Decision 069/2021: Flood Warning Dissemination System - failure to respond

Public authority: Scottish Environment Protection Agency
Case Ref: 202100431

Summary

The Applicant asked the Scottish Environment Protection Agency (SEPA) for information about the status of the Flood Warning Dissemination System, in particular:

• How the contract was extended beyond the end date on the "contracts register"
• The new end date of the contract and/or extension
• The cost of extending the contract to this date
• The ability of SEPA to further extend this contract and any criteria required to do so
• The long term strategy and likely budget range for providing a flood warning system beyond this contract

This decision finds that SEPA failed to respond to the request within the timescale allowed by the Freedom of Information (Scotland) Act 2002 (FOISA) and the Environmental Information (Scotland) Regulations 2004 (the EIRs). The decision also finds that SEPA failed to comply with the Applicant's requirement for review within the timescale set down by FOISA and the EIRs.

Background

1. The Applicant made an information request to SEPA on 6 January 2021, via the "Whatdotheyknow" website.

2. SEPA did not respond to the information request.

3. On 4 February 2021, the Applicant wrote to SEPA, requiring a review of its failure to respond, again via the "Whatdotheyknow" website.

4. The Applicant did not receive a response to his requirement for review.

5. The Applicant wrote to the Commissioner on 6 April 2021, stating that he was dissatisfied with SEPA's failures to respond and applying to the Commissioner for a decision in terms of section 47(1) of FOISA. The enforcement provisions of FOISA apply to the enforcement of the EIRs, subject to specified modifications - see regulation 17.

6. On 15 April 2021, SEPA was notified in writing that an application had been received from the Applicants and was invited to comment on the application.

7. The Commissioner received submissions from SEPA. These submissions are considered below.

Commissioner's analysis and findings

8. It is apparent from the terms of the request that at least some of the information caught by it will be environmental information as defined by regulation 2(1) of the EIRs. In Decision 218/2007 Professor A D Hawkins and Transport Scotland[1], the Commissioner confirmed at paragraph 51 that where environmental information is concerned, there are two separate statutory frameworks for access to that information and, in terms of the legislation, an authority is required to consider the request under both FOISA and EIRs.

9. SEPA explained that a sophisticated criminal cyberattack on Christmas Eve 2020 had a major impact on the way it worked. It was still unable to access its network and was only then regaining limited access to its email system. It was communicating with everyone interacting with it about the ongoing impact of the attack through is website and the media. In this connection, SEPA explained that its "Access to Information" webpage was updated in January 2021 to direct information requests to its Contact Centre via a webform. It also explained that the "Cyber Attack: Service Status" page (located on its website homepage) was updated every Friday.

10. SEPA also explained that the "Whatdotheyknow" website (which the Applicant used for his request) sent requests to SEPA's "Access to Information" mailbox, to which it had only just regained access. SEPA confirmed that the Applicant's request and requirement for review had not been responded to because it was not aware of them until the Investigating Officer notified SEPA about the application.

11. Following notification of this application, SEPA confirmed that it had appointed a Review Officer to carry out a formal review and determine whether or not it had access to any recorded information that might fall within the scope of the Applicant's request. A response would be issued as soon as possible (this was done on 30 April 2021, with an apology for SEPA's earlier failures to respond).

12. Section 10(1) of FOISA gives Scottish public authorities a maximum of 20 working days following the date of receipt of the request to comply with a request for information. This is subject to qualifications which are not relevant in this case. The same timescale is laid down by regulation 5(2)(a) of the EIRs.

13. It is a matter of fact that SEPA did not provide a response to the Applicant's request for information within 20 working days, so the Commissioner finds that it failed to comply with section 10(1) of FOISA and regulation 5(2)(a) of the EIRs.

14. Section 21(1) of FOISA gives Scottish public authorities a maximum of 20 working days following the date of receipt of the requirement to comply with a requirement for review. Again, this is subject to qualifications which are not relevant in this case. The same timescale is laid down by regulation 16(4) of the EIRs.

15. It is a matter of fact that SEPA did not provide a response to the Applicant's requirement for review within 20 working days, so the Commissioner finds that it failed to comply with section 21(1) of FOISA and regulation 16(4) of the EIRs.

16. While the Commissioner acknowledges the very challenging environment SEPA has found itself in over recent months, he has no discretion (except in very specific circumstances, which do not apply here) to find that there has not been a breach of the above provisions where the relevant timescales are not met. Here, there is no doubt that the request and requirement for review were received by SEPA and the Commissioner has no option but to find that SEPA failed to comply in these respects. He notes that a review outcome was sent to the Applicant promptly once the case had been brought to SEPA's attention.

Decision

The Commissioner finds that the Scottish Protection Environment Agency (SEPA) failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2020 (FOISA) and with the Environmental Information (Scotland) Regulations (the EIRs) in dealing with the information request made by the Applicant. In particular, SEPA failed to respond to the Applicant's request for information and requirement for review within the timescales laid down by sections 10(1) of 21(1) of FOISA and regulations 5(2) and 16(4) of the EIRs.

Given that SEPA has now responded to the Applicant's requirement for review, the Commissioner does not require SEPA to take any action in respect of these failures, in response to the Applicant's application.

Appeal

Should either the Applicant or Scottish Protection Environment Agency (SEPA) wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Euan McCulloch
Deputy Head of Enforcement
6 May 2021

---