Official Report 455KB pdf
Welcome back. Under agenda item 4, the committee will hear evidence from David Hamilton, the Scottish Information Commissioner, on his annual report and the accounts for 2024-25. The commissioner is joined by Euan McCulloch, who is head of enforcement, and Claire Stephen, who is head of policy and information. I welcome you all to the meeting.
I invite David to make a short opening statement about his report.
I should first point out that, as the annual report covers the period 2024-25, the earliest date that it covers was 22 months ago, and it finishes in April 2025. That is not ideal, but that is the way the system works. However, if you take all those figures and multiply them by a factor of two, you will probably get an idea of where we are at the moment, because business is booming, shall we say.
There are some highlights. There is a continuing increase in appeals made across the system in Scotland. That is a very welcome thing to happen in that it is part of my remit, but having to enforce it is not so welcome, because even with an increase in volume, a pretty consistent 0.7 per cent of appeals eventually end up in our office. Those appeals take, on average, four months. We are trying to keep to a four-month target, so it is quite a significant workload for us. We usually get between 500 and 600 cases a year, but we have already gone way over that. We will have over 1,000 cases this year, and the demand that that puts on the office is exponential. I am sure that we will cover a number of the reasons for that in the evidence session.
My staff have been absolutely outstanding. It is a very small office. We have only 11 investigators working on the enforcement side of things out of a staff of 30, with other people providing policy and support functions, but it is a team effort. They have dug deep and, again, performance has been through the roof. We have increased the amount of decisions that we put out by half again, so everything is up. We are doing everything that we can to keep up with the demand on us, and we are doing everything we can to increase the demand, which is the conflicted part of this role, because we are trying to promote but also to respond.
I very much thank our staff publicly for that, and I also thank the wider regime across the country. There are many very dedicated information professionals working in public authorities, and they have performed very well over that time. Across the board, we have around 87 per cent compliance on getting information on time. Around 76 per cent of those cases are some kind of information release, and around half are full release.
Despite some of the current headlines, there is a healthy underlying regime. Of course, it needs to be fixed and tightened up, and so on, but we are in a good place in general across the country. It is just when we get into the high-profile cases that the focus is on us.
Thank you for that. As is the convener’s prerogative, I will kick off our questions.
You have touched on the fact that the report is a historical document, and you have given us some reflections on what this year has been like. Do you see light at the end of the tunnel, or are you concerned about the partial success of raising freedom of information requests and the availability of its counterpart under the environmental information regulations?
I suspect that there is a change in culture of people wanting to know and fighting for it. Do you see light at the end of the tunnel, or is that light blocked at the moment?
I guess that depends on what you think the tunnel is.
In general, I am an optimist, which is why I always make a point of emphasising the fact that the regime in general is in a good place. Blockages and issues have always come along the road. I was obviously a bit disappointed that the committee was not able to support the bill as it was, but I was delighted that the Parliament took a different view on it. I look forward to working to see how we can improve it, because I think that, as the committee recognised, some changes need to happen.
The culture in Scotland varies. There is a difference between the practitioners on the ground and senior leadership, and my big focus has been trying get across to senior leaders that those teams are properly resourced and are not seen as low-hanging fruit of service delivery that they can cut. In general, when there are problems and we go in and deal with failing public authorities, it is down to resourcing, and when we get that resource properly put in place, we see a turnaround in fortunes. That is one of the best things that I can do, not just for the regime but for staff working in the area and, ultimately, the public as requesters.
I have always had an interest in your work with regard to children and young people and underrepresented groups. We have spoken in the past about the challenge of getting those groups to understand their rights. Will you give us an update on where you are on that now and how you see that developing, rather than the retrospect that we have in the report?
09:15
Last year, we did some great work with Young Scot to raise awareness of freedom of information rights. As I have said previously, one of the challenges is what people do with those rights when they get the answers. We still need to change the culture around the language used in responses, to make it more accessible to everybody. I have been looking at different options, such as whether we can use artificial intelligence to simplify some of those things for people.
We are also speaking to different groups and to the Patient Safety Commissioner and the Children and Young People’s Commissioner Scotland, and we are trying to develop ways in which we can make FOI a good pathway. Ultimately, it is a gateway tool to a lot of other rights, and we are trying to embed that into a process. It is challenging, but it is something that we need to keep working on and chipping away at.
I will park the question of the extent to which AI can amend FOI for a possible future conference, and I will bring in Sue Webber.
In your opening remarks, you mentioned the rise in numbers, and the annual report records that there were 98,605 information requests last year, which continues the rise since 2021-22. What is your assessment of how sustainable that trend is for public authorities? You mentioned that it is increasing, but what is the scale of that increase?
For the last four quarters, it is 110,000.
:Do you mean 110,000 each quarter?
