Official Report

Good morning and welcome to the 22nd meeting of the Public Audit and Post-legislative Scrutiny Committee in 2019. I ask people in the gallery please to switch off or turn to silent their electronic devices.

Item 1 is to make a decision on taking business in private. Do members agree to take items 4, 5 and 6 in private?

Members indicated agreement.

I welcome our witnesses for item 2, and thank them for coming to the meeting. Members and witnesses will be aware that we are joined by Dr Ben Worthy by videolink. To assist Dr Worthy, I ask MSPs and witnesses to briefly introduce themselves before we begin.

I am Jenny Marra, convener of the committee.

I am a North East Scotland representative and deputy convener of the committee.

I am MSP for Airdrie and Shotts, and am not a candidate for the Tory leadership in Scotland.

You mean “not yet”. [Laughter.]

I am a Labour member for the Glasgow region.

I am MSP for Midlothian North and Musselburgh.

I am the SNP member for Kilmarnock and Irvine Valley.

I am an MSP for the North East Scotland region.

I am a solicitor from Inkster Solicitors.

I am an honorary professor at the centre for freedom of information at the University of Dundee.

I am a lecturer in law at the University of East Anglia. I apologise to everyone because my voice has gone missing. I am sorry.

Do not worry; we will do the best we can.

I am a professor of environmental law at the University of Dundee.

I am a senior lecturer in politics at Birkbeck college, University of London.

Thank you. Evidence will be given in this panel format, but I would like to encourage discussion. As usual, members will ask questions of witnesses, but witnesses can also respond or ask questions of each other. We still want to have some structure to the discussion, so please indicate to me or the clerks when you would like to contribute. When you speak, your microphone will be activated, so there is no need to press the button. Dr Worthy—please raise your hand to indicate to me when you wish to speak, and I will bring you in.

The committee papers suggest four themes for discussion, so I intend to structure the session around them. However, before we do so, I ask witnesses to briefly highlight positive and negative impacts of the 2002 act, just to kick us off. Dr Worthy will start.

On the positives, I would say that the legislation has, comparatively, very high levels of public use and there are good rates of disclosure. About 75 per cent of requests result in some form of openness. Crucially, the legislation has very strong levels of public support and awareness.

In terms of concerns, there are worries that the act has to an extent been undermined by game playing at senior political levels. There are signs of patchy compliance, particularly by arm’s-length bodies, and there is concern—as there is with many such regimes around the world—that there is less proactive disclosure than was hoped for.

I echo those comments, and welcome the beneficial effect that the FOISA regime has had in Scotland on transparency and so on. I have been working with colleagues—Dr Jonathan Mendel and Dr Sean Whittaker—on a project that is looking at the right of access to information under the Environmental Information (Scotland) Regulations 2004. Again, we have found there to be a generally overwhelmingly positive story. There are some details in respect of application that can be worked on, and some users of the system have had problems, some of which perhaps result from different conceptions and ideas about what the scheme is about.

The 2002 act has been a welcome and positive development, and has provided a mechanism for increasing transparency and accountability. We have seen examples: people finding out about school closures or provision of residential homes for people with disabilities, for example.

The legislation has been positive but has, as my fellow contributors have said, fallen short in some respects. The first is that it has not kept pace with changes in technology. For example, we should by this stage be routinely publishing disclosure logs, but that is not happening, even though the technology exists to make it easy and cheap to do. Secondly, if we benchmark what is happening against international normative principles it falls short on five of six that I used.

I will end on a positive note. The 2002 act meets the criterion of reasonable cost. However, it is falling short on other principles, so we could do more.

I will start with the positives. The legislation is functional. By that I mean that although it is not the best law in the world, it has been well implemented. I have acted as an adviser to many Governments and commissioners around the world in places that have much better laws that are, however, quite frankly unachievable in their aspirations.

Public awareness is high. We have tested that since the 2002 act came into effect. Awareness shot up almost immediately the law came into effect and has remained high. There have been very significant disclosures, and some things that we now take for granted did not happen before the act.

Daren Fitzhenry’s submission mentions, for example, food hygiene standards and the certificates that go with them. Before the 2002 act came into effect, those were never published. Nowadays we expect to find them in every cafeteria and food outlet, and companies such as Just Eat are under pressure to ensure that they take their products only from companies that meet the highest standards. Such information was all unknown before the 2002 act came into effect, and was regarded as being commercially confidential. I could give many other examples.

On the downside, we have unfortunately moved into a kind of compliance culture, so decision-making on whether to release information and then appeal to the commissioner is much slower than we expected of an informal process. It is quite commonplace for officials to say that they have 20 days to respond to requests and to comply with that timescale. That is not what the 2002 act says: It says that responses should be given

“as soon as practicably possible”

and, in any event, not later than 20 days after the request.

Secondly, the regime is quite stagnant. We simply have not extended the reach of FOI as was expected under the law, and as is now expected in how public services are delivered. I know that the committee is looking at that.

The third point that has been raised by other witnesses is the failure to record: information is not held in a way that makes it easily accessible for FOI requests. There is no obligation to record information that the public might be interested in.

The biggest positive is the ability of the ordinary individual to go to large public authorities to ask for information that interests them. That is obviously to be welcomed.

There are downsides to the legislation. One of the biggest is probably how public services have changed their delivery. Also, Scottish Governments have until recently been hesitant to use the section 5 powers to extend. There have been some legislative changes in that respect—perhaps we are seeing more now—but there is probably more work to be done on that.

Thank you. I will move to theme 1, which is the first part of the process—making a request for information. I would like witnesses to give us their views—if you have any; you do not have to speak on every theme, if you do not want to—on that process. That is about the whole process of requesting information: whether it is fit for purpose; who uses it; whether more could people use it; Whether more education is required; and whether it could be made more consistent? We heard about that in relation to local authorities at our last meeting.

