Official Report 681KB pdf
Welcome back. Under agenda item 3, the committee will hear evidence from David Hamilton, the Scottish Information Commissioner, on the annual report and accounts for 2023-24. The commissioner is joined by Euan McCulloch, who is head of enforcement, and Claire Stephen, who is head of policy and information. David, I turn to you for some opening remarks, and then we will move on to questions.
Good morning. It is a delight to be back—I have been in post for 15 months and this is my second appearance in front of the committee. It is a really important part of my scrutiny and accountability in the system. I welcome the chance to speak to you and to answer your questions.
I continue to be honoured to carry out this role, not just because of the importance of the subject but because of the people I work with, including the two tremendous members of my senior management team who are here with me today and all of us in St Andrews who work hard to deliver incredible results with a limited resource in a challenging financial environment.
At my previous appearance before the committee, I updated members on our backlog management and I talked about our strategic plan and the legislative opportunities that lay ahead. I will work backwards through that list. The changes to legislation move at tectonic pace—maybe not even that fast. It has been a source of great frustration to see things that need to be done not being done.
One part of my strategic plan is about protecting Scotland’s reputation in an international forum and making sure that it is a leader in transparency and freedom of information. That reputation is now slipping. The legislation is ageing, and new democracies and regimes are emerging that offer better information rights than those that people in Scotland have. That needs attention and I hope that, through Katy Clark’s proposed member’s bill, it will improve. However, it was a great disappointment that the Scottish Government did not see that there was a need to change things. I hope that there will be some changes in that area.
We have engaged with Katy Clark on her member’s bill by giving some views, which are publicly available as part of the bill’s consultation. We look forward to seeing where the bill goes, although we are mindful that the parliamentary timetable will be a pressure on it.
The Scottish Government is keen to look at the section 60 code of practice, which accompanies the freedom of information legislation. It is an important regulatory framework. The potential extension of the code is out for consultation, but that seems to have been paused, because we have to see what is happening with the national care service. I do not have any idea what is happening with that—I do not know whether anyone does. The national care service is holding things back in that regard. We have had engagement on an advisory committee to look at consultations. However, again, that situation is frustrating because it means that implementation is a long way away.
It is worth reflecting on the fact that we have not had a legislative extension of the designation of public authorities for five years. While that continues, people suffer an information deficit, particularly in the care sector. That is a hot topic just now, given that 75 per cent of care is provided by private providers who are not fully covered by freedom of information legislation. Therefore, there is a pressing need for that extension.
My strategic plan remains very relevant. I am glad to say that I am progressing through the plan in many different ways. However, I committed to review the plan after a year, once I understood the landscape better. It stands as it is, but I will review it. The only minor tweak that I can see making is to bring in more of a culture of access to information rather than freedom of information. Information should not be locked away—it needs to be freed and it should be possible to access it. That is another nod to the importance of proactive publication.
I will draw on international experience, particularly in Ukraine. I spoke to one of the commissioners in Ukraine, who said that, when the invasion started, three years ago, people said that they wanted not food but information, which very much puts the issue into context. I thought that that was a great phrase to demonstrate the importance of information to people in times of crisis. Just last weekend, we had storms, and there has been a lot of criticism of some public authorities for a lack of communication. I am interested in probing that area to see whether I can give people a better experience in that environment.
The enforcement performance in relation to dealing with the backlog of cases has been outstanding. That is down to the investigation team, which really has the wind in its sails and is moving just now. In the last calendar year, we made 303 decisions, which is the highest number ever. We had a backlog of 384 cases, but we are now 55 per cent of the way through that, so we are making great inroads into the backlog. New cases have been dealt with faster than our statutory target. That is a very good news story, and I am grateful to the Parliament for the assistance of two temporary members of staff for that.
The policy and information team, which is represented by Claire Stephen, has been doing an outstanding job on consultations. It has been working with a very busy legislative environment. On communications, it has been a busy year for us—for me in particular. However, I have had support from the communications team on media handling and, going beyond that, in the training environment with regard to ensuring that authorities are fit for purpose as well as on the monitoring of public authority performance, which is a key piece of the jigsaw.
My corporate services team is also working hard, but we struggle with disproportionate governance expectations. Our organisation has 30 members of staff, so we are a small organisation, but we basically have the same governance standards as an organisation that is 1,000 times that size. That is very challenging and time consuming. Through the commissioners landscape review, I hope to explore further how we can tackle that and get a more proportionate model.
09:30The biggest high-risk area for me is interventions, as I said last year. This is where we get proactive and go out to deal with system problems before they become recurring issues. All of our interventions have been very well received by local authorities and public authorities. Initially, when we come in and speak to them, there is a bit of suspicion, but we usually end with their saying, “Thank you—that was a great experience.” That is a great thing to do, because we are turning around cultures, including some of the high-profile ones, such as the Scottish Government and national health service boards, including NHS Greater Glasgow and Clyde. It is a real turnaround of culture and, we hope, a positive experience for everyone.
However, that work must be resourced. It never has been resourced, so it remains unresourced and I have to steal from other parts of the organisation or risk not being able to do anything. I need to do a lot more of that work, but I cannot. I have made bids to the Scottish Parliament Corporate Body to try and deal with that, but, at the moment, it is unaffordable. I hope that we can address that in future years.
A general observation about the FOI regime is that, across the system, it is in a very good place. We have done a lot of data gathering for our 20th anniversary. Over those 20 years, there have been 1.4 million freedom of information requests, which is quite astonishing. Of those requests, 83 per cent gave people some or all of the information that they requested, so the regime is healthy in that regard. Eighty per cent of those requests were complied with on time. I see a dedicated cadre of professionals in information governance who are trying to do their best. I am balancing that against the expectations of the public, but, primarily, they do very well. There is more to be done, and there are problem areas, but we are in a good general state of health.
