Official Report 507KB pdf
Our next agenda item is an evidence session with the Scottish Information Commissioner on his annual report for 2025-26. This is our first evidence session with the commissioner and is a chance to check in with him on the major priorities and challenges for his office. I welcome David Hamilton, the Scottish Information Commissioner, who is joined by officials from his office: Euan McCulloch, head of enforcement, and Paul Mutch, deputy head of policy and information.
David, I invite you to make a short statement.
Good morning, and thank you for the opportunity to speak to you. This is an important part of the process for me in my annual programme and is a chance not only to present the annual report but to look ahead to where we are going.
The annual report for the year that ended in April 2026 speaks for itself very clearly. The year can be defined primarily by a massive increase in demand, with new challenges coming to us. The best way of showing that is the 83 per cent increase in the number of cases coming to my office in one year, which is unprecedented. The number has gone from being between 500 to 600 for many years to more than 1,000. That is putting enormous pressure on us and is making us think about how we can do things differently and better. Fundamentally, it is a demand management challenge for us. There is very little manoeuvrability for me under the legislation, but we want to try to give the best service that we can.
Happily, I can say that our productivity has matched the challenges. The number of cases that we have put out, processed and closed has gone up significantly, as have the number of inquiries and the quantity of intervention work that we do to make things better. As you can see from our annual report, on every measure, the amount that my team are doing has gone up. That is a challenge, because they are exhausted. They are a small team—we have a total of 30 people in the organisation, who do everything from the hard coal-face enforcement side work, where we look at appeals, to the interventions, policy work, media work, which is matched with some of the cases that we have been dealing with, and corporate work, which is an essential part of good governance. We have a small team that works hard. To be honest, one of the challenges that I have is trying to keep their heads up, because they can see a tidal wave of cases.
09:45
I am not in a position to match the 35-hour week that the civil service and other public authorities have moved to, because it is unaffordable for the capacity of my office. In many ways, we are having to subsidise work through my staff not taking holidays that others would be entitled to. It is a great credit to them that they are showing that commitment. I acknowledge publicly that I simply could not do the job without them—their public service effort is tremendous.
As with everywhere else, artificial intelligence is a challenge for us. I suspect that we will be talking about that throughout this conversation. We are trying to get ahead of the game. I may have some advantage, in that I have a background in AI. Although that is from many years ago, it is still relevant. I understand what AI does and does not do, as well as its risks and opportunities. We are trying to look at the opportunities, because the risks and challenges will not change. People will not stop using AI, so we need to roll with it and see how we can use it, with a framework in place to ensure that a decision will never be made by AI in our office—that will not happen. There are ways in which we can try to assist people to find information, so that they do not have to make inquiries to us. We could do that through proactive publication, coupled with AI, which would have other spin-off benefits in tackling things such as misinformation and disinformation in the public sphere. There are lots of opportunities, but we do not have a lot of time to develop them, given the fact that we have such a heavy enforcement workload.
Thank you for coming today, and thank you to you and your 30 staff. Much of your work is not known about and goes under the radar, so it is worth thanking you and your team. I am interested in sustainability. You said that there has been an 83 per cent increase in the number of cases. How sustainable is that for you and the team?
It is not sustainable with our current resourcing. I have written a budget submission for next year, which is possibly the worst year for which I could have done it, given the public sector finances. However, I need to make my submission and clearly articulate the challenges that we have. It is not simply a case of upscaling by the same amount; we have to look at things differently. We have a much more blended approach to the way that we look at cases. We will consider whether we can interact early with requesters to achieve some kind of resolution. I would really like to explore that further and get parties round the table to discuss their options where possible, so that we can put it to them, “You might not be able to get that, but you could get this.” Sometimes, the nuance of conversation is lost in digital correspondence. I am keen to explore such conversations, because I think that, if we can sort things out and encourage much more communication at an earlier stage, it would cut down demand. I am focused on demand management, but I need resourcing for it, which is what I have pitched to the Scottish Parliamentary Corporate Body.
Have you seen the increase flatline or is it continuing to increase? How do you see things progressing?
Unfortunately, it is up again this year. We have a robust set of metrics and management information that we are monitoring. We had more cases in the second quarter this year than we had in the second quarter last year. The number of cases and decisions that we are putting up is about 6 per cent more than last year. Everything is up on last year and continues to increase. We need to consider how we manage that, because we want to encourage people to use the legislation but, at the same time, satisfaction is at a lower threshold than I would like. People are not happy with things, and it is a lot of work to explain and work through the issues. One of our big challenges is that we need to get the conversation going.
