, and the outcome is set out below.

Application of section 38(1)(b) exemption
I have concluded that a different decision should be substituted, for the following reasons.

Section 38(1)(b) of FOISA provides that information is exempt information if it constitutes personal data and one of the three conditions set out in section 38(2A) to (3A) is satisfied. In your view, the requested information is not personal data and so I have reconsidered this point. I have also reconsidered whether one of the conditions is satisfied.

Is the requested information personal data?

Section 38(5) of FOISA provides “personal data” is defined as having the same meaning as it does in section 3(2) of the Data Protection Act 2018, and section 3(2) says that “personal data” means any information relating to an identified or identifiable living individual.

The test is accordingly whether the information requested relates to an identified or identifiable living individual. The first part of your request is for the number of FOI requests made by a named person, who is accordingly an identified individual. To the best of our knowledge and belief, the individual in question is alive as at the date of our response. In our view, the information requested clearly relates to that person, and so constitutes personal data. The latter parts of your request seek further details about the subject-matter and the handling of the person’s FOI requests. Again, we take the view that this clearly relates to that person. Accordingly, I conclude that the requested information is personal data for the purposes of section 38 of FOISA.

I note that in your review response you suggest that the information requested is not personal data because it relates to Mr Matchett’s work and you believe that his work is in the public eye. However, this has no bearing on whether information is personal data. I accept that it has some bearing on determining whether any of the conditions mentioned in section 38(1)(b) of FOISA are satisfied and I therefore take it into account below, but it is not relevant (given the definition above) for the purposes of determining whether the information is personal data or not.

Accordingly, I uphold our decision that the requested information is Mr Matchett’s personal data.

Are any of the conditions satisfied?

It is not the case that information is exempt simply because it constitutes personal data. One of the three conditions mentioned in section 38(1)(b) of FOISA must also be satisfied.

In our response to you, we indicated that in our view the first condition was satisfied. I have accordingly reconsidered whether we were correct to do so.

The first condition
The first condition is concerned with whether disclosure would contravene any of the data protection principles set out in Article 5(1) of the UK GDPR and section 34(1) of the Data Protection Act 2018. Our consideration in relation to this condition centres on identifying whether we have a lawful basis to process Mr Matchett’s personal information in order to respond to your FOI request. Of the six lawful bases contained in Article 6 of the UK GDPR, the Commissioner has indicated that only legitimate interest is likely to be relevant when dealing with FOI requests. The Supreme Court has set out three tests for authorities to consider when ascertaining whether legitimate interest constitutes a lawful basis for processing, as follows:
1. Does the person making the information request have a legitimate interest in obtaining the personal data?

2. If yes, is the disclosure of the personal data necessary to achieve that legitimate interest?

3. Even if the processing is necessary to achieve that legitimate interest, is that overridden by the interests or fundamental rights and freedoms of the data subject(s)?

In relation to the first question, I consider that there is a legitimate interest in understanding how requesters who use FOI requests in a professional capacity make requests, the types of requests that they make, and the outcomes for those requests. Authorities have a statutory duty to respond to FOI requests, and we accept that there is a legitimate interest in information about how they go about that. In the Scottish Government’s case, I would also identify a particular legitimate interest in information about the handling of requests made by journalists, especially given the ongoing intervention undertaken by the Scottish Information Commissioner which has examined (among other things) whether journalists’ requests were handled differently to those of other requesters. Accordingly, I have concluded that you have a legitimate interest in obtaining the personal data.

In relation to the second question, “necessary” in this context means “reasonably necessary”, rather than absolutely or strictly necessary. I have accordingly considered whether disclosure of the requested information is necessary to satisfy the legitimate interest, or whether other information could be made available which would meet the interest while interfering less with the interests or fundamental rights and freedoms of the data subject. While I have considered whether other information might be made available, we have been unable to identify information which would satisfy the legitimate interest while interfering less with the interests or fundamental rights and freedoms of the data subject. In particular, I considered whether you might be able to obtain the requested information by considering Mr Matchett’s published articles, which sometimes indicate that information from an FOI request to the Scottish Government has been used in writing the article. However, I have concluded that this would not give you the information you are requesting, partly because not every FOI request will necessarily result in a published article, and partly because it would not address the part of your request about the number of reviews and appeals, and their outcomes. I have therefore concluded that the disclosure of the personal data is necessary to achieve the legitimate interest.

In relation to the third question, deciding whether the interests or fundamental rights and freedoms of the data subject override the legitimate interest of the requester involves a balancing exercise. The Scottish Information Commissioner has observed that “[d]isclosure will always involve some intrusion of privacy. However, that intrusion will not always be unwarranted…”. The Commissioner’s guidance also sets out factors for authorities to consider as part of the balancing exercise, although the factors are not by themselves determinative.

