Decision 066/2025: Scottish Ministers’ WhatsApp and text messages
Authority: Scottish Ministers
Case Ref: 202400422
Summary
The Applicant asked the Authority for WhatsApp and text messages from March and August 2021. The Authority disclosed some information but withheld other information falling within scope of the request under a number of exemptions. The Commissioner investigated and upheld the Authority’s application of the exemptions in relation to some of the withheld information, but found that the Authority had been wrong to withhold the rest. The Commissioner required the Authority to disclose certain information to the Applicant.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1)(b) and 2(e)(ii) (Effect of exemptions); 28(1) (Relations within the United Kingdom); 29(1)(b), (4) and (5) (Formulation of Scottish Administration policy etc.); 30(b)(ii) and (c) (Prejudice to the effective conduct of public affairs); 36(1) (Confidentiality) and 38(1)(b), (2A), (5) (definitions of “data protection principles”, “data subject”, “personal data”, “processing” and “UK GDPR”) and (5A) (Personal information); 47(1) and (2) (Application for decision by Commissioner)
United Kingdom General Data Protection Regulation (the UK GDPR) articles 4(1) (definition of “personal data”) (Definitions); 5(1)(a) (Principles relating to the processing of personal data); 6(1)(f) (Lawfulness of processing) Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data)
Background
1. On 14 October 2021, the Applicant made two separate requests for information to the Authority. He asked for:
(i) Any WhatsApp or text messages sent or received by any Cabinet Secretary of the time on Government business during March 2021; and
(ii) Any WhatsApp or text messages sent or received by any Government Minister on Government business during August 2021.
2. The Authority responded, separately, to both requests on 11 November 2021. It informed the Applicant in relation to both requests that, under section 17(1) of FOISA, it did not hold the information. It stated that this was in line with records management practice and statutory data protection obligations.
3. On 15 November 2021, the Applicant wrote, separately, to the Authority requesting a review of both decisions. The Applicant stated that he was dissatisfied with the responses provided, because he believed the Authority did hold information relevant to his requests.
4. The Authority notified the Applicant of the outcome of its review on 7 and 8 December 2021, upholding its original decision for both requests.
5. On 13 December 2021, the Applicant appealed to the Commissioner with regard to those requests, an appeal which resulted in Decision Notice 045/2024. During that investigation the Authority withdrew its reliance on section 17(1) of FOISA and stated that it intended to provide the Applicant with new responses to his requirements for review, other than in terms of section 17(1).
6. On 15 March 2024, the Authority issued a revised review outcome to the Applicant. This review outcome covered both requests and disclosed some information, but withheld other information under sections 26(a), 28(1), 29(1)(b), 30(a), 30(b)(ii), 36(1) and 38(1)(b) of FOISA. The Authority also withheld information on the grounds that it was out of scope of the requests.
7. On 20 March 2024, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Applicant stated he was dissatisfied with the outcome of the Authority’s revised review because he believed that all of the identified WhatsApp messages fell within the scope of his request. He argued that it was in the public interest for all of the information to be disclosed, particularly since the Authority had repeatedly insisted that government business was not routinely done on
WhatsApp, when that was clearly not the case.
Investigation
8. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
9. On 25 March 2024, and in line with section 49(3)(a) of FOISA, the Commissioner notified the Authority in writing that the Applicant had made a valid application and asked it to send him the information withheld from the Applicant. The Authority provided the information, and the case was subsequently allocated to an investigating officer.
10. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Authority was invited to comment on the application and to answer specific questions relating to its reasons for withholding the information under various sections of FOISA.
Commissioner’s analysis and findings
11. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.
Scope of the investigation
12. As noted above, in its revised review outcome of 15 March 2024, the Authority informed the Applicant it was withholding information under section 26(a), 28(1), 29(1)(b), 30(a), 30(b)(ii), 36(1) and 38(1)(b) of FOISA.
13. During the investigation, the Authority withdrew its reliance on sections 26(a) and 30(a) of FOISA. For both exemptions, it released some information which had previously been withheld, and it withheld the remaining information under different exemptions that were already being applied. Given the Authority’s change of position, the Commissioner will not consider the exemptions contained in sections 26(a) and 30(a) of FOISA in this decision.
14. During the investigation, the Authority also located further information which fell within scope of the request. It disclosed some of this information to the Applicant, and the remainder was either withheld under existing exemptions, or withheld under section 30(c) of FOISA (a new exemption applied during the investigation).
15. The exemptions that will be considered in this decision are:
- Section 28(1) – Relations within the UK;
- Section 29(1)(b) – Ministerial communications;
- Section 30(b)(ii) – Free and frank exchange of views;
- Section 30(c) – Effective conduct of public affairs
- Section 36(1) – Confidentiality in legal proceedings; and
- Section 38(1)(b) – Personal information
16. The Commissioner will also consider the information that has been withheld by the Authority on the grounds that it is out of scope of the request.
Information held by the Authority
17. Section 1(1) of FOISA provides that a person who requests information from a Scottish public authority which holds it is entitled to be given that information by the authority.
This is subject to qualifications which, by virtue of section 1(6) of FOISA, allow Scottish public authorities to withhold information. The information to be given is that held by the authority at the time the request is received, as defined in section 1(4).
18. The Authority was asked to provide details of the searches it had carried out to identify and locate information within the scope of the Applicant’s request.
19. The Authority referred to the submissions on searches it had provided to the Commissioner on 15 March 2024, when it issued its revised review outcome to the Applicant.
20. In those submissions, it recognised that the searches in relation to the original two requests could have been better and that, as a result, it had withdrawn its original reliance on section 17(1) (information not held).
21. After a review of the handling of the original requests, the Authority had concluded that:
(i) Original search requests sent to ministerial private offices should have been clearer that Ministers should search personal mobile devices, and not just Government devices, for information which fell under the scope of the request
(ii) The wording of the search request text could have been clearer
(iii) Some individuals being asked to conduct searches lacked understanding of relevant FOI law
(iv) It did not keep adequate records of searches carried out during the original request
22. Those failures led the Authority to conclude it should conduct the searches again. It explained that, in order to carry out further searches, it drew up two tables detailing all Cabinet Secretaries as of March 2021 and government ministers as of August 2021 whose messages would fall within scope of the requests. All were contacted and asked to search for WhatsApp and text messages relating to government business for the relevant periods. Guidance, which was not exhaustive, was provided with examples of
information which would be classed as government business.
23. The Authority stated that five people submitted that they held no messages (Fergus Ewing, Christina McKelvie, Claire Haughey, John Swinney and Nicola Sturgeon). The Authority also noted that Ms Sturgeon and Mr Swinney stated that, although they did not personally hold messages in scope, they believed that some messages were held by the government for the purposes of responding to the Covid Inquiry. Other individuals provided information within scope of the requests, which was then considered for release.
24. The Authority also provided details of a series of changes it had implemented to improve procedures when dealing with Ministerial WhatsApp and text message FOI requests in future.
25. In its revised review outcome of 15 March 2024, the Authority submitted that as of that date, it had not received a response from former minister Roseanna Cunningham on what, if any, messages she held. However, during the investigation the Authority confirmed that Ms Cunningham did hold some messages and these were provided to the Commissioner.
26. The Authority initially provided the Commissioner with two documents. Document 1 contained messages from March 2021 and document 2 contained messages from August 2021. During the investigation the Authority also located a number of other messages which had not previously either been provided to the Applicant or withheld under an exemption. The Authority disclosed some of these messages to the Applicant, but the remainder were withheld under various exemptions. Messages from Ms Cunningham were contained in a third document (document 3) which was separate to the original documents 1 and 2.
27. Having considered the Authority’s submissions and the terms of the request, the Commissioner accepts that (by the close of the investigation) the Authority had taken adequate steps to identify and locate the information it held which fell within the scope of the Applicant's request. It is clear, however, that the Authority previously failed to do this in relation to the original information requests, requirement for review and (given that further information came to light during the appeal relating to the revised review response) its revised review outcome. For these reasons, the Commissioner finds that the Authority failed to comply with section 1(1) of FOISA.
Section 28(1) - Relations within the United Kingdom
28. Section 28(1) of FOISA exempts information if its disclosure would, or would be likely to, prejudice substantially relations between any administration in the United Kingdom and any other such administration (e.g. between Westminster and Holyrood). The Scottish Administration and the Government of the United Kingdom both fall within the definition of "administration in the United Kingdom" in section 28(2) of FOISA.
29. This is a broad exemption, and the Commissioner expects any public authority citing it to show what specific harm would be (or would be likely to be) caused to relations between administrations by disclosure of the information, and how that harm would be expected to follow from disclosure. This exemption is subject to the public interest test in section 2(1)(b) of FOISA.