I have one final question. You note in the report that 34 per cent of the appeals were machine generated. How do you determine whether something is machine generated?
We ask them.
Right. Okay.
One of our avenues is that we encourage people to use an application form. That is for two reasons. First, an AI bot cannot fill out a form, which is a good start, and secondly, in the form, we simply ask people whether they have used AI assistance to generate the appeal. That does not stop anyone who has done so, but it means that we can almost take them to one side and say that they need to think about it carefully, because AI hallucinates and gets unfocused, and they will end up getting information that is not what they originally wanted. There are many examples of where people have asked it one simple question and end up with information on 10 unrelated ones. We are therefore trying to get people to self-govern—to go back, reconsider and say, “Actually, I need to narrow this down.” That is the intention.
However, that 34 per cent comes from people self-declaring use of AI, so it will be an underestimate.
Yes. That would have been my next question. Given that you are relying on people admitting that they have used AI, the figure of 34 per cent could well be higher.
Yes, indeed.
Two days ago, we had our first appeal that was totally AI generated and did not come in on behalf of somebody. It announced itself as an AI agent: it was not a person, a legal entity, a trust, or a company, but an entirely AI system. It was looking for information that it did not get from a public authority, and it said that it wanted a decision, not just an opinion.
That is interesting. Thank you very much.
You talked about an 83 per cent increase last year, which AI is obviously helping to drive, as more people use that tool to find out information. However, is anything else driving the increase?
Yes—publicity around the whole freedom of information system. There have been some very high-profile cases, and FOI awareness has gone up massively. Public awareness of what freedom of information is had been static for about 20 years, at about 88 per cent. Last year, that figure went up to 93 per cent.
We think that that 5 per cent increase in one year is down to a number of factors. First, there is the fact that we have had high-profile decisions that people are aware of, such as in relation to NHS Fife or the Scottish Government, and perhaps also aspects related to the Ministry of Defence. There is now an FOI story in every single newspaper. We get media cuttings, and the amount of coverage of FOI, and the mentions that it now gets, is incredible—it has gone through the roof. That is part of the reason. People see it and are aware of it and want to be able to use it—and they begin to understand how simple it is to use.
However, the other aspect is the impact of AI, which cannot be underestimated. If somebody does a Google search for information, it will now push them towards an FOI request. That is the real challenge. If somebody asks Google what we would consider to be a relatively simple question and it cannot find the information, it will say, “Do you want me to write you an FOI request?” The seed is planted and they then think, “Oh yes, I could do that”—and off it goes.
I will go back to what you said about AI-generated requests. In our constituency offices, we are seeing long and complex emails. We know that they are AI: the minute I see a bullet point, I know that it is AI. You will be getting the same.
MSPs are finding that, when we get that kind of inquiry, which we know is AI generated, we have to call the constituent. As you said, sometimes the system raises issues that are not really what the constituent wanted to ask about and that are not even relevant to why they have contacted us.
I was struck by the evidence that we heard from Euan McCulloch, who said:
“With AI, it is possible for a request to go through the entire process, up to getting to us, with little—if any—apparent human intervention”.—[Official Report, Standards, Procedures and Public Appointments Committee, 26 February 2026; c 23.]
Perhaps you already do this—or perhaps there is a reason why you cannot—but, given the demands and pressures on your office, would it be desirable, or possible, for you to treat something that is generated entirely by AI with less priority, given that it has not been sent by somebody who has created it themselves?
That is a challenging one. I understand your thinking, and there is a degree of attraction to that approach; however, there are big challenges with it. Primarily, the fact is that AI can be a very good assistive technology for people. A number of people have responded to comments that I have made about it, thinking that we are going to ban it. We are not at all. There is real merit in its enabling people, particularly those with neurological differences, to formulate thoughts and so on.
That is at one end of the spectrum, but there are other aspects. This time last year, a third of our casework for a year came through in two months, from two applicants who were doing industrial levels of FOI-ing. One of the applicants even said that they had sent 600 FOIs out to public authorities in the United Kingdom, which makes you think, “This is not acceptable.”
The challenge is that people have rights, which we want to protect, but we must protect the regime as well. In the cases that I mentioned, I think that we said that one set of requests was invalid and another was frivolous because there was no obvious point to it. We deal with such requests where we can, but entries that come in at an industrial level are easier to spot and to deal with. It is harder when you get into the smaller cases. As you say, the material that we get is voluminous. The real challenge is in how we can pick through it. Ultimately, there has to be a person at the end of it, and nothing in the legislation allows us to differentiate that.