No, it is 110,000 in the year. We count back on quarters. In April 2025, there were 98,000 requests in the previous four quarters. We have now hit 110,000 up to this quarter, so you can see that the trend continues to go up.
Whether that is sustainable is very much down to how public authorities react, and in some ways it is also down to how the Parliament funds my office. We are trying to shift round to the proactive publication of information. I keep telling chief executives that, if they just published the information in the first place, they would not have to deal with the requests. That is the simple answer. It is perhaps a simplistic view, but, strategically, that is where we should be going.
To get there, there is a journey that needs to be taken. I would like to see how we can develop and move that on. I saw the duty to publicise that was in the bill as being a key part of that, and I still do. We will look at the model publication scheme and see whether we can help with that.
We need to get to much more openness—I have used the word “transparency”—by design. I used that idea when I was talking about serious adverse events in the medical sphere. We need to get people to design forms and processes that are FOI-friendly and transparency-friendly. Of course, there are personal data that cannot be released, but we should be able to design paperwork, forms and systems that allow that to be anonymised as part of the process.
Getting the thinking to that position is quite a big challenge. I regularly speak to chief executives and also ask people at information technology companies whether they have thought about it, and they usually have not.
:I am sorry convener, but this is a bit off-piste. Digitalisation in the NHS is a bit of a challenge, because we have all these health boards potentially doing different things and there is not the technology and digital infrastructure to facilitate that. However, that is for another day and perhaps another committee.
Around 500 public authorities submit their FOI quarterly statistics. Is there any particular sector or type of authority where the request volumes are rising more sharply than in others? What factors might be behind that?
Health is always a problem, and that is perhaps understandable because it is one of the most complex sectors. That is definitely a challenging area. There are also challenges in the justice sector. Part of that is down to the nature of the work with criminal cases, so that can be quite challenging.
Different areas have challenges, but I would not say that there is any one sector that stands out for no apparent reason. They are all struggling a little bit at the moment, to be honest, and that is to do with the volume of requests and the surge that we had in the autumn, when the number of cases went up exponentially.
:You talked about that surge, but the foreword of the annual report suggests that some public authorities are reducing their information rights resourcing. If that is compounded with the surge, what effect might that have?
Going back to how I can assist with that, we are having those conversations. When the team comes in and looks at a failing authority, that is when we identify the shortfalls and what is going on with the staff. There might somebody on long-term sickness who has not been replaced or there might be vacancy management policies in place and they think, “We’ll do that later.”
:Do you mean recruitment freezes?
Recruitment freezes, yes. That is what you and I would call them. I am getting too used to speaking in this vocabulary.
Those are the excuses that we get, and we tell them that they just cannot do that, because they have a fundamental legal responsibility.
As I have said previously, I have applied for more resources for the intervention aspect and I am waiting for formal agreement that I can get a team to deal with that and make a difference to the upstream problem of continuing demand. It is just not sustainable to keep going and going. It has to be turned around, and the best way of doing that is through resourcing the public authorities and publicising it at an earlier stage.
:You have perhaps reflected on this and mentioned it in some of your responses, but what impact do the cuts to freedom of information resourcing in public authorities have on your office specifically?
We are at the top of the chain, if you like, or the bottom of the chain—whichever way you look at it. When we see these cuts, we see failure of the demand and failure of the public authorities to deal with it. The number of authorities that are failing to respond to applications has again gone through the roof, and that is simply down to capacity issues. Often, freedom of information and data protection officers wear a dual hat, and an upsurge in subject access requests gets pushed on to the information office.
Of course, with data protection, there are financial penalties and a tangible cost to organisations, so I suspect that the chief executives will be thinking that that is probably a priority under the legislation. I understand that perspective, but the problem is that it causes failure to respond to FOIs, which then come to our office to be dealt with. We are having to work through a huge number of cases just now, and capacity issues seem to be the problem.
:You have a very small team, so are you perhaps suggesting that you might need more resources in your team?
We are absolutely to the bone. As I said in the report, the problem is that there is no elasticity in our resourcing. I can track that and anyone can see on my website the demand and the number of cases that we have open. That can be charted with vacancies. You can see that we have more cases than we should have because we have had a vacancy. If we recruit somebody, the number starts to come down. Our office is to the bone, and that puts a huge amount of pressure on us.
My concern is for the welfare of my staff, who are working flat out trying to do this, but that is probably typical of the public sector. My concern, of course, is to look after them.
:Thank you, David.
Emma, can I pass over to you?
I want to ask about appeals. I know that the number of appeals is still roughly proportionate to the number of requests that are coming in, but, as you were saying, that is increasing exponentially. What arrangements does the office have in place for monitoring incoming cases and appeals, and how are you managing the overall demand from appeals?