30. For section 28(1) to apply, the harm resulting from disclosure must be at the level of substantial prejudice. There is no definition of substantial prejudice in FOISA, but the Commissioner's view is that in order to claim this exemption an authority must be able to satisfy him that the damage caused, or likely to be caused, by disclosing the information would be both real and significant, as opposed to hypothetical or marginal. For the harm to be likely, there would require to be at least a significant probability of it occurring, in the near or foreseeable future and not at some distant time.
31. The passage of time is likely to affect the application of section 28(1). Information may lose its sensitivity over time. Once (for example) negotiations are complete, or circumstances change, it is more difficult for an authority to argue that the exemption applies.
32. The Authority withheld some information in document 2 and one message in document 3, under section 28(1) of FOISA.
The Authority’s comments on section 28(1)
33. While the Authority withheld messages in relation to various subjects sent by various ministers, its detailed submissions were made in relation to messages between Sajid Javid, who was UK Health Secretary at the time, and Humza Yousaf, who was the Scottish Health Secretary.
34. The Authority stated that Mr Javid supplied the information to Mr Yousaf with no expectation that it would be made public. The Authority added that while there was no explicit expectation of confidentiality in the information exchanged, the tone of the exchanges was candid and clearly considered to be sent on a one-to-one basis and not for wider consumption.
35. The Authority argued that it was crucial to protect future such communications to ensure a good relationship was maintained between the UK and Scottish Governments.
It stated that releasing the messages could jeopardise that relationship and make either or both governments less inclined to share confidential information or address issues in future. It considered this would not be in the public interest because it would limit the ability to govern appropriately and make informed policy decisions.
36. Furthermore, the Authority considered that the damage to relationships would be significant. It considered the nature of the exchange to be sensitive, despite the time which had passed since the messages were sent, and despite the fact that those involved were no longer in government. It argued that disclosure of the information would undermine trust and lead to a lessening of such exchanges in future.
37. It added that in a pressured situation such as management of a pandemic (which was the context in which these messages were sent) it was important that channels of communication between the UK and Scottish Governments were as open as possible, including informal channels, so those governments could cooperate to the benefit of the public.
The Applicant’s comments on section 28(1)
38. The Applicant submitted that the Authority had repeatedly claimed that government business was not routinely carried out via WhatsApp. He commented that, in spite of this claim, it was clear that serious government business had been undertaken via WhatsApp and that this was a fundamental issue of both transparency and accountability. The Applicant argued that for there to be accountability for the Authority’s insistence that it did not use WhatsApp for any government business, none of the messages should be protected by any exemption.
39. The Applicant made general submissions in relation to all the exemptions applied to the withheld information. The Applicant submitted that the Authority’s decision to withhold these WhatsApp messages under a number of exemptions, suggested that it was, for years, lying about the scale of government business done on WhatsApp. In his view, only full and unredacted disclosure would provide accountability.
The Commissioner’s view on section 28(1)
40. The Commissioner considers that messages withheld by the Authority under section 28(1) of FOISA fall into two categories – firstly, practical discussions of on-the-ground pandemic response issues in distinct parts of the UK and, secondly, some messages between Mr Javid and Mr Yousaf which were not primarily practical discussions.
41. The Commissioner has carefully considered all of the information withheld under the exemption, along with the submissions from the Authority and the Applicant. He will first consider information relating to practical matters.
42. The Commissioner notes that certain information (in document 2) demonstrates a positive working relationship between UK administrations at a time of crisis. He considers that while some of the information may have been sensitive at the time (for example, highlighting particular issues faced by particular UK administrations during the pandemic crisis) this is no longer the case, given the passage of time, and was not the case at the time of the revised review outcome of 15 March 2024.
43. The Commissioner’s view is that, far from undermining, or risking substantial prejudice to, relations between UK administrations, disclosing this information would show those relations in a positive light and demonstrate how different areas of the UK worked well together. Therefore, he does not accept that the exemption is engaged for those messages and he requires them to be disclosed.
44. The message within document 3, withheld under section 28(1) of FOISA, was sent by Roseanna Cunningham’s private office (as opposed to the UK Government). The Authority made no submissions on the origins of this message, on whether it was sent in confidence, or on whether it was based on a communication from the UK Government. The Authority made no specific submissions on why the disclosure of the information would, or would be likely to, prejudice substantially relations between any UK
administrations.
45. The Commissioner considers the message itself to be innocuous and uncontroversial. He does not believe that disclosing it would damage relations between Westminster and Holyrood. His view, given the nature of that particular message, and the lack of any specific arguments relating to it, is that the exemption is not engaged for this message. He therefore requires the message to be disclosed.
Sajid Javid-Humza Yousaf exchange
46. The Commissioner will now consider the information in document 2 relating to certain messages between Mr Javid and Mr Yousaf. He has carefully considered all relevant factors, including the information, the submissions from the Authority and the Applicant and the nature of the relationship between the particular administrations.
47. The Commissioner acknowledges the importance of maintaining good relations between the various UK administrations. He also acknowledges the importance of a private space where representatives of the administrations (for example, Holyrood and Westminster) can exchange information (and also how informal messaging allows parties to communicate quickly when necessary).
48. The Authority has argued that the exchange between Mr Yousaf and Mr Javid was candid, sent on a one-to-one basis and not for wider consumption.
49. The Commissioner agrees that the exchanges are candid but he does not accept that the content was not intended for wider consumption. The wording of Mr Javid’s message makes it clear that that he was raising the issue only after it had been raised with him by officials. While the messages were sent between two individuals, it is clear that the issue raised was more widely known and the exchange was prompted only after third parties raised it with Mr Javid. In other words, the matter was being more
widely discussed than by just those directly involved in the exchange.
50. In addition, the messages convey an expectation that if Mr Yousaf did not know the answer to the question Mr Javid had raised, he would find out (in other words, he was expected to share the substance of the message more widely, albeit within the Authority).
51. The Authority submitted that disclosure of the messages would make the administrations less likely to share such information in future. In the Commissioner’s view, the Authority is incorrect to suggest such exchanges would be less likely between members of UK administrations in future. He considers that subjects considered important or urgent by either or both parties would – and should – still be raised, in order to ensure that those matters could be discussed and, if necessary, acted upon.
52. In relation to the Authority’s comments about the need for open channels of communication during a pressurised situation such as a pandemic, the Commissioner (as above) acknowledges the importance of quick and effective communication in government generally and particularly during a time of national crisis. However, as above, he does not consider that disclosure of this exchange would, or should, make those in government less likely to do what was required in the course of their public duty, and in the public interest.
53. Moreover, the Commissioner notes what he considers to be an inconsistency within the Authority’s position on this matter. He considers that, in light of events to which the messages refer, it is unsustainable for the Authority to argue that confidentiality and the risk of jeopardising relations mean they should be withheld.
54. In addition, the Commissioner does not agree with the Authority’s argument that the exchanges are still sensitive. While elements of them may retain an element of sensitivity, more than two-and-a-half years passed between the messages being sent and the Authority’s revised review outcome of 15 March 2024. At the point the revised review outcome was provided, Mr Javid and Mr Yousaf were no longer in the posts they had held at the time of the original requests and the acute crisis (which the Commissioner acknowledges did require significant co-operation between the UK administrations) had passed.
55. Furthermore, in the Commissioner’s view, society’s focus is now on exploring how UK administrations (and individuals within them) handled different aspects of pandemic governance, in order that lessons can, if necessary, be learned. This is evidenced by the ongoing Scottish and UK Covid-19 public inquiries.
Relations between Holyrood and Westminster
56. The Authority argued that withholding some of the information under section 28(1) of FOISA, was crucial to ensure a good relationship was maintained between the UK and Scottish governments.
57. For the exemption at section 28(1) of FOISA to be engaged, the Commissioner must be satisfied that substantial prejudice would result from disclosure of the withheld information. To that end his view is that, for an argument based on good relations being maintained to succeed, good relations must first exist. However, he considers that in the recent past, and certainly at the time of the Authority’s revised review outcome, of 15 March 2024, relations between the UK and Scottish administrations were poor.
In coming to that view, the Commissioner has taken into consideration a number of public disagreements between the two administrations, during which Scottish Ministers made clear their views on the actions of, or the position adopted by, the UK administration on different subjects. These include:
(i) The Supreme Court ruling in November 2022 that the Scottish Parliament could not hold a second independence referendum without Westminster approval. Following this ruling, the then-First Minister Nicola Sturgeon accused the Westminster Government of showing “contempt” for Scotland’s democratic will and said the ruling confirmed that the notion of the UK as a voluntary partnership of nations was no longer a reality (if it ever had been).
(ii) Ms Sturgeon described the UK Government’s blocking of the Gender Recognition Reform (Scotland) Bill, which had been passed by the Scottish Parliament, as a “full-frontal attack on our democratically elected Scottish parliament”.