I will speak to some research on FOI that I have been doing over the past few years.

It seems that users of FOI in Scotland are similar to users in other regimes—a mixture of the public, businesses, non-governmental organisations and journalists. It is important to note that the largest user group is normally members of the public. As, I think, the successive information commissioners in Scotland have pointed out, there are gender and age discrepancies, however: if you want to imagine the typical requester, he is male, middle-aged and white. There is a discrepancy in terms of who uses the law and their age.

Most requests go to local government—we estimate about 80 per cent. It is important to remember that, in relation to resources and patterns, FOI is primarily a local tool.

Also—here, I suppose, you can refer to what Tony Blair famously said about the UK Freedom of Information Act 2000—a small number of requests attract a great deal of attention. I will quote Professor Dunion, who said:

“The real value of FOI is often in the pages of the local newspaper rather than in the national newspaper.”

I think that that pattern of FOISA used being by white male middle-class people reflects knowledge and understanding among the general public of all legislation. Ben Worthy says in his submission that the legislation is less accessible to people with disabilities and older people. That is not unique or specific to FOI legislation: it is part of how the population works. People with educational disabilities find it difficult to find out about any law, never mind FOI.

That means that we have to address a broader societal problem. How do we make the public more aware of their rights and the law? I would say that knowledge of FOI is no worse than knowledge of other laws.

Thank you. That was helpful.

I have looked at the matter in quite some detail. I also read what the witnesses at the previous committee meeting said about it. There seem to be two tracks that we can go down. One is a track that was suggested at the last committee meeting, which is that we in some way formalise the process of making requests. That might be of assistance to people who are not aware of how to do so. The suggestion might be, for example—as is the case in many other countries—that there be a portal, or a named person or a specified address and public authority to go through.

I could argue that we should have, for example, named freedom of information officers in every authority, which is commonplace around the world. Many countries require under their FOI legislation that there be named freedom of information officers who have overall responsibility, but are not necessarily the people who answer requests.

With my other hat on, as convener of the Standards Commission for Scotland, I note that every public authority in Scotland has a monitoring officer or a standards officer, as required by legislation. I do not know why we do not have the same thing for FOI. That could be done. We could, for example, create lists of contact points that could be held by the information commissioner. The website WhatDoTheyKnow lists about 24,000 authorities, including Scottish authorities, with contact details that can be used to make requests.

However, the legislation—this is not quite unique, but it is unusual—was designed so that people do not have to know their rights. Why is it that people who understand the law are white middle-class males? Every information request is an FOI request in Scotland. The person does not have to know their rights: the duty lies on the authority to recognise that it has an obligation to respond to that and to treat it as per the legislation.

My concern, if we were to move away from that, would be that that would be of great assistance to white, middle-class, male activists and journalists, but not to the ordinary individual who just wants to ask a question about what is happening on their street or in their school, and simply makes a request to their school or local council. To force them to go through a portal or to a specific email address would be contrary to the expansive intentions, which were discussed in great detail in committee as the legislation was progressed .

Thank you.

I would echo Professor Dunion. The advantage of the way in which the act is drafted is that one does not need to know that FOISA exists in order to make an FOI request. You can just write to a public authority by email, or whatever means, to ask for information. The public authority is then under a duty and an obligation in law to deal with that as an FOI request. To move to a system in which people have to fill in a form could be detrimental to the rights of individuals, so I would caution against it.

That is interesting.

I want to explore a couple of areas, one of which is very straightforward. Is FOISA compliant with the provisions on access to information under human rights legislation? Would anyone like to comment on that?

Dr McCullagh, did you allude to that earlier?

I will start and then I imagine that everyone else will chip in. The existence of a right to access to Government information is increasingly recognised in national and international laws. At the international level, the existence of a right to access information is frequently articulated in human rights documents. The first convention on access to information law—the Council of Europe Convention on Access to Official Documents—was adopted in 2009. The convention is the first binding international legal instrument that recognises a general right of access to official documents that are held by public authorities. It lays down a right of access to those official documents and limitations on that right are permitted only in order to protect certain interests, such as national security, defence or privacy.

However, this is where it gets interesting. The convention has been adopted but it will not enter into force until it has been ratified by 10 member states. To date it has been ratified by nine states and it has been signed by a further eight states. The United Kingdom has not yet signed or ratified the convention, and I think that it should add that to its to-do list. Even if the UK—or should I say the Westminster Parliament—is consumed by all things Brexit, that should not stop the Scottish Parliament giving consideration to how Scottish law could comply with the convention. The Scottish Government should take steps to ensure that the FOI law in Scotland matches the convention standards; it should be ready and in a position to say to the UK and other Governments, “We are ready to sign and ratify this. Let’s move the discussion forward.”

You also asked specifically about human rights laws. When it comes to human rights laws, there is a variety of different levels. There is the United Nations, which is an important body, and in 2011 the United Nations Human Rights Committee published a new general comment on article 19 of the International Covenant on Civil and Political Rights. It expressly acknowledged that article 19 embraces a general right of access to information held by public bodies.

As for the European convention on human rights—

I am sorry, Dr McCullagh. Please be brief.

Yes. If you look at the European convention on human rights, you will see that there have been pronouncements saying that a general right of access to information is a good thing, but the jurisprudence of the court has been slow to actually decide that in judgments. We have one judgment—I can give you the name of it—from Hungary, which says that it really depends on whether there is a public interest in having the information.

To sum up, we are doing our best to be compliant with human rights considerations but there is more work to be done.

Are you saying that the FOI legislation is or is not compliant?

