Standards, Procedures and Public Appointments Committee [Draft]

Meeting date: Thursday, February 22, 2024

Official Report 670KB pdf

---

Scottish Information Commissioner

Our next agenda item is an evidence session with the Scottish Information Commissioner. I welcome the commissioner, David Hamilton. David is joined by Euan McCulloch and Claire Stephen. First, I congratulate you on your appointment, David. This is your first battle—meeting—with the committee. The principal purpose of our session today is to talk about the annual report. I hand over to you for some introductory comments.

Thank you, convener. I thank the committee for the opportunity to speak to it today.

This is my 16th week in post. It has been an extraordinary past 15 weeks, in which a lot of things have happened. In fact, it was at the beginning of my first week when we had the opening salvos between the United Kingdom Covid inquiry and the Scottish Government, and that pretty much set the tone for my period of time in office so far. Since then, I have also been to the Court of Session, we have had further UK Covid inquiry drama, let us say, and there have been a number of announcements regarding legislation. I have had what I was expecting to get in my first year in those 15 weeks, so things have been fairly fast paced.

I am genuinely honoured and proud to take on the leadership of the organisation and to take on the role of Scottish Information Commissioner. I have a fantastic staff, two of whom are with us here today—three, in fact, including my colleague at the back of the room—and I am really impressed by the dedication and commitment of the staff in St Andrews to getting to the purpose of freedom of information, which is giving access to all.

I need to pay recognition to the giants who have gone before me and on whose shoulders I stand: Kevin Dunion, Rosemary Agnew and Daren Fitzhenry, my immediate predecessor. They have left me an organisation and, indeed, a regime that are in a good position. Despite a lot of the narrative, which we will no doubt explore a bit more, I take a lot of comfort from the fact that freedom of information is working well in Scotland. There have been a number of high-profile incidents, which we are, of course, addressing, but, as a whole, it works well.

I took office back in October 2023. That was just after the annual report and accounts were laid by my predecessor, Daren Fitzhenry, so it is not my report, but I recognise and agree with everything that is in it, so I will certainly do my best, with the team. If there are any particular questions on that, we will be able to cover them.

It is probably worth saying that, since then, as well as the issues that I have already talked about, there have been a number of other developments, on which I am perhaps more qualified to speak. First, there is my requirement to lay a strategic plan before the Parliament. That happens every four years, and it has fallen on me to set my next four years of work with relatively little experience. My approach to that has been to do my best in setting out a plan, but I will revisit it next year, and I will make sure that it is appropriate and just.

It is important to set out some of the tactical priorities, which I have recognised already, and I will cover those in my further remarks. Workload stabilisation is a key one. Essentially, that involves dealing with the backlog that, unfortunately, we have in the office. There is also the matter of building interventions and the capacity for that, which I consider to be one of the jewels in the crown of the toolbox that I have. There is then the role of supporting and promoting legislative change, which is a fairly hot topic just now.

It is unfortunate that we have a backlog, which has built up. As with many organisations, that is partly down to Covid and its legacy, but we are now dealing with it. Fundamentally, we could not keep up with the demand that was coming in, but we have now put measures in place whereby we have stopped the bleed, and we have control of the situation. We are dealing with the backlog in a managed and slightly different way, which has generally been well received across the organisation.

Ultimately, that preserves the system for everyone. My concern was that, if someone were to put in an appeal to my office today, without any action being taken, they could wait for 18 months or two years before it was even considered, which is not an acceptable position to be in. We have now made it a straight-through process, and all the cases that have come in since the beginning of January are progressing straight through to allocation and investigation.

That is for dealing with the current cases. Of course, we need to deal with the backlog, too, and we are working on that. Additional resources have now been confirmed by the Scottish Parliamentary Corporate Body to help us with that. We are biting our way through that, and we will get through that chunk as well.

We are taking a slightly different approach, which involves pairing up cases and matching issues. So far, it looks promising from the point of view of getting there. Essentially, we are preserving the current system and dealing with what we have to deal with from the past.

I mentioned interventions. There are two major Scottish Government interventions just now. One is a long-running intervention that we hope to bring to a conclusion by the beginning of next year. We are in a good position on that one. It has sometimes been described as a game of two halves, but it is probably more of a game of four quarters. It was bad, then it got good, then Covid happened, then it got bad and now it is getting good again. We are now seeing exceptional performance, but that needs to be sustained, and we are checking the sustainability of that general performance.

The second intervention is unrelated and it is to do with informal communications, which we will, no doubt, touch on more. That is a live intervention. I hope not to have to go into too much of that just now, because we are still at the evidence-gathering stage and are pulling in the information. Once we have that, we will be in a position to undertake better consideration, and perhaps we will be able to delve into that more in a future evidence session.

Finally, on the legislative aspect, it was disappointing that the Scottish Government decided not to go down a primary legislation route. From our perspective, some legislation requires to be looked at. However, we welcome the fact that at least the section 60 and 61 codes of practice under the Freedom of Information (Scotland) Act 2002 will be reviewed. We are already engaging with the keeper of the records of Scotland and the Scottish Government on how we can improve that.