We all need to almost accept that it is what it is, and we need to have a better national conversation about the ethical use of AI by citizens and within organisations. People have been given a nice, shiny tool, and they can generate all this stuff in a key stroke, not thinking about the ramifications of it and what it means for people at the other end of it. You cannot get into a situation where you are telling it, “Generate this,” and then somebody else asks, “Can you summarise that?” I call it envelope AI—it is done for the purpose of transmitting. You tell it, “Say these three points in a letter,” and then somebody else says, “Summarise the points in the letter,” so you just get the three points again. Why bother with AI for that? Just send the three points.
There needs to be a more open discussion about what is socially acceptable AI use, because this is not a genie that is going back in the bottle. Once you get into any suggestion that a request is from AI, but the person who sent it says that it is not, how do you prove that it is? You are right that there are tell-tale signs such as bullet points and em-dashes, but there is also never empathetic AI, which is not a good thing. You never get AI that says, “Thank you for your response.” It seems inhuman because it is inhuman; it is a machine—a pattern-recognition engine.
My frustration is that, having dealt with this issue and all the associated challenges 40 years ago at university, we have not really moved on when it comes to the generative AI aspect. The same challenges and ethical issues that existed back then still exist today; they have not been addressed. We have just unleashed this challenge.
I will follow up on that. You mentioned that one individual made 600 requests. What would you say to the suggestion that, although citizens have rights to access information, they also have responsibilities and that the Scottish Information Commissioner’s office is not the toy of half a dozen citizens but is for the whole of the country? What would you say to the suggestion that 600 requests for information from one individual is of itself vexatious?
I agree, and that is what we said. We knocked out the requests on that basis. However, I sit at the top of the pyramid of appeals, so the difficulty was that the 600 individual authorities did not see that. They just got these really quite complex AI-generated requests, complex appeals and questions. They eventually came to me, and it was only when I sat down and saw the same name appearing and a similarity in the questions that I thought, wait a minute, there is actually a campaign going on here.
We had an indication that something was happening, because we had a bit of noise from the network groups that we run—or, I should say, encourage. People were saying, “There’s somebody asking some really weird questions.” The public authorities involved were talking to each other, and they were seeing that something strange was coming through. However, those were informal communications. The problem was that they were still challenging requests for those authorities to deal with, and the scale did not become apparent until the matter got to our office and we were able to knock it back.
10:00
I do not know whether you are allowed to do this, but could you ask people what the purpose of their request is and why they want the information? After all, is this not just busy work, sometimes, for the applicant?
We are blind to that under the legislation. What people want the information for is neither here nor there—the information right is the right to have the information, and it is not linked to a purpose.
I was just thinking about the balance of responsibilities.
You can reach a level of purposelessness where it would be legitimate to call an application frivolous or, potentially, a request vexatious for the authorities.
So, it would be a request for the sake of it.
Can I ask one last question, convener?
Yes.
There is a conversation taking place now, in the public space, about public service reform. Given the pressures that you are working under, the fact that the landscape is changing in front of you and the fact that you are trying to manage all of that with limited resources, what would be your ask with regard to public service reform?
Don’t do it. [Laughter.] Something that concerns me about public service reform is the unintended consequences. As a senior police officer, I lived through the coming together of the individual forces to create Police Scotland. I saw it, and I know the problems and the challenges that came with it, as well as the benefits. Reform does, of course, bring many benefits, but it brings challenges, too, and one of the challenges that I see from my new world of information governance is in pulling together organisations with different recording systems, different sets of records and so on. It will take a decade to amalgamate that kind of stuff—after all, it was only recently that Police Scotland got a single criminal history system. That is the pace that we are talking about.
Now, multiply that issue by 20 for the scale of the public sector. Actually, it is probably more than that—it is just enormous. People will be frustrated by the fact they cannot find things, and they will hit cost exemptions faster, because there will be more systems to check. Public service reform has huge implications for people’s information rights, and, from our perspective, managing and trying to keep on top of all of that is going to be a significant challenge.
Positives can come out of the process, too, and that is where we really need to push proactive publication, because it allows people to interface with different organisations in a better way. For example, there is no standard definition of social housing in Scotland, which seems crazy because, without one, how can we compare what is happening in different local authorities? Data sets are being standardised, and we should be publicising a lot of them to ensure that that data can be shared not just among public bodies but with the people, too. When challenges emerge in the care sector, for example, the question is: how many spaces are available in the sector, and where are they? That sort of thing is not clear at the moment, and there are probably different definitions when it comes to what you are counting. There is a lot that can be done through proactive publication that will help drive public service reform.
