Decision Notice 301/2024: Employee attendance at specified medical forums
Authority: Ayrshire and Arran Health Board
Case Ref: 202200776
Summary
The Applicant asked the Authority for minutes/agendas for meetings of specified groups attended by a named staff member since 1 January 2016. The Authority provided some information and withheld certain information under the exemptions in sections 33(1)(b) and 38(1)(b) of FOISA. The Commissioner investigated and found that the Authority had wrongly withheld some of the information and required it to provide some further information to the Applicant to fulfil its duty under section 15 of FOISA.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 15 (Duty to provide advice and assistance); 33(1)(b) (Commercial interests and the economy); 38(1)(b), (2A), (5) (definitions of “the data protection principles”, “data subject”, “personal data” and “processing”, “the UK GDPR”) and (5A) (Personal information); 47(1) and (2) (Application for decision by Commissioner)
United Kingdom General Data Protection Regulation (the UK GDPR) articles 5(1)(a) (Principles relating to the processing of personal data); 6(1)(f) (Lawfulness of processing)
Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (10) and 14(a), (c) and (d) (Terms relating to the processing of personal data)
Background
1. On 20 May 2022, the Applicant made a request for information to the Authority. He asked for:
(i) All the agendas/minutes from a particular staff member’s attendance at the Scottish Stoma Forum since 1 January 2016 (the Applicant noted that the staff member likely received the agenda/minute on their work email).
(ii) All agendas/minutes from that same staff member’s attendance at the Scottish Stoma Nurse Group since 1 January 2016 (the Applicant noted that the staff member likely received the agenda/minute on their work email).
(iii) The agenda/minute of any other “National” Stoma Groups that the named staff member has been a member of in their role as an Authority employee.
2. The Authority responded on 17 June 2022. The Authority provided some information in response to each part of the Applicants request with some information it viewed as commercially sensitive withheld under section 33(1)(b), and other information considered to be personal data withheld under section 38(1)(b) of FOISA. It noted that an attachment embedded in one of the documents did not open and so a notice under section 17(1) (Information not held) was provided.
3. On 17 June 2022, the Applicant wrote to the Authority requesting a review of its decision. The Applicant stated that he was dissatisfied with the decision because he considered that more information should be held. The Applicant did not agree with the application of section 38(1)(b), and believed the public interest favoured the disclosure of the information withheld under section 33(1)(b).
4. The Authority notified the Applicant of the outcome of its review on 13 July 2022. It informed the Applicant, in line with section 17(1) that no further information was held and upheld its use of the exemptions in sections 33(1)(b) and 38(1)(b) of FOISA.
5. On 13 July 2022, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Applicant stated he was dissatisfied with the outcome of the Authority’s review because he did not agree with the exemptions applied by the Authority and considered the public interest favoured disclosure.
Investigation
6. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
7. On 4 August 2022, the Authority was notified in writing that the Applicant had made a valid application. The Authority was asked to send the Commissioner the information withheld from the Applicant. The Authority provided the information.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Authority was invited to comment on this application, which it did.
9. The case was then allocated to an investigating officer.
10. During the investigation further comments and submissions were sought from and provided by the Authority. These were in relation to the nature of searches carried out to ascertain what recorded information it held falling within scope of the request, along with its reasons for relying on the exemptions in sections 33(1)(b) and 38(1)(b) for withholding some information.
Commissioner’s analysis and findings
11. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.
Information falling within the scope of the investigation
12. Section 1(1) of FOISA provides that a person who requests information from a Scottish public authority which holds it is entitled to be given that information by the public authority, subject to qualifications which, by virtue of section 1(6) of FOISA, allow Scottish public authorities to withhold information or charge a fee for it. The qualifications contained in section 1(6) are not applicable here.
13. The information to be given is that held by the Authority at the time the request is received, as defined in section 1(4). This is not necessarily to be equated with information an applicant believes the public authority should hold. If no such information is held by the public authority, section 17(1) of FOISA requires the authority to give the applicant notice in writing to that effect.
