Decision 097/2008 Mr A and the University of Glasgow
Internal Audit Update Report
Reference No: 200701129
Decision Date: 13 August 2008
Summary
Mr A requested information relating to an Internal Audit Committee meeting from the University of Glasgow (the University). The University provided most of the information requested by Mr A but redacted certain documents on the basis that the redacted information was exempt from disclosure by virtue of either section 33(1)(b) or 38(1)(b) of FOISA. Following a review, Mr A accepted the University's application of section 38(1)(b) but remained dissatisfied with the University's application of section 33(1)(b) and applied to the Commissioner for a decision.
Following an investigation, the Commissioner was not satisfied that disclosure of the information would prejudice the relevant service provider's commercial interests substantially and therefore found that the University had failed to deal with Mr A's request for information in accordance with Part 1 of FOISA, by incorrectly applying section 33(1)(b) of FOISA. He required the University to release the information to Mr A.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) (General entitlement) and 33(1)(b) (Commercial interests and the economy).
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Background
1.On 7 June 2007, Mr A wrote to the University requesting information generated by the second meeting of the University Audit Committee of 2007. He particularly requested:
The agenda of the meeting
All papers relevant to the agenda, including those tabled at the meeting
All correspondence (including email correspondence) which the University held in relation to the meeting (including correspondence between members, between staff in attendance at the meeting, between members and staff in attendance at the meeting and between members and/or staff and external auditors and/or internal auditors)
All minutes prepared in respect of the meeting (including draft minutes since superseded).
This request encompassed an Internal Audit Update Report (the Report) complied by Deloitte and Touche LLP (Deloitte), a commercial organisation contracted to carry out internal audit services for the University.
2.The University responded to Mr A's request for information on 4 July 2007. It released all of the documents covered by his request, but redacted certain information on the basis that it was exempt from disclosure by virtue of either section 38(1)(b) of FOISA. The Report was released by the University as part of its response, with certain information redacted as exempt by virtue of section 33(1)(b) of FOISA.
3.On 30 July 2007, Mr A wrote to the University requesting a review of its decision. In particular, he questioned the University's application of section 38(1)(b) and 33(1)(b) of FOISA and asked it to reconsider its application of the public interest test.
4.The University wrote to notify Mr A of the outcome of its review on 10 August 2007, upheld the initial response in its entirety.
5.On 17 August 2007, Mr A wrote to the Commissioner's Office, stating that he was dissatisfied with the outcome of the University's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA. In his application, Mr A stated that he no longer wished to pursue the University's application of section 38(1)(b) of FOISA to certain information.
6.The application was validated by establishing that Mr A had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
7.On 12 September 2007, the University was notified in writing that an application had been received from Mr A and was asked to provide the Commissioner's Office with copies of the information that had been withheld. The University responded with the information requested and the case was then allocated to an investigating officer.
8.The investigating officer subsequently contacted the University, providing it with an opportunity to make comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions. In particular, the University was asked to justify its reliance on section 33(1)(b) of FOISA.The University was also informed that Mr A was no longer concerned with the information withheld under section 38(1)(b) of FOISA.
9.With its own submissions to this office, the University provided additional comments from Deloitte in support of its claim that the redacted information should be withheld under section 33(1)(b) of FOISA.
Commissioner's analysis and findings
10.In coming to a decision in this matter, the Commissioner has considered all of the submissions and other information presented to him both by Mr A and the University and is satisfied that no matter of relevance has been overlooked.
Section 33(1)(b) ? Commercial interests and the economy
11.Section 33(1)(b) of FOISA states that information is exempt information if its disclosure under FOISA would, or would be likely to, prejudice substantially the commercial interests of any person (including, without prejudice to that generality, a Scottish public authority).
12.The University has relied on the exemption in section 33(1)(b) of FOISA for redacting information from the Report.The Report was prepared by Deloitte for submission to the meeting of the University's Audit Committee held on 23 May 2007.
13.There are certain elements to section 33(1)(b) of FOISA which an authority needs to demonstrate when relying on this exemption.In particular, it needs to identify whose commercial interests would (or would be likely to) be substantially prejudiced by disclosure, the nature of those commercial interests and how they would (or would be likely to) be harmed.
14.The exemption in section 33(1)(b) is subject to the public interest test contained in section 2(1)(b) of FOISA, so an authority which considers the exemption to apply must go on to consider whether, in all the circumstances of the case, the public interest in disclosing the information is outweighed by that in maintaining the exemption.
15.Information has been redacted from two pages within the Report. The first is page 2, which is entitled "Overall Activity Summary" and contains a table summarising by project the work undertaken by Deloitte in implementation of its 2006/07 audit plan. In this table, the columns detailing the budgeted days and actual time to date for each project have been redacted, as has the line containing total budgeted days and time to date.
