Public Audit and Post-legislative Scrutiny Committee

Meeting date: Thursday, November 7, 2019

Official Report 659KB pdf

---

Freedom of Information (Scotland) Act 2002 (Post-legislative Scrutiny)

Agenda item 2 is post-legislative scrutiny of the Freedom of Information (Scotland) Act 2002. I welcome our witnesses and thank them for coming.

The evidence session will take a round-table format, with the aim of encouraging discussion. As usual, MSPs will ask questions of witnesses but witnesses can also ask each other questions. However, we want to retain some structure to the discussion, so please indicate to me or the clerks—Lucy Scharbert and Alan Hunter—if you would like to contribute. When you speak, your microphone will be activated automatically, so there is no need to touch the console.

Before we begin, I ask members and witnesses to briefly introduce themselves.

My name is Jenny Marra, and I am the convener of the committee.

I am director of communications for NHS Lanarkshire.

I am an MSP for North East Scotland and the deputy convener of the committee.

I am head of information governance at the Scottish Courts and Tribunals Service.

I am the MSP for Airdrie and Shotts.

I am the information and compliance manager at the University of Edinburgh.

I am an MSP for the Glasgow region.

I am the senior customer experience officer in Aberdeen City Council.

I am here representing the Society of Local Authority Lawyers and Administrators in Scotland, and also the Society of Local Authority Chief Executives.

I am the MSP for Midlothian North and Musselburgh.

I am the director of legal and democratic services in Angus Council.

I am the MSP for Kilmarnock and Irvine Valley.

I am the information manager for disclosure in Police Scotland.

I am an MSP for North East Scotland.

I work for NHS Greater Glasgow and Clyde.

Thank you. I will open with a question about the request process.

We have had some evidence to say that the request process can be overly complicated or can cause confusion, and that there is no standardisation of it across the public sector. Would any of the witnesses like to address those concerns?

The problem with ensuring consistency is that the legislation says that any request for recorded information has to be treated as an FOI request. Although we might ask applicants to come through a standard channel, we cannot insist on it. If they have come through an alternative channel—for example, if they are a journalist who has had a discussion with our press office and has subsequently decided that they did not like the answer—they can say, “Oh, the question that I asked was actually an FOI request, and I would now like my issue to be treated as a review.”

It is hard to impose standardisation. Across the sectors, we are happy to discuss with our counterparts the establishment of a standardised suggested approach, but we cannot insist on it being used.

Why can you not insist on it being used?

The legislation requires us to treat any recorded request for information as an FOI request.

In Police Scotland, we have a mailbox in our central processing unit, which is accessible through the Police Scotland website. All of the FOI-specific requests should go through that process. However, as Kenny Meechan said, requests can come from wherever—I am thinking particularly of requests that are made under the Environmental Information (Scotland) Regulations 2004.

The requests are considered by members of a dedicated team who allocate each one to a specific area, where it will be processed accordingly. Individuals get an acknowledgment email and, if they require it, they will get a separate response. The acknowledgment email tells them that their request will be processed within a 20-day period and gives them a link to the timeline for that. From our point of view, using that central route is the easiest way for Police Scotland to ensure that those FOI requests are processed.

You said that the same request process is followed with regard to requests that are made under the environmental information regulations. Do you find that there is confusion between the processes for the two forms of request?

We do not deal with a lot of EIRs, but, like FOIs, they can be made through other means. The concern with EIRs in particular is that individuals might make that request verbally, which means that there is an issue about how we can be sure that that request is recorded and channelled appropriately.

The EIRs are part of a slightly different framework. I am in a similar position to Sheena Brennan, in that my organisation does not deal with a lot of EIRs—proportionally, we deal with many more FOI requests.

In the organisation, there are some complexities that are challenging to deal with in that grey space in which it is possible that an FOI and an EIR might be covering the same sort of area. As administrators and facilitators of the process, our role is to help people through that. That is another example of where it would be challenging to apply consistency across the piece, because you would be relying on a variety of people across different organisations to assist any member of the public or people from a range of organisations to make best use of the processes.

Should the request processes for FOIs and EIRs be aligned?

From our point of view, that would help with regard to the administration processes, and I think that it would be of assistance to the individual applicants, too. There would be some challenges, as EIRs have a slightly different background from FOIs, and there are some differing requirements in that regard. Some work would need to be done to ensure that the administrative processes in the two systems are aligned. In practice, the ways in which the two types of requests are managed and handled in organisations are likely to be similar.

People are unlikely to specify to us that they are making an EIR request. More commonly, we receive inquiries in the form of FOI requests and we realise upon receiving them that the issue would be more appropriately dealt with in the form of an EIR request.

On consistency, we have a web form on our website through which about 90 per cent of the inquiries that we get come, and that drives the consistency of the responses. However, there are 12,000 staff members in our organisation, so there is potential for inquiries to come in via different routes and for them not to get routed through the freedom of information team.

I agree with Calvin Brown that the vast majority of requests come in under FOI. Members of the public probably recognise FOI requests a lot easier than they would EIRs and there would be benefits in having the same system for both.

On consistency, a lot of local authorities now have software to provide a more effective and efficient system, which creates a standardised way for councils to deal with the applications. There can be differences in the process simply because of the requirements of whatever package councils and other public authorities have.

After reading that some previous witnesses thought that there were difficulties with placing FOI requests, I looked at how that worked, focusing on local authorities. Any time that I put the name of a council and “FOI” into a search, it immediately took me to the relevant page, so I found it relatively easy. However, I understand that there may be different requirements in how the process works in each system.

On the issue of potential confusion that was raised in previous sessions, it is for public authorities to help people who are making requests. The system is designed so that they do not have to know anything about the legislation, whether it is the EIRs or FOISA. Every time that somebody asks for a university prospectus, that is a freedom of information request, but we just give them the prospectus. We need to make sure that we deal with the request appropriately and they should not have to worry about it. We provide central systems so that the requests can come through, but the legislation is not really designed in that way.