The other bill is Katy Clark’s proposed member’s bill. We will wait to see where that goes. Some interesting ideas and concepts have been floated through the consultation. We will wait to see what the final detail will be, but we are keen to see a more agile way of expanding the coverage of freedom of information to a number of organisations, not through a gateway clause—having considered that carefully, we think that that could cause more problems than we are looking for—but through a more structured timetable that could perhaps involve Parliament on designation, not just the Scottish Government.

Those are my opening remarks. I am happy to take questions.

Thank you, David. Before I leap in, I put on record my and the committee’s thanks to your predecessor, Daren Fitzhenry, who was the principal author of the annual report. It is interesting that, in his opening remarks in the annual report, he commented:

“It has been a privilege as well as a pleasure to be at the helm over the past six years, and particularly to work with such an excellent team.”

The team obviously has its commissioners very well trained, but that reflects your role as the head of a team, so I thank Daren for the help and assistance that he gave to the committee, his openness towards us and, more importantly, his role as Scottish Information Commissioner over the previous period.

David, you set out your reflections on your first few weeks in the role. We will obviously explore your view of where freedom of information is in Scotland. It is based on a platform that is in a good place, but we seek improvement. You mentioned your four-year strategic plan, which is due to be laid this year, but you also mentioned revisiting it next year. Do you intend to extend it beyond 2028 to 2029, or will you consider a three-year plan once you have a better understanding of the situation and have had the opportunity to input your priorities?

If I could, I would, but, unfortunately, I am constrained by the four-year cycle. What I have in the strategic plan should stand the test of time anyway, but it would be wise to reflect after a bit more time in the job and once we have a bit more certainty regarding aspects such as the extension of FOI to other agencies. That was one of the difficult calls. The temptation was to tinker with what was there from last time, but the reality is that, as soon as you start picking at it, you have to deal with the issues.

It is more than a refresh. I am proud of the plan, and I think that it will stand the test of time on its own merits. However, I would like to have clearer certainty about the legislative picture next year, and I think that we should be in that position.

So, rather than a new strategic plan, it will be more of a one-year analysis of where we are, but also a three-year forward-looking analysis of where you would like to get to.

10:00  

Absolutely. The particular challenges of the first year will be different from those of year 2 onwards.

That is helpful—thank you. I am now going to throw you at the mercy of the committee.

Good morning. I would like to explore the backlog and the case load numbers. You say that you have seen the number of cases reducing. Can you give us a sense of why that is? Do you anticipate that that will continue to be the case?

Our demand has been fairly steady over the past four years—it has been up and down. The difficulty has been with matching that demand to resourcing. The throughput of work has increased, and the staff have responded well to the challenges. Despite all the system changes that my predecessors made, fundamentally, the issues came down to the fact that there were not enough people to deal with the accumulating demand. We now have a much leaner operating model for workforce planning, which ensures that we do not have any gaps in recruitment. We are much tidier and cleaner on those things, so that we do not let that gap run away again.

We are now in a good position on that. Since I started, I have had five new members of staff. Having a new member of staff every three weeks is not bad, but it is probably not a sustainable increase. However, it has made a big impact on morale among the staff in the office, because they see that we are keen to fix the situation.

It is important to recognise the complexities of some cases, which has been a surprise to me. With the new-boy perspective, I came in and said, “Wow—I would’ve thought that that would’ve been an easy decision to make,” but then I began to read the arguments and see the complexities. Some of the issues have been very technical.

You will be aware of the Lochaber cases, which involve a significant amount of public money being used to support a vulnerable part of the country geographically. The complexities and, to be honest, the responsibilities of decision making rest heavily on us when we make those calls. We need to get those right, and we need to bear in mind not just issues of legal challenge but what is the right thing to do for the people of Scotland and for communities.

I was going to ask about complexity. Clearly, such cases bump into the cost restriction at some point, which I suppose puts a limit on how complex cases can get before they breach that.

It does. The cost limit has not changed in 20 years, since the legislation was passed, which seems a bit of an anomaly to me. The threshold is £600. If we were to index link that, I suspect that the figure would be nearer to £2,000 or so. I do not know whether my colleagues have an exact number on that, but the figure would certainly be way above what it is. There is a question about whether that needs to be changed, but that is a primary legislation question.

Very often, the more legally complex cases—the cases involving complex arguments in relation to exemptions—do not engage the cost limit exemption, because matters such as thinking time in relation to applying exemptions cannot be taken into account in costing a request.

I am sorry, but are you saying that the cost number does not include all the costs?

Basically, yes. You cannot take account of the time that is required to think about whether a particular exemption applies in applying it.

Right—so that is excluded from the cost calculation.

Therefore, legally complex matters will not necessarily engage the cost provisions.

Okay—I understand.

Mr Hamilton, you mentioned redefining the process. I think that there is a different triage process and so on. It is good to hear all that. More work on proactive release of information in a standardised form might help, so I assume that that is on your agenda, but will you confirm that that is the case?

Also, to what extent are you looking at new technology, such as artificial intelligence and so on, to speed up the process?