In this case, I have concluded that the personal data relates to Mr Matchett’s public life, and specifically to his employment as a journalist. While I accept that requesters may (and frequently do) use FOI requests to obtain information which relates to their private life (home, family, social life etc), on the face of it all of the requests which fall within scope appear to concern matters of public interest and to concern matters in which Mr Matchett has a professional interest. I also observe that Mr Matchett has a relatively high public profile, as a frequently-published journalist with a national newspaper, and that his articles not infrequently refer to the fact that the source material has been obtained by way of FOI request. I also think it unlikely that disclosure would be likely to cause harm or distress to Mr Matchett, and we are not aware of any evidence to suggest that disclosing information of this type would be likely to do so.

Against these factors, I note that Mr Matchett has been consulted again on the disclosure of his personal data. We are not relying on consent as the lawful basis for processing his personal information, but the Commissioner has noted that an objection by the data subject is a factor which can be taken into account in determining whether the data subject’s interests or fundamental rights and freedoms override the requester’s legitimate interests. Mr Matchett has advised that he no longer objects to us disclosing the information requested in the first part of your request, but he has maintained his opposition to the disclosure of the information requested in the second and third parts.

In our original response, we concluded that Mr Matchett’s interests or fundamental rights and freedoms overrode your legitimate interests in obtaining the information. In reconsidering this test, I have concluded that the information relates to Mr Matchett’s public life and that he has a relatively high public profile. Taken together these factors make it less likely that his interests would override your interests. Additionally, there is nothing to suggest that disclosure would be likely to cause harm or distress, which would be a significant consideration. I have taken Mr Matchett’s objection to disclosure fully into account, but I am not persuaded that it is sufficiently compelling for the balance to favour his interests overriding yours. Accordingly, I have concluded that the interests and fundamental rights and freedoms of the data subject do not outweigh your legitimate interests.

For these reasons, I have concluded that we have a lawful basis for processing Mr Matchett’s personal data in order to respond to your request, the lawful basis being legitimate interest. I do not consider that processing would otherwise contravene the data protection principles, and so I conclude that the first condition set out in section 38(1)(b) is not met.

The second condition
In light of Mr Matchett’s continued objection to disclosure of the information requested in parts 2 and 3 of your request, I have gone on to consider whether the second condition is met in relation to those parts.

The second condition is that disclosure would contravene Article 21 of the UK GDPR (the data subject’s right to object to processing in certain circumstances). The right to object is available where the authority is relying on legitimate interest as the basis for processing the personal data (as here).

As Mr Matchett has confirmed that he continues to object to disclosure of this information, I have concluded that the second condition is met.

However, where an authority proposes to rely on the second condition, the section 38(1)(b) exemption is qualified and we must therefore consider whether the public interest in maintaining the objection outweighs the public interest in disclosure.

Taking account of all the circumstances of the case, I have considered whether the public interest in disclosing the information outweighs the public interest in applying the exemption. I consider that there is a general public interest in open and transparent government, and in enabling public scrutiny of how the Scottish Government handles FOI requests. I also consider that there is a public interest in understanding how the Scottish Government handles requests made by journalists, given the ongoing intervention mentioned previously. In favour of maintaining the exemption, I recognise that data subjects have a right to object to processing, and where they do this should be respected unless the public interest favours disclosure. On balance, I have concluded that the public interest narrowly favours disclosure in all the circumstances of this case.

Third condition
For completeness, the third condition is that, if the data subject requested the same information under Article 15(1) of the UK GDPR, it would be withheld from the data subject in accordance with certain provisions of the Data Protection Act 2018. I have concluded that, were Mr Matchett to have requested the information you have requested under the UK GDPR, we would not have withheld it from him in accordance with those provisions, and so the third condition is not met.

Application of exemption: conclusion

While I have concluded that the requested information is personal data and that the second condition is met, I have also concluded that the section 38(1)(b) exemption does not apply to the requested information because the public interest favours disclosure.

As a consequence, I have determined that a new decision should be substituted, and the answers to your requests are provided in the Annex.

Annex 
1. Mr Matchett submitted 18 freedom of information requests to the Scottish Government between 1 May 2021 and 31 May 2021.

2. Please see the table below for a breakdown of subject-matters:

Subject of request	No of requests
Data protection breaches	7
Covid-19 deaths in care homes	3
FOI responses cleared by special advisers/ Communications dept	2
Policing of Rangers title celebrations	1
Covid-19 lessons learned review	1
National Centre for Geospatial Intelligence	1
2021 Exams diet	1
Mobile phones for Cabinet Secretaries	1
NRS covid-19 statistics	1

3. Of the 18 requests submitted during this period, there had been no requests for internal review and therefore no appeals to the Scottish Information Commissioner as at the date of your request. However, please note that the majority of these requests were still in progress at that date.

About FOI
The Scottish Government is committed to publishing all information released in response to Freedom of Information requests. View all FOI responses at http://www.gov.scot/foi-responses.