It is compliant in the sense that we have a general right of access to information, but we need to make sure that we have that right not just in spirit and that the information can actually be accessed properly. There are procedural barriers and cost barriers in place. In theory it may look as though it is compliant, but is it in reality?

Do other members of the panel have a view?

For all practical purposes, we have tried to steer away from this area because, as Professor McCullagh said, the interpretation of the right has not been heavily tested in the courts, certainly not in this country and barely at all in Europe. It has been more prominent in discussion in Latin America. The United Nations Educational, Scientific and Cultural Organization did a lot of work based around article 19. That is what drove forward a lot of the legislation and there have been court cases in Latin America, particularly in Chile. The campaign for freedom of information also prominently reflects that.

To my mind, the opening right in our legislation is very clear. It is about whether any restrictions on that right are contrary to what we expected. I do not think that they are; I do not think that the idea that you have a right to information means that you cannot place restrictions on the cost or the nature of that information and there would always be exemptions that you would be entitled to apply to it. The question, therefore, is whether those exemptions are either reasonable in themselves or are being unreasonably interpreted. That is the role that the commissioner has to play, but our reference is to the 2002 act and not to the overarching human rights convention.

In the environmental area, there is a specific requirement under the Aarhus convention that is implemented through the European Union directive, which more or less complies with those particular requirements.

I have two questions. In response to another parliamentary committee, the permanent secretary indicated that the Scottish Government archives information after a certain period of time. If I remember correctly, the archived information is not readily available after just a year. Surely any public organisation that archives information, even if that is over a five or a 10-year period, and which receives an FOI request for that information, is duty bound to go into the archives and release it. Is that right?

I would have thought so. There is no special argument to say that because information has been archived, it is no longer accessible under the legislation. Archiving should be a good thing—it should mean that you have looked at the information after a year and studied whether or not to retain it. In other words, information that is ephemeral or of no particular value would be disposed of. The archive, to the contrary, should contain information that is still to be referred to and useful.

I cannot understand why such information would not be accessible through FOI. For example, we are not talking about information that would be covered by any restriction on timescale. That would be a different matter altogether. If the archive material has simply been taken off the day-to-day server but is still accessible, of course it would be covered by the FOI law.

Should there be guidelines on what information can be archived and is therefore retrievable, and what information is disposed of never to be seen or heard of again?

The legislation on public records, for example, was meant to do that. Each authority should have a records management plan that it agrees with the keeper of the records of Scotland. The plan should set out how long information will be retained for before it is archived, when it will be archived and how it would be recovered, and any information that was particularly sensitive that would not be accessible through the normal archival recovery procedures. That was a major discussion that came about in Scotland.

The very first investigation that I carried out as Information Commissioner was on what information about looked-after children existed and what did not. There was a paucity of information and lack of consistency, which is why we came up with a public records management regime in Scotland. That should be the first port of call for public authorities.

Thank you—that is very clear.

Secondly, very often when someone makes a request for information, they get the reply, “That information is not collated or centrally collected.” A distinction is made. For example, it is difficult to deny a request for a copy of a letter, because it is just a question of photocopying the letter and sending out the copy. However, if the request is for information that needs to be collated or collected, what are the person’s rights? The authority might then say, “It would cost over £600 to collect that information.” How do we improve on that response? I think that that is sometimes used as an excuse to get around the legislation.

Given the £15 per hour calculation, £600 represents a fairly generous amount of time to gather information; a lot of hours could be spent on gathering information before the figure of £600 would be reached. The difficulty arises if, for example, the authority is being asked to collate information that it does not hold. There is no right to have the authority create information.

If the information is held in a dispersed fashion across the authority’s functions or sites, that comes within the scope of information that can be recovered. If that can be done within the £600 limit, saying that the information is not centrally collated is not an excuse. The person is entitled to have that information gathered and provided to them. The question really comes down to whether the information that has been requested exists at all. Where is the information? How onerous would it be to gather it in and would that fall within the chargeable regime, under which the charge could be £50 up to the £600 cost limit? Beyond £600, of course, the requester is not entitled to get the information.

Assuming that the cost is within the £600 limit, is the authority duty bound to supply the information although the requester may need to collate and analyse it?

The analysis would be for the requester to do, but if, for example, the information is held locally in a number of facilities in the health board area, the authority does not direct the requester to each one of those facilities. The authority must gather in the information—it holds the information, but simply in a dispersed fashion—and then present it in a list or in the form that the requester wants. They may then want to analyse or interpret it further. The authority does not have to do that for the requester, but the raw material that they have asked for should be made available to them by that process of collation.

This discussion highlights a bigger issue. In looking at the operation of access to information, that cannot be separated from how information is held, collected and used within an authority. One of the frustrations from users with regard to environmental information is the length of time that it takes to get a response, but sometimes that is genuine because the authority—as has been described—holds the information in different places and it needs to be brought together.

The user on the outside can see that as a problem, because the request tends to be based on a particular location or spot within the authority, which does have the information although it is divided for functional and operational reasons. There is a bit of a mismatch there, which sometimes alters the public expectation because people do not appreciate the difficulties that the authorities have in collecting the information. Equally, there may be ways in which the authority can hold, index and archive the information to make it easier to access.

I dealt with something like that in a case in Scotland; I cannot recall the exact case. Basically, the authority refused to add up. The person asked how many instances there had been of whatever the thing was that they wanted. The authority actually held, say, 50 cases in its system but because the request was for a composite number its argument was that it was not required to add up. I said that that was clearly nonsensical. If you can see that you have 50 cases, all individually numbered from one to 50, you know that you have 50 cases. The idea that information can be made available only if the authority has already brought it together for its own purposes is completely contrary to the spirit and the requirements of the legislation.