I mentioned the 20th anniversary, and we want to do a number of things in recognition of that. We are increasing the number of webinars to expand the scale in relation to FOI users and we are doing journalist training sessions. I intend to see more chief executives because the key to dealing with a lot of those issues is that the culture has to come from the top down. We also hope to be part of the festival of politics this year.
Our public awareness research shows us which particular areas we need to firm up on, and I am looking at whether we can develop partnerships with other organisations, particularly the commissioners. At the moment, I am looking to work with the Children and Young People’s Commissioner Scotland to see whether we can have a follow-through of information rights. People ask questions and get answers, so it is about what they do with those answers. We want to see how we can join the areas together and make a whole-system approach, particularly for young people. Those are our initial thoughts on that.
Convener, I meant to speak for five minutes, but I have perhaps overrun. I am happy to take any questions.
That is no problem and thank you for that information. We will move to questions, and I will kick off with the fact that this is, of course, the 20th anniversary. In some ways, 1 January 2005 seems like a long time ago and, in other ways, it seems like only yesterday.
I was fascinated by your comments at the end of your opening remarks about the involvement of young people and working with the Children and Young People’s Commissioner Scotland. We have had 20 years of a landscape where we have seen improvements—sometimes substantial, more frequently just gradual—in the legislative framework, which we will get to in a minute. Beyond engaging with the Children and Young People’s Commissioner, what thoughts have you had about engaging with young people and how to capture the importance to them of freedom of information? My experience is that they frequently ask questions to which they could get the answers on their own if they were more aware and the regime was more friendly towards young people.
Absolutely—I agree with and recognise that entirely, and it is one of the first things that I said. The advantage of coming into the commissioner’s role without first coming through the FOI system is that I can look at things from a more critical outsider’s perspective.
One of the first things that I picked up was that, often, the responses to freedom of information requests are very legalistic, and I have asked the authorities to review that to make the information more accessible to young people and others, so that they can understand it clearly. Sometimes, as an adult, I struggle to understand what on earth a response means, so it needs that review.
We did an experiment using ChatGPT to see whether it could construct a response that would explain a decision. It gave a more human answer than many of the responses that I have seen. It was a challenge to review that, because someone’s accessibility to understanding what they have been told is key. It would be good to see people being given advice about where to go when they ask, “What now?”. I have examples of situations in which children have asked questions and have got answers but they do not know what to do next.
I am sure that we will talk about shared services. However, for me, the issue is about shared functions; it is about how we pass on information and make a route together. Ultimately, freedom of information is an enabling function for many rights; it is not a human right in itself—although there is an argument in that regard, the court says that it is not—but it is a pathway to such rights.
I would like to see how we can develop such pathways. For example, we have done work with the Gypsy Traveller community that aims to engage people and find out how we can give them information. We sometimes need to inspire people by saying, “Here is the advantage in what you are getting.” This is the preserve not of journalists, campaigners or researchers but of the public. Actually, most requests come from members of the public—quite substantially so. We need to engage with them and inspire them.
We are already on the conventional social media platforms, but we are considering whether we should now go on others. I will not be posting on Snapchat or TikTok, but I will ensure that we are on Instagram and exploring different, and perhaps more edgy, communication methods to inspire people to say, “Oh, I didn’t know that” and get their attention in that way. The team have a challenge in front of them, but I am sure that they will do well in it.
I am certainly not going to comment on your choice of ChatGPT as an artificial intelligence platform. It is interesting that, as we contemplate having an environment of positive publication with regard to freedom of information, such AI tools will be able to provide a different nuance to information that currently is quite remote and to get beyond the point of people saying, “I have this—what’s next?”. Your comments on the specific barriers that young people face and the engagement that you are doing to break those down are massively important.
That takes me back to your undertaking to review the strategic plan after 12 months. You have discussed your approach of moving from promoting the idea of freedom of information to highlighting access to it. Is that the extent to which you are reviewing the strategic plan? Now that you have been working under it as it was presented to you, are you confident that it is fit for purpose? Does it reflect where the commission wants to see itself in 12 months’ time?
I am very comfortable with it. The differences will be nuanced. Fundamentally, there is a core role from which our strategy will not vary much. There is perhaps more flexibility on some aspects of the tactical implementation. However, the strategy itself is sound and everything that I do fits into it naturally. Even what I have just said about access to information fits nicely into the proactive publication scheme that we have mentioned, which is fit for purpose. Certain areas might need a bit of strengthening, but there will not be a radical rewrite, that is for sure.
Following on from that, there is the perennial question of “How well is it going?” What are the early indications of success for the strategic plan and the proposals that it contains?
The most obvious one is workload management. The commissioners all have different models, outcomes and outputs. For us, it is actually quite simple if we look at it in quantitative terms. For example, if there is an appeal, we can ask, “How quickly can we deal with it?” We have now moved to a position where we understand our data so well that we are confident enough to put it all on our website. As of a couple of days ago, all elements of our caseload are displayed on the website, which shows exactly where the various parts are in the system. That is important to give transparency—so that I practise what I preach—and to show people what the expectations are and how we are approaching things. It gives people confidence that we are moving through the workload, which is probably the number 1 thing that people ask about.
We also look at the public surveys that we do. Again, those are a helpful bellwether for us, showing whether our approach is working and getting through or whether we need to change our approach to promotion. That is important. We also look at our public authority statistics, which we gather and publish every quarter. We have now put those in a dashboard, so that anyone can find out how their local authority is performing within the sector and geographically. It is an interesting tool that has highlighted deficiencies. For example, we had a concern about environmental information charging in a particular local authority, because it was a standout. Providing access, to show people that we are moving on, fits in nicely with the plan.