We have brought in a Power BI system, which essentially gives us a huge amount of management information about what is coming in. We can now visualise the problem instead of just thinking about it. We have used that from the very beginning, since I have been the commissioner, in order to see the problem and pick up the issues.
One issue is that, more and more, we have seen multiple applications from individual applicants. We have had cases in which someone has submitted 60 or 70 applications. The problem with that is that it hogs the system for one person—one applicant—and usually on one issue. We have now brought in a control whereby people will, in general, be able to have a maximum of five live cases. There can be exceptions, but, in general, that is our policy. That allows us to share out the provision among more people, rather than it just becoming a chronological approach and people getting stuck.
We are looking ahead to see what is coming through and trying to find patterns. We now have a member of staff who works on resolutions, which has been fantastically helpful. Often, people just need to speak to each other. Somebody who has a particularly good skill set in discussing and trying to resolve problems is there to say, “Listen, have you thought about this? Can we do this or that? Can we get a deal here?” The statutory responsibility is not just about giving a decision; it is about trying to resolve the case, and that has been a particularly good use of resource. We have cleared a lot of cases—particularly old cases. Just having that type of discussion has led people to say, “Actually, I don’t need it now.”
We have to constantly think creatively and innovatively and consider what we can use to deal with issues. That has its own challenges, because the pace of change in our organisation is pretty fast just to keep up.
:On the soft limit of five, you mentioned exceptions. What type of exceptions would you consider?
We have not had any cases that we have treated as exceptions. We brought in that approach a month or so ago. You always need to have a backstop, so that you do not tie yourself entirely. Essentially, it would be at the commissioner’s discretion—you might think, “We need to bring that forward.” That might be because there is something particularly pressing or cases relating to a bigger issue that could be conjoined. We sometimes get that. We might have a time when somebody has more than five, because of the circumstances and the nature of the cases, but we are trying not to allow cases to pile into the system, as that just makes it stop for everyone else and deprives everyone who is waiting of the service.
:So, you are thinking case by case whether it is legitimate, rather than thinking about the person, such as a journalist or an MSP, and why they might have multiple open cases.
No, it is nothing like that; it is about the content. We have a validation process, so that, after that, when cases come in, we do not have to think whether they are a valid appeal. That is our first stage of processing. We then look at whether we can resolve the issue early and the best way to deal with it. What we will not do is pass cases on to investigators to go through if there are a number of similar issues—they might be side issues—that are being put through with multiple applications on a particular case.
That approach is reasonable and sensible, because it gets people to prioritise what they want. There is no cost to FOI and, with technology these days, machines are doing it for people. That takes me on to AI, which is another favourite topic of mine. That is the space that we are now in. The process is easy, which is great, but that has its own challenges and needs a little bit of policing at the front end.
:How much of the increase in appeals and in cases overall is a result of certain individuals putting in more, rather than the wider public becoming more attuned to using FOI?
I will give an example. In September, we had 129 appeals from two individuals. That is three months of work for us.
:The numbers alone kind of answer this, but is there a risk that a new backlog will appear?
There is a risk, and we are very alive to that. That is why we are trying to look at everything. We are still trying to clear our previous backlog. We are 78 per cent of the way through that now, which is great.
We have cleared 300 backlogged cases in the face of increasing demand, but, as the system moves forward, we are beginning to get cases waiting for allocation that we would prefer not to be there. The cases are not being held back by the old backlog; it is a consequence of volume. The challenge for us is to maintain momentum and keep the system going. If we can do that, we can attack the backlog of really old cases.
09:30
Our priority has to be to avoid a big backlog building up, but when you get hit with a tsunami of cases, as we did in the autumn, when the number of cases coming in almost doubled, it is inevitable that you will slow down, and we are doing everything that we can to manage that. We are looking at innovative ways to approach things—it is not just a matter of looking at cases and dealing with them chronologically; we also look at whether we can resolve them in other ways. We have to ask, “Are we the best people to do it?” Often, we are not.
People seem to think that, as commissioner, I am there to judge on a topic, but I do not have a view on the issues; I am there to judge how freedom of information legislation is applied. Although I might sympathise with the difficulties that people face, I only get involved with the public interest aspect. Generally, the cases are about technical compliance.
:You mentioned dealing with interlinked cases and being a bit smarter about them. Are particular themes emerging in the appeals that come through to your office?
Euan McCulloch might have thoughts on that. Inequality issues, particularly on gender, come through in the cases, but we also get cases on planning and employment. Planning is always a frequent flyer.
There are public finance cases as well.