14. The Authority identified information in 14 documents falling within the scope of the Applicant’s request and stated that it held nothing further.
15. The Applicant had expected more information by way of agendas and minutes of meetings to be held by the Authority given that there had been numerous meetings, particularly of the Scottish Stoma Forum, since January 2016, and national groups, which the Applicant understood the particular staff member to have attended.
16. In considering whether a Scottish public authority holds the requested information in any given case, the Commissioner must be satisfied that the authority has carried out adequate and proportionate searches in the circumstances, taking account of the terms of the request and all other relevant circumstances. The Commissioner will consider the scope, quality, thoroughness and results of those searches, applying the civil standard of proof (the balance of probabilities). Where appropriate, he will also consider any reasons offered by the public authority to explain why it does not, or could not reasonably be expected to, hold the information. While it may be relevant as part of this exercise to explore expectations about what information the authority should hold, ultimately the Commissioner’s role is to determine what relevant recorded information is (or was, at the time the request was received) actually held by the public authority.
17. The Authority provided the Commissioner with some background information on the constitution of the Scottish Stoma Forum, and the Scottish Stoma Care Clinical Nurse Specialist Group.
18. It explained that the Scottish Stoma Forum was part of the British Healthcare Trades Association (BHTA), a not-for-profit trade association in the healthcare and assisted technologies field, to improve industry standards and consumer protection. Also, that the Scottish Stoma Nurse Specialist Group is a national group whose membership is made up of stoma clinical nurse specialists representing each Board. This group feeds directly to the National Scottish Executive Nurse Director Group (SEND). The Authority commented that the Scottish Stoma Care Nurse Specialist Group had not met since 2019 (at the time of the request). Neither of these groups are, the Authority submitted, groups that belong to it.
19. The Authority provided the Commissioner with details of the relevant staff who carried out searches of their email account and relevant shared and personal drives for any information falling within scope of the request. The Authority explained that as the staff concerned sat on both of the named groups they were considered the most suitable person to ask to undertake searches, as they were the most likely to hold relevant information.
20. The Authority did not consider it necessary to search elsewhere for the following reasons.
21. The Authority explained that there was no legal requirement for its staff member to keep and record the minutes as it was not an Authority group. It referred to a section of its Corporate Records Retention and Disposal Policy that advised staff to:
Review the folder for duplicate documents e.g. you may hold a copy of minutes for a meeting that you attend, but you do not hold the official/master record; the master record is held by the meeting secretary/chair. In some cases, business areas may decide to keep a duplicate set for a short period of time, for reasons of convenience however this does not need to be kept for the retention period.
22. The Authority stated that this was in keeping with the Scottish Government Records Management: Health and Social Care Practice, and made reference to page 106:
Minutes (Master Copies) Master copies are the copies held by the secretariat of the meeting, i.e. the person or department who takes the minutes, writes them and issues them.
23. The Authority submitted that at the time of the request, its staff member was neither the chair nor secretary of either the Scottish Stoma Forum or the Scottish Stoma Care Nurse Specialist group.
24. In response to the Applicant’s view that because the particular member of staff had attended many national groups, he found it hard to believe that no electronic or paper records were held, the Authority explained that the Minutes provided to the Applicant were not master copies. Furthermore, it was not under any legal or other obligation to retain a copy of the minutes. The Authority commented that FOISA is about the information held by it at the time of the request and the Minutes and other information provided were held and recorded on its systems, therefore it was obliged to provide all held information to the Applicant.
25. The Commissioner has considered the scope and adequacy of the searches carried out by the Authority as well as its explanation for why it was not obliged to keep such information. He is satisfied that, on balance, that the Authority does not (and did not on receipt of the request) hold any further information falling within the scope of the Applicant’s request.
Section 38(1)(b) – Personal information
26. The Authority has relied on section 38(1)(b) to withhold some information in 13 of the 14 documents falling within the scope of the Applicant’s request.
27. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is “personal data”,(as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or where relevant in the DPA 2018.
28. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption. This means that it is not subject to the public interest test in section 2(1)(b) of FOISA.