My annual report will, of course, fully capture all of those outcomes.
That is helpful.
You talked about the FOI landscape, and you mentioned the legislative challenges. It may well be that, in due course, the Parliament chooses this committee to review the proposed member’s bill on FOI, so I do not want to go into too much depth on it. However, looking at the FOI landscape, are the legislative changes that you think are needed fundamental or are they about process? You have talked about the slippage in confidence around the world in our FOI system as the one to move towards, which it certainly was at the start. At a fairly high level, what changes would aid in making a better FOI landscape in Scotland and perhaps also improve our reputational position as a transparent and open place?
The interesting thing is that something can look like a big thing in the FOI world but, when you look at it from the outside, you think, “What is the point? What is the difference?” It is about small things such as stopping the clock for timing and some of our timescales. In Ukraine, if someone makes an information request that is to do with food, the body has 24 hours to respond—we are sitting at 20 days.
There are different measures for different regimes across the world, but I would say that, although where we sit just now is pretty good, it could be better. A member of our staff has been looking at the legislation in international comparators and setting us against it. There is a United Nations rating and ranking system to measure the regimes. First of all, we think that we are too low and that we should be higher. We should certainly be higher than England, only because our system was meant to be FOI plus—it was meant to be better, so we cannot have a lower score than England. I think that we have the evidence on that, and we are discussing it.
There is also an opportunity for us to be better and to speak to people in other places about what they are doing and how they operate. We were speaking to people from Ghana just last month. Some of the powers in other countries are more significant than the powers that I have. I have seen and been involved in the proposed bill, and it would go some of the way. Obviously, coverage is a huge aspect. I noted with interest that, in South Africa, political parties are subject to FOI—can you imagine?—and so are companies on the Johannesburg stock exchange.
When you look at what is happening elsewhere, you think, “Wow.” There is significant reach in what people can get information on. The days of our thinking that we are pioneers are gone—we cannot rest on our laurels, because the world is moving on. Other countries are adopting better, tighter and more expansive approaches, and we need to keep up with that.
I look forward to further engagement on that if this committee has the pleasure of dealing with the bill.
09:45
I would like to ask about resources. Your strategic plan states that you have
“insufficient resources to meet demand”,
and you sought contingency funding from the Scottish Parliamentary Corporate Body during 2023-24. What activities or functions was that funding for? Why do you consider yourself to be underresourced? What would be a suitable increase to your core funding?
I probably need to go back to the position we were in when I came into the post. As I have reported previously, we had built up a backlog—which was significantly influenced by Covid—because of a lack of resources. We now have a stable model, but we could not go through cases quickly enough to deal with the backlog, so we took the approach of pausing the system and dealing with the situation in two ways.
As of 1 January 2024, all cases were dealt with as soon as they came in. Previously, they would have been put to the back of the queue and we would have waited two years before we even got near them. That was breaking the system. Rather than doing that, we drew a line in the sand and said that everything that came in after that point would be dealt with more quickly than would have been the case in the past. It now takes about 106 days to close a case that we deal with.
Was the money used for additional staffing?
In order to do what I have set out, we had to get additional staffing to help us to bite into that. It was not necessarily about new staff but about resourcing that would allow us to use some experienced investigators in a different way and to take a different approach.
A key element of the plan was additional resourcing, which was provided for a couple of years. The difficulty is that the resourcing is temporary. I am very grateful for it, but it gives no job security for the staff who are doing the work. I have already lost one of those members of staff—an excellent investigator—so we had to recruit a replacement. We have got somebody, who will be starting soon—it is great that we have managed to turn things around quickly—but I am always mindful that two members of staff are sitting on temporary contracts without job security. My worst nightmare is that one of them leaves now, because nobody will want the job for six months, particularly given the amount of lead-in time it takes to train people. That is the challenge.
Was that the first time that the office had applied to the SPCB for extra funding? Do you envisage having to do that again?
There had been contingency funding for other projects but not for staff. It was the first time that we had applied for funding for staff.
Fundamentally, I want us to have a core operating model in which supply matches demand. We do not have that without those additional staff. Once the backlog goes, I clearly will not need those staff to deal with that, but I have the problem that I cannot make interventions. I am trying to see whether we can move things on in that regard, but our budgeting arrangements are less than optimal.
On the point about interventions, you mentioned in your opening remarks that you want to be proactive in investigating systems problems. Will you expand on what “systems problems” are? How realistic is it that you will be able to do that, given that you have said that you are underresourced?
I will ask Claire Stephen to answer that. As the head of policy and information, she runs the monitoring of public authority statistics.
I will explain briefly what we do. In the first instance, we collect quarterly statistics from public authorities on their performance. We combine that data with internal intelligence from our case monitoring system in order to decide whether we need to intervene. At the moment, we generally wait three quarters before we step in to address a performance issue. Obviously, we would like to do that a lot sooner.
We have conducted a number of interventions and we can show that they are successful. For example, we raised NHS Greater Glasgow and Clyde up to a level 3 intervention. For a full year, it was performing at about 56 per cent—that is, 56 per cent of all requests were being responded to on time—which left a large proportion of requests not being responded to or being responded to late. We have asked the health board to put an action plan in place. That has brought the matter to the attention of senior management, and it is now being monitored at that level. The most recent set of statistics from the health board, which relate to October and November, show that it is now responding to 87 per cent of requests on time.