Often, one person who is an expert on a particular thing or who has a particular grievance fires in lots of requests about a particular issue, which they come at from different angles. The requests might be related but not the same, and picking your way through them can be the real challenge. We speak to them about what “good” looks like in such cases. If we take it back to what is achievable, it helps us to get ahead of the game, because we can say, “It’s unlikely that we will be able to give you legal advice, because there’s a high bar for that, but you might be able to concentrate on this one.” We can have that discussion and ask authorities, “Can you give them this?” It might be that they are able to satisfy the request and had not initially understood what the requester was looking for. Sometimes, we just broker a resolution.
:Is that partly because of the way in which the system was designed? I sit and figure out how to word what it is that I am looking for, but it is then perhaps difficult to look at my request because authorities think, “Where is she going with this?”
One of the first things that people need to do is phone or email people and ask, “Can you help me?” For each of the authorities, part of the freedom of information duty is to provide assistance. There is nothing to prevent people from saying, “Here’s what I’m looking for—how would you suggest I best get this?” Most professionals are quite happy to help with that, because it makes life easier for them. They know what information they do and do not have, so they can guide you to the right information. The people who give out the information are among those who are most committed to freedom of information. If you make a request clear to them, it can make things easier.
We must also bear in mind that a proportion of requesters have a long-standing relationship with the authority in question. By the time they come to us or to other complaint-handling bodies, their relationship with the authority has broken down. Therefore, it is not surprising that their underlying concerns about the authority inevitably get mixed up with the areas that we can actually deal with, and disentangling the two can be quite a challenge.
The commissioner has tools available to him to deal with the large blocks of requests, which do not all necessarily reach the level of full investigation. We do not set a terribly high bar for applicants when it comes to having grounds for dissatisfaction, but if the bar is not met, we cannot take those cases forward. The commissioner can also decline to deal with an application if he decides that it is frivolous or vexatious. There is certainly potential for that to happen with a large block of requests, particularly if the underlying premise of the request is completely unfounded.
That does not entirely address the demand for resources, because we have to be sure that we are entirely procedurally correct in going through the steps—they are not steps that we take lightly, anyway—so there is an inevitable demand for all cases to be processed appropriately, for the applicant to be responded to appropriately and for all the necessary administration to be done. That can still be demanding, even if we do not take a case forward to the level of full investigation.
:How good are public bodies at discerning whether a request is vexatious or just difficult to deal with?
It varies.
There is an on-going reluctance to rely on such provisions. Understandably, the optics do not look good, so it is the last port of call. Providing more guidance on the application of such exemptions is an on-going piece of work for us.
I want to come in with some questions about appeals. Would it be useful for the public if there were a dashboard that indicated the number of cases that are readily available to read—not to put people off, but so that, if they come on to the website, they can see the volume? It might assist you in pointing out how challenging it is to deal with requests, given the approaches that other bodies take to them. Might it be useful if that data were more readily available?
That data is already on the website. We are fully transparent, as you would expect. The case load and the authorities are listed. The only things that are anonymised are the applicants’ names, but the information is on the website in full.
Excellent.
The information does not necessarily influence the expectations of all requesters.
It is a live dashboard, though. It updates at 2 o’clock every morning.
That is very helpful. Something that Euan McCulloch said that stood out to me was that there is a relatively low bar for cases to be progressed. You seem to have massive challenges with appeals in which people have not given their full names, which prevents a number of appeals from progressing. If someone cannot comply with those requirements, the case does not go forward. Do you have any concerns about that? I do not know whether you demand the full name—or just any name—but does that cause problems?
That was a particular issue, and we changed our processes to deal with it. The challenges of the law meant that we needed to have an identifiable person attached to the request. Sometimes, we were not getting the full details, so we were not sure whether an appeal was valid because of the correspondence that was provided. It could start off with people saying, “Oh, I know them,” but we would ask, “But do they know you?”
We had to put in an extra step for cases in which we had a doubt about that, and we suddenly saw a big increase in rejections on that basis. The dashboards picked that up and we said, “What’s going on here?” We looked into it and discovered that we needed a new stage in the process that essentially clarified with the authority who the person was, and we were able to take it from there. Adding that stage to the process was a legal requirement, and the issue has now been resolved. We have seen the number of requests that are rejected on that basis plummet as a result.
Presumably, as a consequence of that, you are satisfied that people being kicked out because they do not know whether to put their full name or half of their name is not a barrier to appeals.
The problem is that, in order to make their appeals, people were being sent back to the beginning of the process and asked to put in their full details, which was no good for anyone and was why we put in that extra step. Previously, we were proactively going back and saying, “Can we just clarify that you are you, and you are you, and you know each other, and that explains the context of these emails?”
There is already full guidance on that on our website. The commissioner cannot accept an application that is made under a pseudonym. Certainly, we will go through an identification process if it looks obvious that an applicant is using a pseudonym—to give a real example, they might use the name Gustavus Adolphus.
So, you have seen the number of appeals being rejected on that ground going down through the new steps that have been taken.
Absolutely, yes.