Out of interest, do you find that the same rules are applied within organisations? I have an example. I asked our Scottish Parliament information centre to collate for me the number of legislative provisions that have been passed by this Parliament but have never been enacted. The precise answer came back about the £600 limit and the fact that too much time would be spent on the request. To me, that seemed strange because it was a legislative answer to an internal question. Do you find that organisations use the scope of the legislation to block requests within that organisation, or is a request such as mine legally a FOI request?

That is a good point. Perhaps until that time there has been a collegiate exchange of requests and responses within the organisation, and the 2002 act has never been invoked or referred to. When the response is not one that the requester has expected, sometimes they formalise the process and that can cause friction or resentment. I have seen that happen, particularly with trade union representatives inside an organisation who have been speaking to the personnel department and then suddenly they formalise a request in a way that is contrary to their previous exchanges.

I think that the very last decision I took as Information Commissioner concerned a health board. A nurse had asked for information regarding near misses in serious incidents that involved operative and surgical care. When that was formalised as an FOI request, the response from the authority was extremely negative. Indeed, at one point it said that it would treat the request as vexatious and suggested that the board might institute disciplinary proceedings against the employee if he continued with his request. I refer to that because it is a very famous case.

On that specific point—clearly, this could apply across Scotland in big organisations such as health boards of councils—is a request from an employee or somebody within the organisation a legal FOI request, or does the requester need to be outwith the body to exercise a legislative right?

Technically, it is. Obviously, if you were sitting next to your colleague and you pinged them something in an email you do not expect to be exercising your FOI rights to them. However, if you are a relatively junior employee in the organisation and you ask management for information that impacts upon the way in which you carry out your work, or how hours are actually allocated to work, that is an FOI request. People often ask, in particular, how procedures are being applied. For example, in the case of universities where academics have asked for information from their own institution, those are FOI requests.

I would like to draw theme 1 to a close—it is a big theme—but before we do that, I think that there is an important point for Professor Reid on environmental information and FOISA. Are we now at a point at which those two should be merged?

Having the two regimes is a bit confusing. Clearly, having just one system would simplify the situation, although in most cases it does not make any difference. Often it is the user, or the requester, who is confused. They make an FOI request but it has to be responded to as an environmentironmentironmental request and they do not quite understand why they are dealing with different things.

Merging the two systems would make that easier. The constraint would be that, with the environmental scheme, even when we leave the EU and no longer have to comply with the detailed EU directive, we would still have to comply with the requirements of the Aarhus agreement on access to environmental information. In some ways, those requirements are a bit different from the rules in FOISA, particularly with regard to some of the exemptions and the definitions. If the two were to be amalgamated, there would have to be a shift. The environmental information rules could not be put into FOISA without falling foul of some aspects of the Aarhus convention, so the general rules of the 2002 act would have to be shifted towards wider access in line with the Aarhus structure.

It sounds as though it probably would not be wise for the Parliament to tackle a merging of those two issues until Brexit is decided.

Until we know what is happening, we are bound to follow the EU directive, which is not just Aarhus but a slightly stricter version of that.

Okay. That is helpful.

Once that directive disappears, we would have more flexibility in what we did on the environmental side so long as we still complied with Aarhus.

Liam Kerr will introduce theme 2.

I will lead on from Alex Neil’s point about how bodies respond to requests and their ability to do so. Dr Worthy and others have highlighted the massive resource pressures on public bodies, particularly local authorities, which I think that Dr Worthy said deal with 80 per cent of requests. We have had a number of representations suggesting that, particularly in relation to local authorities, there should be a review of the cap of £600 on the cost of responding. Does any of you have any thoughts on that or on the resource concerns in general?

We need to have careful conversations on that. The problem is that it is hard to measure how much an FOI request costs. We have looked at different ways of calculating that in different regimes. For example, in relation to the UK Freedom of Information Act 2000, the UK Government estimates that it costs £193 per request, but a local council estimated that it cost £19. You can take whichever figure you like and run with it.

My other concern is that, when we talk about the cost of FOI, we are talking about the cost of a democratic right, so that is like the discussion of how expensive an election is. Also, that discussion is sometimes framed in a particular way. I believe that, given all the resource cuts that local government has experienced, it needs more support, but there is a danger in talking about FOI as a burden. That plays to a certain argument against the law.

Unless anyone else wants to come in, I will move on to come at the issue from a slightly different angle. Professor Dunion talked about the timescales. He pointed out that 20 days is a limit and that compliance should be as soon as reasonably practicable—the period of 20 days is a kind of longstop. If the analysis that we have just talked about is right, compliance is becoming ever more complex. The Scottish Courts and Tribunals Service has suggested that, with complex requests, we should go to a 40-day compliance window. Do you have any thoughts on that?

Ben Worthy is laughing. Would you like to tell us why, Dr Worthy?

I am sorry. It is the problem of an anchoring effect: whichever number is set, people will work to that number automatically. One of the dangers is that if, as Professor Dunion said, people are working towards 20 days and that is changed to 40 days, they will work to that. When the UK Government initially put together its law, it recommended something similar, and there was outrage, with people saying that most requests would end up appearing on day 39 rather than towards the beginning.

Regimes around the world have different time limits. Across Europe, the period varies from five working days to, I think, 40 days in a few regimes. Professor Dunion will know better than I do on this, but I believe that, in Mexico, there are procedures whereby, if an issue is related to human rights, the request has to be dealt with within two days. There is huge variation. I just fear that the anchoring effect will mean that the longer the period the more people will work to the limit. In a way, that is human nature.

There are shorter time periods in other countries depending on the issue, as Ben Worthy pointed out. Information sometimes has a value within a particular timeframe and loses its currency after the timeframe has passed. When journalists are trying to report on something that is newsworthy and topical, it can be important to have timely responses because, in the newspaper world, after 40 days, the whole political situation might have moved on.