The intervention function gives us the ability to go in and speak to senior management, which tends to be where the difference is made, and we can give them more hints and tips about how to improve performance through performance monitoring and how other authorities go about performing well. That is really valuable. As David Hamilton pointed out, we have limited resource with which to do that, but we do what we can with what we have got.
That is interesting. In the event that an authority did not improve its game after your intervention, do you have any power over anything that happens thereafter?
Yes. For example, after bringing the matter to the attention of the board of NHS Greater Glasgow and Clyde, we monitored it at level 1 for a period of time, waiting to see if it would fix the situation itself. When we saw no improvement, we raised the intervention level to level 3, which is where more resource from our end needs to be applied.
Once the action plan is in place, the body has a period of time in which to resolve the issues, and that tends to be what happens. If the issues are not resolved, we can issue what is called a practice recommendation under the codes of practice. However, at the moment, those do not have legal teeth.
That is what I was wondering. That is useful information.
I understand your concerns about resource restraints and so on, but are you optimistic that you will be able to make progress on the things that you want to do, given the current financial arrangements?
No, I am not optimistic at the moment—in this financial environment, I do not think that anyone could be. I take comfort from the fact that the SPCB is sympathetic and understands the business case that we have put forward. However, it cannot make the commitment that we are looking for.
There are organisations and authorities that are failing—we see them on that trajectory—and we want to step in. We are watching it happen, and it is frustrating that we do not have the resource to jump in and tell people to stop what they are doing and get on top of the problem. Like classic crime prevention, we want to stop the problem before it happens. That is our struggle at the moment and, unless we have that investment, there will be greater expense for the whole system—not just for my office, but for the public authorities, as it costs them money each time there is an appeal.
Would it be possible to share resources with other SPCB-supported bodies? Is that something that you could do?
We have looked into that, of course, but it is such a unique enterprise that there is just no crossover. We have explored what we could do with some of the corporate functions, but, even then, that is not where the pinch point is. Corporate services play a key role in keeping the organisation going, but they are working absolutely flat out themselves. Of course, when you share, you are not getting something free; you have to give something. You might be able to share something, but you also need to give something up in order to get that.
It is give and take.
Often, a lot of emphasis is put on the savings that can be made from shared services, but I think that they are greatly overestimated and that, frankly, from a commissioner’s perspective, it is an unambitious approach.
As you know, the Finance and Public Administration Committee held an inquiry into the commissioner landscape, which you took part in. Can you give us your reflections on that?
I always welcome any kind of scrutiny—all the commissioners do. The challenge is that our functions are not quite understood. Our governance structures are entirely distinct—every commissioner has a different governance structure, which fits the nature of what we are doing.
I think that the Parliament is missing a trick in that it is too narrowly focused on the commissioners. We have a budget of a 30th of 1 per cent of the Scottish consolidated fund, so the possible savings are minuscule. From my perspective, big savings can be made from across the public sector, so the public sector landscape should be being looked at—and also the third sector landscape, because there is an entire supported third sector out there. We should question whether that is providing the best value and how we can best deliver those services.
It is not entirely clear to me what the problem is that others are trying to fix. I do not see a huge amount of possible savings from the commissioners, and there is a danger that there would be collateral damage from lumping us all together. I look forward to the evidence sessions, but more can be done on a wider scale to make savings, although I accept that the committee has its remit to follow.
The initial concern seems to be more about the proliferation of new commissioners, and it seems to me that there is a fairly easy fix for that: do not appoint any more of them. It is radical, but it would fix that problem. However, the nature of democratic politics means that those who are making the decisions have constituencies and that the parties are influenced by people who would like there to be commissioners for all the different interest groups. That is unfortunate, but it is understandable.
I would like to clarify something that you said a minute ago—perhaps I picked it up wrong. Were you suggesting that we should cut public sector and third sector organisations?
No—I think that we should consider them in the review.
Different commissioners have impacts in different areas. My area is not like this, but some of the other commissioners have more of an advocacy role and there is some crossover with the third sector, Government departments and so on. That is from a functional perspective. From a services perspective, I do not think that we should necessarily compartmentalise all the commissioners into one building or another. It should be about where there is space in the public sector for them.
When I came here this morning, I walked past the City of Edinburgh Council building and it was empty. I looked in the window and there were all these spare desks. I do not understand why anyone in the public sector is looking for accommodation from private landlords when we have so many empty public buildings. I think that that aspect is missing and that the review could have been bolder about it—it could probably have gone even further.
That is helpful. Euan McCulloch, do you want to come in?
No, thank you.
Before we move to Sue Webber’s questions, I want to pose a question about your current organisational structure. In the report, you say that you have “a team of 29 people.” One of the sub-notes mentions
“the absence of the Head of Corporate Services”—
we have talked about corporate governance—and it says that
“outstanding Management Assurance has been provided by the Corporate Services Manager.”
Are you confident that the system that is operating at the moment, in the absence of the head of corporate services, matches your current requirements?
I am. It is extraordinary that small organisations have to deal with the same model as big organisations. It seems strange that somebody has to assure me about something that happened at a meeting that I just left with them. That does not make sense. I have spoken to others about this and have asked, “Can I not just self-assure? I was there.” I am hands-on—that is the nature of a small organisation. If I had an organisation of 1,000 people, I could not possibly self-assure and there would be a role for assurance through that funnel, but there is not in my organisation.
10:00
However, under the current system, assurance is provided by others, and you are confident in those assurances that the system matches your requirements.
Yes, the assurance chimes very closely with what I think.
I hope that the chief executive of the City of Edinburgh Council was listening to those remarks. I share your view, Mr Hamilton.
In your opening statement, you mentioned that you have reduced the backlog by 55 per cent, but there is still quite a significant backlog of cases. What is your view on that performance? The reality is that there has been a failure to meet the case-closing target for the third year.