There is a really interesting perspective with AI just now. I prefer to call it “assisted technology”, rather than “artificial intelligence”, because I think that the “AI” badge takes it to the wrong place. We are engaging with other regulators across the UK to see how AI is impacting elsewhere. We already know that there are artificial intelligence packages that are doing freedom of information requests. [Interruption.] Yes—I know.

In order to respond to that, the authorities need to have an equality of arms to answer requests, which means having AI packages. The other approach to that could involve much more open publication and a self-service aspect, and that is the kind of model that I tend to favour. Otherwise, we get into a sort of arms race, which does not really get us anywhere, as it is just about who has the fastest computer. I think that most benefits can be achieved in changing the culture through publishing by design. That is where the whole publication scheme aspect needs to come in.

It is interesting that you can see a culture. I suspect that Stephen Kerr will jump on that, so I will leave it to him to do so.

Is there any calculation or sense of how much the whole process of pulling information together for FOIs costs across the public sector?

There is not, and the question is how we measure that. That will mean different things to different people, and there will be different costs. I would encourage public authorities to start considering how they can cut down their FOI response costs. I would say that, if people can self-serve, they will not have to make FOI requests. Enabling people to go to a website and get all the information that they require seems intrinsically to be a much more sensible approach than making them have to ask somebody to give out something that is in the cupboard.

Could that have a significant impact on your case load?

Yes. Last year, across the country, there were 84,000 freedom of information requests that we know of, which represents a significant amount of data processing. What if people could do it themselves?

The Scottish Environment Protection Agency provides a good example. A lot of consultants use FOI to get information but, while SEPA is reconstructing its information technology infrastructure, it is encouraging the consultants to self-serve, as they are quite good at that—they understand data sets and how to put things together. With tools such as Power BI, there are lots of new things that people can start using in a more imaginative way. That is where we need to go with the next stage of publication, and we need to move away from the current publication schemes, which are well out of date.

I applaud what you have just said about transparency—that is effectively what you have been talking about. In your initial reflections to the committee this morning, you discussed how you felt that FOI was in a reasonably good place in Scotland, but that is not the same thing as saying that the culture that surrounds transparency and accountability is in a good place.

This is a difficult question, but I do not think that you will ever be in a better position to answer it, because, after only 16 weeks in post, you are brand new. What is your assessment of the overall public sector culture in respect of transparency, accountability and accessibility?

It varies. The information teams on the ground, across the public authorities, are hugely committed to transparency, accountability and accessibility. They are very keen to do things in that regard. The challenge comes further up the tree. There is resistance at the top of organisations, and there—

That is where I am pointing you.

There is a piece of work to be done around the valuing of the work that those teams do and ensuring that its importance is understood.

The public attitude surveys make it clear that people have more trust in an organisation—I think that it is about 75 per cent more trust—if it has a good freedom of information regime. That goes back to the fundamentals of open governance—not only in Government, but across the public authorities. We need to encourage people to appreciate the fact that, if they are open with their data, people will trust them.

What are the obstacles to that? What is seen as a barrier by the senior echelons of public sector organisations? What is the downside?

There is a reputational aspect—that is, a concern about the reputation of the organisation. There is also a lack of investment in some of those teams because of an attitude that was summed up in a comment from a health board, which was, essentially, “We are trying to save lives here; why do we need to be answering freedom of information requests?” However, you just need to look at what is going on in relation to hospital inquiries and so on to understand why that does not add up. Nonetheless, that attitude prevails among some at senior levels.

We have also seen that the right senior people making the right decisions can turn organisations around massively. The Scottish Government is a good example of that. The new permanent secretary has grasped FOI with both hands, and we are seeing the fruits of that labour. The merits of that approach are now embedded in the culture of the organisation and its management.

You are targeting the people at the top.

That is where my laser sights are moving to next.

Good—they are in the crosshairs.

Absolutely. I want to get into the authorities and have those high-level conversations. I want to say, “This is why it matters. These are the benefits for you—and, also, you have to do it.”

Do you have all the powers that you need? Has Parliament granted you everything that you need to create that leverage? Have you got the leverage?

Some tweaking is perhaps needed. We have seen some pretty bad comments publicly regarding actions that I have described as subverting the principles of FOI legislation. That needs to be dealt with. It seems bizarre that what was done in that case is acceptable legally. Had there been a live freedom of information request with regard to the messages in that case—there may yet be one; I do not know—then what was done would be an offence. However, if there was not a live FOI request, it would not be. That is a gap, and I think that we need more teeth regarding that cultural piece. If you try to evade FOI and get caught doing that, there should be some kind of penalty.

We need to give St George a bigger spear to take on the dragon.

Yes.

There is provision in the section 60 code of practice—and has been for some time—for senior management responsibility for FOI in every organisation.

But culture—

Yes, to a degree, that relates to culture as well. We have pursued interventions and, in at least one case, made a practice recommendation on the basis of issues relating to senior management taking responsibility for FOI within an organisation.

It could well be, though, that some of the people who have served at the top of some of those organisations for a long time are simply not suited to leadership in the more transparent and accountable culture that we would all like to see across Government.