That can happen in 40 minutes.

Well, yes.

There is one aspect that I would like to mention about timescales. It is a comparison with the 2000 act and is something that the committee and Parliament might want to be aware of when considering the matter. Under the 2000 act, the period is 20 working days, as in Scotland, but that can be extended in certain circumstances. However, if the period is extended, there is no definitive legislative date by which the request must be responded to. If the Parliament and the committee are minded to recommend that there is some form of change to the timescales, it is important to ensure that there is an absolute maximum statutory period in which a request can be responded to. I have seen examples under the 2000 act of requests taking nine, 10, 11 or 12 months to be dealt with.

That is helpful.

There is an issue about the development of technology. The environmental rules were made up at the end of the last century, when access to information meant somebody getting a printed copy from the filing cabinet, copying it and posting it. Public expectations about immediate access to information have changed hugely. There is a deeper issue in that the way in which information is kept, gathered, stored and distributed is now a bit out of step with the situation when the legislation was first thought about.

Professor Reid, let me put an example to you involving a business in my constituency that submitted an environmental request. Someone from that business told me:

“After 14 days, I was advised that Government”—

Scottish Government—

“Departments would require extra time to acquire the relevant information. This extension was another 28 working days. So the initial request commenced in September, but it was not delivered”

until much later. In addition, virtually all the staff names, positions and email addresses were redacted. It was argued that that was to protect the staff, but it made it very difficult to determine who was providing information to whom. It was only because the same request was made to three different Government departments and agencies that they were able to put the pieces of the jigsaw together to get the information that they needed.

Is that acceptable, and is it common?

I do not know how common it is, but it does not sound like good practice. Without more detail, it is hard to comment. Authorities have an obligation to assist the requester and it sounds as though that may not have been the case there. There is also the issue about different information being held by different authorities and being divided up and so on. That goes back to the wider issue that, from the outside, people might see a single issue but, from the governmental side, it may be divided up into a number of chunks for a good or a bad reason.

Are authorities overwilling to redact?

I have not studied the content of responses often enough to answer that. Professor Dunion would be in a better position to answer it.

To go back to your first question to Professor Reid, convener, did you mention that the information requested was environmental information?

Yes.

That is a good example of what Ben Worthy has talked about. Because of the Aarhus convention and the directive, the environmental information regulations allow additional time for what are described in the regulations as particularly complex and voluminous requests for information. It does not sound to me that that request was particularly complex or voluminous, but who will test that until after the fact? The authority can assert that a request is of that nature and can then take the extra 20 days. In those circumstances, authorities can take up to 40 days to provide environmental information. Unfortunately, the concern is always about the potential for abuse by the authority in dealing with information requests and not abuse by the requester.

As Dr McCullagh said, there are sometimes time constraints on the usefulness of information. With the environmental information regulations, the directive and the convention are about not just access to information but public participation in decision making. In other words, there is a purpose built in, which is that the information is intended to be useful in allowing the public to contribute to a democratic decision-making process. An example would be the planning process. Authorities sometimes push things to the limit so that the information is less useful than it might be otherwise.

Dr Worthy, in your introduction, you used the phrase “proactive disclosure”. What do you mean by that, given that we have what seems to be more of a reactive process?

It is important to remember that freedom of information laws are supposed to do two things. Organisations are supposed to respond to requests, but they are also supposed to publish information that may be of interest to the public proactively without a request. That brings me on to one of the problems that Dr McCullagh and others have been alluding to. When the laws were created in the mid to late 20th century, the idea was that the publication schemes, as they were called, would help to drive the process. The idea was that an index would be available so that people could see what information was available and would be published. The difficulty is that the proactive aspect has been overlooked to an extent, because of the focus on requests.

We have found in our research that the publication schemes do not work in the way that they used to because, if people want to find information from a public body, they just Google it. They do not scroll through a long list of documents; they try to find it by Google.

In research that involved an experiment with English parish councils, we made FOI requests to some and an informal ask to others, and we also asked if they would publish the information. We found that, when we made a formal request, they were more likely to publish the information on their websites, even though they were not legally obliged to do so. The two are linked, but our research pointed to the idea that the proactive side, because it is difficult to manage, is slightly outdated and is not happening as much as it should.

Dr McCullagh, is that what you meant when you talked about disclosure logs?

Yes. It is basically that authorities should publish a record of any requests that they have received. People often use Google to look for the same answer over and over again, and people have to submit the same requests. If authorities publish what they have already disclosed, that cuts down a lot of the interaction and speeds things up. It keeps everyone happy and it is easy to do, because of the technology and the internet.

Mr Bowman’s question has moved us into theme 3, so I will bring in Mr Sarwar on that in a moment, after Professor Reid.

Another of the legal differences between the FOISA regime and the environmental regime is the greater obligation under the environmental regime towards proactive disclosure. However, because of the dominance of the general freedom of information stuff, as an area of research, work and study priority, that issue tends to be diminished. People still tend to think about the environmental information regime as reactive, although the proactive side should be important and it genuinely is, because authorities publish a lot of information.

Dr McCullagh and Professor Reid have covered some of this in talking about proactive publication. Can I take you back a step to before the proactive publication? FOI was meant to be all about openness, transparency and greater accountability. Is there a risk that the culture has changed and that people may now not be recording information that they previously did so that they can avoid FOI requests?

There is always that risk, and I think that it has got greater in some respects. On the preparedness to be candid in the advice that is given, for example by an official to a minister or between ministers, when I was looking at documents within the confines of FOI requests, I did not see any reduction in the candour and professionalism of advice that was given to ministers. What people were more concerned about was the informal email exchanges that led up to that official advice coming out, but often those were protected by the exemptions in the legislation about formulation of policy and so on.