29. To rely on this exemption, the Authority must show that the withheld information is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles found in Article 5(1) of the UK GDPR.
Is the information personal data?
30. The first question that the Commissioner must address is whether the withheld information is personal data for the purposes of section 3(2) of the DPA 2018.
31. “Personal data” is defined in section 3(2) of the DPA 2018 as “any information relating to an identified or identifiable living individual”. Section 3(3) of the DPA 2018 defines “identifiable living individual” as “a living individual who can be identified, directly or indirectly, in particular with reference to:
(a) An identifier such as a name, an identification number, location data, or an online identifier, or
(b) One or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual”.
32. The Court of Justice of the European Union looked at the question of identification in Breyer v Bundesrepublik Deutschland. The Court took the view that the correct test to consider is whether there is a realistic prospect of someone being identified. When making that determination, account can be taken of the information in the hands of a third party. However, there must be a realistic causal chain – if the risk of identification is insignificant, the information will not be personal data.
33. Although this decision was made before the UK GDPR and the DPA 2018 came into force, the Commissioner considers that the same rules will apply. In accordance with Recital 26 of the GDPR (the source of the UK GDPR), the determination of whether a natural person is identifiable should take account of all means reasonably likely to be used to identify the person, directly or indirectly. In considering what is reasonably likely, the Recital states that all objective factors should be taken into account, such as the costs and amount of time required for identification, taking into consideration the available technology at the time of processing and technological developments.
34. The Applicant in his Application accepted that names may be redacted but that he believed other information should not have been withheld, such as initials, as this is not a name.
35. In his comments to the Commissioner, the Applicant stated that he did not consider that he had asked for personal data, and that he understood there could be redactions and that this was not an issue. He considered that the reality was that if groups that people choose and volunteer to go on where decisions that affect thousands of people are made there has to be some transparency.
36. The Authority considered that data protection protects both personal and personal identifiable information, such as that it had withheld.
37. The Commissioner has considered all of the information being withheld by the Authority under this exemption, including names, initials, job titles, email addresses and direct line telephone numbers, and accepts that most of this is personal data as it “relates to” identifiable living individuals.
38. The Authority withheld some information in documents 1, 6 and 14 that the Commissioner does not accept would constitute personal data.
39. In documents 1 and 6 (emails) this comprised the second part of a work email address. As an example the Commissioner’s staff email addresses end @foi.scot and although it indicates the place of work, it does not relate directly to an individual member of staff.
40. In document 14 (Presentation made at Stoma Acute Patient Pre-Tender CAP meeting 22/03/2022), the second part of some email addresses were withheld as well as health board names and job titles of those present.
41. The Commissioner does not accept that such information in documents 1, 6 and 14 would fall within the definition of personal data as it does not relate to an identifiable living individual.
42. During the course of the investigation, the Authority changed its position, no longer relying on section 38(1)(b) to withhold some information in documents 1 and 6, which it subsequently provided to the Applicant.
43. The Authority explained that it was still seeking to rely on the exemption in section 38(1)(b) of FOISA for information relating to staff who worked for external parties. It was however willing to disclose the names and job titles of its own personnel who attended the presentation. The Authority however provided no further comment on similar information (the second part of email addresses) in document 14, other than to state that this document (with some limited redactions) had been placed into the public domain by NHS National Services Scotland NHS NSS) at a later date.
44. The Commissioner therefore does not accept that information including the second part of email addresses, names of health boards and job titles contained in documents 1, 6 and 14 constitutes personal data, as defined in section 3(2) of the DPA.
45. The Commissioner must therefore find that the Authority was not entitled to withhold this information under section 38(1)(b) of FOISA. As the Authority has already provided the information in documents 1 and 6 to the Applicant the Commissioner does not require it to take any other action. However, he does require the Authority to provide the Applicant with the relevant information on page 4 of document 14.
46. Having reached this conclusion, the Commissioner is not required to go on to consider whether any of the further tests for section 38(1)(b) of FOISA apply to this particular information, but as the Commissioner is satisfied that the rest of the information (names, initials, partial email addresses and telephone numbers) is personal data he must go on to consider these tests in relation to that.
