FOI/EIR: Section 60 code of practice

Part 1 - Introduction

This Part explains the purpose of the Code, provides an overview of the main terms of the regimes and the bodies subject to them, and explains the role of the Commissioner in enforcing the Code.

1. Purpose of the Code

This Code provides guidance to Scottish public authorities on the practice which Scottish Ministers consider desirable for authorities to follow in connection with the discharge of their functions under the regimes.^[1]

In particular it includes guidance on:

• responsibility for FOI within an authority;
• proactively publishing information;
• the provision of advice and assistance by authorities to people who propose to make, or have made, requests for information;
• responding to requests;
• handling a request for information;
• training and staffing arrangements;
• records management and searching for information;
• transferring requests to other authorities;
• consulting third parties to whom information requested relates, or people whose interests are likely to be affected by the disclosure of such information;
• the disclosure of contractual and procurement-related information;
• responding to reviews;
• monitoring compliance, collecting and recording statistics about request handling; and
• appeals to the Commissioner

The Code sits between the regimes and the Commissioner’s guidance. It contains good practice guidance to supplement the statutory provisions, but it is not intended to provide detailed, comprehensive guidance on the regimes. Such guidance is already available from the Commissioner.^[2]

The Code is not a substitute for the legislation and does not duplicate or conflict with the legislation. The Commissioner will promote observance of the Code and can serve a practice recommendation on any authority whose practice does not conform to the Code. Should an authority fail to comply with the Code it may be failing in its duties under the regimes. The Commissioner has a range of powers to address any such failures to comply (see Enforcement | Scottish Information Commissioner).

2. Main terms of the regimes

By way of an overview, it is helpful to outline the main terms of the regimes, both of which encourage a more open culture and confer on the public a statutory right of access to information of any age that is held by Scottish public authorities.^[3]

The regimes place three core duties upon public sector bodies. These are:

• The duty to respond to requests for information
• The duty to proactively publish information
• The duty to provide advice and assistance to people seeking information

Duty to respond to requests for information

• Anyone may make a request for recorded information. FOISA applies to all such information^[4] while the EIRs apply to environmental information only. Section 39(2)(a) of FOISA allows an authority to exempt environmental information which the authority is obliged to consider under the EIRs. By applying the exemption at section 39(2)(a), the authority can consider the request under the EIRs alone. Authorities who do not claim this exemption for a request for environmental information are required to consider that request fully under both FOISA and the EIRs.
• The request may seek information which is held by another person on behalf of the public authority;
• Requests for information must be answered as soon as possible and within 20 working days. If a request is for environmental information and the information held is both complex and voluminous, the authority may extend this period up to a maximum of 40 working days^[5];
• A fee may be payable for receipt of the information requested. Regulations set out the basis on which fees may be charged for FOISA requests, which are subject to an upper cost limit.^[6] There are no comparable fees regulations for EIRs; when responding to EIRs authorities may charge “a reasonable amount”.^[7] Authorities should publish their scheme of charges for all requests for information.
• There is a presumption in favour of disclosure under both regimes, but the right of access is not absolute. FOISA and the EIRs set out ‘exemptions’ and ‘exceptions’ respectively under which information may be withheld. If any information is withheld, the authority must explain why. Authorities are not obliged by either regime to apply exemptions or exceptions, even where they could be applied. This means they can disclose information through choice, unless prevented by other legislative provisions such as the Data Protection Act 2018. When deciding whether to release or withhold information, authorities must be mindful of their statutory duties under other legislation.
• Where information is subject to an exemption or exception, in many cases the authority must also decide whether it is more in the public interest to withhold the information than to make it available. There is an in-built presumption in the regimes that it is in the public interest to disclose information unless the authority can show why there is a greater public interest in withholding the information. Where competing public interests are evenly balanced, the information should be disclosed.
• If the requester does not receive a response or is dissatisfied with the response (e.g. because they have not received all of the information asked for or they disagree with the authority’s reasons for withholding the information), they may ask the authority to review their decision within 40 working days of receiving the response (or, where no response has been received, within 40 working days of the deadline for the original request).
• If the requester is still dissatisfied after the internal review, or fails to receive a review response, they have six months to appeal to the Commissioner for a decision on whether the authority has appropriately handled their request. Thereafter the requester and the authority may have a right of appeal to the Court of Session on a point of law.