(iii) Maggie Chapman of the Scottish Green Party, which was at that time part of the Scottish Government, said the blocking of the above Bill made “a mockery” of any decision taken at Holyrood from then on.
(iv) The then-Scottish Government circular economy minister, Lorna Slater, in May 2023 accused the UK Government of trying to sabotage the Deposit Return Scheme (DRS) after it refused to allow glass to be included.
(v) Also in May 2023, Mr Yousaf (then the First Minister) described the UK Government stance on the DRS issue as a “democratic outrage”.
58. The Commissioner notes that the Authority has been publicly frank about its view of the Westminster government in relation to each of the situations above (which are by no means the only examples of such situations).
59. While he also notes that administrations in different parts of the UK will inevitably adopt different (or indeed opposing) positions on different issues, the Commissioner’s view is that the examples above go beyond mere difference of opinion and demonstrate the extent to which, in recent years, relations had deteriorated between Holyrood and Westminster.
60. He considers that both the general situations referenced above and the language used demonstrate that, at the time the Authority issued its revised review outcome to the Applicant on 15 March 2024, the relationship between the administrations could not be described as good. Given this, the Commissioner considers that disclosure of this information would in no way worsen their relationship.
61. In the particular circumstances of this case, and with regard to the particular administrations involved and their specific history of relations with one another, the Commissioner does not accept that the exemption at section 28(1) is engaged, because he is not satisfied that disclosure of the withheld information, would prejudice substantially relations between any administration in the United Kingdom.
62. As he has found that the exemption in section 28(1) does not apply, he is not required to go on to consider the public interest.
63. The Commissioner requires all of the information withheld under section 28(1) of FOISA to be disclosed to the Applicant.
Section 29(1)(b) of FOISA – Ministerial communications
64. The Commissioner will consider this exemption in respect of some information in documents 1, 2 and 3.
65. Under section 29(1)(b) of FOISA, information held by the Authority is exempt information if it relates to Ministerial communications. Ministerial communications are defined in section 29(4) as communications between Ministers, including (in particular) communications relating to proceedings of the Scottish Cabinet or any committee of that Cabinet. Section 29(5) makes it clear that in section 29(4), “Minister” means a member of the Scottish Executive or a junior Scottish Minister.
66. The exemption covers information “relating to” Ministerial communications, so it covers more than just direct communications between Ministers. It could also cover information such as:
(i) records of discussions between Ministers and
(ii) drafts of letters, whether or not the letters were finalised or sent.
67. The communication must be between two or more Ministers; the exemption does not apply to communications between a Minister and officials or other third parties. However, communications between private secretaries, when corresponding on their respective Minister’s behalf, will be covered by the exemption.
68. The exemption in section 29(1)(b) is a class-based exemption. This means that the exemption will apply if the information falls within a particular class of information, in this case, Ministerial communications. The Authority does not have to demonstrate that disclosure of the information would cause harm before applying the exemption.
The Authority’s comments on section 29(1)(b)
69. The Authority provided the Commissioner with the names of the Ministers or Cabinet Secretaries involved in each message.
The Applicant’s comments on section 29(1)(b)
70. The Applicant made general submissions in relation to all of the exemptions applied to the withheld information (including section 29(1)(b)). He argued that for the Authority's repeated (and in his view incorrect) insistence that government business was not routinely done on WhatsApp to be accurate and fair, no message should be covered by any exemption relating to government business.
The Commissioner’s view on section 29(1)(b)
71. The Commissioner considers that, for the exemption to be engaged, those involved in the communications should be acting primarily (if not solely) in their Ministerial (i.e. government) role and that the communications should relate primarily to that role or function. If this was not the case, section 29(1)(b) of FOISA could apply to any communication between individuals who happened to be Ministers, regardless of how far removed the content or subject matter of the communication was from their government
role. The Commissioner does not consider that this was the intention of the legislation, particularly in light of the reference to “policy” in the overall heading of Section 29 of FOISA, which then goes on to encompass Ministerial communications.
72. In his view, this part of the legislation was intended to cover information which fell outwith the scope of part 29(a) (formulation or development of government policy) and which did not relate directly to Scottish Cabinet or cabinet committees (where section 30(a), if anything, would be likely to be more relevant), but which nevertheless related to the ministerial role. The Commissioner does not consider that it was intended to be so wide as to allow it to be applied to situations where either the subject matter was nothing to do with the Ministerial function, or where individuals were not primarily acting in their role as Ministers or Cabinet Secretaries – for example if individuals who held such offices were, in a particular communication, primarily acting in their capacity as party members.
73. In relation to the above, the Commissioner notes that in recent years, the nature of communication within government has changed (as it did in society more generally) to include much more use of informal messaging. He also considers that the ease of informal messaging means the parameters of when Ministerial business ends and other business, for example personal or political, begins may not be immediately apparent. He considers this point is relevant to his consideration of the information withheld
under this exemption. He also notes the Authority’s announcement of 17 December 2024, ending the use of WhatsApp and other non-corporate messaging services for government business from spring 2025 (outwith the period covered by this request, but still indicative of the prior use of such services).
74. The Commissioner has considered the nature and content of all of the information withheld under section 29(1)(b) of FOISA, and he is satisfied that some of the messages clearly fall under the scope of Ministerial communications and the exemption applies. He will now further consider one particular exchange between two individuals who are both Cabinet Secretaries.
75. The Authority has withheld four sections of this exchange under section 29(1)(b) of FOISA. Interspersed within this exchange are two further sections (covering the rest of the exchange) which the Authority considers to be political, rather than government, business. It has therefore withheld them as being out of scope of the request.
76. The Commissioner considers that the nature of this exchange, while taking place between two Cabinet Secretaries, was not primarily Ministerial but party political. That is, while the individuals involved in the exchange were cabinet secretaries, one in particular was clearly acting in a party-political capacity when asking for information about government business (that is, for the purposes of FOISA, they were not acing in a Ministerial capacity).
77. The Commissioner notes that the second Cabinet Secretary was only able to provide the information sought by virtue of their Ministerial role. He considers that these are not Ministerial communications but party business involving the seeking and imparting of knowledge gained by virtue of a government position for party political ends.
78. He has also considered the exchange in light of his guidance as referenced above, which allows for section 29(1)(b) of FOISA to be engaged by communications between private secretaries corresponding on behalf of their respective Ministers. The Commissioner has considered whether it would have been appropriate for this particular exchange to have been conducted by private secretaries and concludes the nature of the discussion means it would not have been appropriate. Given this, the Commissioner is satisfied the exemption is not engaged and he requires this information to be disclosed.
79. The Authority withheld other sections of this particular exchange, on the grounds that they were out of scope. The Commissioner will consider the information which the Authority has deemed out of scope later in this decision.
80. The exemption in section 29(1)(b) is a qualified one, subject to the public interest test in section 2(1)(b) of FOISA. The Commissioner must consider whether, in
all the circumstances of this case, the public interest in disclosing the information is outweighed by the public interest in maintaining the exemption (i.e. in withholding
the information). The Commissioner does not have to consider the public interest test in relation to information where he has found the exemption was not engaged.
The Public Interest test in relation to section 29(1)(b)
81. There is an in-built presumption in FOISA that it is in the public interest to disclose information unless a public authority can show why there is a greater public interest in maintaining the exemption.
The Authority’s comments on the public interest test – section 29(1)(b)
82. The Authority submitted that it was committed to openness and transparency and it used this as a cornerstone when considering information for disclosure. It stated that it recognised the public interest in the release of the information, for reasons of openness, transparency and accountability. It also stated that it had applied a presumption in favour of disclosure and had previously released messages between Ministers where the public interest favoured disclosure.
83. However, the Authority argued that it was important that Ministers could communicate freely and frankly with one another, in private where appropriate, to maintain the convention of collective responsibility. It argued that a private space was vital for Ministers to explore and refine issues and policy positions until the Government could reach a decision or adopt a sound policy. This allowed all options to be properly considered, so that good decisions could be taken. It argued that premature disclosure was likely to undermine the full and frank discussion of issues between Ministers which, in turn, would undermine the quality of the decision-making process.
84. The Authority submitted that the messages were exchanged in the expectation that they were private, one-to-one communications, and that maintenance of this private space allowed Ministers to build and maintain good working relationships, which helped make government more effective.
85. It stated that the exchanges remained sensitive, that this was not affected by the age of the information or the individuals involved, all of whom were Ministers at the time of the exchanges, and that disclosure of the information would undermine trust between Ministers and lead to a lessening of future such exchanges. The Authority added that it was important that channels of communication (including informal channels) between Ministers were as open as possible, to ensure that government operated
efficiently.
86. The Authority considered that, on balance, the public interest in withholding the information outweighed that in disclosing it. The Authority referred to the Commissioner’s guidance on section 29(1)(b) which states that the public interest may be defined as something that is “in the interest of the public” not merely “of interest to the public.”