The question, I guess, is whether that was the right thing to do. The feedback from a lot of applicants has been that, yes, it was the right thing to do, but, of course, there are some people who do not think that it was. I think that we are on the right path and that we are making good progress.
We have also taken a different approach in order to preserve the system. That approach has meant that, at the expense of a few cases, the whole system has been able to survive. It would have brought the system utterly into disrepute if people had to wait two years to get an appeal through the system, so a different approach was necessary.
That approach has also been good in that it has allowed us to take the group of backlogged cases and approach those in different ways. From our dashboard, you will see that we are approaching things from different angles. We are trying to deal with some new claims and some old claims, and we are doing a lot more management of claims. A lot of claims have been withdrawn; some people have said, “Actually, I don’t really need that.” No one had ever asked them that before.
So, were people just doing it out of mischief?
Yes, and, again, that has caused delay.
We now have a system whereby, although we have what appears to be a lot of cases—from 2022, for example—there are sometimes multiple cases from the same applicant. Some applicants submit lots of cases. To preserve the system, we say to them, “We are only going to deal with one of yours at a time, because there are a whole lot of other people waiting.” That also forces the applicant to prioritise, and we have a conversation about that. Therefore, there is now a lot more stakeholder management, which has helped us to deal with the backlog. Rather than dealing with cases according to a strict chronology, which is what we do with the other cases, we take a more bespoke approach to the particular situation.
Therefore, we are coming at the work from different angles, with the objective of getting as many cases closed as quickly as possible. We have had some early wins, which, in truth, is probably why we are doing better. We will get round to the other cases. You only need one big complicated case to clog up the system. However, it is when you get 40 cases on one big complicated topic that you get problems—I am thinking about Lochaber. That just slows everybody down.
It is interesting to hear that, because some of my questions were going to be about whether cases are becoming more complex and the effect of increased awareness of FOI. Is there also an element of dissatisfaction with public authorities and their practice around freedom of information? Is that contributing to that persistent issue?
I think that 95,000 FOI requests were made this year; there is a continuing upward trajectory. Our case load has continued to go up. It is typically about 0.7 per cent of the cases in Scotland—that has been static for 20 years—so, as awareness increases, we see the case load increase. However, it also follows the economic cycle, so we see an increase when people think that things are bad. For example, when bus services suddenly get cut, people want to know why that has happened.
It is interesting that some of the things that I expect to be problematic do not become problematic. I expected to see more appeals about Police Scotland’s hate monster campaign, but Police Scotland was on that pretty quickly. It knew that that was going to be contentious, so it was a case of getting that out quickly and managing it.
Equally, with some of the issues that have happened in this building, cases did not really come our way, because the public authorities were on that and said, “This is going to be something, so let’s just get it out there and deal with it.” Sometimes, it is the cases that you do not expect that go on for ever and turn out to be really complicated.
In your opening comments, you spoke about creating a culture of access and the proactive publication of documents.
That is the number 1 thing that a public authority can do to help itself with regard to freedom of information—to put it out in the first place.
You also spoke about trust and the fact that we are not doing so well in the rankings—for example, if people do not trust the information that they get about why a bus service is cut.
To be fair, the rankings are more about legislation and powers. The issue of practicality is a separate aspect. However, the public survey data suggests that people think that that is important and see the value of it.
Euan McCulloch, would you like to comment on that?
Yes. There are issues with applicants’ trust of some public authorities. There is certainly a perception among a core of applicants that the authority should hold information where it does not. Obviously, that leads into records management issues. Once again, we still have the section 61 code, and it would be good to find ways of tackling those things through interventions.
When we see a stream of new applications coming through, that feeds into our intervention work. Those will be flagged up to us, and we will try to address that by making a phone call to stem the number of appeals that are coming to us. That happened recently in relation to the Scottish Fire and Rescue Service. Interventions add real value in terms of upstreaming that work.
Do you get a sense of when you might see that backlog being eliminated?
The funding goes until May 2026. If the backlog is dealt with before then, I will not use it—the promise was that we would use the funding for what we have to deal with. By that time, we might have made a business case around transitioning staff across to intervention. That is my hope, and I think that most people accept that position. The issue simply comes down to financial practicalities. However, for the investment, it represents best value.
It is fair to say that we are continuing to engage with that backlog—it is not just sitting there static. We allocate cases from it, as resources allow, without impacting on the current case load, and we engage with the applicants from time to time.
David Hamilton mentioned withdrawals, and we have recently engaged in a mass communication with the remaining applicants in the backlog. That produced a fair number of firm confirmations that they wish to continue with their cases. On the other hand, a fair number of people did not respond. We will follow that up but, if the applicants are no longer engaged, we may—with some regret, obviously, because the cases have been waiting for some time—explore the possibility of treating those cases as abandoned. That might lead to a reduction in case numbers as well.
Obviously, you have been going into quite a lot of detail around the process. When you have been reviewing the backlog of investigations, have you identified any efficiencies that can be made?
We have certainly reviewed our procedures as part of the process, and we are taking far more of a right-first-time approach with authorities.
For a while, in the early days of the backlog, we asked authorities for their submissions in general terms as soon as the cases passed through validation. That did not produce terribly meaningful submissions even from authorities that were quite experienced in FOI, so we have reverted to asking detailed questions of authorities to obtain more meaningful submissions when the cases are allocated to investigators. Equally, we make it clear at that point that this is their one chance to make a case for whatever they have done with the request at an earlier stage. We will go on to make a decision on the basis of the submissions that we get then. If the submissions are not adequate, that may result in information being disclosed, or, if searches have been inadequate, the authority being required, through a decision notice, to go back and search again.