Would disclosure contravene one of the data protection principles?
47. The Authority argued that disclosing the personal data would breach the data protection principle in Article 5(1)(a) of the UK GDPR, as it did not believe processing this personal data in response to this request would be “processing lawfully, fairly and in a transparent manner in relation to the data subject(s)”.
48. The Authority submitted that it considered the only lawful basis that would be applicable to allow them to process the personal data in response to this request would be condition (f): legitimate interests in Article 6(1) of the UK GDPR.
49. “Processing” of personal data is defined in section 3(4) of the DPA 2018. It includes (section 3(4)(d)) disclosure by transmission, dissemination or otherwise making available personal data. The definition therefore covers disclosing information into the public domain in response to a FOISA request.
50. The Commissioner must consider whether disclosure of the personal data would be lawful (Article 5(1)(a)). In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed.
51. The Commissioner agrees with the Authority’s view that condition (f) in Article 6(1) was the only condition which could potentially apply in the circumstances of this case.
Condition (f): legitimate interests
52. Condition (f) states that processing shall be lawful if it is necessary for the purposes of legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data (in particular where the data subject is a child).
53. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
54. The three tests which must be met before Article 6(1)(f) can be relied on are as follows (see paragraph 18 of South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55 (the South Lanarkshire Council case) - although this case was decided before the GDPR (and UK GDPR) came into effect, the relevant tests are almost identical):
• Does the Applicant have a legitimate interest in the personal data?
• If so, would disclosure of the personal data be necessary to achieve the legitimate interest?
• Even if the processing would be necessary to achieve the legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects which require protection of personal data (in particular where the data subject is a child)?
Does the Applicant have a legitimate interest?
55. The Applicant considered he had a legitimate interest in understanding the decisions taken by attendees at the meetings for reasons of transparency and accountability, particularly given that the decisions taken had the potential to impact the approximately 20,000 stoma patients in Scotland.
56. The Authority has not argued that the Applicant does not have a legitimate interest in the withheld information.
57. The Commissioner acknowledges that disclosure of the remaining personal data would facilitate transparency and accountability to both the Applicant and the wider public regarding those involved in the decision-making process. There is clearly a significant number of NHS patients and their families who are affected by the actions and decisions of the groups under discussion in this request who have a legitimate interest in this topic. Consequently, the Commissioner accepts that the Applicant has a legitimate interest in disclosure of the personal data.
Is disclosure of the personal data necessary?
58. The Commissioner will now consider whether disclosure of the personal data is necessary for the Applicant’s identified legitimate interest. In doing so, he must consider whether these interests could be met by other means.
59. The Commissioner has considered this carefully in light of the decision by the Supreme Court in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55.
60. "Necessary" means "reasonably" rather than "absolutely" or "strictly" necessary. When considering whether disclosure would be necessary, public authorities should consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the requester's legitimate interests can be met by means which interfere less with the privacy of the data subject.
61. The Applicant highlighted that he had previously been provided with staff identities by another public authority in relation to other working groups.
62. The Applicant also stated that he believed that as these groups (Scottish Stoma Forum) were not NHS or Government groups but run by private pharmaceutical companies there was very much a public interest in knowing what public servants said at these meetings.
63. The Authority considered that withholding the names of staff would not impede the Applicant’s understanding of who had attended meetings as roles and organisation names had been provided.
64. It also considered that the names of attendees were not necessary as if the Applicant had concerns about the process, or propriety at either the meetings of the Scottish Stoma Forum or the Scottish Stoma Care Nurse Specialist Group there were routes available to raise concerns. It submitted that there was a complaints process in place via BHTA with respect to the Scottish Stoma Forum. Also, the Authority explained that if the Applicant had concerns about the actions of the Scottish Stoma Care Nurse Specialist Group, he had a right to escalate these to the National Scottish Executive Nurse Director Group (SEND) via NHS NSS Board Services Team who provide the secretariat for SEND.