I absolutely agree. That is how the legislation is designed, but it does not always work in that way in practice, particularly when a public authority is trying to avoid answering the question, which is not a rare event.

I move on to a wider issue. We have had some evidence that indicates that there is a problem with organisations such as the integration joint boards, which are kind of betwixt and between. They are not listed as statutory bodies in terms of FOI, yet they are now accountable for two thirds of health board expenditure and a fair chunk of local authority expenditure. There is a danger that people are batted between health boards and local authorities when they are trying to get answers to questions that should really go straight to the IJB.

There are parallel issues for bodies such as leisure trusts, as Angus Council indicated. If somebody wants to make an FOI request about a leisure trust, should they write to the leisure trust or the council?

How do we tackle the issue? Is it case of adding the IJBs to the list of organisations that have to reply directly to FOI requests? Should we, as has been suggested by the Society of Local Authority Chief Executives and Senior Managers and others, empower local authorities and health boards to refer an FOI request to another public body? What is the view on that? It is frustrating for everybody—the health board and the person who is asking for the information.

I should mention that in my day job I work as head of information for Glasgow City Council. We have exactly that scenario in terms of our integration with NHS Greater Glasgow and Clyde. The team that handles FOI requests for both organisations is co-located, and we have the bizarre scenario in which an officer can deal with a request that has been sent to Glasgow City Council and issue a response that says, “We do not hold the information. You need to make the request to the health board”, and when the request is made to the health board, it goes to that same officer to deal with operationally.

The problem is that the legislation does not presently allow us to transfer the request. Just after we set up one of our arm’s-length external organisations, the council had a request related to information held by that body. The council dealt with the request and issued the response, which went to review and appeal. It was only at that point that the commissioner said that the request had not been made to the body that held the information and that, therefore, the commissioner had no jurisdiction.

An attempt to be helpful by transferring a request to another organisation has the inadvertent effect of depriving the applicant of their appeal rights, so it would be much more sensible if we could transfer that information.

09:15  

Listing IJBs would be part of a solution, but it would not be much of a solution. The simple reason for that is that IJBs draw up the integration plans and then issue directions back to councils and health boards, so almost all the information about the delivery of health and social care services that people are interested in is held by local authorities or health boards. IJBs hold very little information, so designating them for FOI purposes would not achieve much.

If someone is looking for information about what Mr Neil described as spending under the auspices of the IJB, are they legally entitled to get that information from the health board, the council or both?

In general, the information is held by one or both of those bodies.

Would a change in the legislation be required to protect the right of appeal in the case of a transferred request?

Yes, that would require a change in the legislation. The transfer mechanism already exists under the EIRs, but not under FOI.

Does anyone have any further comment on what councils or health boards are doing to make the process clearer or easier for the public to access? It is quite confusing.

In practice, we try to help. One of our functions is to explain how individuals can best access the information that they are looking for.

For health boards and—I guess—councils, the health and social care partnerships and IJBs issue is one of the opportunities in this process. The world has moved on significantly since the 2002 act came into force, and this is probably the best opportunity so far to look at the detail of how it is functioning and to draw out practice from the EIRs to use in FOI. That could help individual members of the public gain seamless access to the information to which they are entitled.

With regard to seamless access, I heard what Jackie Buchanan said about putting the name of a council and “FOI” into a search engine and where to go being quite clear. However, we have heard a lot of evidence that people do not find getting information from public authorities to be a user-friendly experience. I am interested in hearing more examples of what each of your organisations is doing to make the process clearer for people. A clear process will enhance their right of access.

I want to add a supplementary question to that. Dr Meechan mentioned the co-location in Glasgow of people who handle FOI requests for the local authority and the health board. However, there are six IJBs in the NHS Greater Glasgow and Clyde area, including Glasgow; I presume that there is no such co-location in the other five IJBs.

No, there is no co-location between the separate local authorities. We are trying to standardise a number of things, such as having a common information-sharing protocol that will describe the information flows between the health board and the local authorities. It will be a common protocol that will apply across all six local authorities.

We work alongside and in partnership with six local authorities and their six IJBs. Of necessity, that applies a level of complexity to the relationships. In the health board and the IJBs and with the staff who work through the HSCPs, we have a joined-up system for sharing learning, at least. We have officers in each of the HSCPs with whom we work in partnership. They are responsible for a range of corporate functions, including in relation to FOI and the EIRs, as well as complaints and other matters. We ensure that we regularly bring people together from the organisations to talk about how we do things and to share our learning.

In terms of proportion, NHS Greater Glasgow and Clyde receives many more FOI requests than any of the HSCPs, so it is probably our responsibility to share our learning with our partners in the other organisations. We have frameworks in place to do so.

There is an additional level of complexity when things are taken a stage further. There are six councils, and we also work regionally and nationally. There are FOI leads networks in the national health service, and there is a local authority framework, which SOLAR will probably have an opportunity to talk about.

The SOLAR data protection and FOI group exists largely to share best practice in this area. That involves a degree of similarity in approach, because we are sharing best practice, as identified through dealing with the appeals process at the sharp end or dealing with the awkward customers who test the systems to the limit.

As far as the public engagement side is concerned, that is not an area that we have explored in a huge amount of detail. We could perhaps pick that up.

I want to pick up the convener’s question about how we help the public. If someone wrote into us and the information was held by the health board, we would tell them that. As others have said, it would be helpful if we could simply refer on the request, but that would require a change in the legislation.

Before we move on, I want to ask about private companies. An issue that has come up in evidence is the fact that many of your organisations will have contracts with private companies that deliver services for you, but they are not covered by the FOI legislation. Should the legislation be extended to give the public the right to information that is held by such companies, because public money is being spent on those contracts?