Excellent. Thank you. I will move on, as I want to ask about some of the communication with Scottish ministers.
Sue, do you mind if I ask for some clarification?
In relation to when the backlog will be extinguished, you have spoken about an ideal situation in which the financial provision allows you to transfer the current investigators. Are you still confident that the backlog will be gone by May next year?
Yes. On the proviso that I do not have—
Unknown unknowns.
—further staff changes, because there is a lead time. It is a very specialist role. If we were to lose one or two members of staff and had to recruit again, that would put us right back to the beginning, which would have an impact on pace. When we are staffed up with experienced people, as we were at the end of last year, we motor. When we are not—
There has been a recent departure. If, once the new person comes in and is up and running, the staffing remains constant, May 2026 is still an achievable date for there to be no backlog.
Yes. I would be confident about that.
Thank you for that.
In your opening statement, you mentioned interventions that were high risk but really important in turning round the culture in organisations. What was the reason behind the increase in intervention activity in 2023-24? You mentioned that that could impact on your delivery of other core functions. Will you expand on that a bit more?
We have always made interventions, some of which have been long running. The Scottish Government one, which goes back to 2017, has taken a lot of resource. It has been a journey, but we are, I hope, getting to the end of it.
We have a second intervention in relation to the Scottish Government, which relates to what came out of the UK Covid-19 inquiry. We have done a lot of the background work on that, but we cannot get near it to write it down and articulate that in a report. We have had a lot of engagement with the Government. We have spoken to Emma Martins about her work—she has produced an excellent report. We have concerns. For example, I do not think that banning WhatsApp will solve anything, but that is something that she will come to.
We have clear ideas and we have things that we need to do, but we do not have the capacity to get into that at the moment. That is causing delay in the system, and it is really frustrating for us all. We want to get that report out for everyone, because it is not a Scottish Government problem—it is a public authority problem. It is for everyone. It just so happens that the Scottish Government was het, as it was at the inquiry. I can assure you that, had you gone into any public authority, you would have seen that everyone was using and making decisions on WhatsApp. They should not have been doing that or, if they were, they should have been recording it properly.
This is a much wider problem. We want to be able to report on that and to make some practice recommendations, but we simply cannot get near that, because we have so many other crocodiles that are closer to the canoe.
Resource means people to you, does it not?
Yes, resource is people.
There is also the question of expertise. You have already outlined some of that. That also goes back to what you said at the beginning—that Scotland’s reputation for transparency is slipping. The delay and the inability to progress those things do not help with that, either, do they?
They do not. Again, we are trying to balance lots of things; we have thrown a lot into the air that we need to keep moving. It is an incredible testament to my staff that they manage to keep the whole thing going, because people are paddling like crazy under the water in order to do that.
I genuinely believe that there is a reputational risk for Scotland. As we have stopped designating, things have stalled. When the Freedom of Information (Scotland) Act 2002 was introduced, it was expected that a growing number of organisations would be designated; that was meant to happen regularly. I do not think that we are in a position that is at all tolerable in terms of what the public expect from public authorities, particularly in a changing landscape of governance and structures. We did not have all these different organisations, including leisure trusts and those in the care sector, involved. That has all changed. The system has to keep up, but it is not doing so.
As you have said, it is a very complex and growing space. How often do public authorities or any of the organisations that you have mentioned engage with you to improve their practice? Are they doing that?
That is probably more Claire Stephen’s sphere.
10:15
We do a variety of work. We constantly engage with public authorities, and we have network groups that we attend to share practice among public authorities. We do our intervention work when we can, and we monitor performance through statistical returns. For example, this year, we did a series of webinars through which practitioners were invited to come along and learn about our new approach to investigations.
We try to be as proactive as possible when we make changes and to share good practice. We have monthly newsletters going out, and we have practitioner events and conferences every year. We try as much as possible to share good practice among public authorities. We have a good relationship with practitioners—there is a good relationship with the regulator and with us.
How does the commissioner decide whether to undertake specific intervention activity? To what extent does that take place in response to your identifying a failure to follow good practice?
As I mentioned briefly, we monitor the quarterly statistics returns. We also monitor any practice issues that come through our case-handling system and any inquiries—sometimes, people come to us directly to raise concerns. We then analyse all of that data to identify where there are practice issues.
We then make a decision, at senior management team level, on whether to open an intervention if we have the resources to do so, or to just continue to monitor that authority until such time as we have to step in. As I said, resource features heavily in that decision making.
In addition, there will be the odd case where we identify something individually that is sufficiently serious that we have to make an immediate intervention.
Do you want me to go on to do the next little bit, convener?
I was going to pass over to Joe FitzPatrick.
Okay, and then will I come back in.
Yes.
Thank you.
Cool.
Before I cover the questions that I was going to ask, I want to ask about proactive release, which you talked about earlier. Ultimately, proactive release is one of the tools that will help the landscape to become easier to navigate. In the past, there has been a suggestion that perhaps that could lead to information dumps, which would make things really difficult. You mentioned AI. Might artificial intelligence assistants take away the risk of an information dump, because those tools can go through screeds of stuff and pull out what people want in an accessible way?
I have never subscribed to the idea of an information dump, because there are things called search engines, which are quite helpful. Essentially, a search engine is an artificial intelligence—it is an assistive technology.
Technologies are now coming through that can summarise and give people the information that they want. However, guardrails need to be in place for the things that you do not want to go out, such as private data. I do not ever want to see, and I do not think that there ever will be, a situation in which a machine is deciding on what information can be given out in response to an information request. Ultimately, that will come back on the authority. The legislation is fairly clear on that, whether it involves a machine or a human, and I do not think that any authority will put its trust in a machine getting it right every time. We are a long way away from that.