65. In relation to the Applicant’s point about what another authority had provided, the Authority considered it could not comment on how other public authorities chose to apply exemptions, highlighting that each Board is an independent authority.
66. The Commissioner has carefully considered the submissions from both the Applicant and Authority as well as the withheld information. He does not consider that disclosure of the remaining personal information (other than that already discussed from documents 1, 6 and 14) is necessary to meet the Applicant’s legitimate interest. The Commissioner does not accept that the removal of names, initials, partial email addresses and direct line telephone numbers affects the understanding of the matters discussed or the decisions taken.
67. The Commissioner is therefore satisfied that, although the Applicant has a legitimate interest in the personal data, disclosure is not necessary to achieve that legitimate interest. It is apparent from reading the submission from the Authority that should the Applicant have concerns over the decisions taken at the relevant groups, there are mechanisms available to him to pursue these concerns without the need to have access to the personal data that has been withheld.
68. As the Commissioner is not satisfied that it is necessary for the remaining personal data to be disclosed to the Applicant he finds, in all the circumstances of the case that condition (f) in Article 6(1) of the UK GDPR could not be met in relation to the remaining personal data. As such the Commissioner has concluded that disclosure of that personal data in response to this request would be unlawful. He is not therefore required to go on to consider whether disclosure of such personal data would otherwise be fair and transparent in relation to the data subjects.
69. For the reasons set out above, the Commissioner concludes that disclosure of the remaining personal data would breach the data protection principle in Article 5(1)(a) of the UK GDPR. The Commissioner therefore finds that these personal data are exempt from disclosure under section 38(1)(b) of FOISA.
70. The Commissioner finds that the Authority was entitled to withhold some information under section 38(1)(b) but wrongly relied on this exemption to withhold other information. Some of this in documents 1 and 6 has already been provided to the Applicant but as detailed in paragraph 44 above other information wrongly withheld on page 4 of document 14 must now be provided to the Applicant.
Section 33(1)(b) – Commercial interests and the economy
71. The Authority relied on the exemption in section 33(1)(b) to withhold information in documents 2, 5, 7 and 14.
72. Section 33(1)(b) of FOISA provides that information is exempt information if its disclosure under this Act would, or would be likely to, prejudice substantially the commercial interests of any person (including, without prejudice to that generality, a Scottish public authority). This is a qualified exemption and is subject to the public interest test in section 2(1)(b) of FOISA.
73. There are three elements which an authority needs to demonstrate are present when relying on this exemption. In particular, it needs to establish:
(i) whose commercial interests would (or would be likely to) be harmed by disclosure;
(ii) the nature of those commercial interests; and
(iii) how those interests would (or would be likely to) be prejudiced substantially by disclosure.
74. In order to evidence that this exemption is engaged, an authority has to show that disclosure of the information would, or would be likely to, be the catalyst that would cause the substantial prejudice to a commercial interest. The prejudice must be substantial, in other words of real and demonstrable significance.
75. Where the authority considers the commercial interests of a third party would (or would be likely to) be harmed, it must make this clear. While the final decision on disclosure will be one for the public authority to make, it is helpful if the third party has been consulted on the elements referred to above.
76. During the course of the investigation the Authority informed the Commissioner that it no longer wished to rely on section 33(1)(b) to withhold some information in documents 2, 5 and 7, and it provided this information to the Applicant.
77. As such, the Commissioner must find that the Authority was not entitled to rely on the exemption in section 33(1)(b) of FOISA to withhold some of the information in documents 2, 5 and 7 at the time it responded to the Applicant’s requirement for review.
78. The Authority continued to maintain it was correct to rely on section 33(1)(b) in relation to some of the information in document 14 at the time of the request and request for review.
The Authority’s submissions on the exemption
79. The Authority explained that it provided the Applicant with a redacted version of document 14, a presentation entitled NP51/22 Stoma Acute Patient Pre-Tender CAP Meeting 22/03/2022.