Yes, NHS Lanarkshire thinks that that should be the case. We have three acute hospitals, one of which is run by NHS Lanarkshire, while the other two are private finance initiative hospitals, where private companies are involved. When people write in to request information across all three hospitals, we sometimes find that we hold the information on Monklands, but because the information on the other two hospitals might be held by the PFI consortiums, we are not always able to provide the consistency of information that we would like to provide. We have a very good relationship with the consortiums and the exchange of information is good, but there are sometimes differences when it comes to the level of detail of the information that we provide.

The public probably expect to be able to get consistent information, because the three hospitals are public NHS hospitals. They would expect to be able to access the same information in relation to each of them.

I would like to ask a supplementary on that, because I agree with what Calvin Brown has just said.

The main PFI contractor should hold a lot of, if not all, the information, but sometimes there are big subcontractors. Should the right to know extend to information held by subcontractors?

You are right. I think that it should.

Do people agree with extension of the FOI provisions to contracting firms?

Without saying yes or no, my experience is that the number of circumstances in which we have been unable to provide information because we do not hold it ourselves and it is held by a contractor has been very limited. As some of the information will be commercially sensitive, the council might be slightly reluctant to disclose it even if it holds it, because that could damage the contractor’s commercial interests, but it is quite unusual for us to refuse requests on the basis that we do not have the information in question.

There is provision in the Public Records (Scotland) Act 2011 whereby, if a contractor creates public records on behalf of the public authorities that are listed in that legislation, provision should be made to ensure that those records are properly managed in accordance with the records management plan. Therefore, there is already provision whereby information that is being managed under an organisation’s records management plan should be accessible under FOI.

We received strong evidence from Unison and Glasgow City Council that the council has a number of private contracts in relation to which such information is not available, but that does not seem to be what you are saying, Dr Meechan.

Unison has a particular interest in a number of our contractors. That is not the effect for the vast majority of our applicants.

When you say “applicants”, do you mean the people who ask for information?

Yes.

What did you mean when you said that that is “not the effect” for them?

With the vast majority of requests, most people are given the information that they ask for, or most of it.

So you do not think that the fact that the FOI regime does not extend to private contractors is a problem.

It is true that that restricts the scope of the FOI legislation, but the extent to which it does so is perhaps less clear.

Okay. Does anyone else have comments on whether the legislation should extend to your organisations’ private contracts? This has been quite a hot topic in the evidence that we have received so far.

I am not aware of it being a particular issue, from personal experience. On what Dr Meechan said about the requirement to publish information, I would add that the Procurement Reform (Scotland) Act 2014 requires councils to maintain a register of their contracts. It is quite detailed about the specifics. Of course, it might not provide all the information that an applicant requests, but it has a framework for that.

To pick up on a point that Calvin Brown made, it would be difficult to explain to a member of the public why information about one hospital is available when equivalent information about another hospital is not. I do not know to what extent that differentiation applies in practice. What Dr Meechan is saying suggests that it might not be quite as obvious as might be thought, but I reiterate that it would be difficult to explain why two different levels of information are available from two different but, to a member of the public, similar services.

Turning to the issue of responding to requests for information, I have a couple of points on timing. We have had written evidence that users find that responses to FOI requests are often delayed and are received on or after the deadline, and also that authorities use the 20-day time limit even when the information is ready and readily available on day 1. I ask for your comments on that. Linked to that, we have also had suggestions that the deadline for responses might be delayed in certain cases. In a previous session, we had evidence from Dr Ben Worthy, who spoke of “an anchoring effect” whereby people basically work to a deadline and, if you extend the deadline, that will just become the limit that they work to. Do you have any comments on that?

Obviously, in the terms of the legislation, we are aiming for 20 working days. We report on our compliance to the Scottish Information Commissioner, which has the performance regime very much in mind: it is classed as a failure to respond if we do not respond within 21 days. Like many other organisations, we are very keen on close performance monitoring. We have been criticised before by the commissioner, who has a specific grading in relation to our compliance rates. We have managed to improve our compliance rates substantially over the past three quarters.

In processing requests, the aim is obviously to get the information out within 20 days, although there will be circumstances in which that is just not feasible. The important thing is to make the applicant aware of potential delays or the fact that we might not be able to get them the information. We have had discussions with the Information Commissioner previously about whether it helps applicants if we are able to give a partial response within the timescale. Fundamentally, the act talks about failure to respond within 20 working days as the key element. Certainly, Police Scotland is very much aiming to get that information out within 20 working days to keep our performance rates up.

I reassure the committee that my organisation’s FOI performance is a measure that is dealt with at a board level on a bimonthly basis. Our board takes our FOI performance into consideration along with all the other performance measures that are applied to the health board. There is a significant challenge on our performance there. In line with the performance management that we do on a more operational basis and submit to the Information Commissioner, we are also pretty strong within our organisation on reporting on performance and demonstrating what actions we will take where there are performance challenges.

09:30  

How often do you respond in less than 20 days?

At the moment, around 90 per cent of our applications are dealt with fully within 20 working days.

How many within 10 days?

I do not have the data on that in front of me, although we do collate it. There is an intention within organisations to provide information when it is available. I realise that a prevalence of responses are being issued at around the 18, 19 or 20-day mark. I do not think that we can escape that point.

So you are, in effect, working to the 20-day deadline.

In practice, the majority of our requests are responded to at around the 18, 19 or 20-day mark, but we maintain a view on what we can put out earlier.

I point out that organisations are in a challenging situation with regard to delivering services. If a deadline is given to people, they naturally go by it. However, we encourage early responses whenever possible. In Aberdeen City Council, our performance is also at around 90 per cent of responses within 20 days. Complex requests come in, which may involve 60 schools all contributing towards a response, after which there is quality assurance and approval by the relevant officers, so those requests can take up to 20 days and on some occasions more. It depends on the complexity of the request.

We heard evidence from Claire Cairns of the Coalition of Carers that she had put in 32 identical requests to every local authority in Scotland and 14 of the responses were received late. Why is that? Does anyone from a council want to comment on that?