They may be, or they may not be. That has to be considered on an individual basis. I have seen some excellent leadership and some less excellent leadership.

Good morning. To start with, I will follow up on some of Ivan McKee’s points.

David Hamilton, you spoke about the backlog. What does the backlog look like? At present, what is the longest that a case has been sitting in that backlog? How do you interact with people whose cases are in that backlog and update them on progress?

We have a project called “project blue”—I was actually FOI-ed about whether there was a reason for the choice of colour, which I suppose shows that the system is working well, but there was no reason for it. It was just a random colour.

Currently, we have 329 cases in our backlog, including those that we are still validating as to whether they are live cases. Unfortunately, last November, we had a perfect storm when a significant surge in cases—we were up to more than 70 that month—coincided with some staffing challenges in the office, which slowed things down. However, we are back on top of that again.

10:15  

Our oldest case, currently, dates from 14 June 2022. I think that we would all agree that that is absolutely unacceptable, but it is a matter of fact that we have to deal with, and we are dealing with it.

On engagement, we have explained clearly to all the stakeholders how we are dealing with the backlog and the rationale for that. By and large, most people entirely accept that and see the benefit of what is being done, which is about protecting the whole system, not just the few.

We have also been briefing the public authorities on aspects of that and trying to be clear about how we are trying to move through it. We have asked them to actively review the cases because, often, as cases get older, the rationale and reasons for not releasing the data change. We have also asked the applicants whether they wish to review cases to see whether they still need the data and whether it is still relevant, because the story may have moved on and they might need something different.

In truth, we have had varying degrees of success with that approach. A lot of people, particularly the applicants, want a decision. Sometimes that can be a fairly academic position involving the principle of the thing, but it is their right to have that decision and, if that is what they want, we will go through the process.

I suppose that the biggest challenge is in ensuring that we keep the two things going. We will continue to report everything as a whole, but we now have some sub-context to be able to say that the new cases that are coming through as of 1 January are going straight through and are being dealt with, and that we are dealing with the backlog separately as a contained and definable project. We are working our way through that and trying to pair things up and look at themes. We are also trying to find specialist resources that are good on particular aspects in order to deal with things not necessarily chronologically, as we would usually do, but with the best approach for the whole system.

Some people are not happy about that, and I entirely understand that. However, I think that the majority think that the approach makes sense and is the right way to do things. We just need to carry on with that.

If someone is sitting in the backlog, what update on their specific case do you give them? There are 329 cases, the oldest of which is from June 2022. Are you giving people a full picture of where you are? Exactly what information do you give to people?

What we have told people so far is that it is not a case of being number 15 in the queue, for example; it is more a case of saying, “Here’s the approach we are taking.” For those with multiple applications, we try to empower them and give them a say by asking them what their priorities are, because they might want us to prioritise an application that is further down the list than ones that we would otherwise get to first.

We have regular contact with people to give them updates on their cases. That is an important part of service delivery. We record all those contacts and ensure that we do everything that we can to keep people in the loop.

Do you give people a timescale for when you think that the issue will be dealt with?

I will ask Euan McCulloch, who is head of enforcement, to answer that question.

We do not do that at present. As we go through the backlog and get a better picture of it and the cases that are more ready for prompt resolution, we should be in a better position to do that. There are undoubtedly cases that will be more straightforward to address than others. That is part of the triage process that we are initially going through with the backlog. After that, we should be in a position to have a good idea of how long the remainder will take.

On our website, on a monthly basis, we publish the status of every live case that is open with us, which is in addition to the regular contact that our investigators make with each applicant.

It is understandable that applicants who have been waiting for some time will want to hold out for a decision. That is coupled with the fact that we get a fair number of applicants who are, I think it is fair to say, quite entrenched by the time that they come to us, which is probably due to a number of factors. There will be a good number of cases in which the FOI request is tied up with other issues that the applicant has had with the authority, and in some way or other, the relationship has broken down over time.

Your oldest case is from June 2022. Is that an outlier? What is your second-oldest case?

It is a bit of an outlier. The second oldest is a couple of months newer than that, as I recall.

That is helpful. Thank you.

We see backlogs in other areas of our work, and we see that providing a good response and regular updates eases the frustrations of people who are in that backlog. The update should reflect what you are actually doing rather than what you are trying to work on.

I agree entirely with that. The customer services piece is important in giving reassurance to people that they are not being forgotten. That is one of the risks that we identified. We do not want it to look as though we are just ignoring the backlog and sweeping it under the carpet. As far as I am concerned, there is a massive bump in the carpet and it needs to go. We will finish that job before we close it off—it needs to happen.

We are still at the assessment stage, but the challenge is that there is no quick way of scanning through things and saying, “That is easy; that is not.” Finding the low-hanging fruit and the easy, quick wins needs a bit of investigation, which is the process that we are in now. We are trying to triage the cases and work out what we can do.

As you rightly mention, the next stage is about whether we can give people an expectation as to when that will land. We should be able to do that once we get a grip of the numbers. It is a significant number to have in a qualitative exercise to work out where everything sits. Again, it is most important that we preserve the existing workflow that is coming through, but if we can continue without any significant spikes—touch wood—that will allow us to do that work. If we get any dips in the current workflow, we can divert resource into dealing with the backlog more quickly.