80. It explained that it was not the lead authority or owner of this document and that as per the Section 60 Code of Practice it deemed that consultation with the NHS NSS Procurement Team was appropriate in the circumstances. However, given the tight timescales and the guidance in the Section 60 Code of Practice (paragraph 7.4.1), it had made a decision in respect of applying the commercially sensitive exemption. The Authority took the decision that more damage would be done if it released information that was considered, at the time of the request, to be commercially sensitive, therefore it redacted any information it believed to fall under this exemption.
81. The Authority submitted that it understood that a few weeks later NHS NSS received a similar request and released more information than the Authority had done. The Authority explained that this information is now in the public domain via the NHS NSS disclosure log FOI-000148 (published after the request and request for review in relation to this application).
82. The Authority explained that the presentation was delivered to Procurement, Logistics, Contract Implementation Managers and Commodity Managers as well as Stoma Nurses, Clinical Lead Managers and Lead Stoma Care Clinical Nurse Specialist (CNS).
83. It also highlighted that all NHS procurement processes must comply with two key pieces of legislation:
• The Public Contracts (Scotland) Regulations 2015 (Procurement Regulations) and;
• The Procurement Reform (Scotland) Act 2014 (the Reform Act).
84. At the time of the review, the Authority considered that the information was commercially sensitive as the purpose of the meeting was to discuss pricing, spending by lot, products by spend, selection criteria, weighting/scoring criteria etc. as the current framework was due to expire on 31 October 2022. Its view was that disclosure of the information at that time could have prejudiced the tender process. It pointed out that the market for these products is highly competitive, and that disclosure would have impacted negatively on competition and future pricing, prejudicing the commercial interests of the tenderer and NHS Scotland by preventing them from achieving best value.
The Applicant’s submissions on the exemption
85. The Applicant did not consider that the information being withheld by the Authority was commercially sensitive as if the presentation was made to a group of Stoma Nurses, he doubted that the information was commercially sensitive.
86. The Applicant suggested that as such nurses sit on groups funded by pharmaceutical companies then they should have recused themselves from being at a meeting where highly classified information was shared.
87. The Applicant did not consider Stoma Nurses would be involved in making commercial agreements and so does not consider the exemption in s33(1)(b) applied.
The Commissioner’s view on the exemption
88. The Commissioner has carefully considered the comments from both the Applicant and the Authority, along with the withheld information.
89. The Commissioner is satisfied, given the nature of the information in document 14, and the prospect of a tendering exercise, that the information withheld was commercial information, and that its disclosure could have an impact on any future tendering process to the detriment of NHS Scotland, and possibly to some of the companies that may choose to tender.
90. He is also satisfied that the information relates to a commercial interest, in so far as the NHS is a procurer of goods and services and has an obligation as a public body to achieve the best value it can for the public money it spends. The other commercial interest is that of those tendering to provide said goods and services to NHS Scotland.
91. The Commissioner is satisfied, therefore that the exemption in section 33(1)(b) of FOISA has been correctly engaged by the Authority in relation to document 14.
Public interest test
92. As the Commissioner has found that the exemption in section 33(1)(b) of FOISA was correctly applied to the withheld information, he is now required to consider the public interest test in section 2(1)(b) of FOISA.
The Authority’s submissions on the public interest
93. The Authority acknowledged the general public interest in transparency and accountability particularly in relation to how money and resources are allocated and spent within public authorities.
94. The Authority restated that it considered that if the information had been released into the public domain at the time of the request and request for review, it would have, or would have been likely to, prejudice substantially the Authority’s, NHS Boards’ and service providers’ commercial interests as it would have allowed other parties to have personal knowledge of the selection and award criteria.
95. It considered that releasing this criteria and pricing from suppliers would have prejudiced the commercial interests of it, individual companies involved and ultimately the public if the best price could not have been secured, and that disclosure may have given advantage to one company over another by knowing their competitor’s rates and tender criteria/process.
96. The Authority considered that an impact from disclosure would have been to deter companies from wishing to tender, which would have a detrimental effect on services provided to patients. It highlighted its duty to ensure the best value and appropriate services are available to meet the health needs of its service users. To do that it follows procedures that are in place to serve the public interest.