I am not familiar with what the request was. Very often, deadlines are missed because requests can be made through any channel. We are dependent on individual members of staff recognising that what they have is an FOI request and routing it through the appropriate team. FOI teams regularly receive requests late in the 20-day period, so they have already lost a significant amount of time before they can start working on them.

We have also heard from journalists that they get an email from public authorities asking for clarification on the FOI request just before the 20-day limit. Why would a request for clarification be sent just before the 20-day limit? Why would it not be sent within three, five or 10 days? Does any of you have experience of going back to applicants to seek clarification of their FOI requests?

It could be down to the number of services that are involved in responding to the request. Sometimes it might not be until further into the process that it is identified who a request needs to go to, so it may be that that service does not receive it until later on and at that point it has questions. Without knowing the circumstances, it is difficult to comment.

How many of your responses from Aberdeen City Council are late and take more than the 20 days?

Overall, our performance is quite consistent. Around 90 per cent of responses are provided within 20 working days.

So about 10 per cent are late.

Approximately.

Leanne Jobling, you are from the Scottish Courts and Tribunals Service.

We are a central unit, a bit like what Sheena Brennan described, and we try to identify within about five working days whether clarification will be needed so that we can respond within the time limits. In 2018, we had a rate of 92.5 per cent responses on time, so 7.5 per cent of our responses were late. That happens for a number of reasons, but we try to respond within the 20 working days and earlier than that where possible. Our organisation, like many others, has multiple sites. There are 39 sheriff courts and, if we have to bring in the information because it is not centrally located, that can take time.

What is your hit rate in relation to the 20-day period? Lucy McKenzie said that Aberdeen answers 90 per cent of responses within 20 days.

I have numbers from only the first two quarters of this year, in which we hit a 91 per cent response rate. In 2018, our response rate was 92.5 per cent. We are in the upper compliance bracket of between 90 and 95 per cent, according to the Scottish Information Commissioner, so we are doing quite well.

So your situation would be about the same as that of Aberdeen, in that 10 per cent of your responses are late and 90 per cent are answered within 20 days.

Yes—it is about the same.

Calvin Brown, do you know what your hit rate is?

Historically, it has been above 90 per cent. We have had some short-term challenges this year, which meant that we dipped below 80 per cent in some months, but we are taking measures to address that, and we expect the rate to come back up again.

Is there a distinction between requests for information that you have to hand and information that you have to derive from somewhere else? There could be an issue with delivering information if you do not have it—for example, if a member of the public is looking for information that requires a little bit of research. Do you distinguish between the two types of requests in your performance in relation to each of them?

Does Sheena Brennan want to answer that on behalf of Police Scotland?

I will give the committee a flavour. This year, we have improved our compliance from 81 per cent in quarter 1 to 91 per cent in quarter 3 because we have triaged what we class as basic requests.

With regard to the scenario that Willie Coffey described, we have an individual who can look at the requests and triage the basics in order to get the responses out as quickly as possible—to get them off the list in effect. There might be an easy answer, or an exemption under personal data considerations. We might be able to say that the information is already held elsewhere, or that we cannot supply the information because we simply do not have it. If we can process those requests quickly, there is a better return rate from the applicant’s point of view.

On the harder questions, we might have to source information, as other witnesses have said. We might look at a request and say, “Okay—I think that that information is kept in our statistics team, or in our operational team.” We might source information from elsewhere and then, a couple of days later, someone will come back to us and say, “That’s not in my department—it might be somewhere else.” For some requests, it is much more difficult to source information.

Asking people for clarification at the last minute is not something that we would ever want to do. Sometimes, however, because of the nature of the request and the route that it has taken, we might get certain pieces of information back and, when we have looked at them and looked at the question again, we might think, “I can’t do this.” We would then need to go back to the person and provide advice and assistance. Perhaps they could vary the request—we could tell them what we have, and ask whether there was something else that we could do. That is why we have sometimes not sourced all the information until the last minute.

It is probably important to mention that, as well as looking at the response rate and the percentage of requests that are responded to within 20 working days, quality control must be considered. Sometimes we could get responses out quicker, but if we want to be absolutely sure that we have the full information, we take a bit more time with a response. There are plenty of examples in which we have deliberately taken a bit longer with an inquiry just to be sure that we get the response right and that we have the complete information.

We also measure ourselves against the number of review requests that we get, which we try to keep to an absolute minimum. We could have a higher response rate, but we might also then have a higher review rate.

Kenneth Meechan, you have an overview of all local authorities in Scotland. Is 90 per cent around the rate at which councils are answering requests?

That seems to be about the standard level. There is some variation, but I am not aware that any councils have reported a rate that is significantly below 90 per cent. Glasgow City Council is reporting 98 per cent compliance in the current financial year, which is our best-ever result.

So you would say that the evidence that we received from Claire Cairns, in which she said that 14 out of 32 responses were late, is an exception.

I would say that it is an exception. As I said, I do not know what those requests related to. If there is a particularly complicated request that requires information to be pulled from multiple sources, it will take longer to respond to it.

On the point about what happens if additional work has to be done on a request, there comes a point at which, if someone has to do so much work on it, they would eventually turn round and say, “We do not hold the information that you are requesting.” We are not required to create new information—we are required to assemble it in a way that the applicant would like, to an extent, but not to the extent of creating new information.

Forgive me, but I am struggling a wee bit with the idea that everyone is performing so well. The committee also received evidence from Professor Kevin Dunion, who—as you will know—was the previous Scottish Information Commissioner. He said:

“failure to respond accounts for a quarter of all appeals to the SIC.”

That does not really tally with a hit rate of 90 per cent across the public sector.