However, I see the potential for assistive technology in summarising and looking at things, as you say. As long as it goes back to reference points, I am pretty comfortable with that. It is an exciting area. The amount of data that is held in the world at the moment is something like 490 zettabytes, which is 10 to the power of 27, and that will increase fivefold by the time that I demit office. There is nothing to suggest that the trend in the public sector in Scotland should be any different to that. We will see more and more data being held, and it needs to be managed.
Records management is a colossal challenge. The bit where I come in is to do with how organisations find their way through that data. If they are doing that exercise, they might as well allow anyone to do it. There are some quite good examples from the Scottish Environment Protection Agency. I think that 40 per cent of its applications are from consultants, and it is considering whether it can help them to self-serve, because they know what they are doing and could work things through. Therefore, there are opportunities.
That sounds really good. It sounds as though we should be encouraging that, because, if people could get that information, it could save organisations money and save you from having to complain.
In your opening remarks, you said that you are funding practice interventions from core funding. Obviously, it is hoped that practice interventions will reduce demand later, so there will be a bit of a pay-off. I will give you the opportunity to say whether you are seeing that benefit from your cases.
The Scottish Government is a great example in that regard. It would be fair to say that, when we started off, its performance was not particularly good—it would accept that itself—but its performance has changed greatly. On average, 97 per cent of its requests are responded to in time, whereas the figure had been down in the 70s. That goes back to 2017, so it was not just to do with Covid. The way in which the Scottish Government has turned around its performance on freedom of information has been transformational.
That comes down to leadership, particularly by the permanent secretary, who has made freedom of information an issue in the organisation. At the end of last year, he invited me to speak to all the Scottish Government directors. I said that they were doing a great job, because the freedom of information system is now ingrained in every civil servant I meet. It is monitored, and directors are held accountable for it. We need to see that type of leadership and model across the public sector.
That is good. However, if that does not work, you have various levels of intervention. Will you give us a wee outline of how the interventions differ in resource intensity?
I will ask Claire Stephen to do that, because that is her area of expertise.
We have four different levels of intervention. Level 1 relates to a simple failure to follow good practice. A member of our staff might have picked up an issue with case handling, for example, so they might pick up the phone and speak to the practitioner to address that issue—it might be something to do with the content of their notices, or they might have miscalculated the statutory timeframe. Level 1 interventions involve quick and easy wins.
If the issue is more ingrained, there will be a level 2 intervention, which is for practice failure. A member of our staff will raise the issue at chief executive level to try to get it addressed.
Level 3 interventions are for more serious and systematic practice failures. The commissioner will contact the chief executive and require a detailed action plan to be put in place. There will be continued monitoring and communication on our part with that authority. That can last in excess of a year before practice is turned around, so level 3 interventions are when real resource issues are created for us.
Level 4 interventions vary in relation to the resource requirements. They could be very resource intensive. The only one that we have had involved a discrete issue that we were able to turn around fairly quickly, but it involved quite serious contact with the authority.
Level 3 interventions are the ones that have the best impact, but continuing to monitor an authority requires a substantial amount of our resources.
Can you provide an update on the level 2 interventions relating to Midlothian Council, SEPA and CES?
The intervention relating to Midlothian Council had been at level 1, but it was raised to level 2. The council is making good progress. Its legal services manager provided us with a soundbite—they told us that our intervention has “changed behaviours”. They were very thankful for our intervention, and their department got the resources that it needed to turn practice around. We are looking to close that intervention shortly, because the council is responding to in excess of 85 per cent of requests on time.
You also asked about SEPA. We closed that intervention in December, having opened it in December 2020, after the cyber incident. It was a unique set of circumstances, and access to information was one of the issues that it was grappling with—it was quite a serious incident for the organisation.
When we were able to start collecting statistics from SEPA, it was responding to only 14 per cent of requests on time and had built up a substantial backlog. We supported SEPA in developing strategies on how to deal with the backlog and how to start improving performance and, in December, David Hamilton met with the chief executive to formally close the intervention after SEPA consistently responded to more than 90 per cent of requests on time over a period of four to five months. It has dealt with its backlog and has changed its culture in that it is looking towards more proactive publication and a more sustainable regime. It has identified that request numbers are continually going up, so the regime has to be sustainable. That is a good news story, and the experience with SEPA was a positive one.
What was the other organisation that you asked about?
Western Isles Council.
That involved another cyber incident. We were able to put the council in contact with SEPA to get some advice and learning from its experience. We are working on getting key information on to its website and building up practice. Again, we have had a rather positive dialogue with the council, and we will continue to support it until we are satisfied that it has a sustainable regime.
It is good to hear about that progress, and it is good that we are able to shed light on what is happening because there is an intention to expand the scheme and people are terrified of being covered, so we need to help them not to be scared about what is coming and ensure that they realise that this is not just good in terms of public information but will be good for those organisations themselves.
Everyone in a public authority who goes through the experience comes out having had a positive experience and feels that they were supported. “Intervention” sounds quite aggressive and intrusive but, as you can see, two of the organisations were digitally on their knees when we first got in touch with them, and we supported them with what they can and cannot do and assured them that we were not going to give them a hard time, because we understood their situation.
Time after time, we have seen organisations that have low rates of response turning their positions around. I note that an organisation that was the subject of one of our previous interventions actually got an FOI award for its performance. An organisation that was failing winning an FOI award is a great news story.