At the beginning of this year, we wrote to all applicants individually to explain what we were doing in relation to project blue—that is, the backlog—and we have written to them periodically in between. With an active case, the expectation is that the applicant is updated every two months. We have not stuck strictly to that in relation to our backlog, because it is not always helpful to simply explain that nothing is happening. However, we have certainly had contact with all applicants at least twice in the past year, in addition to the correspondence that we put out in January.

Thank you. Will you give the committee a progress update on your intervention with SEPA?

The SEPA intervention was opened in June 2021. The work continues to support the agency’s rebuilding of its freedom of information performance following the cyberattack.

A significant issue in the intervention was having access to reliable and comprehensive performance monitoring data. SEPA has now undertaken work not only to collect the most comprehensive data sets so that FOI performance can be measured but as part of a wider project to rebuild its access to information regime. That is what I was talking about in relation to self-service for consultants and so on.

We set a target of 80 per cent for responses that were due on or under the time limit by December 2023, and that will go up to 90 per cent from 1 April 2024. According to the latest performance figures, SEPA’s performance was at 85.5 per cent, so it is performing well and responding to the targets that have been set for it.

We will keep a watch on that. SEPA has been through a pretty awful time, but it has not been helped by some of the approaches that it has taken. We gave it advice on how to handle some of the cases that it was dealing with, but it did not follow through on that by informing all the applicants about how it was dealing with their appeals. That has now been rectified and applicants are being contacted in a managed and measured way to make sure that the agency does not get swamped, which is not in anyone’s interests.

It has been a difficult time for the agency, but we hope that it will be in a much better position at the end of it. It has also had an unexpected opportunity to trial some of the new technologies that are available in relation to self-service provision. We believe that it is also looking at whether redaction software can help with processing things quicker. There is a lot of interest there.

SEPA is therefore generally going in the right direction.

Yes, it is going in the right direction. Claire Stephen, who has been leading on the SEPA intervention, will be able to give you further details.

The team at SEPA has been working incredibly hard. It found itself in a unique position with the backlog of requests that it received. Obviously, a large percentage of that backlog consisted of information requests that were made under the Environmental Information (Scotland) Regulations 2004, which are slightly different from FOI requests in that they have strict time limits. A lot of requests in that backlog were time barred from making appeals to us and from the right to seek a review, which is why SEPA took the approach of closing those requests and advising everyone who was impacted to make a new request for information.

The other aspect to that is that SEPA must consider such a request at the time that it is made. At that time, it had difficulty in accessing information, so the response to a large majority of those requests would have been that the information was not held. I think that SEPA has taken the correct approach and worked incredibly hard. As David Hamilton mentioned, it is investing in using AI software as a redaction tool, and it has invested in more staff. It is trying to rebuild a sustainable access to information regime, and it is building more public registers. David also mentioned the ability to self-serve.

Therefore, I hope that what SEPA has done will be held up as a good case study for other authorities in the future.

That is reassuring.

You are monitoring the response rate, which is what the target is for, and SEPA’s rate is above that. You have talked about the access to information regime. Are you satisfied that that is as far along the pathway as it should be?

I think so, given the impact of the cyber incident on the organisation, the fact that it has managed to invest quite heavily in staff and the fact that there has been senior management buy-in. With all such interventions, it is invariably the case that real differences are made when there is senior management buy-in to the access regime.

It would be helpful to address—I will add the word “carefully”—the intervention with regard to the Scottish Government. I am aware that you sent a letter on 7 February, in which you sought additional information. We are still within the period for that information to be provided—I think that it expires next Thursday or Friday. At this stage, you do not have the relevant information. Have you received any confirmation that the information can be provided by your requested date, or are you worried that it might not appear?

I have been given assurances that it will arrive with us by 29 February. We might require some additional information and some follow-up questions might arise, but I have been provided with assurances that the information will come in on time.

10:30  

That is helpful.

In relation to intervention activity, the report outlines concerns that your ability to intervene has been restricted because of resources and so on. Can you give the committee a short explanation of how those concerns came about? It is probably more important to emphasise that you want your intervention capacity to be back to where you would hope it to be.

I share the frustrations of my predecessors in that, in my view, the interventions function is, without doubt, the part of our toolkit that provides the greatest value, because it deals with systemic issues and can be applied across platforms for different authorities. It allows us to apply learning from one authority across other authorities, no matter what their size. The function works at different scales. Whether we are working with the Scottish Government or a small dental practice, we can help people with the same issues.

Our frustration is that the commissioner’s interventions function has never been resourced, and it needs to be bolstered. There should be a dedicated team to do that work, because there would be benefits for everyone. This is a classic case of prevention. I come from a policing perspective—we do not want crime to happen; we want to detect it to prevent it from happening in the first place. That is how I see the future for us. We need to look more seriously at whether we can dedicate the resources to allow us to get involved in an issue.