To be honest, I am less convinced about the structural benefits, because most of the issues that arise tend to be about the delivery of services at the front end. There are tools—I am thinking in particular of proactive publication coupled with the use of AI in a good way—that will allow people to see things. There could be, say, a single public services portal that would allow people to search all of our public authorities for information. That is the dream.
They are trying that sort of approach in Brazil at the moment, and we are taking a keen interest in it, too. In essence, all the data sets are made machine readable, and, because they are all the same, people can have a look at what is going on. In fact, it could also be a way of cutting down the amount of information that is needed. Using AI technologies, you ask the question and the search engine will go and find the information for you. There are no concerns about data dumping, either. It also looks at where the information came from and provides sources. It is a super-enhanced search engine to get information from the public sector. That is exciting and the kind of thing that we should be looking at. It would also drive efficiencies.
That is a clear outline of some of the benefits of AI. On standardisation of data, I recognise that there can be different approaches even in one local authority.
Ha! Yes.
Good morning. That was a useful segue at the end. So far this morning, we have looked at the issue from the user perspective and at whether it is fair or right that users can chuck in 600 requests. To flip that around, do you think that it is fair to ask about the availability of information from organisations in the first place?
I submit a huge number of parliamentary questions and FOI requests, but that is because I sometimes struggle to get the information that I need for my constituents. I can give a quick example. Amey was due to carry out work on the bridge on the A96 that spans the River Spey in Fochabers. I asked the company for a works plan, because the work was going to continue for a while and would cause a big problem for those travelling on the A96. It was not a big request, and I was not trying to be political. I was simply trying to get information. I asked for the information twice, but I was not going to get it. I submitted an FOI request, which was refused. I appealed the decision. You guys said, “Yes, that’s fine. You can get the information,” and I got it. It should not have needed to go that far.
Do we need to do more to encourage organisations, particularly those that are under strain, such as those in the national health service, to make information publicly available in the first place?
Yes is the simple answer. That is very much why I support the creation of a code of publication. There is a publication duty, but, essentially, that is based on a model publication scheme that is universally accepted as being a tick-box exercise. When someone is filling out the form, it is a case of, “We do this—tick—and we do that—tick—and here it is.”
We really need to change the culture around sharing information—you are quite right about that. When I meet chief executives, I tell them that the best way to cut down their FOI demand is simply to put the stuff out there. People should not have to ask for it, but, if they do ask for it, the organisation should just give it to them. Sometimes, I look at the requests and think, “What on earth?”
As human beings, we are quite private about things, and people might say, “I’m not going to give you that.” People need to remember—I keep saying this—that it is public information, not their information. They have a responsibility to give the people whose information it is—namely us, as taxpayers and as a society—that information and to meet that demand. It is their information anyway, and public bodies are simply the facilitators of access to it.
Of course, there are times when that cannot happen, which is where the exemptions regime kicks in. However, in 50 per cent of our cases in the past year we found in favour of the applicant. That figure has changed massively; it used to be a third. Another 23 or 25 per cent of cases were, I think, found partly in favour of the applicant; that figure used to be a third. So, now, in 76 per cent of cases, people will get the information. That is a change, which is partly down to people being dissatisfied with public services—relating to demand and the environment in which we operate—and is partly an indication that organisations are underresourced and are perhaps not making great decisions. That is a concern, too, and we need to work with them on that.
How we change the culture to a much more outward-facing one is a challenge, and that is where a code of publication would be really helpful. When I spoke with your predecessor committee last year about what that might look like, I said that I would like to see sectors designing their own codes to an extent, because what can be published in health is different from what can be published in justice. There are degrees of nuance that can be reflected within a code by agreeing sector-specific information and the types of material that should be published, allowing people to see it in plain sight rather than having to request it, because requests are what take up the time.
My confusion arises from the fact that we have had FOI for quite a long time now, yet we still have a culture of protectionism around our own little spaces. I get that, to some extent, because things go wrong and mistakes happen when service organisations such as NHS Grampian or NHS Fife are under massive pressure and are cutting staff and budgets, but there must be honesty about those mistakes when they happen or there will be a flood of requests for information. That culture change is not happening and I am not entirely sure that a code of practice is going to make it happen. However, we must do something or, as you say, more and more people, from politicians to people in communities, will put in more and more FOI requests seeking that information.
How do we truly make a transition, so that organisations are far more open about the information that they share? Also, how can we make that information accessible? At the moment, if you search a lot of those websites it is hard to find out whether someone else has already made the same FOI request.