87. The Authority argued that the public interest in enabling Ministers to work out issues prior to formal views being made public, and allowing Ministers to share concerns privately, outweighed the factors which favoured release. It submitted that this that led to better policy decisions and more effective government, both of which would be negatively impacted if the information was released. The Authority added that release of the information would allow others to know Ministers’ views before they were fully formed and could damage relationships where Ministers might have a particular view about a stakeholder. It commented that this could impact delivery of vital public services.
The Applicant’s comments on the public interest test – section 29(1)(b)
88. The Applicant provided general public interest arguments for all of the exemptions relied on by the Authority. He argued that it was clear that serious government business was undertaken via WhatsApp, and it was in the public interest for these messages to be published in full and unredacted.
The Commissioner’s view on the public interest test - section 29(1)(b)
89. The Commissioner has considered all of the submissions from the Authority and the Applicant, along with contents and nature of the withheld messages themselves.
90. He acknowledges that there will be occasions where it will be in the public interest to maintain the exemption rather than disclose information relating to policy-making processes or Ministerial communications. However, he does not accept that this should automatically be accepted. Each case, and in this case individual messages and parts of messages, must be considered on its own merit.
91. The Commissioner recognises that the nature of some of the information remains sensitive, despite the passage of time and the fact that the individuals have moved on. Some communications are open and frank discussion about policy or negotiations with third parties. In all the circumstances, the Commissioner is satisfied that for this type of information, the public interest in withholding it outweighs the public interest in disclosing it and that such information has been correctly withheld under section 29(1)
(b).
92. The Commissioner acknowledges that some other information is a frank discussion of Government policy and its presentation. He accepts the public interest in a private space for Ministerial discussion and the merit in open channels of communication. However, he also considers there is a considerable public interest in the efforts made by Government to ensure effective messaging and communication of policy to the public during a time of crisis. He also takes the view that some of the information has
lost its sensitivity over time.
93. The Commissioner considers that other information reveals important aspects of the interactions between the Authority and third parties and important details of the Covid pandemic response by senior figures. Certain aspects of these interactions are already in the public domain and the Commissioner considers that there is a strong public interest in the perspective the withheld information adds to what is already available, in terms of how it illuminates the considerable pressures on Ministers and how
they responded to these pressures.
94. The Commissioner has carefully considered another section of the withheld information which is a transcript of a voice note. The Authority in its public interest arguments referred to the importance of a private space to allow Ministers to discuss or develop policy. In this case however, the Commissioner considers the information to be an update, containing a narrative of how particular events were expected to unfold, rather than a discussion of policy. He also considers that fact that the information was contained in a voice note is relevant, because a voice note does not allow for direct discussion or interaction (unlike a telephone call). Moreover, in the Commissioner’s view, other information from the voice note has already been disclosed, and he does not believe that the information which has been withheld is significantly different in content, tone or type from that other information.
95. Given all of the above, the Commissioner believes that, on balance, the public interest in withholding some of the information outweighs the public interest in disclosing it, and he is therefore satisfied that the exemption at section 29(1)(b) of FOISA has been correctly applied. However, he believes that for other information the public interest in disclosure, on balance, outweighs the public interest in withholding and he requires that information to be disclosed.
96. The Commissioner will provide the Authority with a marked-up document which details the exact information that it is required to disclose.
Section 30(b)(ii) – substantial inhibition to free and frank exchange of views
97. Section 30(b)(ii) of FOISA provides that information is exempt information if its disclosure would, or would be likely to, inhibit substantially the free and frank exchange of views for the purposes of deliberation. This exemption is subject to the public interest test in section 2(1)(b) of FOISA.
98. In applying the exemption in section 30(b)(ii), the chief consideration is not whether the information constitutes opinion or views, but whether the disclosure of that information would, or would be likely to, inhibit substantially the free and frank exchange of views. The inhibition must be substantial and therefore of real and demonstrable significance.
99. Each request must be considered on a case-by-case basis, taking into account the effect (or likely effect) of disclosure of that particular information on the future exchange of views. The content of the withheld information will need to be considered, taking into account factors such as its nature, subject matter, manner of expression, and also whether the timing of disclosure would have any bearing. It is important to bear in mind that the exemption, where applicable, will apply to particular information and not inherently to a process (such as drafting).
100. As with other exemptions involving a similar test, the Commissioner expects authorities to demonstrate a real risk or likelihood that actual inhibition will occur at some time in the near future, not simply a remote or hypothetical possibility.
The Authority’s comments on section 30(b)(ii)
101. The Authority submitted that information withheld under this exemption consisted of free and frank exchanges between Ministers and officials, and Ministers and Special Advisers (Spads). It stated that the exchanges contained candid discussion relating to identifiable individuals and aspects of pandemic management and their possible impact.
102. The Authority submitted that disclosing the full content of such exchanges by named Ministers, senior officials and Spads would substantially inhibit future exchanges, because those involved would be less likely to express themselves in a similar way. It argued that this would be to the detriment of good decision making and the Authority’s ability to test propositions. It stated that a private space which allowed the free and frank exchange of candid views without those views being made public was vital, particularly when the process under discussion was not finalised.
103. The Authority also argued that subjects to be discussed at Cabinet were restricted and that some of the withheld information set out what was to be discussed. The Authority submitted that Ministers needed a private space to be provided with topics to discuss at Cabinet. Cabinet was the highest decision-making forum within the Scottish Government and as such topics it was to discuss (or not discuss) needed to be handled with care.
The Applicant's comments on section 30(b)(ii)
104. The Applicant made general submissions in relation to all of the exemptions applied to the withheld information (including section 30(b)(ii) of FOISA), and argued that none of the exemptions applied, and that all of the information should be disclosed.
The Commissioner’s view on section 30(b)(ii)
105. The Commissioner has taken account of all the relevant submissions together with the information which was withheld under section 30(b)(ii) of FOISA.
106. He is satisfied that the Authority has correctly applied the exemption to some of the withheld information, given its content and the context of the discussion. The Commissioner is satisfied that the information falls within the definition of free and frank discussion and that its disclosure would, or would be likely to, substantially inhibit future discussion.
107. However, the Commissioner is not satisfied that all of the information withheld under section 30(b)(ii) of FOISA, falls under the exemption. He notes that one of the exchanges comprises an interaction between a Cabinet Secretary and a Spad. The Commissioner considers that the content of these messages falls within the day-to-day professional responsibilities of both parties and, given that the content concerns instructions rather than an exchange of views, disclosing the information would not lead to
substantial inhibition in future. The Commissioner does not uphold the exemption in relation to this exchange.
108. The Commissioner considers certain other information which has been withheld under section 30(b)(ii) to fall into one or more of the following categories:
(i) a narration of facts
(ii) a summary or passing on of feedback received
(iii) onward communication of a plan already agreed
(iv) information which, while it may contain a view, would not substantially inhibit future free and frank discussions were it to be disclosed.
109. In the Commissioner’s view none of the above specified information engages the exemption contained in section 30(b)(ii) of FOISA, and he requires it to be disclosed. In relation to the Authority’s argument about the expression of candid views, particularly when the process under discussion was not finalised, the Commissioner notes that the relevance of this argument is limited given that few, if any, of the discussions related to live policy development by the time of the revised review outcome of 15 March
2024.
110. Having concluded that some of the withheld information is exempt from disclosure under section 30(b)(ii), the Commissioner must go on to consider the application of the public interest test in section 2(1)(b) of FOISA in relation to this information. The information can only be withheld if the public interest in maintaining the exemption outweighs the public interest in its disclosure.
The public interest test - section 30(b)(ii)
111. As set out above, there is an in-built presumption in FOISA that it is in the public interest to disclose information unless a public authority can show why there is a greater public interest in maintaining the exemption.
The Authority’s comments on the public interest – section 30(b)(ii)
112. The Authority recognised that there was a public interest in disclosing the withheld information, for reasons of openness, transparency and accountability.
113. However, it submitted that it was important to protect that Government Ministers, Spads and officials maintain a private space where views might be exchanged in as free and frank a manner as possible. It argued that it was important to protect some private space, to allow all options to be properly discussed, commenting that this benefited good policy making and built good internal and external relationships.
The Authority argued that a private space allowed Ministers to receive up-to-date information quickly and that releasing the messages would inhibit the free and frank exchange of advice by private offices, Spads and officials, which would in turn inhibit Ministers’ decision making, and that this was not in the public’s interest.
114. The Authority stated that the public interest lay in upholding the exemption and that the maintenance of a private space outweighed the benefits to open government and public understanding which would result from disclosure.
115. It argued that upholding the exemption allowed Ministers and officials to discuss matters fully before formal views were made public, and it provided an opportunity for Ministers to share concerns privately rather in a public forum. The Authority submitted that upholding the exemption would lead to better policy decisions and effective government, which would be negatively impacted if the messages were disclosed.
