Number of Freedom of Information request submitted by journalist: FOI review

Information requested

1. The number of Freedom of Information requests sent to the Scottish Government by journalist Conor Matchett in the period 1 May 2020 to 30 April 2021.

2. Please give a rough breakdown of requests by subject matter.

3. Please give a breakdown of how many were appealed and reviewed internally and externally with a breakdown of the verdicts of the appeals.

Response

In your request for a review, you indicated that you were dissatisfied with our response because you do not agree that the requested information is personal information. I have therefore reviewed our application of the exemption in section 38(1)(b) (personal information) of FOISA, and the outcome is set out below.

You also question why we responded on the 20th working day to your request, and I have interpreted this as expressing dissatisfaction that we did not respond promptly to your request. I have therefore reviewed our handling of it, and my conclusions are set out below.

Handling of request
Section 10(1) of FOISA provides that (subject to a number of exceptions which are not relevant in this case) a Scottish public authority receiving a request must respond to it promptly , and in any event by not later than the twentieth working day after the receipt of the request.

The Scottish Information Commissioner has considered the parallel duty to respond “as soon as possible” to requests made under the Environmental Information (Scotland) Regulations 2004 (“the EIRs”) in two decisions: Decision 120/2016 (“the RATS decision”) and Decision 038/2017 (“the S&TCS decision”). In the RATS decision, the Commissioner indicated that it was reasonable to take a consistent approach to the meanings of “promptly” in FOISA and “as soon as possible” in the EIRs (paragraph 25). The Commissioner went on to analyse the duty in light of the Upper Tribunal decision in John v Information Commissioner and Ofsted [2014] UKUT 444 (AAC), from which three factors derive (paragraph 37):
1. The resources available to deal with requests. This requires a balance between [FOISA] applications and the other core business of the authority.

2. It may take time to discover whether the authority holds the information requested and, if it does, to extract it and present it in the appropriate form.

3. It may take time to be sure that the information gathered is complete. Time spent doing so, is not time wasted.

I have therefore taken these factors into account in considering whether we responded to your request promptly. I also note that you have made a related request on the same date as this request (202100202676) and three related requests on 2 June 2021 (202100208816, 202100208818 and 202100208819), all of which were responded to more promptly than this request was, and I have considered why this was the case.

Having reconsidered the casefile for this request in detail, it appears to me that this request took longer to respond to than your other requests because of the time taken to consider fully the third party representations received from the person mentioned in your request, to obtain and consider advice from both data protection and FOI specialists on the interaction of the two regimes, and to reach a decision about whether the section 38(1)(b) exemption applied. As the Commissioner observed in S&TCS, it is not inherently more straightforward, and less time consuming, to withhold information (whether in whole or in part) than to provide it, and if done properly, it can be the opposite (paragraph 37). This goes to the second factor mentioned above.

In my view, the reason that this case took longer to respond to than your other requests (where information was disclosed, save in 202100208816) is precisely because of the time taken to consider whether the in-scope information was exempt or not. You have separately made a request for all internal and external communications relating to 202100202676 and 202100208816, and we are responding to that request under separate cover (202100215169). The information being disclosed in response to that request illustrates, in my view, the careful consideration involved in identifying the requested information and then in deciding whether it was exempt or not. A final decision was reached on that point on 14 June, our draft decision letter was updated to reflect the decision later that evening, and the response was issued to you the following day.

Having reconsidered the handling of our response, as detailed above, I have concluded that we did respond promptly to your request. I hope that this explanation (taken together with the information to be disclosed to you in response to 202100215169) clarifies why it took 20 working days to respond on this occasion, whereas we were in a position to respond to your other requests sooner.

Application of section 38(1)(b) exemption
I have concluded that a different decision should be substituted, for the following reasons.

Section 38(1)(b) of FOISA provides that information is exempt information if it constitutes personal data and one of the three conditions set out in section 38(2A) to (3A) is satisfied. In your view, the requested information is not personal data and so I have reconsidered this point. I have also reconsidered whether one of the conditions is satisfied.

Is the requested information personal data?

Section 38(5) of FOISA provides “personal data” is defined as having the same meaning as it does in section 3(2) of the Data Protection Act 2018, and section 3(2) says that “personal data” means any information relating to an identified or identifiable living individual.

The test is accordingly whether the information requested relates to an identified or identifiable living individual. The first part of your request is for the number of FOI requests made by a named person, who is accordingly an identified individual. To the best of our knowledge and belief, the individual in question is alive as at the date of our response. In our view, the information requested clearly relates to that person, and so constitutes personal data. The latter parts of your request seek further details about the subject-matter and the handling of the person’s FOI requests. Again, we take the view that this clearly relates to that person. Accordingly, I conclude that the requested information is personal data for the purposes of section 38 of FOISA.