To be frank, the area that I am now concerned with is the temptation to have actual avoidance, and I see that there have been some submissions on that. When I was commissioner, I came across an authority that actively went out of its way to instruct staff not to write anything down, to verbally brief their colleagues if they came back from a meeting, for example, and to remove all their diary entries once their expenses claims had been submitted. Clearly, that was intended to frustrate FOI, so some of that gaming of the system will go on.

The third area is the ability to exchange information not using the official channels, using private email addresses, WhatsApp and so on. That has always gone on since the advent of BlackBerrys, but the intention was that that information would still be copied into the official systems thereafter. It is quite clear that there have been instances where that has not happened. If I am allowed to refer to what is currently in the public domain, there was the exchange between Michael Gove when he was Secretary of State for Education and Dominic Cummings when he was a special adviser. That was referred to by Severin Carrell in one of your earlier sessions. Severin Carrell got that wrong, because he said that the information was not accessible—

Severin Carrell thinks that he is never wrong.

Well, in that case, Severin Carrell misremembered what happened subsequent to the Financial Times report. The information commissioners, Christopher Graham—my counterpart in England at that time—and I, clearly said that it did not matter the portmanteau through which the information was exchanged. Whether it was exchanged through the official channels, via a Hotmail account or in a Tesco bag, it remained official information if it was on official business and, therefore, was still FOI-able. Commissioners would have the right, for example, to inspect any device that held that information, and that is quite clearly the case.

On that point, are you saying that exchanges between special advisers via email or text message on personal phones all fall under the ambit of FOI?

They do if they are about the official business for which special advisers are employed. That is clear from the decision that goes back quite some time now, back to when that incident happened. It is quite clear in the guidance. If you go on to the websites of the information commissioners in Scotland and the UK, that is quite clear and warnings are given that—and this is why it is extremely important—if an FOI request comes in and you do not disclose the fact that you hold that information on that device, you are in danger of being prosecuted for obstructing the release of information. You could be prosecuted and fined £5,000.

If it were believed that official information had been exchanged in private personal emails and texts, are you saying that the people exchanging that information would be legally obliged to disclose it under FOI?

Yes, they would be. It is quite clear. My concern is that that is not being readily understood and people are endangering themselves by thinking that they are getting around the law.

If an FOI request is made and the officer who is dealing with it goes to the relevant ministers or special advisers to request information but is not proactively told that communications took place on private servers and, therefore, denies that information, are you saying that they are proactively breaking the law?

Yes, I am, because it is quite clear that they are obstructing the release of information that they know they hold and is within the scope of the request. Section 65 of the 2002 act sets out quite clearly that it is not just simply destroying or defacing the information that is an offence; obstructing its release is also an offence under our legislation and is actionable. When I was commissioner, there was an instance where I found that information had not been provided in response to requests and had been deliberately taken off the system by the authority concerned. That case was not to do with a private mobile, but it is because of that case that we had a change in the legislation in Scotland so that a prosecution could take place some time after the offence has committed, because it is so difficult to establish that it has happened.

Professor Dunion, undoubtedly there will have been private emails used or text messages used to communicate Government business. The scale of it is unknown for the moment. Have you ever seen an FOI response that included communications on a private server, private email, text message or WhatsApp?

Well, I do not think WhatsApp existed when I was Information Commissioner, so not that.

Or even since then?

No. That is why, when Dominic Grieve stood up in Parliament four weeks ago and asked that question, he was knocked back intentionally by Michael Gove in his new capacity and by Geoffrey Cox, the Attorney General, but I think that they were both wrong. They said, “Who would be the person who could actually inspect the devices?” Well, the answer is that the Information Commissioner has the power to do so. That is quite clear in the legislation. However, it is not something that a commissioner would do lightly. I have asked the question of senior civil servants and ministers directly, “Is there any other information within the scope of this request?” but I would not ask them to hand over their mobile phone to prove it. I think that there would have to be some evidence from a third party before I would do so.

Ben Worthy is desperate to come in on this point. Is that right, Dr Worthy?

Yes. I was going to add exactly to what Professor Dunion said and talk a little bit about our attempts to bottom this out in our research on FOI in the UK 2000 act and in English local government. Our conclusions were twofold. One was that, at an official day-to-day level, the chilling effect, as it is called, is quite rare. We found that officials were more concerned about the result of not having a record if a judge came knocking. We even found—and other researchers supported this—that the arrival of FOI can sometimes have a professionalising effect. I mean that in a positive way in relation to how people went about keeping records.

The second area, and the area that is a bit more mysterious, as Professor Dunion alluded to, is about the higher politics. In 2018, of course, there was the intervention from the Information Commissioner in Scotland. At the same time, the head of the civil service in Northern Ireland spoke of how some senior political meetings were not minuted any more. There was a creeping sense that there was some avoidance. It can be done through use of private communications or even—if I dare bring it up—the reclassifying of information, which is what seems to have been happening in the White House according to some sources. There are different ways around it. It sends a very negative signal and it undermines the law.

To think about this in the round, what we are seeing now is that FOI is interacting with all these new forms of communication. This is where it gets complicated. Dr McCullagh talked about the arrival of new technology and how that affects openness laws. The only positive that I can think of is that we are discussing these things in public and politicians keep getting caught out because, almost inevitably, there will be leaks or a whistleblower will point out what has happened. However, we are not really sure of the scale of it. There is a twin track in that we do not think that it happens every day, but we think that it can take place, particularly at controversial senior levels.

Clearly, you can see that it is happening because there is political chaos in certain places and, when there is political chaos, politicians make life difficult for each other, and that helps with leaks. However, when you have command and control government it is a lot harder. We are accepting that undoubtedly, regardless of how much it happens, there will have been business done on private servers, whether that is private emails, text messages or WhatsApp, by ministers and special advisers. There will have been FOI requests in the past, and maybe even current requests, that would be relevant to private emails, text messages and WhatsApp messages. If those have never ever been seen in any FOI responses, clearly special advisers and ministers have broken the law.