116. The Authority commented that releasing the messages would allow others to know Ministers’ views before they were fully formed, which could potentially damage relationships and inhibit candid chat which would lead to good decision making.
The Applicant's comments on the public interest – 30(b)(ii)
117. The Applicant’s submissions on the public interest test were as previously detailed in paragraph 91, including his argument that (contrary to what Ministers had stated) serious government business was carried out over WhatsApp and it was therefore in the public interest that the messages be published.
The Commissioner's view on the public interest - section 30(b)(ii)
118. The Commissioner has considered the nature of the withheld information and all the submissions from the Authority and the Applicant.
119. He considers that there is merit on both sides and acknowledges the public interest in Ministers, advisers and officials having a private space for free and frank discussion. The Commissioner also acknowledges that the Applicant was correct to observe that government business was done over WhatsApp but, as set out above, he does not accept that blanket disclosure should automatically be the result. His view is that each piece of information must be considered individually.
120. The Commissioner is satisfied that in relation to some information, free and frank views are exchanged and that substantial inhibition would result from its disclosure. He is therefore satisfied that for this information, the exemption was correctly applied.
121. Certain other information, in his view, does contain free and frank discussions but, because it is speculative (as opposed to factual), the Commissioner considers there is little, if any, public interest in its release and that, on balance, the public interest favours withholding that information.
122. However, the Commissioner considers that some of the information that has been withheld under section 30(b)(ii) of FOISA sheds valuable light on the decision-making process in relation to issues of national importance. For these messages, he considers that the public interest in disclosing information which illuminates the manner and timing of decision making, in relation to both the pandemic and other significant government business, and certain pressures on the Authority, is greater than the public interest in withholding it.
123. The Commissioner recognises that the circumstances in which the messages were sent would previously have made those discussions more sensitive but, in his view, that sensitivity lessened considerably between the time of the original response and the revised review outcome of 15 March 2024.
124. Furthermore, some of the views were communicated and received as part of the day-to-day professional functions of the individuals involved. The Commissioner does not consider that disclosing this information would inhibit such discussion in future, given that such discussions would be required or expected as part of the roles the parties held.
125. The Commissioner, in light of all of the above, considers that in relation to some of the information, the public interest in withholding is, on balance, greater than in disclosure and he is satisfied that the exemption has been correctly applied. For some other information he considers that, on balance, the public interest in disclosure is greater than that in withholding the information. He therefore requires that information to be disclosed.
126. As indicated previously, the Commissioner will provide the Authority with guidance on the specific information that he requires to be disclosed.
Section 30(c) – Prejudice to effective conduct of public affairs
127. Section 30(c) of FOISA exempts information if its disclosure “would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs”. This exemption is subject to the public interest test in section 2(1)(b) of FOISA.
128. The use of the word “otherwise” distinguishes the harm required from that envisaged by the exemptions in sections 30(a) and (b). This is a broad exemption, and the Commissioner expects any public authority citing it to show what specific harm would (or would be likely to) be caused to the conduct of public affairs by disclosure of the information, and how that harm would be expected to follow from disclosure.
129. The standard to be met in applying the tests contained in section 30(c) is high: the prejudice in question must be substantial and therefore of real and demonstrable significance. The Commissioner expects authorities to demonstrate a real risk or likelihood of substantial prejudice at some time in the near (certainly foreseeable) future, not simply that such prejudice is a remote or hypothetical possibility. Each request should be considered on a case-by-case basis, taking into consideration the content of the information and all other relevant circumstances (which may include the timing of the request).
130. During the investigation, the Authority located messages from Roseanna Cunningham (document 3) which fell under the scope of the request, and it relied on section 30(c) of FOISA to withhold some information in those messages.
The Authority’s comments on section 30(c)
131. The Authority withheld the information under section 30(c) of FOISA, arguing that disclosing this information would reveal the source of Scottish Government legal advice.
132. It stated that this would breach the Law Officer Convention that Ministers must not divulge either who provided legal advice or its contents (whether the legal advice is from the Law Officers or from anyone else) and that the convention applies to all forms of legal advice, including advice on a particular subject.
133. The Authority argued that to reveal the source of legal advice to the Scottish Government on any particular topic (either the organisation or the specific individuals) and who those lawyers consulted in preparing their advice, would substantially prejudice the effective conduct of public affairs. The Authority submitted that this was because disclosing this information would be likely to lead to conclusions being drawn about the fact that any particular lawyer or group of lawyers had, or had not, been asked to provide advice, which in turn would be likely to impair the Government’s ability to progress these matters.
134. The Authority also submitted that disclosing whose advice was sought would also significantly harm the conduct of public affairs by breaching the Law Officer Convention because it would reveal whether or not advice on a particular topic was sought from the Law Officers. Revealing whether or not Law Officers had been asked to advise on particular matters would encourage people to draw conclusions about the importance the Government placed on that subject and about whether there were uncertainties
regarding the Scottish Government’s position.
135. It argued that disclosure would significantly harm the effective conduct of public affairs by placing undue pressure on Ministers and officials to consider these factors in future, before deciding to consult Counsel and/or the Law Officers. Disclosure would also be likely to significantly harm the effective conduct of government business by putting Ministers and officials off requesting legal advice, when they needed it, for fear of information about the source of the advice being divulged and subjected to public and media speculation.
The Applicant’s comments on section 30(c)
136. The Applicant disagreed with the application of section 30(c) of FOISA, because he did not believe disclosing the names of those who provided legal advice (which he argued the Authority had admitted had been asked for and provided) would prejudice the conduct of public affairs. He argued that the Authority had not provided a reasonable explanation of why that would be the case.
The Commissioner’s view on section 30(c)
137. The Commissioner has considered the withheld information with the submissions made by the Authority and the Applicant. He is satisfied that section 30(c) applies to the information, in this particular case, in relation to the Law Officer Convention.
138. The exemption in section 30(c) is a qualified one, subject to the public interest test in section 2(1)(b) of FOISA. Given his conclusion that the exemption does apply the withheld information, the Commissioner must now go on to consider the public interest in relation to the information under section 2(1)(b) of FOISA. This means assessing whether, in all the circumstances of the case, the public interest is better served by disclosing or withholding the information.
The public interest test – section 30(c)
139. As noted previously, FOISA does not define the term “public interest”, but it has been described as “something which is of serious concern and benefit to the public.” It has also been held that the public interest does not mean what is of interest to the public, but what is in the interest of the public.
The Authority’s comments on the public interest test – section 30(c)
140. The Authority acknowledged that there was a public interest in disclosing information as part of open, transparent, and accountable government and to inform public debate.
141. However, it argued there was a greater public interest in maintaining the exemption. The Authority stated that there was a greater public interest in enabling the Scottish Government to determine how and from whom it received legal advice, without facing external pressure or concerns over conclusions which might be drawn from the fact that a particular lawyer or group of lawyers had or had not been asked to provide legal advice on a particular matter.
142. The Authority argued that it would be damaging to the public interest if information about the identity and status of an individual legal adviser was used to suggest this was relevant to the advice the Government received.
143. The Authority stated that releasing information about the source of legal advice would be a breach of the standing Law Officer Convention and referenced paragraph 2.38 of the Scottish Ministerial Code, which said that Ministers must not divulge who provided the advice. It argued that there was no public interest in breaching the Convention by divulging which lawyers were asked to provide advice on any issue because the public interest considerations in maintaining the Law Officer Convention had to be
given considerable weight.
144. It referred to a decision of the High Court in England and Wales, HM Treasury v ICO [2009] EWHC 1811 which found that the tribunal in England and Wales had misdirected itself by failing to conclude that the general considerations of good government underlining the history and nature of the Convention were capable of affording weight to the interest in maintaining an exemption, even in the absence of evidence of particular damage. The Court’s decision noted that the tribunal had also erred in
concluding that the Convention and Code had been somewhat displaced by the introduction of the Freedom of Information Act 2000 (FOIA). The Court specifically commented that the Convention and the equivalent principles of good government set out in the Code do not cease to have substantial relevance or less weight following FOIA.
145. The Authority also referred to paragraph 30 of the above-referenced High Court Case, where the tribunal had suggested (and which the Court found to be fallacious) that disclosure of the fact that advice had been sought from the Law Officers would provide reassurance to the public that fully informed decisions were being made on the basis of the best possible legal advice (the counterweight being that if advice had not been sought there would have been a “very strong” public interest in that fact being disclosed, as it would have raised “legitimate and important issues” about the basis on which the Government was acting). The High Court did not accept this argument and found that the tribunal had substantially misdirected itself.