I note that in your review response you suggest that the information requested is not personal data because it relates to Mr Matchett’s work and you believe that his work is in the public eye. However, this has no bearing on whether information is personal data. I accept that it has some bearing on determining whether any of the conditions mentioned in section 38(1)(b) of FOISA are satisfied and I therefore take it into account below, but it is not relevant (given the definition above) for the purposes of determining whether the information is personal data or not.

Accordingly, I uphold our decision that the requested information is Mr Matchett’s personal data.

Are any of the conditions satisfied?

It is not the case that information is exempt simply because it constitutes personal data. One of the three conditions mentioned in section 38(1)(b) of FOISA must also be satisfied.

In our response to you, we indicated that in our view the first condition was satisfied. I have accordingly reconsidered whether we were correct to do so.

The first condition
The first condition is concerned with whether disclosure would contravene any of the data protection principles set out in Article 5(1) of the UK GDPR and section 34(1) of the Data Protection Act 2018. Our consideration in relation to this condition centres on identifying whether we have a lawful basis to process Mr Matchett’s personal information in order to respond to your FOI request. Of the six lawful bases contained in Article 6 of the UK GDPR, the Commissioner has indicated that only legitimate interest is likely to be relevant when dealing with FOI requests. The Supreme Court has set out three tests for authorities to consider when ascertaining whether legitimate interest constitutes a lawful basis for processing, as follows:
1. Does the person making the information request have a legitimate interest in obtaining the personal data?

2. If yes, is the disclosure of the personal data necessary to achieve that legitimate interest?

3. Even if the processing is necessary to achieve that legitimate interest, is that overridden by the interests or fundamental rights and freedoms of the data subject(s)?

In relation to the first question, I consider that there is a legitimate interest in understanding how requesters who use FOI requests in a professional capacity make requests, the types of requests that they make, and the outcomes for those requests. Authorities have a statutory duty to respond to FOI requests, and we accept that there is a legitimate interest in information about how they go about that. In the Scottish Government’s case, I would also identify a particular legitimate interest in information about the handling of requests made by journalists, especially given the ongoing intervention undertaken by the Scottish Information Commissioner which has examined (among other things) whether journalists’ requests were handled differently to those of other requesters. Accordingly, I have concluded that you have a legitimate interest in obtaining the personal data.

In relation to the second question, “necessary” in this context means “reasonably necessary”, rather than absolutely or strictly necessary. I have accordingly considered whether disclosure of the requested information is necessary to satisfy the legitimate interest, or whether other information could be made available which would meet the interest while interfering less with the interests or fundamental rights and freedoms of the data subject. While I have considered whether other information might be made available, we have been unable to identify information which would satisfy the legitimate interest while interfering less with the interests or fundamental rights and freedoms of the data subject. In particular, I considered whether you might be able to obtain the requested information by considering Mr Matchett’s published articles, which sometimes indicate that information from an FOI request to the Scottish Government has been used in writing the article. However, I have concluded that this would not give you the information you are requesting, partly because not every FOI request will necessarily result in a published article, and partly because it would not address the part of your request about the number of reviews and appeals, and their outcomes. I have therefore concluded that the disclosure of the personal data is necessary to achieve the legitimate interest.

In relation to the third question, deciding whether the interests or fundamental rights and freedoms of the data subject override the legitimate interest of the requester involves a balancing exercise. The Scottish Information Commissioner has observed that “[d]isclosure will always involve some intrusion of privacy. However, that intrusion will not always be unwarranted…”. The Commissioner’s guidance also sets out factors for authorities to consider as part of the balancing exercise, although the factors are not by themselves determinative.

In this case, I have concluded that the personal data relates to Mr Matchett’s public life, and specifically to his employment as a journalist. While I accept that requesters may (and frequently do) use FOI requests to obtain information which relates to their private life (home, family, social life etc), on the face of it all of the requests which fall within scope appear to concern matters of public interest and to concern matters in which Mr Matchett has a professional interest. I also observe that Mr Matchett has a relatively high public profile, as a frequently-published journalist with a national newspaper, and that his articles not infrequently refer to the fact that the source material has been obtained by way of FOI request. I also think it unlikely that disclosure would be likely to cause harm or distress to Mr Matchett, and we are not aware of any evidence to suggest that disclosing information of this type would be likely to do so.

Against these factors, I note that Mr Matchett has been consulted again on the disclosure of his personal data. We are not relying on consent as the lawful basis for processing his personal information, but the Commissioner has noted that an objection by the data subject is a factor which can be taken into account in determining whether the data subject’s interests or fundamental rights and freedoms override the requester’s legitimate interests. Mr Matchett has advised that he no longer objects to us disclosing the information requested in the first part of your request, but he has maintained his opposition to the disclosure of the information requested in the second and third parts.