At the moment, the organisation is robbing Peter to pay Paul. If we take resources away from our enforcement capability, we will not clear the backlog and will not be able to deal with existing things that are happening. If we take resources away from the policy and information side of things, we cannot provide training or policy support, which is equally important just now. I will be coming back next year to ask for money.

It might even be before that.

You made one level 4 intervention in relation to a council, but that has now been completed and closed. Have you been able to review the level 4 intervention process so that there will be best practice in the future?

I will bring in Euan McCulloch, who was involved in the Aberdeen case.

We identified the learning points and publicised them fairly well.

That intervention was discrete and specific. It was unlike our level 3 interventions, the learning from which can be much more broad. We had to deal with a particular issue and, as far as I am aware, it has been handled.

My point is that a level 4 intervention is highly unusual. Do local authorities realise the significance and importance of a level 4 intervention? Following your generic experience of level 4 interventions, are you able to say to local authorities, “Watch out, but we are here to support you, not to punish you”?

Yes. The authority in question certainly realised the importance of the intervention at the time. The practice recommendation was published and fairly widely publicised on our website. It was a fairly specific point, but it ties into the issues that we discussed earlier about senior management buy-in and about senior management understanding their role in relation to FOI. From that point of view, it is important.

My final question on the issue is aimed at David Hamilton. In a sense, the approach to initiating new interventions has changed substantially in the past 16 weeks. I want to give you the opportunity to discuss the concept of being proactive about information becoming available, rather than reactive, following a request that is put in, usually from a member of the public. Is there a change in approach or is it just a response to circumstances that you have become aware of?

To be honest, I think that it is to do with circumstances more than anything. The interventions process is fairly well documented and it has been used. There are fairly significant numbers on that—we have done several hundred, I think. I do not remember the actual number, but it is not an uncommon thing to happen.

The challenge is that we are reluctant to escalate too quickly. We have sometimes thought about whether an intervention should be opened, but we are also aware of our capacity. The situation is frustrating, because we want to do that and we think that the authority in question would benefit from it, but we cannot, because we do not have the resourcing.

One of the key things is that, by and large, authorities welcome interventions. It is not a punitive process and it is not adversarial; it is about support. We get them to do the work and they come out in a better position. We have a number of testimonies from authorities who have gone through the process and who say that they welcomed it, and that it was actually good. At first, they were a bit “Hmm” about it, but it worked out okay and they are now in a better position. That is a positive to take from the process.

The process for identifying interventions is interesting. We do not look only at the enforcement aspects of complaints. We, of course, look at that, but we look at other intelligence that we gather. We have information coming in from the authorities and we can monitor that and see where they are at. That flags up to us where there are issues. I would like to develop that a little more as part of intelligence gathering whereby people who have concerns about an authority’s practices can submit something to us without necessarily having to have an enforcement appeal in process. That will give us a richer picture, so that we can find out where we need to focus resources and can look at thematic issues. If we need to take that across the board, we can do so.

Brilliant. Thank you very much.

I will turn to Stephen Kerr or Annie Wells.

I am okay just now.

All right. Stephen, do you want to come in?

Okay. Let me come back to our earlier conversation about teeth.

Is this the dentist’s surgery?

No, we will not be bringing up national health service dentistry. We did that yesterday in the chamber, so we are not doing that today.

I am interested in where you feel the current legislation is lacking. You mentioned, with a slight tone of exasperation, some of the game playing in relation to FOI law as it stands. Will you elaborate on where you feel that changes in primary legislation would give you sufficient powers and the leverage that you need to bring about the change of culture that certainly I would like to see?

First of all, the powers vested in me are good—they work well and have stood the test of time. They have to be proportionate to what we are looking for. Any suggestion that there has been some subversion of the principles of freedom of information is wrong and should not be tolerated until we have something specific. There are criminal offences in the Freedom of Information (Scotland) Act 2002, but they are very specific. The remit is specific, in that there has to have been a request for information, but how do we, as a regulator, know whether that request has been made?

The issue has arisen as a consequence of the UK Covid inquiry, because—perhaps uniquely—it has opened up a box that, in truth, would probably not have been opened in the past. That is what we need to look at. Now that we are aware of some of the things that have come out in public, we need to dig into that a bit more and reassure ourselves or take action on what we find in there.

That aside, what we have already seen concerns me. Other people have contacted the office on the back of the inquiry to say that they are concerned about a particular practice that happens in a particular authority. However, in the absence of an appeal, I have no locus—I cannot deal with that issue. My gateway into this is very narrow, and I have to be able to match that.

It just so happens that, in these circumstances, the issue has been opened up by the Covid inquiry, which allows for intervention. In the absence of something like that, I have no natural way in. A lot of people are frustrated about why we are not doing something about this, but the fact is that the locus is just not there.

It is also important to note one particular difference: I am not the transparency commissioner. A lot of people expect me to say, “This is not right,” or “That is not right.” Over the past few weeks, my mailbox has been extraordinary with some of the things that people want me to fix, but they are not within my remit. My remit is very much defined in the legislation as freedom of information, and there needs to be a gateway in for it to operate. If people want me to do more than that, there needs to be a review of that gateway; if people are unhappy about clear evidence of subversion of FOI principles, they need to look at my remit again and tell me what they wish from it. It is frustrating for me to try to promote the regime and give people trust and confidence in it when we do not have those tools.