They have broken the law if they deny that they have information that is within the scope of the request and the note exists, in whatever form, whether it is sitting in their briefcase or sitting in their private Hotmail account. The case that was mentioned involving Michael Gove came to light because they inadvertently forwarded an email to somebody they did not intend to—actually to a journalist—and they outed themselves.

There are clearly instances where information that you would expect to exist does not exist. There have been some significant events in Scotland for which, when an information request was made, there was found to be nothing within the scope of that request, which seemed implausible given the nature of the activity, whether it be legislative programmes or otherwise. To go as far as saying that information exists but has been simply withheld or destroyed is a leap that I would not want to take without evidence.

I am keen to wind this up but, Dr Worthy, you started speaking there and we could not hear you. Can you please repeat what you said, briefly?

There have been a few cases, but I do not know where they have got to. It was said that David Cameron and Nick Clegg, when they were Prime Minister and Deputy Prime Minister, used to communicate via text messages. There were definitely some FOIs for their text messages, but I never saw that they were ever released, so it might be worth tracing a few of the high-profile requests like that to see where they got to.

I want to ask about record keeping, which is an aspect that Anas Sarwar has introduced. During previous meetings, there were complaints that minutes are not being taken and recorded and so on. I think that Professor Dunion said that there is no obligation under the 2002 act to record information. How do we square that with the issue that Anas Sarwar raised about the expectation that information is there somehow but is not recorded? How do we square that circle?

It is a hugely difficult question. I speak to other people in the field about this. It is one thing to have a duty to provide information that exists, but it is quite another to stipulate what information has to exist. In some countries with more modern FOI laws, built within the confines of the statute is a requirement to produce certain information; therefore, of course, people have to record that information if they are to produce it. The equivalent of our publication scheme would be much more specific in a country such as Croatia, where the legislation sets out the information that must be made available, so there is a bottom line as to what information should be recorded.

That has taken us into the wider territory of what information actually is. We, as a society, have never really thought about what kind of information we expect to be held and released. Are we looking at that aspect now? Should it be in the FOI act or should it be somewhere else?

That certainly has been the case. There are other European obligations and legislation on what constitutes information. For example, you now expect to get access to raw data to allow you to create your own apps to analyse it. It is not just what the authority has done with the raw data that you get access to; you get the raw data itself, and you get it in a usable form, which has not necessarily been the case under FOI. I think the nature of what constitutes information has changed markedly since the legislation, which was based on a 1960s view of the world rather than on current views. I have heard Liz Denham, who was now the UK Information Commissioner, say in her previous capacity as the British Columbia Information Commissioner, say that we have a problem in that we have more information than we have ever had, and the capacity to store it, but less capacity to recover it than ever before, because we do not know what we have and how to get it back. That is a problem for us all.

This picks up on what I put in my written submission to the committee about keeping records. There has been some discussion this morning about whether such a requirement should be on the face of the FOI legislation. I would suggest not, because the bounds of it could become quite detailed and technical, as some of the discussions this morning have suggested. Is a conversation between two individuals about a project while they are in the staff canteen making a cup of coffee a meeting that should be documented? If there is just a general duty to document, you would probably end up with litigation over precisely what that means. You would probably have to define it fairly technically in a piece of legislation, and that might make the FOI act unwieldy, which is something that you probably want to avoid.

We have covered theme 3, proactive publication and record keeping. Before I move on, does anyone want to add anything on that theme that we have not heard? I see people shaking their heads. All right. Thank you.

I will introduce a topic that is of concern to the committee, or certainly to a few of our members. Our other duty is to be the audit committee, and under that duty we follow the public pound. When we try to do that, we find that there are several private companies that deliver public services but which fall outwith the ambit of FOI. You have probably read the evidence of our meeting on 19 September, when Unison made quite a compelling case about its difficulty in being able to get information from companies that deliver services but which are reliant on the public pound to do so. Do you think that those companies, which are building our hospitals and delivering services, should come within the ambit of FOI?

My general observation is that this is another function of the age of the whole process. In the same way as our vision of information went back to the 1960s, 1970s and 1980s, our vision of the public sector and the private sector also goes back to that period, when there was a very strict divide. What we have seen in the past 40 years is a huge merging of the two—all sorts of arrangements, with partnerships, contracting and franchising—and that creates a huge problem. There is no longer a sharp divide between public and private, which is causing a problem in all sorts of areas. I would say that sticking to traditional public authorities—bodies that are constitutionally public authorities—reflects a narrowing of the scope, which should be extended.

You think that it should be extended.

Yes. There are then difficulties about where to draw the limit within the part-private company in relation to which of its activities and functions trigger its falling within the regime. That is a hugely complicated area because of the complexity of the arrangements that Governments keep coming up with to fix things.

People feel most strongly about having lost rights since the 2002 act came into effect. One of the reasons why there has been such a push to get RSLs within the scope of designation is that people—

And RSLs are—

RSLs are registered social landlords.

When people who were once council house tenants became housing association tenants, they found that they automatically lost their rights to information that they could have got under the 2002 act as council tenants. The concern about including RSLs was that that would affect very small housing associations—the question was whether they could cope. We were marched up and down the hill quite a lot before we got to the stage we are at now, where we know that this year, registered social landlords will come within the scope of the legislation.

I feel strongly that we should be following the public pound for the purposes of efficiency and economy. That is partly to do with public borrowing. A lot of what was once done at the hand of public authorities directly is now done on their behalf by others, over a long period of time and for vast sums of public money. I think that that should be directly within the scope of the legislation. My view is that anything done that is a public or statutory function of an authority, anything done with public funds—proportionately within the scale of the contract, perhaps—and anything that attracts a level of public interest in it should be within the scope of the law. We are talking about things such as healthcare, care homes and schools.