Duty to proactively publish information

• Both regimes require the proactive publication of information. Public authorities subject to FOISA must adopt a Publication Scheme which is approved by the Commissioner. To support public authorities in this, the Commissioner has produced a Model Publication Scheme (MPS) for authorities to adopt. Through adopting the MPS, authorities commit to the routine and ongoing publication of a wide range of information falling within the classes of information set out in the MPS.^[8] In adopting the MPS, public authorities are also required to publish a ‘Guide to Information’ which specifies the information (including environmental information) that an authority will routinely publish along with details of how that information can be accessed. Under regulation 4 of the EIRs, authorities must also ensure that the environmental information they hold is made progressively available to the public by electronic means, unless it was collected before 14 February 2003 and is not available in electronic form.

Duty to provide advice and assistance

• It is also a clear expectation under both regimes that public authorities must provide advice and assistance to people who propose to make, or have made, a request for information. This expectation is set out in section 15 of FOISA and regulation 9 of the EIRs. This could include advising a prospective requester of how they might construct their request in order to ensure that their request is successful in obtaining the information they are interested in, or signposting to other authorities which may hold information of interest. Such advice and assistance should always be tailored to the interests of the requester, rather than those of the authority.

3. Bodies which are subject to the regimes

The Scottish public authorities which are subject to the regimes are listed in Schedule 1 of FOISA or designated in an order under section 5(1) of FOISA. These include the Scottish Government, local authorities, the NHS, schools, colleges and universities, and the police. Wholly publicly-owned companies (including those wholly owned by more than one authority) are also covered by the regimes.^[9] Under the EIRs, additional bodies are subject to the regime if they fall under the control of a public authority covered by EIRs and they have public responsibilities, functions, or provide public services in relation to the environment.

Where a public authority is considering outsourcing any of its functions it should take steps to ensure that there is no resulting reduction in the public’s rights to access information through requests and proactive publication. This may be by outsourcing to a wholly-owned company which will be subject to the regimes as a Scottish public authority in its own right. Otherwise, the authority must take steps to ensure public access to information relating to the functions which have been outsourced, as set out in part 2, section 8 of this Code (particularly information about performance and finances). This might be through the provisions of any contract in place.

As noted above, FOISA and the EIRs apply to information held on behalf of Scottish public authorities, as well as to information held directly by them. This may include information held by contractors relating to the delivery of services on the authority’s behalf - particularly where those services constitute part of the authority’s own functions (as opposed to information the contractor holds only for its own organisational purposes). In such instances, Scottish public authorities will wish to consider the nature of any arrangements in place with a contractor and, if necessary, seek their own legal advice if it is unclear whether particular information should be considered ‘held’ by the authority for the purposes of FOISA and the EIRs.

4. Role of the Scottish Information Commissioner

The Commissioner has duties and powers to promote the following of good practice by public authorities. This includes promoting observance of this Code.^[10] Scottish public authorities are expected to adhere to the Code unless there are good reasons not to which are capable of being justified to the Commissioner. If the Commissioner considers that an authority is failing to take account of the guidance in this Code, the Commissioner may issue a practice recommendation specifying the steps that the authority should, in the Commissioner’s opinion, take to conform with the Code.^[11]

The recommendation will set out in writing the particular provisions of the Code with which the authority is failing to comply. A practice recommendation is designed to help the authority improve its compliance with the legislation.

Although it cannot be directly enforced by the Commissioner, a failure to comply with a practice recommendation may lead to a failure to comply with the legislation which can result in an enforcement notice being issued by the Commissioner.^[12] A failure may also be the subject of specific comment in a report by the Commissioner to Parliament.

If the Commissioner reasonably requires any information to determine whether an authority is complying with the Code (or with the provisions of the regimes), the Commissioner may issue an information notice which requires an authority to provide the necessary information to the Commissioner within a stipulated time.^[13] The notice will explain why the Commissioner requires the information and give details of the authority’s right to appeal to the Court of Session against the decision that resulted in the giving of an information notice. The Commissioner may also refer to non-compliance with the Code in decision notices issued as a result of a request being appealed.^[14] If a public authority fails to comply with an information notice, an enforcement notice, or a decision notice, the Commissioner may certify in writing to the Court that the public authority has failed to comply with the notice.^[15] The Court may then inquire into the matter and may deal with the authority as if it were in contempt of court.