Trust in government in general, not just in Scotland but across the United Kingdom, is a pretty crucial issue at the moment. So much has happened that has led people to doubt not competence as much as trust and confidence. It is important that we get this right, for the sake of our democratic institutions and our democratic way of life. That sounds very dramatic, but that is what we are talking about.

I am concerned about your ability to resource that kind of inquiry, however narrow the route into it might be. You have two dozen staff, one office and not a huge budget. Do you have the strength of arms to be able to take on such a broad and fundamental issue as part of your role? I am asking about information, not transparency.

It should come as no surprise to hear me say that no is the answer, but I think that it is a justifiable no. The benefit of my just being in the door is that I can ask whether this is all that we have for a task of this size. Eventually I will become institutionalised, because I will see that this is just how it is, and that is what happens with commissioners—

I do not think that you will.

I hope not.

The Parliament will help you to stay ahead of that.

The freshness of my approach is that I am looking at this and thinking, “This is unusual. I can’t believe that this is all that we have.” In fact, I actually asked at one of the meetings, “So where is everyone?” only to be told, “This is it.” I was like, “Really?”

The office does, at times, feel thin, and perhaps it is too lean as it is, but it is for me to make a strategic case now. My first plan was to stabilise and the next stage is for us to grow, develop and support the regime as it needs to be supported. Fundamentally, if we want to do more, we will need more resource. There is a definite case to be made for that.

10:45  

I am concerned about how you deal with the immovable object. You mentioned the new head of the civil service in Scotland, John Paul Marks, who is much more amenable to this whole cultural approach than might have been the case previously.

In that respect, I am thinking of the example of James Hamilton. I am not going to ask you to comment on anything specific, but the overall principle was that a member of the public sought an FOI and the whole thing ended up in the Supreme Court, where it was finally disclosed that the Scottish Government had not told the truth about what it did and did not have, and there was then a ruling about what was FOI-able. In fact, there is an update on the matter in today’s newspapers.

I know that you have not commented on this and I will respect however you choose to respond to what I am saying, but I note that, in relation to the possibility of a further appeal to you, the Scottish Government has said that you have

“confirmed the requirements for the decision notice of the Supreme Court have been complied with”.

Do you agree that that sets the stage for tackling the immovable object? What exactly happens in a situation in which you, as commissioner, now have a new definition of what is FOI-able in relation to this specific case but in which the holder of information says that they will not disclose any more information? What exactly do you do, given the limits on your resources?

Ultimately, an FOI request is a legal instrument. I will make a decision and, if either the applicant or the authority is not happy with it, they have the right to take it to the Court of Session and challenge it on matters of law. That is the practice and process, which is why we must ensure that we get it right, with quality decisions that are justifiable and that stand up.

We have a very good track record in the Court of Session and elsewhere, because we do not get many challenges. That comes from trust in the organisation. Ultimately, we have to allow the process to take place. It is not about personalities or politics; it is fundamentally a legal process.

The application of law.

Yes, the application of law. The office is a quasi-judicial body that makes assessments for which there is an appeal process. We will do what is the right thing and if the Court of Session finds differently, that is the law—I will have done my bit and the court will have done its bit, too.

That is a fair response.

May I come in? We have confirmed that we are satisfied that the Scottish ministers have complied with the decision notice that was before the court.

Have they done a review?

They have carried out a review in relation to the information that the court accepted that they held—that has been done. The ministers have carried out the review and have responded to the requester, and we now have a further appeal, on the substance, that we will have to consider.

That is based on the substance of what is FOI-able.

Yes.

And the Scottish Government now accepts that it has that information. We will have to leave that there, because I am sure that the convener will stop me otherwise. I am pushing the envelope, but that is all part of the transparency of the job.

You mentioned your disappointment with regard to the Government’s attitude to amending the act. Can you explore that a bit more? Where would you have liked to see a more positive response from the Government?

The response to the Government’s public consultation was very clear. There is an appetite for change across Scotland, from both the authority and applicants. I think that some opportunities have been missed to promote Scotland’s transparency and openness internationally, and I think that Scotland has been harmed by not taking them.

A number of measures in the legislation have never been used, including the First Minister’s veto. If it has never been used, why do we have it? There are also questions whether the Crown Office and Procurator Fiscal Service should be fully covered by FOI legislation. Also, if someone FOIs me and I give a decision, it is not possible at the moment for someone else in my office to review it, which means that the only avenue left is to take me to the Court of Session, denying people natural justice.

However, perhaps the biggest issue is publication schemes. There is not enough about them in the tweaking of codes of practice. Perhaps I can put it in context: the publication schemes were written when 9 per cent of people had access to broadband and 50 per cent had access to the internet. They are 20 years old. The system is archaic in that what organisations should publish is expressed in terms of manual paper filing systems—that is, it pre-dates Google.

Let alone ChatGPT.