It does if you consider the number of requests made to any given sector as opposed to the number of appeals that are taken to the commissioner. For the local authority sector, the total number of requests runs into the tens of thousands, as opposed to dozens of appeals. A small percentage of cases go to appeal to the commissioner, which is what Professor Dunion would be reporting on. The cases that go to the commissioner are not representative. They are the ones where something has gone wrong and, if there has been a failure to respond, the applicant wants something to be done about that.

Does any of you feel that you need longer than 20 days? The Police Scotland witness is smiling.

Yes, please.

There are a couple of ideas in my mind. There is a differentiation between the timescales for EIRs and FOI requests. I would not want us to be looking at 40 days for an FOI request.

I was not suggesting doubling the time period.

I think that the anchoring effect has been referred to. If you apply a time limit, it is likely that people will respond around that limit. One prevalent point is that FOI is about building trust; it is about openness and transparency in public authorities.

I would hope that, around 15 years after FOISA came into force, we are getting towards a place where people have more trust in public authorities. I am not certain that that comes across in the evidence that has been presented to the committee. I would not want us to look at extending the timescale, because I think that a blanket extension sends the wrong message. However, there is scope to say that, where there are particularly challenging requests, and perhaps where interaction is required between local authorities, health boards and IJBs, there is a level of complexity that would justify, on a case-by-case basis, a slight extension.

It is better to provide information in 21 or 22 days and for it to be right and useful than not to provide any information at all.

Thank you.

A number of the responses that we have received raise resource issues, particularly around staffing. For example, NHS Lanarkshire says that it is getting four times as many requests now, but the resources have not been increased to match that. The statistics seem to suggest that requests are at a record high. What action can you take, and what action is being taken, to meet the timescales, given a lack of staff resource?

As Jackie Buchanan touched on, as organisations, we are looking at software and systems that can help us to streamline the process and automate where we can. For example, if applicants can access previous responses that have gone out, they can get the information immediately. We are going digital where possible to try to make the process more efficient.

Again, it is about the sharing of best practice as well. If you do not have a technology solution, there is good practice such as fast triage of the easy requests so that they are not waiting in a queue behind a request that is very complicated and will take a lot longer to do.

On the extension of timescales, there are three main regimes for accessing information in Scotland: FOISA, the environmental information regulations and subject access requests under data protection legislation. FOISA is the only one that does not have an extension provision. That is why we would argue that, particularly for complicated FOI requests, there is scope for a provision akin to the provision that is available under the EIRs or data protection. That would allow us to say to the applicant, within the original 20 days, “We are not going to be able to make the 20-day timescale—it will take a bit longer.”

On the anchoring effect that Ben Worthy referred to, the two-stage process in which a reminder has to be sent out means that people are not working to a 40-day timescale. Our experience is that very few requests under data protection or the EIRs utilise the extension provisions. Were we to legislate for that kind of provision, it would not increase the average response times in any way. The ones that we are not presently turning around within 20 days would continue to be processed in the same timescale, but we would at least be complying with the legislation.

09:45  

I agree with Kenny Meechan about the requests that have only just gone late. We did an exercise the other day to look at the cases that were one or two days over the timescale. The issue is with the ones that take a longer time and more resources. If we could extend the timescale to match what happens with data protection and go for 30 days, we would still be looking at triaging and making sure that the quick wins could be processed quickly.

On resources, we are quite a few years down the line with the FOI legislation. We are more culturally aware and are publishing more. In May, we started publishing our multimember ward stats back to 2013-14, which has been of great assistance; it has allowed us to push requests from individuals to the published information and gives a quicker win. There are tweaks that we can make to assist the process, given that we do not have the resources or any additional information. Most of teams also work with DP, and the impact of last year’s new legislation has been substantial. We are struggling, so we need to look at everything that we do and ask, “What is best for us, but also for the applicants?”

NHS Lanarkshire has done a few things to address the resourcing issue. A couple of years ago, we held an organisation-wide review of FOI and how we manage it, from which we produced an action plan that included extra training for staff and raising awareness across the organisation. We are working on an electronic learning module on FOI that will go out throughout the NHS, not just in NHS Lanarkshire.

We have also focused on increased publication. We have analysed particular areas, such as pharmacy, in which we get a high volume of requests, and we have proactively published more information about those areas, which has reduced the number of requests.

An element of FOI is unmanageable, and that is where information needs to be provided by clinicians. There is no route around them having to take time away from their day job to source that information and get it back to us. There is no easy answer to that bit of the resourcing issue.

It is interesting that you talk about dealing with some of the issues by resorting to proactive publication. We will come on to that.

We have mentioned that FOIs can come in from anywhere, and a dedicated channel in terms of the legislation might be helpful, so that the requests come in in a set way. That has dangers in itself, in that it might not allow some requests through, but it would help efficiency.

Sticking with the process of responding, a charge can be levied to offset the resource cost, which, currently, is limited to £600, or £15 an hour. A number of the submissions that the committee has received suggest that there should be a review of the charging of fees. Should the fees be increased, or should more be done on efficiencies to strip costs out of the system?

The current fees regulations are such that very few organisations bother to charge a fee. Pragmatically, by the time you have worked out how much it is going to cost under the fees regulations and the £15-an-hour cap and 90 per cent disregard have been applied, the absolute maximum fee that you can ever charge is £50, which is roughly how much it costs most organisations to process an invoice. Therefore, the fees regulations are effectively pointless.

Does the approach need to be reviewed? If the regulations are pointless, should we put in place a different regime that would allow hard-pressed local councils to recover some of the costs?

Yes. The fees regulations under the EIRs effectively allow for full cost recovery. Again, that is not a provision that many local authorities use regularly but it is useful if you get requests that are clearly commercially motivated, as a number of them are. Whether you would want to look at having a differentiated fees model depends on the commercialisation or otherwise of the requests that come in.