16.The second redaction occurs on page 11, which is entitled "Overview of Strategic Internal Audit Plan" and contains a table setting out Deloitte's resource allocations for internal audit for the years 2006/07, 2007/08 and 2008/09, broken down into a number of functional categories or "process areas".In this table, the columns showing the allocated resources equated into actual days have been redacted. The columns conveying the percentage of resources allocated to each category have been provided.
17.The University argued that using the redacted numerical data in conjunction with the total value of Deloitte's contract with the University (released as a result of another information request made by Mr A), Mr A would be able to calculate the daily rate charged for Deloitte's services. The University considered this rate to be directly related to (a) the mix of skill sets and associated costs required for the internal audit work carried out by Deloitte, (b) the application of Deloitte's unique specific tools, technologies, methodologies and approaches to that work, and (c) Deloitte's commercial and competitive advantage. It took the view that Deloitte's commercial interests would be seriously prejudiced by release of the rate, pointing out that the firm operated in a very competitive environment and that the information related to the allocation of specialised expertise.
18.In setting out Deloitte's position on disclosure of information about the internal audit contract, the University provided a list of categories of information considered to be commercially sensitive by virtue of the potential impact of disclosure on Deloitte's commercial and competitive position in the marketplace. These included details of its specific tools, technology and approaches.
19.The University also submitted that it operated within a very commercial environment itself. It argued that it was not in its own commercial interests to take action (such as releasing information directly related to the commercial position of its internal auditors and thereby causing serious damage to their competitiveness and business interests) which would substantially prejudice business confidence in it. It suggested that this would inhibit commercial organisations, such as those supplying specialised services, from seeking to provide such expertise to the University in the future, which it contended would be substantially prejudicial to its own commercial interests.
20.Firstly, the Commissioner is not satisfied that the University has adequately demonstrated that it has itself a commercial interest in this context. Generally he does not consider the purchase by an authority of the resources required to carry out its core activities (the type of activity in relation to which the University has argued its commercial interests would be engaged in this case) to be commercial in nature, and he can identify nothing in the particular circumstances of this case which could be regarded as making it so. He does accept, however, that Deloitte, as a third party commercial organisation seeking and carrying out business in a competitive environment, does have commercial interests in this context. He will now go on to consider how those commercial interests might be affected by disclosure of the redacted information.
21.Having considered the redacted information, the Commissioner is not entirely persuaded that Deloitte's daily rate could be calculated from it, in conjunction with information already disclosed to Mr A. However, he accepts (as he has in relation to information of this kind in cases involving tenders for goods or services, for example Decision 050/2008 Mr Q and the University of Glasgow, which related to the tenders for this same piece of work) that pricing information at this level of detail, and for that matter information relating to the allocation of time and other resources to particular functions or tasks (at least to the extent that it reveals unique methodologies or approaches), may in certain circumstances be of sufficient interest to competitors that substantial prejudice to the commercial interests of the subject of the information would, or would be likely to, follow from disclosure.
22.In this case, however, even if the Commissioner were to accept the University's position on the potential for calculation of Deloitte's daily rate, it does not follow that he would agree that section 33(1)(b) applied. In Decision 050/2008, the applicant had requested information shortly after the tendering process was completed and the Commissioner was satisfied in the circumstances that the information concerned retained the necessary commercial sensitivity then and at the time of the authority's review. Here, however, outwith the context of a current or recent tendering exercise (the process of requesting the information and seeking a review in this case was completed approximately a year after conclusion of the relevant contract), he is not persuaded that information specific to the performance of an ongoing contract (and which by that time would not necessarily reflect in all its detail the equivalent information contained in the contractor's tender) would retain the commercial sensitivity it might have held at or around the time the tendering process was completed and the contract concluded. Consequently, he does not accept in this case that disclosure of the redacted information would, or would be likely to, prejudice Deloitte's commercial interests substantially.
23.As the Commissioner has not accepted that the redacted information would be exempt under section 33(1)(b) of FOISA, he is not required to go on to consider the application of the public interest test as set out in section 2(1) of FOISA. Therefore the Commissioner requires the University to release this information to Mr A.
DECISION
The Commissioner finds that the University of Glasgow (the University) failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in dealing with the information request from Mr A.In relying upon section 33(1)(b) of FOISA for withholding the information redacted from the Internal Audit Update supplied to its Audit Committee Meeting of 23 May 2007 (the Report), the University failed to comply with Part 1 (and in particular section 1(1)) of FOISA.
The Commissioner therefore requires the University to provide Mr A with a copy of the Report, within 45 days after the date of intimation of this decision notice, that is by 28 September 2008
Appeal
Should either Mr A or the University of Glasgow wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Kevin Dunion
Scottish Information Commissioner
13 August 2008
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
33 Commercial interests and the economy
(1) Information is exempt information if-
?
(b) its disclosure under this Act would, or would be likely to, prejudice substantially the commercial interests of any person (including, without prejudice to that generality, a Scottish public authority).