97. The Authority considered that to disclose the information would have impacted negatively on competition and future pricing, prejudicing the commercial interests in this case of any tenderer and NHS Scotland by preventing them from achieving best value. This is not in the public interest. It is, however, in the public interest that there is fair competition.
98. On balance it did not believe it was in the public interest to undermine these procedures by engendering a lack of confidence in its ability to meet these health needs.
The Applicant’s submissions on the public interest
99. The Applicant stated that there was clearly a public interest in the information he had requested as it related to decisions that could affect thousands of people’s access to prescription items.
The Commissioner’s view on the public interest
100. The Commissioner has carefully considered the submissions from both the Applicant and the Authority. He acknowledges the general public interest in transparency and accountability.
101. He acknowledges the concerns highlighted by the Applicant and the need for transparency and accountability as to how choices are made relating to products and/or services in healthcare that go on to impact the lives of the end users of such products and services.
102. The Commissioner also recognises the onus on public authorities to achieve best value when spending public money and that there are processes in place to ensure this happens. He accepts that disclosure of the withheld information could affect NHS Scotland’s ability to achieve the best value for money when the framework is renewed.
103. The Commissioner appreciates that the Authority’s concerns around the likelihood of this harm occurring were reasonable given the timing of the Applicant’s request and the close proximity of this to the presentation of the commercial information contained in document 14, as well as the tender process that was likely to follow from this regarding the framework renewal.
104. He also recognises that the Authority was not the owner of this information, and that although it had contacted the lead public authority, it had not received a response before it was obliged to respond to the Applicant in order to meet the statutory timescale laid down in the legislation( something that the Section 60 Code prioritises over a waiting for a third party view on the information being requested). The Authority had indicated that in the absence of a steer from NHS NSS, it had erred on the side of caution in order to protect the public interest in achieving the best value. As mentioned before, at a later date, much of the information was subsequently placed into the public domain by NHS NSS (the lead authority) in answer to another FOI request.
105. The Commissioner has already acknowledged the submissions made by the Authority in support of the exemption and has concluded that disclosure of the withheld information would, or would have been likely to, prejudice the commercial interests of the Authority, NHS Boards’, and commercial companies who may wish to tender.
106. Having balanced the public interest for and against disclosure, the Commissioner concludes that, in all the circumstances of the case, the public interest in maintaining the exemption in section 33(1)(b) outweighs that in disclosure of the withheld information under consideration here.
Section 15 – Duty to provide advice and assistance
107. Section 15 of FOISA requires a public authority to provide reasonable advice and assistance to someone making an information request.
108. It can be difficult for those outside a sector or particular public authority to have an understanding of how an organisation works and how it relates to other public sector bodies.
109. The Authority provided the Commissioner with some helpful information in its submissions that aided the investigating officer to understand the context and how concerns about the groups that were the subject of this request, the decisions made in relation to stoma products, and/or procurement in relation to stoma products could be taken further.
110. When highlighted to the Authority by the investigating officer how useful this information was in relation to the request, it acknowledged that on reflection it would have been beneficial to provide the Applicant with this information at an earlier stage.
111. The Commissioner therefore considers that the Authority did not provide the Applicant with adequate advice and assistance to meet its duty fully under section 15(1) of FOISA.
112. The Commissioner requires that the Authority share this information with the Applicant.
Decision
The Commissioner finds that the Authority partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.
The Commissioner finds that by withholding some information under sections 33(1) and 38(1)(b) of FOISA, the Authority complied with Part 1.
However, the Commissioner found that the Authority was not entitled to rely on sections 33(1)(b) and 38(1)(b) for some of the information it withheld from the Applicant. He also found that the Authority failed to provide the Applicant with adequate advice and assistance in relation to some of the issues he raised around his request.
The Commissioner therefore requires the Authority to disclose the information detailed in the accompanying appendix and provide him with adequate advice and assistance by 3 February 2025.
Appeal
Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Enforcement
If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply. The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.
David Hamilton
Scottish Information Commissioner
20 December 2024