That may be connected to a wider challenge for the public sector. Public authorities, and particularly leaders, should not take the view that they cannot admit to doing something wrong because people might lose confidence in them. They should accept that a problem has happened and that people would have more confidence in them if they said what had happened and what they were doing about that. Those are the two sides of the coin.
The data shows that most of the thorny problems that we deal with are connected to cover-ups. That might be too strong a word, because it might suggest malfeasance, but people behave like ostriches and make it difficult to see things. It would be better if people put things out there, admitted that they messed up and said what they were doing about that. That would give me and many others a lot more confidence than having people refuse to admit that they had made a mistake because other people might lose confidence in them. That always comes across as a cover-up, and, as a cop with 27 years’ service, I can tell you that cover-ups always cause problems. That also applies in my new world of looking at this stuff. We need a change in attitude, so that someone who makes a mistake puts their hands up to that, but there is real reluctance to do that, which I do not understand, because it always ends up badly.
It does, and that is the interesting thing. It would be far better to admit those mistakes early on, because they come out and, ultimately, cause problems.
Please tell me if I am pressing on the wrong point, but your organisation is also under significant budget and workload pressures. If you do not have the resources and capacity to embed cultural change, and if it is not coming from the Government, who is actually trying to do that? If it is not coming internally, from the chief executives of the organisations, it seems clear that we will see far more requests coming in, which will put more pressure on you guys and on the organisations. At the moment, it does not seem to me that anyone is really getting to grips with that and trying to change the culture. Am I wrong? Is that happening in the background?
Our interventions process looks at authority practice on a more systemic level. Over the past year, we have added to the resources that are available for that, which is already proving to be effective to some extent. If there is funding to allow that to continue, I am sure that it will carry on being effective.
We have a trial resource, until April, of two officers who can look at the public authority culture and practice side of things. They have been in place only since June and we have already managed to cut the number of failures to respond by 43 per cent in comparison to last year. That is an immediate change in the number of people who actually get a response. They were not getting anything last year, but we are now tracking that and dealing with it, because we are identifying why that is happening and turning it round.
Part of my job involves making that a boardroom problem. Too often, the issue slips too far down the corporate governance line to people who deal with FOIs, but I find that the most effective thing is to go to the very top and say, “There will be problems for you unless you deal with this.” I am not frightened to take people to court, as I have shown. That message is now getting out loud and clear, and people do not want me chapping on their doors. That is bringing about welcome change, but the culture should not come down to just fear; more than that, people should consider the issue and think, “We need to be much more different and open about this.”
There have been some changes. For example, seven years ago, the Scottish Government’s approach was pretty poor—in fact, it was very poor, which is why we intervened. By and large, we are now in the position of getting much better responses from it. The most recent figures show that 95 per cent of its responses to requests are coming out in time, which is a tremendous turnaround. I think that the figure was previously about 70 per cent—is that correct, Paul?
10:15
Yes, at the start of the intervention, the figure was about 70 per cent. Over the past three years, the Scottish Government has consistently responded to about 96 per cent of requests on time, 85 per cent of which resulted in the disclosure of some or all of the information that was requested. There has been a massive impact.
That turnaround was driven by cultural change from the top. The civil servants I speak to now as friends and so on say, “We all know about FOI now—we know its importance and we value it, and we put the information out.” We need to get that messaging out across the entire public sector.
Even our enforcement tools that do not have teeth when it comes to enforcement in court still get responded to by authorities. In the practice sphere, the key enforcement tool that can influence culture is a practice recommendation. On each occasion that we have issued a practice recommendation, the relevant authority has fully responded to it by implementing real measures.
That is good to hear. Fundamentally, the message that I would send to organisations is that, if they do not want a huge amount of AI requests to come in, they should put the information out there. In an information age—which is becoming more and more apparent online—and with the use of AI tools that can get information at the click of our fingers, such information cannot be hidden any more. Organisations just need to get it out there and, if a mistake is made, we can all work through that together at a different point.
I will segue into a different question, because I was going to come on to the point about the Scottish Government. You conducted investigations in 2017 and 2024, and NHS Fife is currently at a level 4 intervention. The 2024 investigation into the Scottish Government has never been reported on, so it is great to hear that there have been improvements in FOI responses. Is there still an issue with resource, or are you hoping to conclude the final reports relatively soon?
The fundamental challenge has always been that we have never had the resource to do that type of work, so we have always had to beg, borrow and steal from other parts of the organisation. The 2017 investigation was slightly different because it was delayed by the pandemic and there were several side issues, but it is now back on and we are at the final stages. Paul Mutch may want to come in on that point.