146. The Authority argued that it was difficult to see what countervailing public interest benefit was achieved by disclosing whether the Law Officers had been asked to provide advice in cases such as this through disclosure of the fact that they had, or had not, been involved in the advice. To disclose that fact did not provide access to the legal advice itself. The Authority acknowledged that there may sometimes be a legitimate public interest in knowing the legal basis for key government decisions and actions, but argued that merely revealing whether the Law Officers were, or were not, asked to provide advice would not in itself advance that interest. Equally, the Authority argued that it was not necessary for anyone to know who gave the advice to be able to question Ministers or hold them to account for the legality of their conduct.
147. Furthermore, the Authority argued that to disclose (other than in exceptional cases) the source of the legal advice within the Authority risked unduly politicising the role of the Law Officers and could lead to them being held responsible for political decisions. It commented that if this occurred, it risked seriously undermining the processes by which the government obtained legal advice and would undermine the public interest in good governance and the maintenance of the rule of law within government. The Authority submitted that the convention against disclosure of the fact and content of Law Officer advice was designed to protect against this.
148. Overall, the Authority considered that the strong public interest in allowing it to decide when and from whom it seeks advice, and also the very strong public interest in upholding the Law Officer Convention, outweighed any public interest in release of the withheld information.
The Applicant’s comments on the public interest test - section 30(c)
149. The Applicant stated his position on the public interest as regards section 30(c) was the same as it had been in relation to the other exemptions. He believed it was fundamentally in the public interest for them to be disclosed, due to the time that they were being sent (i.e. in the middle of a global pandemic where WhatsApp appeared to have been the primary form of communication between Ministers).
The Commissioner’s view on the public interest test – section 30(c)
150. The Commissioner has considered the withheld information in light of the submissions from the Authority and the Applicant. He accepts there is a general public interest in transparency in the conduct of public affairs.
151. The Commissioner notes the Applicant’s general argument about the context in which these messages were sent, but in relation to this exemption he is not convinced that disclosing the source of the legal advice referenced in the messages would advance the public interest significantly (if at all), for example in aiding understanding of decision and discussions which took place at that time. He considers that the context of this particular information and the exemption which has been applied makes it clear
that the withheld information is the source of legal advice and that disclosing the source would not, in these circumstances, aid the public interest.
152. The Commissioner accepts the Authority’s submissions on the principles of protecting the source of legal advice, and specifically the weight placed on the importance of upholding the Law Officer convention. While he considers that particular circumstances may arise which would allow a strong public interest argument to be made in favour of disclosure of such information, he has concluded that is not the case in this particular appeal.
153. The Commissioner therefore finds that the Authority correctly applied the exemption in section 30(c) to the withheld information.
Section 36(1) – Confidentiality
154. Section 36(1) of FOISA provides that information in respect of which a claim to confidentiality of communications could be maintained in legal proceedings is exempt information. One type of communication covered by this exemption is that to which legal advice privilege, a form of legal professional privilege, applies.
155. Legal advice privilege covers communications between lawyers and their clients in the course of which legal advice is sought or given. For the exemption to apply to this particular type of communication, certain conditions must be fulfilled:
(i) the information must relate to communications with a professional legal adviser, such as a solicitor or an advocate;
(ii) the legal adviser must be acting in their professional capacity; and
(iii) the communications must occur in the context of the legal adviser's professional relationship with their client.
156. Furthermore, the information cannot be privileged unless it is also confidential. For the section 36(1) exemption in FOISA to apply, the withheld information must be information in respect of which a claim to confidentiality of communications could be maintained in legal proceedings.
157. A claim of confidentiality cannot be maintained where, prior to a public authority's consideration of an information request or conducting a review, information has been made public, either in full or in a summary sufficiently detailed to have the effect of disclosing the advice. Where the confidentiality has been lost in respect of part or all of the information under consideration, any privilege associated with that information is also effectively lost.
The Authority’s comments on section 36(1)
158. The Authority submitted that all the information withheld under the exemption at 36(1) of FOISA related to communications with, or references to communications with, legal advisers acting in their professional capacity, in which the Scottish Government was the client. The Authority argued that in these communications, legal advice was being sought and provided, including material which evidenced the substance of those communications.
159. The Authority submitted that all the material was either made or affected for the purpose of seeking or giving legal advice, or that it evidenced the substance of those communications. It stated that release of the material would breach legal professional privilege by divulging information about the points being considered by lawyers, the extent of their comments and the issues being flagged up for further consideration. It concluded that all of the necessary conditions for legal advice privilege to apply
were satisfied.
160. The Authority confirmed the sources of the legal advice and stated that those sources were acting in their professional capacity when sending the messages that have been withheld. It argued that a claim to confidentiality could be maintained in legal proceedings because the correspondence in question was shared only between the Scottish Government and its legal advisers (apart from being provided to the Commissioner as part of his investigations in relation to this case).
The Authority argued that the information remained confidential at the time it responded to the applicant’s request and requirement for review (and it remained so at the time of its submissions). It submitted that legal professional privilege had not been waived.
The Applicant’s comments on section 36(1)
161. As noted earlier, the Applicant challenged the Authority’s reliance on all of the exemptions, including section 36(1) of FOISA.
The Commissioner’s view on section 36(1)
162. The Commissioner has carefully considered the information withheld under this exemption. He acknowledges that it comprises communications between the Authority and its in-house legal advisors, but he does not accept the Authority’s arguments that the messages relate to the seeking and provision of legal advice. He considers that the messages are administrative in nature, and deal with routine organisational matters. The information withheld under this exemption includes conversations about logistics and the Commissioner is not convinced that this engages legal advice privilege.
163. In Decision 001/2007 the Commissioner found that the exemption at section 36(1) did not apply to certain documents (an administrative memo and a letter describing certain administrative arrangements) because he did not accept that a claim to confidentiality of the communications could be maintained in legal proceedings in relation to that information. The Commissioner considers that similar circumstances exist in this case and evidence has not been provided to demonstrate that it relates specifically to
legal advice. Furthermore, he considers that nothing in the substance of the information withheld is confidential.
164. He therefore finds that the Authority was not entitled to withhold the information under section 36(1) and he requires its disclosure.
Section 38(1)(b) – Personal Information
165. Section 38(1)(b), read in conjunction with section 38(2A)(a), exempts information from disclosure if it is “personal data”, as defined in section 3(2) of the DPA 2018, and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the GDPR.
166. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
167. In order to rely on this exemption, the Authority must show that the information being withheld is personal data for the purposes of the DPA 2018 and that its disclosure into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Article 5(1) of the UK GDPR.
168. The Commissioner has reviewed all of the information that has been withheld under section 38(1)(b) of FOISA, and he is satisfied that some of this information does not, in fact, fall within the scope of the request. In general terms this information is entirely personal and has no relevance to government business. The Commissioner has deemed this to be out of scope of the request and he will not consider it further in this decision.
The Commissioner will now consider the information that has been withheld under section 38(1)(b) of FOISA, and which he considers to fall within the scope of the request.
Is the withheld information personal data?
169. The first question the Commissioner must address is whether the information is personal data for the purposes of section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable living individual. “Identifiable living individual” is defined section 3(3) of the DPA 2018. This definition reflects the definition of personal data in Article 4(1) of the UK GDPR.
170. Information will "relate to" a person if it is about them, is linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus. An individual is “identified” or “identifiable” if it is possible to distinguish them from other individuals.
171. The Authority submitted that much of the information withheld under this exemption was about individuals (including their names) which would identify those individuals directly or indirectly. It submitted that the information was therefore personal data. It argued that other information related to the individuals’ private lives (including their opinions, health or family).
172. Addressing the subject of individuals’ opinions, the Authority submitted that, taken in isolation (i.e. without any of the accompanying information which has already been released), it might in some cases have been difficult to work out if individuals could be identified from the opinion alone (either the person expressing the opinion or the subject of that opinion). However, it argued that because the message headings, which disclosed the names of those involved in the exchanges, had already been released, it would not be hard to work out that the opinion belonged to one of the participants in the exchange.
173. The Authority submitted that the opinion related to the person expressing it, and sometimes to a third party they were talking about, and it therefore considered the opinion to be personal data under the legislation.
174. The Commissioner has carefully examined all of the information withheld under this exemption. He is satisfied that most of this information relates to identifiable, living individuals and as such would be personal data as defined in section 3(2) of the DPA 2018. He agrees that almost all of the information relates to individuals who can be identified by that information and that it is personal data. This information includes names, contact details, opinions, views and biographical data.
