Open Data resource pack: version 2

2. Existing Legislation

The Open Data Strategy supports a wider legislative initiative which has been designed to get public sector organisations across Europe releasing their data on a regular basis.

The strategy recognises and supports the duties placed on organisations under access to information legislation in Scotland and the UK. Whilst the Open Data Strategy encourages the proactive release of data in a manner currently beyond that required by legislation, legislation in this area can change over time. It is critical you understand your obligations under five key pieces of legislation. It is also important that you understand what powers the legislation gives you to support open data.

• Freedom of Information (Scotland) Act 2002
• Environmental Information (Scotland) Regulations 2004
• Data Protection Act 1998
• INSPIRE (Scotland) Regulations 2009
• Re-use of Public Sector Information Regulations 2015

You should also be aware of any other specific legislation which may govern your organisation's activities or obligations to disclose or withhold information.

Freedom of Information (Scotland) Act 2002 ( FOISA) and Environmental Information (Scotland) Regulations 2004 ( EIRs)

FOISA and EIRs are enforced by the Scottish Information Commissioner.

The legislation gives any person the right to ask for recorded information held by a Scottish public authority and the right to receive it. Requests for information under FOISA must be in writing. Requests for environmental information under the EIRs may also be oral.

The Scottish Information Commissioner has created a short guide to help authorities decide which law applies to any particular request. More detailed guidance is available to help public authorities understand their obligations and deal with requests. There will also be a FOISA contact within your organisation who you should speak to if you have any questions.

The legislation imposes two broad duties on Scottish public authorities:

1. The duty to respond to information requests within statutory time limits .

There is a presumption that information will be disclosed but the legislation makes provision for it to be withheld if exemptions or exceptions apply. These exemptions and exceptions are also relevant when releasing open data. This should be taken

into account when developing your Open Data Publication Plan.

2. The duty to proactively publish information.

Section 23 of FOISA requires authorities to "adopt and maintain a scheme […] which relates to the publication of information by the authority…". This is called a 'publication scheme'. Open Data is one class of information which the Scottish Information Commissioner has included in the Model Publication Scheme which she has prepared under section 24 of FOISA.

Data Protection Act 1998 ( DPA)

The DPA is the main piece of legislation which protects personal data in the UK. Anyone who processes personal data is obligated to comply with the Act. The Act defines 8 data protection principles. If you have questions about your obligations under the DPA, you should speak to your Information Asset Owner ( IAO) or Data Protection Office ( DPO). Alternatively, you can consult the UK Information Commissioner's Office ( ICO) guidance.

The DPA is based on the 1995 European Union Data Protection Directive. The EU has just passed a new General Data Protection Regulation ( GDPR) which increases individuals' rights and imposes further obligations on organisations processing personal data. The GDPR will come into force in May 2018. Even though the UK is leaving the EU it is likely that we will have to comply with the GDPR to ensure we have an adequate level of protection for processing EU citizens' personal data. The Information Commissioner's Office ( ICO) has guidance on the GDPR available here.

INSPIRE (Scotland) Regulations 2009

The INSPIRE Regulations cover the release of spatial data by Scottish public authorities and organisations which carry out duties on behalf of public authorities. The regulations brought into force the EU Inspire Directive which aims to create consistency across all member states so that all spatial datasets can be easily shared, modified and combined. INSPIRE defines common technical standards for publishing spatial datasets which fall within 34 data themes.

All spatial data which falls under INSPIRE must be published. You should ensure that you publish your data as both view and download services, to the required standards, as well as its associated metadata. The latest information about INSPIRE can be found on the UK Location website.

In Scotland, the Scottish SDI Metadata Catalogue ( SSDI) supports the publishing of Scottish public sector spatial data metadata to the INSPIRE and UK Location metadata standards. It provides the discovery component for a set of on-line services that will allow users to evaluate and use public sector spatial data.

Guidance on how to create INSPIRE metadata on the SSDI can be found here.

Re-use of Public Sector Information Regulations 2015

The Public Sector Information Regulations cover any information a public sector body:

a) produces, holds or disseminates within its public task, and

b) holds the copyright for.

Under the regulations, public sector bodies should make their information available for re-use under an open licence at marginal cost. Marginal cost in most cases will be nil. The legislation specifies exceptions to the marginal cost default, for example trading funds. In such cases, public sector bodies may charge re-users to cover the costs of collection, production, reproduction and dissemination of information, together with a reasonable return on their investment.

The National Archives have produced a checklist to help public sector bodies make sure they satisfy their obligations under the regulations. Detailed guidance, including information around charging, has been produced for public sector and cultural sector bodies.