We are in what we hope will be, in essence, the final review. A lot of our interventions involve working supportively with authorities and providing guidance while they do a lot of the groundwork to bring about improvement. The nature of the Scottish Government intervention is that it requires a slightly more resource-intensive focus from our office, because we have undertaken a deep dive into individual case-handling records, which requires a degree of resource. That has led to a bit of a delay with that particular intervention, but we hope to conclude it shortly. As has been noted, there has been a significant improvement in the overall performance, particularly in the past three years.
Grand. Those are all my questions.
I will follow on from that question a wee bit. You talked about there being changes to the level of investment that you have been able to put in to support organisations to change their cultures. What is the next step of that process? Will you expand on that? Are you looking to share good practice across local authorities and health boards? Also, are you taking any learning from your conversations? I am sure that such activity is happening not only in Scotland but around the UK and perhaps further afield.
We are looking at taking steps to share the learning that we get from our interventions. Interventions have a massive impact; they have been enormously helpful for us. Back in 2013, I think, we started to collect data on FOI performance from public authorities. It was an international first for a regulator to undertake that kind of work, and it has been enormously helpful for us in assessing where practice is potentially falling short and in being able to step in and support organisations to bring about improvements.
Currently, we have about 16 live interventions up and running. On the interventions that have closed, improvements are being sustained. For example, we closed an intervention with the Scottish Ambulance Service a couple of years ago. It has improved its performance from 66 per cent to more than 90 per cent, hitting 99 per cent and 100 per cent in some cases. Recently—over the past year, I think—it has been sitting at well over 90 per cent, and it was awarded a performer of the year award from a UK-wide FOI award scheme. There have been some enormous successes.
We have a number of measures in place for sharing that learning and pushing it out to other organisations. We will shortly launch a new resource on our website that will pull together learning from across all our interventions and set out some of the formulae for improvement that we have seen through all the different organisations, so that we can communicate that learning more widely and share it with other organisations. Fundamentally, if organisations can get that right, it offsets the need for reviews and appeals and will help to address some of the issues of appeal numbers that we spoke about earlier. If people get the information that they are looking for at the first point of asking, that will help to resolve that issue.
That is helpful. To touch on the earlier conversation about resources being scarce—which is the case just now across every sector, I think—have you been able to identify specific improvements that you have made to support? I imagine that that is part of your request for an increase in budget.
That is a challenging question, because those two officers started only in June. However, the fact that there has already been the reduction of 43 per cent in people not getting responses makes me say, “Wow—this is really making a difference.”
We have a quarterly meeting to look at the performance of the public authorities, and we identify areas for a little bit of digging or keeping an eye. If we start to see problems, we do that. Again, I want to get in early and speak to the chief executive, to say, “You’re beginning to fail and we don’t really want to have to do an intervention, so can you fix it?” Often, they do that. We have had some really good examples of that.
The challenge is that that is resource intensive—on not just the team’s time but mine as well. It is about getting the balance right. Having the two dedicated officers has made a massive difference and I fear not being able to retain them, because that will bring a lot of the work to a hard stop. The work that we are doing has been transformational in the cultural piece. When it comes to best value for tackling that particular issue, we get some bang for our buck.
It is like crime prevention, which aims to prevent the crime from happening. It is the same for FOI, and initiative has been good.
In addition, we put the work that we take from that—the learning side of things—into seminars and webinars with public authorities, and the feedback that we get from those is fantastic. Again, credit is due to my policy colleagues who deal with that. It is really instructive and helpful. Credit is also due to applicants. We open up to them and invite them in to give some direction and assistance. We are very much focused not just on regulating on the enforcement side but on trying to make things better on the softer side of things.
On that subject, we are looking at template AI, which we can prompt engineer, to get people to think about what they are putting in and to run what they are asking through a prompt, which, as an agent, sorts it out for them and keeps it focused. We have talked about the website side of things, and we are also giving guidance to applicants and to authorities on how to deal with that. That proactive piece is important in controlling demand. It is about getting the right balance of resources on it.
You make a very good and clear point about prevention, which is an issue not only in the legal system but in healthcare as well. There is also the knock-on effect that, if you support local authorities, health boards and so on, that gives them an opportunity to shift their resources into areas where they are dealing with such issues. That prevention helps them as well.
I also asked about learning from elsewhere. Would you like to go into that?
One of the big things that we have been doing is trying to keep an international focus, both in sharing our practice and in getting examples of practice. Recently, there was an international conference at which we looked particularly at the themes of misinformation and disinformation—which, clearly, are a challenge for us in the UK as well—and of information integrity. We are taking a lot of ideas on those themes from what is happening around the world.