175. The Commissioner accepts that some of the personal data also reveals information about an individual’s health status and must therefore be considered special category health data. The Commissioner does not accept that all of the information that relates to an individual’s health, but which does not reveal their health status, is special category health data. This information is more accurately described as information relating to the administration of healthcare. The ICO’s guidance on special category
health data , advises that while health data can include a wide range of personal data, it must reveal something about a person’s health status. It goes on to state:
“For example, a GP or hospital appointment in isolation will not tell you anything about a person’s health as it may be a check-up or screening appointment. However, you could reasonably infer health data from an individual’s list of appointments at an osteopath clinic or from an invoice for a series of physiotherapy sessions;
176. The Commissioner has taken the ICO’s guidance into account when reviewing the personal information that has been withheld in this case. He has concluded that while some of the withheld personal information relates to the administration of healthcare, it does not reveal anything about the health of the individuals concerned.
The Commissioner considers that the offer or arrangement of an appointment, where that offer is standard across a large cohort, provides no specific information about that individual’s health status (nor does it indicate that the appointment was attended). In these instances, the Commissioner does not consider the information to be special category personal data.
177. Amongst all of the personal information that has been withheld under section 38(1)(b) of FOISA, the Authority has withheld one first name (there is no accompanying surname) under this exemption. During the investigation, the Authority was asked whether this name related to a particular Minister. The Authority submitted that it could not confirm this and wanted to continue to withhold the name under section 38(1)(b) of FOISA. The Commissioner’s view is that if the Authority itself cannot identify the individual concerned, it is highly unlikely that anyone else will be able to do so.
178. The Commissioner therefore finds that this particular name is not personal data (as it does not identify a living individual) and he requires it to be disclosed.
Would disclosure contravene one of the data protection principles?
179. The Authority argued that disclosing the personal data would breach the first data protection principle. The first data protection principle in Article 5(1)(a) of the UK GDPR, provides that personal data shall be processed “lawfully, fairly and in a transparent manner in relation to the data subject.”
180. The definition of “processing” is wide and includes (section 3(4) of the DPA 2018), “disclosure by transmission, dissemination or otherwise making available”. For the purposes of FOISA, personal data are processed when disclosed in response to a request.
Special category personal data
181. The Commissioner will first consider whether it is lawful and fair to disclose the special category personal data that he has identified.
182. The Commissioner’s guidance on section 38(1)(b) notes (at paragraphs 70 to 72) that Article 9 of the UK GDPR only allows special category personal data to be processed in very limited circumstances.
183. Although Schedule 1 to the DPA 2018 contains a wide range of conditions which allow authorities to process special category data, for the purposes of FOISA, the only situation where it is likely to be lawful to disclose third party special category data in response to an information request is where, in line with Article 9(2)(e) of the UK GDPR, the personal data has manifestly been made public by the data subject. Any public authority relying on this condition must be certain that the data subject made the disclosure with the intention of making the special category data public.
184. There is nothing to suggest that disclosing information that reveals the health status of individuals (including Authority employees, third parties, family members and children) would comply with Article 9(2)(e) of the UK GDPR.
185. Consequently, the Commissioner is satisfied that it would be unlawful for the Authority to disclose this information as to do so, would breach the first data protection principle.
The Commissioner finds all of the special category personal data to be exempt from disclosure under section 38(1)(b) of FOISA.
Non-special category personal data
186. The Commissioner must now consider the remaining personal data which has been withheld and decide whether disclosing it would breach the first data protection principle.
Lawful processing: Article 6(1)(f) of the UK GDPR
187. In considering lawfulness, the Commissioner must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed.
188. The Commissioner considers that condition (f) in Article 6(1) is the only condition which could potentially apply in the circumstances of this case. This states that processing shall be lawful if it is “necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data ...”
189. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
190. The three tests which must be met before Article 6(1)(f) are as follows:
(i) Does the Applicant have a legitimate interest in obtaining the personal data?
(ii) If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?
(iii) Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subject?
Does the Applicant have a legitimate interest in obtaining the personal data?
191. There is no definition within the DPA 2018 of what constitutes a “legitimate interest”, but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. The Commissioner’s published guidance on section 38(1)(b) of FOISA states:
“In some cases, the legitimate interest might be personal to the applicant, e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety.”
192. The Applicant argued that there might be occasions where small amounts of personal data could be of interest to the public with regard to potential rule breaking during the Covid period or other potential public interest areas. He submitted that the Covid pandemic increased the bar in terms of what was in the public interest beyond the standard understanding of personal data. The Applicant also made general arguments about the need for full disclosure, noting that the Authority had been lying about the
WhatsApp use for government business for years.
193. The Authority submitted that it was not aware of any legitimate interests that the Applicant had in the names of junior officials. It contended that it did not consider that the Applicant had any legitimate interests in the content of any of the messages that did not relate to the government/public role of the individuals involved.
194. The Commissioner considers that there are four broad types of non-special category personal information that has been withheld under section 38(1)(b) of FOISA,
namely:
- Personal information of junior civil servants (or equivalent)
- Contact details
- Information about family members/circumstances (including children)
- Personal information of senior individuals (including the administration of health services, opinions, views and comments)
The Commissioner will consider each type of information, in turn, to determine whether or not the Applicant has a legitimate interest in obtaining the information.
Personal information of junior civil servants (or equivalent)
195. The Commissioner notes that some of the personal information relates to junior members of the civil service or equivalent third parties. The Applicant specifically excluded this from his consideration and, even if he had not, the Commissioner does not accept that the Applicant has a legitimate interest in obtaining this information. The Commissioner finds that the Applicant has no legitimate interest in this information and he will not consider it further in this decision.
Contact details
196. The contact details that have been withheld include mobile phone numbers, and individuals’ personal email addresses and a home address. The Commissioner does not accept that disclosure of any of this information would meet the Applicant’s legitimate interests. This personal information is not related to government business and would not aid transparency in any way. The Commissioner does not accept that the Applicant has a legitimate interest in obtaining these personal data, and therefore he will not consider this information any further in this decision notice.
Information about family members (including children)
197. Some of the personal information that has been withheld under section 38(1)(b) contains references to the family members of Ministers and officials. A large number of these references discuss children. Recital 38 of the UK GDPR provides that children merit specific protection with regard to their personal data. The Commissioner does not consider that the Applicant has any legitimate interest in obtaining the personal data of the family members of officials, particularly children. This information does not shed any light on government business, nor does it aid transparency. The Commissioner finds that the Applicant does not have a legitimate interest in obtaining this personal information and he will not consider it further in this decision.
Personal information of senior individuals (including opinions, views and the administration of health)
198. Having considered the nature of the request and the Applicant's concerns, the Commissioner is satisfied that the Applicant has a legitimate interest in obtaining the personal data that involves or relates to government business, and which contain the views, opinions and actions of senior individuals (including senior individuals who are not employed by the Authority).
199. Having accepted that the Applicant has a legitimate interest in the personal data, the Commissioner must consider whether disclosure of this personal data is necessary for the Applicant's legitimate interests. In doing so, he must consider whether these interests might be reasonably be met by any alternative means.
Is disclosure necessary to achieve that legitimate interest
200. The next question is whether disclosure of the personal data would be necessary to achieve the legitimate interest in the information. “Necessary” means “reasonably” rather than “absolutely” or “strictly” necessary.
201. When considering whether disclosure would be necessary, public authorities must consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the Applicant’s legitimate interest could reasonably be met by means which interfered less with the privacy of the data subject(s).
202. The Commissioner is not aware of any less restrictive means by which the Applicant’s legitimate interest could be met. The Applicant would not be able to obtain this information in any other way, and it is not information which is obviously in the public domain. In all the circumstances, the Commissioner agrees that disclosure would be necessary to achieve the Applicant’s legitimate interest in this case
203. The Commissioner will now consider whether the Applicant’s legitimate interest in obtaining the withheld information outweighs the rights and freedoms of the data subject(s).
The data subject’s interests or fundamental rights and freedoms (and balancing exercise)
204. The Commissioner has concluded that the disclosure of the information would be necessary to achieve the Applicant’s legitimate interest. However, this must be balanced against the fundamental rights and freedoms of the individuals in question. Only if the legitimate interest of the Applicant outweighed those of the data subject(s) could personal data be disclosed without breaching the first data protection principle.
205. The Commissioner has considered the submissions from both parties carefully. In carrying out the balancing exercise, much will depend on the reasonable expectations of the data subject(s).
206. The Authority noted that it had already disclosed the names of senior officials or Ministers but that it had withheld some information relating to their private and family lives. It submitted that everyone had a right to privacy and a family life, regardless of seniority, and that the information in question was personal, rather than relating to government business. The Authority argued that those involved in the exchanges, on private topics, would not have expected them to be disclosed. The Authority did not consider that it had a lawful basis under which to process the personal data in order to answer the request and that doing so would contravene 5(1)(a).
207. The Authority also argued that Ministers and officials had a right to privacy and to conduct personal conversations about personal matters. It stated that the information was provided by these individuals in good faith in an effort to fully co-operate with the [UK Covid] Inquiry’s broad request for information as part of their investigations; however, that did not mean the individuals intended or expected their information to be more widely disclosed or otherwise waived any right to privacy. It argued that the personal data had not been made public by the data subjects.
