Care home and 'care at home' service providers - FOISA extension: consultation

5. Supporting the rollout of any extension

As discussed above, any extension of FOISA would impose new duties on care providers and give people who use care services, and others, new rights to access information about those services.

Providers would be required to adopt the Scottish Information Commissioner’s Model Publication Scheme to make the following classes of information about their work proactively available, wherever relevant information is held:

Class 1: About the authority: Information about the authority: who we are, where to find us, how to contact us, how we are managed and our external relations.

Class 2: How we deliver our functions and services: Information about our work, our strategies and policies for delivering our functions and services and information for our service users.

Class 3: How we take decisions and what we have decided: Information about the decisions we take, how we make decisions and how we involve others.

Class 4: What we spend and how we spend it: Information about our strategy for, and management of, financial resources (in sufficient detail to explain how we plan to spend public money and what has actually been spent).

Class 5: How we manage our human, physical and information resources: Information about how we manage our human, physical and information resources.

Class 6: How we procure goods and services from external providers: Information about how we procure goods and services and our contracts with external providers.

Class 7: How we are performing: Information about how we perform as an organisation and how well we deliver our functions and services.

Class 8: Our commercial publications: Information packaged and made available for sale on a commercial basis and sold at market value through a retail outlet e.g., bookshop, museum or research journal.

Class 9: Our open data: The open data we make available as described by the Scottish Government’s Open Data Strategy and Resource Pack, available under an open licence

This may have the effect of increasing the information available to the public regarding services.

Also, anyone who wanted more information about a care home or ‘care at home’ service would have the right to seek that information by making a request to the provider. Requests under FOISA must be made in writing or another recordable form. The provider would then have a duty to consider and respond to that request, providing the relevant information wherever possible, within 20 working days. The provider would also have a duty to advise and assist the requester to help them to obtain the information they are seeking.

If the requester were dissatisfied with the response to their request, they would have the right to ask the provider to carry out a review of its handling of the request. The provider would have an obligation to consider and respond to the review within a further 20 working days.

Following review stage, the requester would have the right to apply to the Scottish Information Commissioner for a decision, if they remained dissatisfied with the provider’s handling of their request. The provider would then be required to make submissions to the Commissioner, setting out its position.

In 2024-25 only 3% of FOI requests in Scotland became subject to an internal review and fewer than 1% became the subject of an application to the Commissioner.^[17]

It should be noted that designation as a Scottish public authority under FOISA also confers obligations under the Climate Change (Scotland) Act 2009. These are intended to be proportionate in their requirements for smaller bodies.^[18]

Under data protection law, every Scottish public authority is also required to appoint a Data Protection Officer (DPO). The requirement to appoint a DPO is set out in guidance from the (UK) Information Commissioner’s Office, which regulates data protection compliance of all organisations in the UK.^[19]

More generally, Scottish public authorities need to be mindful to ensure compliance with data protection law when they carry out their obligations under FOISA. This includes the need to guard against any inappropriate processing or release of personal data when handling requests. Providers would need to ensure FOISA compliance was integrated with existing data protection obligations under UK GDPR and the Data Protection Act 2018. This would include applying exemptions under FOISA where necessary in order to protect personal data, accurately undertaking any necessary redactions, and maintaining records of decisions to ensure accountability.

Care providers are of course already subject to the requirements of data protection law and should already have processes in place to ensure their compliance. This includes the requirement to comply with requests from data subjects for their own personal data (i.e. subject access requests).

A Business and Regulatory Impact Assessment is being developed to consider the regulatory impact on providers in greater depth. A Data Protection Impact Assessment, to consider the impact on data protection rights and obligations is also being developed.

7. What would be most helpful to assist care providers in discharging their obligations under FOISA? Please provide your thoughts below:

[please insert response here………………….]

8. What would be most helpful to people who access social care and other members of the public to enable them to access their rights under FOISA? Please provide your thoughts below:

[please insert response here………………….]

9. What categories of information relating to the work of care home and ‘care at home’ services would people be most likely to seek? Please provide your thoughts below:

[please insert response here………………….]