A lot of people are really interested in our public dashboards and the information that we display on a quarterly basis, which allows people to see how their local authorities and local organisations are performing and compare that against sector averages. That is an interesting aspect, because through those platforms we are driving a bit of accountability. A lot of people internationally were interested in that and they wanted to take it through.
We have a very good relationship with the Information Commission, as it is now called, and we have regular meetings with it to find out about where things are going, about legal aspects and challenges that we need to be aware of, and about trends. The Information Commission is seeing the same trends—it is seeing the use of AI go up. We work jointly with the Information Commission to make sure that we are aligned and that, ideally, we share resources where we can. Certainly, we are sharing our thinking and trying to look across the issues. Albeit that we have different regimes, in many ways the issues are broadly the same.
You have laid out clearly that you have a small team who are very dedicated, and colleagues have commented on the increase in the number of requests that you are getting. Can I ask for three paragraphs—maybe a paragraph from each of you—about your budget and where, if it does not increase, that might result in your not being able to provide the services that people are requesting? I am also interested in the preventative side and where in Scotland we might lose out more widely if that recognition is not there.
The system will fail if we are not properly resourced. My budget is currently half of a ten-thousandth of 1 per cent of the Scottish consolidated budget. The office provides a lot of value for money, and many people get their rights and the ability to get a lot of information from it. If we cannot keep up, that will fall apart. It is an area in which we can make a big difference. I have demonstrated that we are looking not only at a linear increase in budget but at practice changes and innovative ways to make things better for anyone and to reduce the cost of doing that. I am acutely aware of the financial pressures, and I am also acutely aware of the financial waste that I see. I need to make my case in that complicated environment. However, if we do not get what we need, there will be a pretty grim situation for Scotland in relation to people not getting their rights.
It is fair to say that, with the resource that I have at present, I can tread water. We have made tremendous inroads into the case load that we have. Recently, we finally got rid of the backlog that David inherited. Had demand continued at that level, we would be in a wonderful position, but, as we have explained, it has not. It has been a tremendous challenge to meet the 83 per cent increase in demand.
As David has also mentioned, we are looking towards alternative ways to address the problem. One key issue is engagement with applicants and requesters of information at an early stage, to seek resolution and to manage expectations. It is important that, at an early stage, we home in on applications that are clearly going nowhere—they might be frivolous or vexatious, or they might be valid but there is simply no chance of the requester getting the information that they are looking for—so that we can manage expectations, which, we hope, will lead to withdrawal or an applicant coming back with a more focused request. However, we cannot do that with our current resources. We need additional resources to allow us to focus on early engagement.
10:30
As we have set out, probably the biggest resource challenge in my team relates to our intervention activity, for which we have dedicated funding only until April. We have already set out the significant impact that such activity can have in relation to the benefits that it brings to the system as a whole. We are keen to protect that resource wherever we can and to continue that work, because it benefits everyone in the system—requesters, public bodies and us in relation to a reduction in the number of appeals and so on.
Beyond that, we have a very small team that deals with an enormous range of functions and activities across the organisation. We look after the website, media research and training, and we run events for practitioners and requesters. We pick up whatever we can. We have aspirations to do a lot of other things, but we do what we can with our small resource.
Those were really helpful answers. I recognise a lot of the arguments that you have made from my previous life, when I worked in BBC Scotland’s Gaelic department, which had a small budget and had to find different ways to do things.
How do you see freedom of information changing in the future? What changes would you like to be made to the current legislation? As you know, in the previous parliamentary session, Katy Clark introduced a member’s bill—the Freedom of Information Reform (Scotland) Bill—which was supported but did not get through the parliamentary process.
I have always been a big supporter of a reform bill, but, to be fair, that was not an earth-shattering bill. It included a lot of technical adjustments to tighten up a very good piece of legislation that has stood the test of time.
Even since that bill was introduced, new challenges have come along. We have talked about demand management. Sometimes, when people who had not been given information get it during our investigation, they say that they still want a decision, even though they have all the information. At the moment, that is their right, so I have to get an investigator to write a hypothetical decision that is of no use. I do not know what people do with it—it might be for the bedroom wall or whatever—but that is not a good use of my resources. I am not able to deal with that issue particularly well under the current legislation, and such issues have been exacerbated by high demand. I need something that enables me to deal with demand in a more subjective way and say, “I can’t see how this can bring value.”
In the world in which we now live, as you will be aware, there have been denial-of-service attacks on computers. Across the world, people are using information requests to carry out such attacks on organisations. It would be naive to think that that could not happen in this country, so we must be aware of that. It would be helpful if I had something that allowed me to deal with that.