I do not think that many of us want to be in the business of charging the ordinary member of the public who is asking for something of local significance to them. We are more interested in the amount of time that we require to devote to a request before we are allowed to say, “No—it’s too much.” At the moment, the calculation equates to 40 hours of work, which is more than a week’s work for a member of staff. One applicant with one question can take out a member of staff for more than a week, and we have no option but to comply with that. Staffing resources at the moment mean that that is probably unsustainable.

As one of my colleagues mentioned, the teams that deal with FOI also deal with the significantly enhanced workload that is associated with the implementation of the general data protection regulation, and it is getting to the point where we are struggling.

Are there any further comments on that?

There is obviously a difference between FOISA and FOI down south in relation to the cost levels. A number of people have mentioned that, and it should be noted.

Down south, there is a £450 cap, I think.

I do not think that I have the figure in front of me, but the figure is higher down south. It is capped at £25 per hour, whereas we are capped at £15 per hour.

Evidence that we have taken in earlier meetings has shown that there is a lot of inconsistency in how responses are made, depending on who makes the FOI request. For example, journalists and MSPs or other politicians can feel as though their requests are treated differently because of who they are. Do you accept that? If not, can you explain it?

I have a core team of three members of staff who have responsibility for processing freedom of information and EIR requests. We try to direct as many requests as possible to those staff by making their contact details available. As part of our regular training for all members of staff, we have some basic guidance on FOI and forwarding requests to that core team.

Part of the function of doing it in that way is that all the applicant’s details are stripped out of the request. We have a staff of 40,000, and we access information from the range of services that my organisation provides. When we go to individual departments to ask for information, they do not see any details about who is asking. They receive a bare request for a set of information.

I suppose that if, over time, the same people regularly made the same requests, directed at the same area, we would pick up that there was some consistency in the way in which the information was asked for. However, where possible, we try to be entirely applicant blind. When the people in my team ask for the information that they will collate, those who provide that information do not know from whom the request has been received.

I have a follow-up question, but does anyone else want to answer the general question first?

I support what Graeme Forrester said. Our process is applicant and purpose blind. The request goes out to the business area with no further information attached, and no other information is shared. It is for my team alone to know who the applicant is. I totally support there being no differentiation. Some individuals will send in a number of requests on the same topic—we might not want to class them as vexatious—and some requests are more complicated, but the process for dealing with all requests is applicant and purpose blind.

That is fairly standard practice now. The request that goes out to the information holders is generally anonymised. We do not identify who the request is from, so there is no scope for treating requests differently.

The only subtle distinction that most organisations make is that they let the press office know if the inquiry is from a journalist. They would run the request past the press office not for prior clearance but simply so that it knows what has been provided to the journalist when the inevitable follow-up inquiry comes in.

I accept that, when you gather information, you probably anonymise the request or do not share who it is from. That is about data gathering, but what about the sign-off and response process? Once the data is gathered and you have compiled the response, is there any difference? I do not think that any journalist or most MSPs would believe you if you said no.

That puts me in a difficult position. I could not assure you that there have been no such occasions. Significant investigation work was done by the SIC—

What is the SIC?

I am sorry—the SIC is the Scottish Information Commissioner. Investigation work was done in past years into the Scottish Government, so it would not be right for me to assure Anas Sarwar that everything is rosy. We can put in place systems that protect the process into which people make applications. I think that Anas Sarwar made a fair distinction between the information-gathering stage and the stage for collation and issuing.

Can you explain the sign-off process when it comes to giving a response? You have explained the information-gathering process.

We do not apply a sign-off process as such. Given the variety of sources of information that we have in quite complex clinical environments, a quality assurance check is usually carried out. A recent example is a request that we received for information about numbers of clinical procedures—I do not recall exactly what the request was for. It was passed to the part of the organisation that we refer to as business intelligence, which collates statistics and data on a vast range of our processes, both clinical and otherwise. The information that came back was a link to the Information Services Division of the NHS in Scotland, which collates data nationally on performance and other NHS matters. The reasoning behind that was in part that there is a degree of comparability across hospital sites across the nation for that type of information. We had other information that was localised, on which there was a bit of a sense check, and that was also made available to the individual. An explanation went with the two sets of data in response to the same question.

I am sorry to interrupt you. I have sent hundreds if not thousands of FOI requests to NHS Greater Glasgow and Clyde, which you probably had to respond to, so I apologise for that. Once you have an FOI request from a journalist or an MSP, who do you share it with outwith your office and the FOI team before the response goes back?

If there is a press-related request, we notify our press team so that it is aware of what has been issued.

Would you share the response with it before you sent it out, so that it knows what will be shared?

Yes, and if we are about to put into the public domain some information that might be difficult or challenging, the press team is often keen to be aware to prepare lines for—

Would the press team ever ask you for another couple of days?

I have never held anything back on the basis that someone has asked for extra time.

Have you ever amended or changed anything? Has there never been a request about what the response says, how it is framed or what might go into it, or for a bit more time?

I am not aware of applying extra time or changing the information that has been given on that basis.

Can everyone say that?

That is about the approval process. My issues relate more to the subject matter, as opposed to who the applicant is. Perhaps if the subject is more challenging, as has been said, that is when one would alert certain people to what we are putting out. The case officers make the decisions—they have the actual knowledge of the 2002 act—but there will be business areas that have more knowledge of the potential sensitivity, particularly with certain topics that are more challenging.

We are not in the business of giving more time, because—to be quite honest—our performance and getting the response back to the applicant are more key.

There will be individuals who will have an interest, and there will be certain senior staff who will want to sign something off. However, it is for us to prepare the response and to ensure that we have given out the right information and applied whatever the relevant exemptions are, because our aim is to give the information back.

10:00  

Will those senior staff who want that sign-off take more interest in a request that comes from a journalist or a politician than one that comes from elsewhere? In relation to the sign-off, have they ever suggested amendments?

They might offer more context, which is where the business area comes into it, because it will know the nature of the topic. In certain cases, we will have the bland information that we have been given, with any exemptions. In addition, there will be an explanation or context. For example, with firearms, we might explain our staffing and how we train our officers. We will be able to gain much more context from the business area, because they will have individuals who are knowledgeable on that topic. The focus is on complying with the legislation, because that is our regulatory response.