So, hopefully, that will not appear in next year’s report.
I invite Annie Wells to come in. We are having some technical difficulties, so I am not sure whether you can hear us, Annie.
Good morning. Thank you for being here today, commissioner. In January 2025, you informed the committee about project blue, and I have a couple of questions about that. I am sorry that I am not on camera. To what extent is the closure of older project blue cases affecting reported performance against case closure targets? Can you give us a wee example of that?
It is not affecting the targets, because the strategy was always to ensure that we kept the live cases going and used any spare capacity to go back and deal with blue cases. That has been a successful strategy, which we followed all the way through until we were hit with the tidal wave of demand, which really slowed down the resolution of the blue cases. The priority is the new cases coming in, and, with any additional capacity that we can free up, we are looking at the blue cases and trying to go back. We have never taken our eye off the ball on that. We have always tried to keep our investigators with at least one old case, just to keep the momentum going.
By taking on a member of staff to do some of the resolution work, we have made big progress, which has been good—again, that is keeping the momentum going. The challenge is trying to get through those cases. We have had a lot of engagement with stakeholders, and we have explained why we have done what we have done. We have had a lot of support for that, even from people who have been adversely impacted.
One curious thing is that some people do not really want the information that much; they want a decision. We still have to go through the whole process, despite the fact that the information has very little value to them. That is a bit frustrating, including for investigators, because they think that they are not making a big impact. Essentially, at the end of the day, you are giving somebody a certificate for their bedroom wall or something.
:I completely understand where you are coming from.
Do you have any data that gives a more representative picture as to how quickly new appeals are being resolved?
Yes. On the online dashboard that we now have, you will see our progress in going through the blue cases. You can see whether cases have been allocated for investigation or whether they sit waiting for allocation, and you can chart all that. That has cut down our demand, because people no longer phone up and ask, “Are you getting on to this now?” They can see live information on where their case sits. That is helpful and is probably good practice for other organisations. People can see where they sit and get a full picture.
There is a lot of information on that. I cannot remember the address for the subpage, but it is under “About Us”. You will see our operational performance and a dashboard that shows the tracking. It has as much information as we think is useful. If there is a demand for more information, we would be delighted to put more on, but we do not want to overwhelm people.
:Finally, what is the oldest case that is still in the backlog? How is the office supporting the requesters who are involved and keeping them informed of progress? That is probably something that most people would like to know.
09:45
The answer to your question is that the oldest case is from June 2022, which seems awful, but that is by design, in some ways, because it is one of our multiple applicant cases. We have done 40 cases on the subject in question, and there are a couple of straggler cases that we have said we are going to deprioritise just now, because there are people who have made individual requests that we need to put ahead of that case. That is an example of using demand management to make sure that the service is provided equally. We will, of course, get to that point, but the applicant is determined that they wish, as is their right, a decision on the case. I cannot, hand on heart, say that it is a priority for the office, given some of the other requests that we have and given the amount of work that we have done on that topic, which has moved on significantly since then as well.
:Thank you very much, commissioner, and thank you, convener. I apologise again for not being on camera.
No problem, Annie—technology is what it is.
Good morning, commissioner. Interventions with the Scottish ministers remain at level 3, which is serious systematic practice failure. The intervention that was initiated in 2017 remains open. Can you tell the committee the reasons for that? Can you let us know when you expect to publish reports on those interventions?
I will ask Claire Stephen to deal with that one.
The original intervention, which opened in 2017, is still on-going, but it is in its final stages. What we are lacking at the moment, as David Hamilton has already alluded to, is the resource to look at those interventions. For the 2017 performance intervention, it is a case of reviewing the last of the recommendations that we made in our most recent progress report to ensure that they have all been handled appropriately. We need to review some casework on that, but I hope that we will get that completed towards the first part of this year.
:That is helpful.
You spoke a little earlier about intervention resources. What stage are you at in planning and seeking funding for those resources?
I have made a budget bid for resourcing. The budget was passed last night, so I am awaiting a letter. We will see.
:Can you provide further updates on the other level 3 interventions that remain open with local authorities and the NHS?
Again, I will pass that to Claire Stephen, who is our specialist on this topic.
At the moment, we have the NHS Forth Valley intervention, which has been open with us for a while. That was escalated to level 3 in July last year. The board has made significant improvements in its performance, so we are pleased with that. Again, it comes down to having adequate resource and senior management buy-in, but the board is now responding to 90 per cent of requests on time. It has cleared the backlog, so we are happy with the progress on that one. We continue to monitor that progress to ensure that it is sustainable. The Clackmannanshire Council intervention opened at level 3. That was due to an information searches and records management issue. We are also satisfied that the council has started to put in place measures, such as search templates, to deal with that.