As we look to the future, we are in a different world from where we were 24 years ago, and even from where we were when Katy Clark’s bill started its journey, four years ago. I can already see additional measures that it would be helpful to have in place. My fear is that legislative reforms of this kind happen only once in a generation, so I do not want to miss the boat on some of those things. If the bill is reintroduced, we would like to make a few suggestions on how to tighten it up. They would not be particularly controversial, but they would be legally helpful for us.
The bill’s fundamental principles—particularly the need for proactive publication, which is probably the key part of the bill—are absolutely the right way to go. Allowing us to determine whether attempts have been made to seek resolution, and whether someone has acted unreasonably, would allow us to deal with some of those demands. Let us be clear: there are unreasonable applicants out there, so we have to get the balance right. The problem does not sit only with public authorities.
I will just add, on the proactive publication element of the bill, because there has been some discussion about it, that the duty to respond to requests is already extremely clearly defined in FOI law. Public bodies understand exactly what they are supposed to do to respond to that duty, and we are able to regulate it effectively. The duty to proactively publish information is much less clear. It effectively just sets out that organisations should publish information about their service, their standards and the decisions that they make. There is not much beyond that in the legislation itself, which makes it much harder for organisations to understand what they should do to effectively meet the duty and what we should do in order to effectively regulate compliance with the duty.
The discussion around the code of practice on publication allows us to get to a place where we can set out far more clearly our expectations of organisations under that duty, including what they should publish and how publication should be aligned across sectors. As David Hamilton said earlier, that would help to ensure that information is readily available, comparable and machine readable, so that it can be accessed and interpreted by artificial intelligence tools and used to generate responses through that route. The code of practice opens up a lot of scope for bringing about much greater service improvement, to address some of the issues that Tim Eagle referred to in his questions.
It would be very valuable if the legislation required an applicant who is dissatisfied with the commissioner’s decision to seek leave from the court before proceeding to a full appeal in the Court of Session. At present, any appeal, whether it has any merit or not, has to go right through the full rigour of the judicial process. It is important that there is provision for the legislation to be tested and for the commissioner to be subject to the court’s jurisdiction. On the other hand, we have seen appeals that have no merit and no prospect of success take up a huge amount of external legal resources, as well as a considerable amount of my time and David Hamilton’s time in instructing legal representation. It would be extremely helpful if there were a way to avoid that.
That neatly ties back to our previous conversation about scarce resources and budgets.
Absolutely.
Earlier this morning, we took evidence about a CPG on social care, and I am interested in hearing your thoughts about extending FOI requests to cover social care providers.
We are very much in favour of that. There is very strong public demand for the change. A simple way of looking at it is that, if a care home is run by a public authority, you have different information rights from those that you have if it is run by a private company, despite its being paid for by the local authority. There is a lot of evidence of an imbalance in that area and of the challenges that it causes, so we need to open that up.
We need to do that in other areas, too. Yesterday, we were talking in the office about bus services. Only one bus service in Scotland is FOI-able, which is Lothian Buses, because it is council run. Although bus services provide lifeline services for people, we have no visibility of those services. Those are the areas in which we need to see expansion, because the environment is totally different from where we were in 2002. Structures change, organisations change and services have been outsourced, which we have tried to keep track of.
I previously described progress as glacial. It is even colder now, because we still do not know where we are with extending FOI to the care sector. We are seven years into the process and we have contemplated, I think, four consultations in that time. That is a hopeless situation for everyone. It is hopeless for people who want to get those rights, and it is hopeless for the organisations that face uncertainty in that area. When they look at their resourcing models, should they plan to be FOI-able or not? That uncertainty is just not acceptable. If it is not going to happen, they should let us know about it.
There is a very strong argument for the change. A lot of organisations will not agree with that, but the previous time that we designated a big sector group—registered social landlords—we found that they had similar fears, yet they are now one of the best-performing sectors. A lot of organisations have those fears, but we can support them on that journey, as we did the landlords. We did a lot of work to check what the fears were beforehand and then checked in with them after the change was implemented. Essentially, it was not a problem. I would like to think that we could use the same model for the care sector. As I said, as a basic principle, people absolutely should have the same information rights in the private care sector.
Thank you. This afternoon, there will be a debate on buses, so raising that issue might be a suitable intervention for members here to make.
As members have no further questions, I thank those who have come along to give evidence this morning. Thank you very much, David, Paul and Euan. That concludes our business in public.
10:42
Meeting continued in private until 12:08.
Previous
Cross-party Groups