208. The Applicant argued that the Covid pandemic had altered the threshold for what now might be in the public interest in relation to personal data. He provided an example of how information about meeting other people might reveal potential Covid rule-breaking (under the rules in place at the time) and stated that it was important for any such potential breach to be made public.
209. The Commissioner accepts that Ministers and senior individuals (whether employed by the Authority or by other third-party organisations) have a right to have conversations about personal matters, and for those matters to remain private. He also already agreed that the Applicant does not have a legitimate interest in obtaining personal data regarding officials’ families, contact details and personal information pertaining to junior officials. He has therefore accepted that the Applicant has no legitimate interest in most of the personal data where that data relates to matters which are private and personal.
210. However, as noted above, the Commissioner does consider the Authority has withheld personal information that does pertain, in some way, to government business or has relevance to the Applicant’s arguments regarding transparency and the public interest. The Applicant indicated that his interest in the personal data was in relation to areas of potential public interest relating to particular (senior) individuals within the context of the time (during the pandemic); the Commissioner accepts that the Applicant has a legitimate interest in the disclosure of this type of personal data, contained in documents 1 and 2.
211. The Commissioner's guidance on section 38 of FOISA notes the factors that should be considered in balancing the interests of parties. He notes that Recital (47) of the General Data Protection Regulation states that much will depend on the reasonable expectations of the data subjects. These are some of the factors public authorities should consider:
(i) Does the information relate to an individual's public life (their work as a public official or employee) or to their private life (their home, family, social life or finances)?
(ii) Would the disclosure cause harm or distress?
(iii) Whether the individual has objected to the disclosure.
Does the information relate to public or private life?
212. The Commissioner has carefully considered the personal information, along with the context of the exchanges (most of which has already been disclosed to the Applicant) and the identities and roles of the senior Government figures involved in the exchanges. Some of the information contains the opinions and comments of individuals on issues of government, and other information relates to the administration of an aspect of the data subject’s personal life (such as their health).
213. However, the Commissioner considers that any discussions relating to an individual’s private life only took place as a consequence of their professional role and, potentially, personal or professional links to government (i.e. he considers that the same discussions are unlikely to have taken place in relation to most other private individuals or “ordinary” members of the public).
214. The Commissioner also considers that the context of some of the exchanges (the organisation of healthcare during the Covid pandemic and the identity and public roles of those involved in that exchange) means that it relates to public life. Moreover, the Commissioner considers that the Authority, in already disclosing some details of these exchanges to the Applicant, has accepted that such exchanges, as a whole, fall within scope of the request (i.e. that the Authority has already accepted that the messages relate to Government business).
215. The Commissioner accepts that the personal information of senior individuals (including opinions, views and the administration of health) relates both to the organisation of an aspect of an individual’s personal life and to public life both in terms of their connection to it, and to those involved in the exchange. Furthermore, his view is that the exchanges illuminate wider aspects of the workings of Government and the different pressures on the time of senior figures overseeing the pandemic response and how, on occasion, they used that time. In relation to one exchange, he considers that individuals’ professional roles and/or links to government may have had a bearing on their circumstances being discussed at senior government levels, when other members of the public are extremely unlikely to have been afforded the same personal attention.
Has the individual objected to the disclosure of the information?
216. The Authority made no submissions on this specific exchange, but publicly available information shows that information which relates to it has already been disclosed.
Would the disclosure cause harm or distress?
217. The Commissioner’s guidance on section 38(1)(b) of FOISA acknowledges that:
“Disclosure will always involve some intrusion of privacy. However, that intrusion will not always be unwarranted and public authorities must consider each request on a case by case basis.”
218. The Commissioner also considered the harm or distress that might be caused by disclosure of the information. Disclosure, under FOISA, is a public disclosure. He has taken this into account when reaching his decision.
219. The Authority has provided no specific submissions setting out how disclosure of the personal information would cause harm or distress.
220. Having carefully balanced the legitimate interests of the Applicant against the interests or fundamental rights or freedoms of the data subject, the Commissioner finds that the legitimate interests served by disclosure of the personal data would not be outweighed by any unwarranted prejudice that would result to the rights and freedoms and legitimate interests of the data subject. In coming to this decision, he has considered the legitimate interests of the Applicant and the wider public interest in the use of public resources (in terms of senior figures’ time and effort) at a time of crisis, and in the efforts made to try to ensure that individual Ministers were able to carry out their professional duties to the fullest possible extent.
221. The Commissioner considers that intrusion of privacy, in this instance, is a minimal consideration, given that much of the information was made public at the time of the revised review outcome. He does not consider this to be a situation where disclosing it now under FOISA would cause fresh harm or distress due to the particular nature of the information.
222. The Commissioner finds that condition (f) in Article 6(1) of the UK GDPR can be met in relation to the withheld personal information of senior individuals (including opinions, views and the administration of health).
Fairness
223. The Commissioner must also consider whether disclosure would be fair. He finds, for the same reasons as he finds that condition (f) in Article 6(1) can be met, that disclosure of the particular withheld information would be fair.
Conclusion on the data protection principles
224. Having carefully balanced the legitimate interests of the Applicant against the interests or fundamental rights or freedoms of the data subjects, the Commissioner finds that the legitimate interests of the Applicant served by disclosure of this last element of withheld personal data outweigh any unwarranted prejudice that would result to the rights and freedoms and legitimate interests of the data subject(s).
Out of scope information
225. The Authority withheld a number of messages or parts of messages within documents 1, 2 and 3, on the grounds that they were out of scope of the request. It submitted that the request asked for messages sent or received on government business and that the information withheld on these grounds was withheld because it was not related to government business. It stated that the information was either personal or related to party political activity and that this type of information was not held on individuals’
devices on behalf of the Scottish Government.
226. It also argued that a third category of information was out of scope which related to Crown Office and Procurator Fiscal Service (COPFS, which is a separate public authority under FOISA) business, and not government business.
227. The Applicant argued that none of the messages should be considered out of scope and stated that if they were released as part of the disclosure (in response to his requests), then they were all within scope. He said he found it difficult to understand how something released under the initial request could be anything but in scope.
The Commissioner’s view – information deemed out of scope
228. The Commissioner has considered the information withheld as out of scope, along with the submissions from the Authority and the Applicant. He accepts the Authority’s submissions as regards most of the messages which are marked as out of scope and he considers that most are clearly personal, party political or relating to COPFS business.
229. With regard to the Applicant’s comments, the Commissioner understands that the Applicant wants access to all of these messages, particularly since they demonstrate the level of government business that was carried out on WhatsApp.
However, in his view, having reviewed the content of all of the withheld information, the way in which the messages appear, which arises from their informal nature, means that material which is out of scope can appear mixed in with or alongside material which has either been disclosed or which is withheld under an exemption. In those circumstances, he considers that the Authority has taken the appropriate approach, which is to take the material as a whole and mark the material as out of scope where it believes that to be the case.
230. The Commissioner believes the Authority has incorrectly marked a small amount of information as out of scope.. There are several instances (concerning identical information) where he believes material is in scope. In his view, while this information does not relate to substantive Government business (i.e. policy or discussion of government business) it does impact on the retention of material relating to government business and therefore the Commissioner considers it falls within scope.
231. Where the Commissioner has found the information to be within scope of the request, and where the Authority has not applied any exemption to this information for him to consider, the Commissioner requires this information to be disclosed to the Applicant.
232. As noted previously, the Commissioner will provide the Authority with a marked-up version of documents 1, 2 and 3, which clearly indicates what information should be disclosed to the Applicant.
Decision
The Commissioner finds that the Authority partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.
The Commissioner finds that by relying on the exemptions in sections 29(1)(b), 30(b)(ii), 30(c) and 38(1)(b) for withholding some information from the applicant, the Authority complied with Part 1.
However, by wrongly withholding some information from the Applicant under sections 28(1), 29(1)(b), 30(b)(ii), 36(1) and 38(1)(b) the Authority failed to comply with Part 1.
The Commissioner therefore requires the Authority to disclose the wrongly withheld information (to be detailed in a marked-up copy provided by the Commissioner), by 5 May 2025.
Appeal
Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such
appeal must be made within 42 days after the date of intimation of this decision.
Enforcement
If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply. The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.
Additional Comments
In considering the withheld information in this appeal, the Commissioner and his staff have had to read hundreds of personal messages sent by Scottish Ministers. If any case demonstrates the clear need for delineation between work and personal life, this case does that. Many of the issues raised would be resolved adopting an appropriate records management regime in relation to such messages in which appropriate messages can be saved to the corporate record and then purged from devices. The Commissioner will consider this further in his ongoing intervention with Scottish Ministers.
David Hamilton
Scottish Information Commissioner
19 March 2025