I think that those are all the open level 3 interventions at the moment. We obviously have NHS Fife at level 4, and that is in the early stages. I will let David Hamilton talk about that, if you would like to know more about it.
:Yes, please.
For Perth and Kinross Council, there is a records management issue that is progressing.
And the Scottish Government.
There is also part 2 of the Scottish Government intervention.
:It would be helpful to hear about the level 4 intervention.
There is another Scottish Government level 3 intervention on informal communications, and that has probably been the biggest casualty of the lack of resource that I was talking about earlier. We have had some struggles getting to it. We have made some progress, but the delay has been quite helpful, because it has allowed others, such as the independent review, to report back on how the Government’s own review is managed and handled.
The Scottish Government has been in the spotlight, but it certainly applies to all sectors and how they do this. We need to make sure that we get guidance and recommendations that are appropriate and practical, because water follows the easiest route. For example, I am not sure that banning WhatsApp from Government devices was necessary. It was not a recommendation—it was something that the Scottish Government decided to do. I also wonder whether it was a practical solution, because people will always get WhatsApped just because they have a phone number. We need to be practical about that side of things. The key thing is the recording of communications when it is done in a business capacity. The review looked at the ethics aspect of that and the duty to record as an individual, which was helpful.
The NHS Fife investigation is relatively new and on-going. We discovered some significant issues that go beyond the obvious high-profile employment tribunal and the costs associated with that. We are engaging with NHS Fife and working our way through the investigation.
The thing that I take most satisfaction from is the fact that the intervention process works. If you said to me that NHS Forth Valley, which was not good, could turn itself around in the way that it has done, I would have doubted it, but it has done a great job because the problem became a board-level problem. It becomes a strategic risk, and my job is to make it that, among all the conflicting priorities that health boards have. It is important, because people and patients are now able to understand these things. NHS Greater Glasgow and Clyde is another example of where we went in and sorted problems out and their performance is going up.
That is not to say that none of those organisations will ever have a problem again. Of course, they will have challenges and issues, but we are looking at systemic issues and sorting them. It is a really good use of resource, but it is not a statutory use that has timeframes stuck to it in the way that enforcement does, which is why I need specialist resource to deal with it.
:The number of intervention activities decreased from 296 in 2023-24 to 255. That is perhaps not a big enough number to read anything into, but can you speak to any factors in that reduction? Is it about resource again, or is it about something else?
It is partly about resourcing.
It is partly about resourcing. A huge number of those interventions are light touch and do not require a lot of resources on our side, but, as we go up the levels, getting the results that we need requires significant resources. That was certainly the case with NHS Forth Valley, which started as a level 1 with a soft touch; there was no improvement, so it went to level 2; and now it is level 3. It is only at level 3, with significant resource, that we see a turnaround in performance.
We have a fairly well-developed intelligence gathering system that is fuelled partly by the observations of investigators and partly by the statistics portal that we use. That is on our website and it is a rabbit hole, because, when you go in and start looking at individual authorities and sectors, you can compare how your health board is doing against the sector. That tool has been helpful for us, because it means that we are able to identify dips, problems and trends, which we review on a quarterly basis.
The challenge is that I am seeing big problems in certain authorities, but I do not have the resource to deal with them. I hope to be able to change that, because I am watching organisations fail in front of me and I know that that is just going to mean more demand for my office. When we make the decision to intervene in particular authorities, that is sometimes about self-preservation—preservation of our own resource, in the absence of having a dedicated resource for that work. I hope that I will now have the resources to go in and fix all the problems or as many of them as I can, as opposed to the minimum, which is where we are at the moment.
:Thank you. It is helpful to get that on the record.
Commissioner, you have talked about the budgetary challenge—your resource challenge. You have a request in at the moment and were gleeful at the passing of the budget last night, although the funds have probably come from somewhere else. Is the resourcing model working and will it work going forward, or should the Parliament and the Scottish Government look at the model for the commissioner?
I am sorry—could you repeat that?
In essence, you end up having an annual—sometimes more frequent—argument about needing more resource. Is that because the model that is used to calculate the resource is wrong and we should look at it again, or is there a way that we could anticipate increasing needs? As you say, those are hard to identify, but you have mentioned a number of factors in relation to which resource is becoming a challenge. From your point of view, do we need to look at the resourcing model?
I would welcome that. It is meant to be zero-based budgeting, but the reality is that you are told, “You take this as an assumption for inflationary factors.” It cannot be zero-based budgeting if you then make assumptions about inflationary factors. It is not a particularly complex model, and the simplification of it is a problem. We need an approach that allows us to do some medium-term planning. My auditors keep telling me, “You need to have some medium-term financial plans,” and I say, “Very good. What am I going to have?” I do not know what I am going to get this year; I certainly do not know what I am going to get next year or the year after that. I just know that public sector finances are very stretched. I live within what I am given, but I am acutely aware that that is very constraining. The biggest thing is that I cannot plan; I cannot get ahead of the game. I have aspirations for things that I would like to do and to develop, but I am constrained.