What about local authorities?

I agree with Sheena Brennan that the sensitivity or escalation of a request relates much more to its subject matter than to the identity of the applicant. With some subjects that are known to be sensitive, we have a discussion with senior officers in reaching a decision. The FOI team itself will not know what is sensitive, in the sense of knowing whether releasing the information will be harmful or damaging. As I am pretty sure is true across all sectors, we rely on the information holder identifying potential sensitivity. The FOI team then take that response and deal with it.

On the suggestion that somebody might try to interfere, we all have independent internal review processes, and I am certainly not aware of anyone trying to interfere with an internal review process. An internal review should be able to say, “We hear what you are saying and that you do not want this information going out, but there is no legitimate FOI basis for withholding it, so out it goes”.

Have you ever been asked for more time or amendments?

We have been asked to make amendments, usually of the contextualisation variety: although we might have the answer to a question, it would be misleading if it was presented baldly without the surrounding context. Releasing bald information without putting it into context would not do either the organisation or the applicant any favours.

Is that the same for everyone else?

We have a standard sign-off process, which is that any inquiry that relates to a director’s area of responsibility is ultimately signed off by them or a nominated individual. Certain inquiries go through me for sense checking. MSP inquiries would be included in that, usually because I have greater awareness of the context and maybe some background information.

The amendments that we make at that stage are similar to those that we make in other areas, in that we add additional context because we feel that, while the response might comply with the requirements of the legislation, it does not tell the full story. That is where I am likely to request an amendment to put in additional context and information.

Do those who get inquiries from MSPs ever wonder why they send them to you and do not just ask the minister those questions?

Would anyone like to answer that question?

There is silence.

Okay. I will ask a quick follow-up question on that. Graeme Forrester said that, if a press request comes into him, he refers it to the press team. How do you define a press request?

Based on who presents the request to us; it is probably almost as straightforward as recognising the names of journalists or the email addresses that are used to submit them.

Is it just journalists’ requests that you refer to the press team or are there are other categories of people whose requests you would consider a press request—would the requests of MSPs, councillors or other elected politicians fall into that category?

No. As an organisation, we have a relationship with the press. As I said, when we get a request, who presented it is usually identifiable—primarily because it comes into the FOI inbox as an email with, for example, an “@guardian.co.uk” address.

I am trying to clarify which requests you refer to your press team. Is it just those from journalists, or is it requests from journalists and politicians?

We would provide notice only of something going out to a member of the press, so that our press team can be prepared in case follow-up questions arise from it.

So, as Mr Sarwar said, if he put in a request to you, you would not refer it to the press team, and the response would just go straight back to him, without that referral.

Yes. It would be dealt with—

Calvin Brown, you have said that, at NHS Lanarkshire, if requests come in from politicians, they are referred to you, as the senior person.

Just to clarify that, in Lanarkshire, the freedom of information function is managed within our communications department. We manage freedom of information requests, media inquiries and MSP inquiries on behalf of the organisation. By default, we have oversight of all of those.

We have been talking about exemptions, and I would like to explore that a wee bit further. A Scottish public authority can withhold information in response to a request if it falls under one of the exemptions that are detailed in the act. I guess the most common point is that the request has to comply with the public interest test. There is written evidence, however, suggesting that the exemptions that are available under the freedom of information legislation are sometimes applied too broadly, particularly in areas of commercial confidentiality. A number of examples have been given, such as queries about public-private partnership and PFI contracts. Do you have any thoughts on that? Do you agree? Do you disagree?

I do not think that we are overapplying the exemptions in the local authority sector. The type that mostly gets criticised is the section 30 exemption, on

“effective conduct of public affairs”.

The advice that I give is that that is the exemption of last resort. There is a requirement for a private thinking space. Applied properly, section 30 is absolutely fine—as long as we do not get carried away. Just because we are having an internal discussion, that does not make that discussion exempt. Just because a discussion involves a commercial negotiation, that does not mean that it is commercially sensitive.

We have done a piece of work examining the commercial exemption from the perspective of competition law. Our main concern is not “Is it a number?” It is more one of whether that number would have the effect of distorting future competition when we go back to retender. It is a matter of taking a slightly more refined approach.

We have not felt any particularly adverse consequences. On the occasions when we have applied exemptions and the commissioner has overruled us, we have not seen an adverse consequence. Other than the personal data exemption, we do not overapply them.

If there is a perception that the exemptions are being applied too broadly, would you agree with that or not?

At the University of Edinburgh, we only ever apply exemptions where they meet the tests and it is legitimate for us to do so. We spend a lot of time working with colleagues to understand their concerns about disclosure, if they have any. We might have to say, “I’m afraid that doesn’t meet the test,” and the information has to go out.

In my experience, that perception is not the case.

At NHS Lanarkshire, we do not like applying exemptions. If we are seeking information and a service comes back to us saying that something is exempt, we will not take that at face value. We will ask to see the information so that we can make our own judgment on it, and we might challenge it. We always feel that we need to be in a firm position, should we be reviewed on the request concerned, such that we know that it was legitimate to have applied the exemption.

I echo that point of view: I do not think that exemptions are overapplied. We have a robust process in place around the use of exemptions. Some of the feedback that we have received concerned section 30, and we think that it might be helpful to have further guidance on its provisions, as exemptions under that section can cover a wide variety of things. On some occasions, it could potentially be applied incorrectly. If the wording of those provisions could be amended, or if further explanation could be given, that might be helpful.

As the others have said, when we gather in the information, it is for the business area to evidence any harm, which it is then for us to assess, as case officers with the knowledge to determine whether an exemption is applicable with regard to the withholding of the information.