Claire Stephen also mentioned level 1 interventions. Through those, we can make an impact on the front line, albeit in small steps, through casework at the earliest stages of an investigation. A lot of that casework is dealt with by our validation officers as cases come in, in contact with the authorities’ own FOI staff. I do not think that we should underestimate the impact that that approach can have.
Prevention over cure.
I was interested in Claire Stephenson’s comment that Midlothian Council used the intervention to acquire additional resource.
Yes, that is quite common.
Sue Webber wants to come back in.
Mr Hamilton, you mentioned that there were two level 3 interventions with the Scottish ministers. You provided some information about that, but could you say what you would have expected the Scottish Government’s performance to be at this point, in order to allow the intervention that began in 2017 to conclude?
That intervention is in its last stage. We are at the assessment stage, so, having decided that we are content with the quantitative aspect, we are reviewing on a qualitative basis to see whether the process is working properly.
We are doing a retrospective review of the last quarter to see how things have gone. It is our hope that we will be satisfied at that point and can close off the intervention by springtime this year.
Can you shed any light on the reasons for the process being so protracted?
10:30
To be fair, it has been a bit of a journey. At the start, things got better. Then Covid hit and things got bad, and things stayed bad after Covid. We had to put a bit of accelerant on the flames to bring that process back up.
You seem to be encouraging things with your hand actions.
That is exactly what I was trying to do, yes. [Laughter.]
It was very much my predecessor who was involved in that, and a lot of learning has come out of the process. We are now seeing an entirely different approach and system being used in the civil service, which is quite impressive. There are always cases that stand out—I am not mentioning the elephant in the room. However, normally, the vast majority of cases—6,000 a year—are dealt with.
I will come back to something else that you mentioned, and I will use the term “brand free”, because it is quite amusing. Can you provide an overview of the intervention that relates to the use of non-corporate messaging tools and an idea of how lengthy a process that intervention is likely to be? You have already shared some of your frustrations around that.
In truth, we would have liked to have been further down the road than we are with that, but, quite simply, it is a resourcing issue. We have to balance the demands across the organisation. We cannot just stop doing something, because there are too many interlinked things going.
The Emma Martins review was very useful, and we had good engagement with Emma. At first, I thought that her recommendations were good, but, on reflection, I think that they are very good. She dealt a lot with the cultural aspect, which is what this issue is about. There is a danger in focusing on specific technologies, because technologies change, so it has to be about principles. One of the things that the FOI legislation is very strong on is information held. That information can be held on paper, on a server, in the cloud or on your work phone; it can also be on your personal phone, because, if it relates to the business, it is information held. That broad definition is very helpful.
For example, in relation to, I think, an observatory on racial equality, it was announced that it would be FOI exempt because it would not hold the data on its servers—or rather, people were saying, “We’ll hold it for them but it’s not our data.” If someone is holding data, we are probably getting into the territory where that approach is not going to work.
The piece of work on where information is held will be reinforced by that. However, ultimately it is about behaviours. WhatsApp and other non-formal messaging platforms are, for me, more about replacing conversation than they are about replacing email. We have always worked on the basis that if, for example, I had a conversation that I should record and which should be part of my official record but I do not record it, that is on me and I am at fault. Similarly, with WhatsApp, the key thing, and what I am interested in, is that that information is recorded. I want to ensure that people can understand how decisions were made and why things happened—not just have a conversation or a WhatsApp conversation and record it; it must be more than that.
There is a bit of work to be done on that, which we really want to get right. We want to ensure that the approach is applicable to all platforms and that it is sustainable. The Emma Martins review was very good on the behavioural aspect. Her report was strong on that, and we want to see how we can embrace that.
The process needs to be sustainable and clearly understood.
Yes, absolutely. The process must also be workable, because water finds the easiest route. If we do not give people platforms that are usable, they will find other ways of doing things. I am very conscious that the approach must be pragmatic. I hate not being able to use a technology that would make my life easier because it has been interpreted in the wrong way.
You will be glad to know that we are coming to the end of the session.
Interestingly, that leads on to an issue that I wanted to mention: the section 60 code of practice. I note that that is a code rather than anything else. Earlier, you spoke about the Scottish Government’s engagement on that. We have also talked about the legislative challenges.
The section 60 code can be updated and it will, I hope, be updated. Do you see that as an answer, not to some of the legislative problems but to the cultural need to change understanding about FOI, which we have discussed? Am I putting too much emphasis on the code as a possible short-term answer to that? Will it be achievable in the near future?
“Near future” is not a phrase that I associate with freedom of information—perhaps I would if we were in Narnia.
The section 60 code provides an avenue for making productive changes. Again, the issue is when that work will come through. It is moving slowly and it is in a queue. I do not hold out great hope that we will see anything in the near future. However, it is a route for change. You never know—it might even be overtaken by a member’s bill, in which case we would probably have to look at the whole thing again, which could be interesting.
Certain things could be in the code, and we have certainly fed into the review. The consultation work on that, whenever that happens, will be interesting.
Thank you for that. If anything comes to mind after this session, please feel free to write or to contact the clerks about it.
I highlight the penultimate paragraph in your opening statement, which I found really interesting. This is the 20th anniversary of the 2002 act coming into force. Maybe it should not have passed its 10th anniversary. As we have touched on in relation to a number of matters, there is a need for proactive publication of information. We live in a digital age, we have AI—whatever that means, and it means different things to different people—and the landscape is changing very rapidly. There seems to be a need for us to consider that as soon as the Parliament is able to.
I thank Euan McCulloch, Claire Stephen and especially David Hamilton for their attendance today and look forward to engaging in the future.
Thank you very much.
I close the public part of the meeting.
10:37 Meeting continued in private until 11:38.Air ais
Cross-Party Groups (Compliance)