I can understand entirely why the corporate body, as my funder, wants to have involvement and checks and balances, but, to be honest, at times, that is probably a bit of an overreach in terms of the legislation. However, there is no question but that some process of check and balance is needed. I have looked at whether we could develop almost a commercial arm to help to recover funds from individuals and authorities, perhaps even providing something like a qualification for practitioners. There are lots of things that I would love to do to develop a business model, but I am disincentivised from doing so because, if I generate cash, my budget will be cut, so why would I do that?
From the report, at a very simplistic level, it seems that your expenditure has gone up, the reserves are, in effect, gone and savings are immediately absorbed because you have an increased workload. Would it be fair to say that? It is worth a conversation—or maybe something slightly stronger than that.
Yes, absolutely. I would very much welcome that.
I want to make my last point sensitively, harking back to your initial comments about your brilliant staff and the quality of your staff. One thing that jumped out from the report was ill-health absence. You are a very small team, so even one or two absences are reflected very strongly in percentage figures. However, you are adrift of the Office for National Statistics benchmark on total days lost through ill-health absence, which I know will concern you.
Is there anything that would assist with that in the short term? If this committee were to make recommendations about the report, is there anything that would help you with that? The absences seem to have a much bigger impact than they perhaps would in larger organisations.
10:00
They do, and the size of the organisation means that it is very vulnerable to absences. The nature of the work is that it can be quite taxing, particularly on mental health, and the nature of mental health absences is that they can be longer term. I have to be careful where I go with this, because I do not want to breach any confidences. Ultimately, the problem is that we do not have that elasticity. You can look at our performance graphs and see a simple cross-reference with vacancies. When we have a vacancy because somebody has left to go to another role, the performance slumps. There is nothing extra—there is no fat on the bone. That is quite challenging, particularly for investigators who see lots of fat on other people’s bones, because their job is to look at these things and understand that aspect. We are a lean organisation. I think that we are too lean, and that is reflected in the lack of elasticity.
In essence, rather than just coming to the end of it, you are beyond the resilience element of being able to cope with changes, because of the lean nature of the organisation, the level of efficiencies that you are trying to achieve, and the very small team. Actually, the flipside is the pressure of the work when the team is interacting with members of the public who, as you indicated earlier, range from people who are saying, “I just do not really understand this,” all the way through to people who are raising much more complex issues that go above and beyond freedom of information.
Absolutely. You will all be aware of the fact that everyone is angry. This is the thing that really strikes me—everyone has become really angry, and it is not just applicants but authorities. As a result, staff get a bit of grief, and I am trying to reach a zero-tolerance approach to that behaviour. The staff want to help, and I am saying, “Listen, I will back you 100 per cent on this,” but some of the abuse that they get is not acceptable. Equally, relationships between people and authorities sometimes break down. It is just a sad reflection of society just now. It is something that certainly chimes with other people.
Like many staff, your investigators and staff are sometimes at the front edge of that.
Before I close this part of the meeting, is there anything else that you would like to add?
If you do not mind, convener, I will briefly mention artificial intelligence, which is causing a problem. That is a new challenge, and the situation that I mentioned—of 129 cases from two individuals—comes from artificial intelligence. We are seeing more and more AI use across the public sector. If you now ask Copilot or ChatGPT a question about an authority and they do not have the publicly available data, they say, “Do you want me to write an FOI request?” That FOI request goes in, and the AI tool comes back and says, “You have got a response from this organisation—do you want a review?” You say, “Aye.” You get the review, and the AI tool asks, “Do you want me to send it to the commissioner?”
We are now literally battling against machines and we do not have the tools for that. As a former AI engineer, I assure you that there are no tools that are appropriate for decision making. We can do things with AI administratively, but we cannot do things that would possibly come near the benchmark for making decisions. That is a real challenge for us, and it adds to the volume, which is going through the roof. AI can be a great assistive technology. My goodness—spellcheck is essentially an AI tool and, thankfully, people do use that. However, more and more now, our teams are picking up the telltale signs of AI formatting, such as bullet points and bold text. The AI tools are not listening to people. In their responses, they are hallucinating at times and referencing decisions that do not exist. That is the challenge, and we have to check everything, so we are trying to find a proportionate way of gatekeeping on that.
With AI, it is possible for a request to go through the entire process, up to getting to us, with little—if any—apparent human intervention. We have seen such cases, and they were certainly included in the ones that we rejected. In one case, it was vexatious. The requester—I will say that it was the requester—asked for a review of a very complex request within a matter of minutes of receiving a response. Clearly, that was the AI asking for a request and not the requester, because there just had not been the consideration that you would expect of the response that was received.