In our original response, we concluded that Mr Matchett’s interests or fundamental rights and freedoms overrode your legitimate interests in obtaining the information. In reconsidering this test, I have concluded that the information relates to Mr Matchett’s public life and that he has a relatively high public profile. Taken together these factors make it less likely that his interests would override your interests. Additionally, there is nothing to suggest that disclosure would be likely to cause harm or distress, which would be a significant consideration. I have taken Mr Matchett’s objection to disclosure fully into account, but I am not persuaded that it is sufficiently compelling for the balance to favour his interests overriding yours. Accordingly, I have concluded that the interests and fundamental rights and freedoms of the data subject do not outweigh your legitimate interests.

For these reasons, I have concluded that we have a lawful basis for processing Mr Matchett’s personal data in order to respond to your request, the lawful basis being legitimate interest. I do not consider that processing would otherwise contravene the data protection principles, and so I conclude that the first condition set out in section 38(1)(b) is not met.

The second condition
In light of Mr Matchett’s continued objection to disclosure of the information requested in parts 2 and 3 of your request, I have gone on to consider whether the second condition is met in relation to those parts.

The second condition is that disclosure would contravene Article 21 of the UK GDPR (the data subject’s right to object to processing in certain circumstances). The right to object is available where the authority is relying on legitimate interest as the basis for processing the personal data (as here).

As Mr Matchett has confirmed that he continues to object to disclosure of this information, I have concluded that the second condition is met.

However, where an authority proposes to rely on the second condition, the section 38(1)(b) exemption is qualified and we must therefore consider whether the public interest in maintaining the objection outweighs the public interest in disclosure.

Taking account of all the circumstances of the case, I have considered whether the public interest in disclosing the information outweighs the public interest in applying the exemption. I consider that there is a general public interest in open and transparent government, and in enabling public scrutiny of how the Scottish Government handles FOI requests. I also consider that there is a public interest in understanding how the Scottish Government handles requests made by journalists, given the ongoing intervention mentioned previously. In favour of maintaining the exemption, I recognise that data subjects have a right to object to processing, and where they do this should be respected unless the public interest favours disclosure. On balance, I have concluded that the public interest narrowly favours disclosure in all the circumstances of this case.

Third condition
For completeness, the third condition is that, if the data subject requested the same information under Article 15(1) of the UK GDPR, it would be withheld from the data subject in accordance with certain provisions of the Data Protection Act 2018. I have concluded that, were Mr Matchett to have requested the information you have requested under the UK GDPR, we would not have withheld it from him in accordance with those provisions, and so the third condition is not met.

Application of exemption: conclusion
While I have concluded that the requested information is personal data and that the second condition is met, I have also concluded that the section 38(1)(b) exemption does not apply to the requested information because the public interest favours disclosure.

As a consequence, I have determined that a new decision should be substituted, and the answers to your requests are provided in the Annex.

Annex 
1. Mr Matchett submitted 63 freedom of information requests to the Scottish Government between 1 May 2020 and 31 April 2021.

2. Please see the table below for a breakdown of subject-matters:

Subject matter	Number of requests
Covid-19 vaccine	10
Relaxation of covid-19 restrictions around Christmas	9
Ministerial meetings	7
Contingencies/modelling for potential covid-19 second wave	5
SG contracts	4
Four nations discussions	3
Second independence referendum	3
Legal advice to Ministers/staff	2
Handling harassment complaints procedure	1
Financial support provided to Scottish Business Resilience Centre	1
Scotland House memberships	1
Furlough	1
Election contingency planning	1
Scottish Government spend on working from home equipment	1
Human Trafficking & Exploitation (Scotland) Act	1
Covid-19 children & young people	1
Scottish Tourism Alliance	1
Correspondence relating to a previous request	1
Covid-19 briefings	1
Death statistics	1
Bute House renovations	1
Information on Judicial Review	1
Websites accessed by SG staff	1
Corporate information management	1
SG staff who have roles with external firms	1
James Hamilton’s report	1
Covid-19 at Hilton Carlton Hotel	1
Covid-19 advertising costs	1

3. Of these 63 requests, 22 were internally reviewed. 16 reviews confirmed the original decision without modification, one confirmed the original decision with modification, three reviews led to a different decision being substituted, one was a review of a failure to respond and one was currently in progress as at the date of your request. Five appeals were subsequently made to the Scottish Information Commissioner. At the time of your request, these appeals were all still under investigation.

About FOI
The Scottish Government is committed to publishing all information released in response to Freedom of Information requests. View all FOI responses at http://www.gov.scot/foi-responses.