The spirit and principle of the act is that we should provide the relevant information if we are holding it. When an individual is concerned about the exemption that might have been applied to the withholding of the information, they have the right of review. That involves an independent assessment of the request from start to finish, to say exactly what has been dealt with, and the individual can then appeal to the SIC. We have all had decisions where the SIC has not supported our use of exemptions and we have had to learn why there was not, in fact, a match—it is a learning process, and, over the past 15 years or so, we have all varied our position on certain exemptions. However, I would not say that we are overly using exemptions.

Do you have a ballpark figure for the percentage of FOIs that fall under exemptions?

I see that nobody feels that they do. Do you have any further questions on this issue, Colin?

No.

Okay. Willie Coffey will ask the next question.

I want to examine record keeping and proactive publication of information. The panel will probably be aware that issues have been raised during our consideration of this matter about the possible failure of Government to record and to keep minutes of decisions and so on. A number of examples of such concerns have been presented to the committee. We know that the act does not require information to be recorded, or even created, as Dr Meechan said. What are your views on that? Are we recording and keeping the correct type of information, the information that the public would like to see, or could we be doing more to improve what we do in that regard?

It is difficult to legislate to compel authorities to keep information. How would you actually frame that? It should be borne in mind that the papers and minutes of local authority committees and sub-committees—where the more significant decisions tend to be taken—and meetings of the full council already require to be published.

I have a brief supplementary question following on from Colin Beattie’s question. The Scottish Courts and Tribunals Service is in a unique situation regarding exemptions, whereby it is not required to release records until they are 15 years old, and after that, there is a requirement to consider whether they can be released. Leanne Jobling, can you talk about that situation and tell us whether 15 years is a suitable period or whether that needs to be reviewed?

Section 37 applies to the Scottish Courts and Tribunals Service with the effect that court records are exempt. Previously, the period was 30 years, and it has been reduced to 15. I am not sure how much difference that change makes, but most of the records that we hold, by their nature, concern either criminal or civil case court proceedings and, once that exemption falls, we have to look at the section 38 exemption. Further, we have found that our consideration also involves section 12, in terms of costs, because we have to do quite a lengthy assessment of whether court records can be released, based on the personal data that they contain—we have to determine whether people are deceased and so on. The cost of that assessment is not covered within the cost requirement. The cost of doing any redaction is included, but looking at all of that and making a decision can be a costly process, especially in a High Court case, where the records contain information about witnesses and victims and so on. Personal data has to be exempt and, when the exemption is applied and the redaction is done, there is a question of whether it is worth while putting the record into the public domain. We must consider that issue, compared with the cost that is involved in terms of our staff, because that is not covered.

10:15  

What is the solution to that. Might it be a fee?

I put two options in my submission: we could consider changing the exemption period; or we could reconsider what we could include in the cost, in relation to our unique situation.

The issue of what should be recorded was raised a number of times with the committee. You would expect the minutes and agendas of organisations that have those things to be made available through FOIs. However, for organisations and departments that do not routinely have records of minutes and decisions, should keeping those become a requirement in the act, or should that matter sit alongside the act so that the public can gain access to that kind of information?

The absence of formal minutes of meetings that has been identified in some organisations is mostly driven by the fact that none of us have the admin resource to take formal minutes any more and so are reduced to doing an action note at the end of the meeting. I face that scenario myself, with the recent loss of an admin resource. It is not because I am trying to hide anything; it is because we simply do not have the time and luxury to do full-blown minutes for anything other than the formal meetings of full council, committees and sub-committees.

To go back to the point on proactive publication, there are two ways of doing that. One is the “Here are our stats” approach that we heard one of the health board representatives describe, where a set of information is identified that the body wants to make public, which is great. Again, a lot of us do not have the resource to do that as much as we would like. The other approach involves proactive publication in response to the FOI campaign. That has been done very successfully by Glasgow City Council and the City of Edinburgh Council. In those cases, when there has been an issue that is of obvious public controversy, the flood of FOI requests has been forestalled simply by saying, “Here is all the information that we have. We are going to make it available on a website.” That has been a very successful strategy, and I would recommend it to anyone else who is dealing with a controversial issue.

Should other organisations that do not do that adopt that model? Should there be more proactive publication of information? Should the information that is sent back to a requester be made available to a wider audience, where appropriate?

Some organisations have disclosure logs—Moray Council and, I think, the City of Edinburgh Council, for example. They are a good thing. Of course, they are a resource in themselves, and you have to go back through the request and take out the requesters identity and so on. There is a self-populating disclosure log on the What Do They Know website, which automatically web-publishes any responses that are sent to it.

We started our disclosure log in February 2018, and all our responses are published on the web within seven days, so anybody can access them. It has been a useful tool, because we can suggest to business areas that, on the basis that we have just published a response on the internet, we should proactively publish that information.

To go back to the recording of minutes and so on, sometimes it is about the appropriate governance route for the organisation. You want to make sure that at least you have an action log if someone comes back and questions your decision making at a later stage.

On some of the regular requests, we try to push for the multimember ward stats to be published, because those were regularly requested. It is the same with expenses: that information is regularly requested, so we should publish it. Doing that saves us from responding to requests, because we can point to the information that is already published. That matches with the aims of the Information Commissioner’s model publication scheme.

Are there any further comments on proactive publication?

We want to proactively publish more. Where we do so, we find that it can be a useful tool. However, we also find that many of our applicants are not satisfied by what we publish and want something slightly different. Therefore, we have to create bespoke reports for them to provide information that is slightly different or slightly outside the timescales to which the exemptions apply. Because we cannot say, “It is going to be published very shortly. Can you wait for that?” we end up having to do a lot of work outside of the proactive publication planned resource, which is very frustrating.

If anyone has anything burning to say that they have not had the opportunity to say, they can say it now.

As there are no further points, I thank witnesses for their evidence. I will suspend the meeting briefly for a changeover of witnesses.

10:20 Meeting suspended.  

10:27 On resuming—