I should add that that the same request was also sent out to 600 public authorities. We are the tip of the iceberg.
So, there are vexatious AI requests.
Yes.
Emma, do you want to follow up?
:Yes. I can empathise with that situation entirely. With a lot of casework that MSPs get, the trick is trying to figure out whether it is a constituent who did not feel confident drafting something themselves—that might also be the case in the example that you gave, and that seems like a legitimate use of AI—or whether it has just been created by AI. How do you navigate that and figure out whether something is a legitimate request that somebody needed help drafting? How do you decide whether the person wants the information and it is a fair ask of the organisation, or whether it is not even a real person and nobody needs the information?
We have to look at every case individually. When you look at cases and start seeing the telltale signs of AI, you immediately start assessing them more tightly. We have the tools of being able to say that requests are frivolous or vexatious or, indeed, invalid. On one occasion, we asked somebody to give a rationale for their objections and they said, “I’m not doing that—I’ve got 60 cases in with you.” In that case, we said that the objection was invalid.
We have to try to use the tools that we have. We are being fairly robust but, at the same time, we recognise that there is also a benefit from AI. However, if we could get public authorities to publish stuff openly in the first place, the AI would find it.
:My concern is about where there should be intervention from legislation or policy to tighten up what can be done. There are legitimate uses of those tools, but AI also opens us up to the potential of people overwhelming public authorities on purpose, whether that is local people or people from further afield.
That is something that I am acutely aware of. In my international work, I have been in Ukraine a few times and I have spoken to and have relationships with commissioners there. They are experiencing denial-of-service attacks using FOI by Russian actors. That is happening, and there is no reason at all to think that it would not happen here. It might well have happened—we do not know. That is where we get into the difficulties of how to manage the issue, as you say.
It is not just an issue in my area of work. I sit with a number of other regulators in Scotland trying to deal with it, and we are all scratching our heads a little about where to go. The Parliament is suffering from AI, and I know that the courts are suffering from it. There is a bigger conversation to be had about how the public sector and public organisations deal with the issue, but I suspect that that could be a long time coming.
Part of the problem is that there is a general lack of understanding of what artificial intelligence is. I have been lecturing students on the issue. It is remarkable how little people, and particularly chief executives, understand about the issue. AI is not clever. When I studied, it was called artificial intelligence or pattern recognition. Unfortunately, we chose the wrong name. If we talked about pattern recognition software, that would explain exactly what it is. It is about patterns, and you cannot use patterns for decision making. The intelligence is not there yet. To be honest, we are years or decades away from it being useful in decision making.
That is a challenge. AI is a very live issue, and we just have to try to deal with it using the tools that we have.
Naturally, we and public authorities have equalities responsibilities that we take seriously. All authorities, including us, are subject to the obligation to provide advice and assistance where that is required. In that context, some careful and considered use of AI is entirely appropriate in helping people to frame requests that they cannot frame themselves. Equally, however, where somebody makes 100 or more requests at the same time to a range of public authorities, it is unlikely that they just need help framing the request.
I go back to the commissioner’s comments about just asking sometimes.
Ruth Maguire has a follow-up question.
:Somebody said to me recently that AI should be considered as one of those slightly unreliable friends who often gets facts wrong. It is quite helpful to consider it in that way. Has there been an opportunity to speak with technology companies about the issue? I was struck by your comment that, if someone enters something in Copilot, it suggests what to do next. Can any intervention be made to plug in the correct information at that level?
The problem is that it is global and we are a minnow in a very big pond. Essentially, it is a pretty unregulated landscape, which is a huge problem. If you go to the Public Services Ombudsman for Wales website, the very first thing that you get is a splash screen that tells you to check everything if you used AI. We are not alone in this, but, as a public sector in general, we need appropriate responses. The biggest threat to public service delivery is from AI of that type, whether it is legitimate or illegitimate use.
That is probably the finest defence that I have heard in a long time of a little human intervention at the right moment, before you press send on your computer. Interestingly, we will have another commissioner in front of us next week, and we will discuss a not dissimilar issue. People recognise that a really important discussion needs to happen on AI, and I think that we need to start having discussions about ethical use and so on sooner rather than later.
I thank you and your staff, who support you, for the annual report and for the evidence that you have given. If anything comes to mind afterwards, you know where to find us—at least for the next few weeks—or those who will follow us in the future. Given that this is probably the last time that I will have a chance to speak to you in this parliamentary session, I thank your office and you personally for your work as Scottish Information Commissioner. Thank you for the openness with which you have confronted the challenges that we have placed on you and for giving us the answers that we need.
We will now move into private session to consider the evidence that we have heard.
10:12
Meeting continued in private until 10:28.
Previous
Subordinate Legislation