Absolutely. We are now in a different space. Our difficulty is that the scheme is set up in such a way that it has become a box-ticking exercise: “We’ll just put people into little folders, and here’s what we do.” It is not interesting or dynamic, and it does not allow people to ask the right questions. The fact is that most people now search for things on search engines. In the future, of course, ChatGPT will come through, given all the different references, and we will need to get to a different place with that.

We would rather that organisations just had a duty to publish. Having proactive publication of information makes things much easier than publishing through stipulation, because as soon as you stipulate, people go to the lowest common denominator and say, “Well, I ticked the box, so that’s fine.” We need to go further than that.

How many freedom of information requests did you say there had been? Was it 80,000?

It is 83,000.

I would love to know how many are repeated follow-ups because people did not ask the right question and were answered absolutely on the terms of the question that they asked, so they think, “I’ve got to ask another question,” in the same way as they might interrogate Google.

Absolutely—with iterative questions.

It is such a waste of time and money compared with what you suggest, which would be a far more open approach to information management.

I want to ask you about Katy Clark’s proposed member’s bill. I was intrigued by something, and I probably need you to help me understand what it means. Her proposed bill includes provisions such as the creation of a new statutory officer with designated responsibility for FOI in public authorities. I think that your office’s response to that was “Partially supportive”. I hope that no one will be offended by this, but I think that that is like being partly pregnant. Are you for it or against it? It would be useful to know. Again, I hope that no one has been offended by my reference.

I am not sure that the position on pregnancy is for or against. [Laughter.]

Well, a person either is or is not pregnant.

Yes—the question is whether there should or should not be such a post.

The response to Katy Clark’s consultation predates me, so I will ask Claire Stephen to fill you in on that. The general principle, as I picked it up from the response, was more about the fact that, although elements of the proposal make sense, it will be more difficult to put it into practice. I will probably be corrected on that, though.

No, that pretty much sums it up. In addition, the responsibility for FOI should be on the whole organisation, not just down to one individual. That is the key aspect. We absolutely see the benefits of having a statutory officer, which would be somewhat similar to the requirements of the Data Protection Act 2018. Equally, though, FOI transcends and goes much wider than one individual.

Exactly. What you are really saying is that everybody in every avenue of public service should be responsible for the management of the information within their remit.

The issue is cultural and is also about system design. Again, this is for the future: we need information management systems to embed freedom of information at the design stage. I know that work is going on in some IT companies to look at data sharing between different agencies; indeed, policing is a good example of that. However, we need to go further and ask whether that stuff needs to be behind firewalls at all. Perhaps I can switch it around by saying that if it is public knowledge, people should have access to it.

Yes. If you create just one role with responsibility for something that is good across the whole organisation culturally, the rest of the organisation will go to sleep on that cultural value. That is as true of quality as it is of information.

Your response also refers to the reduction in exemptions to the 2002 act. I think that this relates to a redefinition in the proposed bill of what is FOI-able, particularly in relation to procurement—as I understand the bill—and your response to that proposal was that you are “partially opposed”. What do you mean by that?

What we mean is that we think that the current exemptions work well. Some of them could do with some tinkering but, largely, they work well in practice, so we do not necessarily see any reason to reduce them.

I am not quite sure about your point about procurement.

I think it had to do with the fact that public—

I think that it relates to what your submission says with regard to the Government’s proposals on the organisations that FOI should apply to. In your response, I think that you said it was probably best dealt with through a schedule rather than through what you call a “‘gateway’ clause”. I think that the same question was asked in a slightly different way by Katy Clark about the extent to which it should apply.

I mentioned procurement, given that so much of public service delivery is now done by commercial operations. That is all well and good, but there is a limit to how much information commercial operations are liable to provide on a FOI basis, if any at all.

That probably comes back to my observation at the beginning with regard to what I felt when we started looking at some of the commercial aspects. It is a very delicate balancing act, and when you start putting public interest tests on top of that, you get into something very challenging that you really need to ponder over.

What has surprised me more than anything coming into this role is the complexity of some of these calls. There is a danger of overlegislating on definitions and exemptions. Having the parameters that we have for the exemptions works for me, because it allows for a degree of case law and a degree of future proofing, too.

A section of Katy Clark’s proposed bill is about “defining information” further. That is probably not such a good thing, particularly given some recent court cases in which it has been made very clear what the definition of “information” is and what information should or should not be held. Defining that further takes you into territory where unintended consequences kick in, and that is not where we want to be.

You have to be careful that you do not ask the question that you do not necessarily want the answer to. That is a good point.

Another dimension is that, when commercial operations bid to work in the public sector to deliver a public service, they already go through hoops of fire even to be considered as potential providers of that service. On top of that, you have to ladle in all the other costs of what we are describing. There are many dimensions to this.

I think that I have exhausted my well of questions, convener.

That is fine. It was lovely to have them.

Ivan McKee looks as if he is just leaving. [Laughter.]

Clearly, the question of legislation is something that we will return to.

I thank you, David, and your staff for coming to the meeting this morning. You have survived it, and we will, no doubt, see you again. If you would like to add anything, please feel free to write to the clerks in the normal way.

I now close the public part of the meeting.

10:58 Meeting continued in private until 11:18.