We have really made very heavy weather of this. This was all thought of before the 2002 act came into effect; we simply have not used its provisions in the nimble way that we expected to. We have to get this done now. We will never keep pace with the awarding of contracts if it takes five, six or 10 years to designate the bodies that receive those contracts.

I want to add something about the difficulties of doing this. There is a broad view, which is supported by the public, that freedom of information legislation should be extended. Polling shows that that would be a popular move. The difficulty is that lots of politicians, particularly across the UK but also elsewhere, have promised to do that. However, it takes, first, a great deal of time and, secondly, quite a bit of political capital and will. I think that it will happen when there is a big enough reason with enough outcomes; otherwise, it is quite a difficult process.

To point to one rather wonderful example, when David Cameron was Prime Minister, the 2000 act was extended to cover Network Rail, seemingly because its designation was changed for another reason. Therefore, sometimes—

Would Carillion not be a big and good enough example?

I thought that it was. I thought that it was the sort of event that would change the conversation. As with lots of things, it is about somebody taking up the point at the right time.

Do any other countries extend their freedom of information regime to private companies? Professor Dunion and Karen McCullagh are both nodding.

I gave some examples in my evidence. I listed Mexico and Ireland. I have brought the legislative text from Ireland with me—I am happy to give the committee a copy of that.

In Ireland, they had an interesting experience. They decided to have the option to prescribe or designate—the word that they used was “prescribe”—certain bodies that were in the private sector but which were funded by the Government to provide what were traditionally state services. One body mistakenly thought that it was a prescribed body and went about setting up a freedom of information portal on its website and giving very good information. Then the Irish information commissioner said, “That is great, but you are not a prescribed body”. That shows that it is not as challenging as it is sometimes said to be. It is all about mindset, culture and just grasping the nettle and getting on with it. Delay is the problem

We are running short of time, so unless you have a new point on that, Professor Dunion—

To answer your question, many countries have provisions in their legislation to directly cover organisations that provide public services or expend public funds, and that could include charities, of course. India is one example, and Croatia and Brazil are other countries that I have worked in where the legislation covers such organisations. Such provisions are part of nearly all modern FOI law. As Ben Worthy says, the test is to make it happen. In both Serbia and Croatia, the information commissioners have gathered and published the names of the bodies that are covered by the law using that element of their primary legislation.

You are leading us nicely to a conclusion. Before I draw the session to a close, do members have any further points to raise with the panel?

One area that I do not think we have touched on is the definition of “vexatious requests”, which is used in the 2002 act. Is the term “vexatious” clear? Does it need better interpretation? Is it being interpreted properly at the moment? Perhaps the witnesses have a view on that.

I think that the legislation on that point is adequate. A difficulty is that public authorities are not using the vexatious provision as often or as appropriately as they could—I think that that is a view that was shared by the current commissioner when he gave evidence to the committee earlier this year. There is case law that defines what the term means both in the UK and in Scotland. The Scottish case, which was heard just last year—the case of Beggs v Scottish Information Commissioner—basically adopted the UK case law. The provision is there and it is to be used, but I think that public authorities are not using it as often as they could. I would not suggest changing it at this time.

Does the term “vexatious” equate to the term “manifestly unreasonable” in the Environmental Information (Scotland) Regulations 2004?

In practice, the terms equate, because you are talking about the request and its impact, rather than about the requester; we talk about a vexatious request or a manifestly unreasonable request. As a commissioner, you have to ask what that means, and it is taken to mean the impact of the request. The first that I upheld was against a firm of solicitors that had submitted several hundred requests to the Scottish Government for information regarding tendering for a ferry. The firm knew that the requests would simply overwhelm the capacity of the authority and was unwilling to work with the authority to reduce the scope of the requests. I regarded that as being manifestly unreasonable and the firm knew it to be so—the intent was partly to affect the authority’s capacity.

I think that authorities have been remarkably restrained. They hardly ever use vexatiousness as a reason to refuse information. I think that they shy away from doing so. It may be that they should use it more often to deal with the concerns that they have raised, but they do not choose to do so. I think that the manifestly unreasonable test, as in the EIR, is the test that would apply in practice.

I will go back to a previous answer given by Kevin Dunion in relation to chasing the public pound, particularly in the private sector. You seemed to hint that the provisions are already in the statute and are not being used. Is that a correct interpretation of what you said?

Yes, the provisions are there both to directly designate such bodies or to bring them within the scope of the legislation on an ad hoc basis for certain purposes. It is just that the legislation is not very nimble. It seems to require lots of consultation and the gathering of responses and then it needs to go to committees, the Government needs to come up with a designation order and there needs to be an implementation period. Let us say that a contract is for only three years. The three years might expire, with several million public pounds being expended on a failed project, without a single question being answered while the contract was live. We have to find a way of building the designation into the contract process and of saying that the recipient of the contract will be subject to FOI laws. That would be a practical approach to making the law work as opposed to the process that we have.

There are many examples in Scotland. I go back to the concerns about the Reliance contract—the prisoner escapes and so on—and to what is happening in some public-private partnership projects. We would expect to get information directly from the builder or the operator, rather than from the authority that lets the contract, which may not hold the information.

Thank you. Do members of the panel have any further points to make or solutions to suggest before we end the session? Do you all think that the 2002 act needs to be updated?

Yes.

Yes.

Yes.

Yes.

Yes.

You all agree. That is very clear. Thank you very much indeed for your evidence this morning. I now suspend the meeting until 10.20 to allow for a changeover of witnesses.