The Scottish Information Commissioner’s Enforcement Strategy Version 1 May 2008
The Freedom of Information (Scotland) Act 2002 (FOISA) and the Environmental Information (Scotland) Regulations 2004 (the EIRs) both came fully into force in 2005. Three years have passed since the two sets of legislation were implemented and this has given Scottish public authorities sufficient time to learn about FOISA and the EIRs, and to put in place adequate systems and resources to fulfil their responsibilities under these regimes when responding to information requests. Generally authorities have shown a positive approach to embracing and implementing FOISA and the EIRs. However, there is evidence of poor practice by some authorities, sometimes repeatedly so. It is the Commissioner’s intention to take a measured but vigorous approach to dealing with those authorities which do not fully comply with their responsibilities. This Enforcement Strategy addresses the Commissioner’s duty to promote good practice, together with the powers of enforcement available to him.
Promoting good practice
Under section 43 of FOISA, the Commissioner has a duty to promote the following of good practice by Scottish public authorities in relation to FOISA and the EIRs, and the provisions of the associated codes of practice. The Commissioner expects that all Scottish public authorities will have adequate and appropriate resources and systems in place to deal with information requests under both regimes. It is recognised that some authorities are very efficient and effective in dealing with requests where others are less so. The Commissioner does, however, expect all Scottish public authorities to take their responsibilities seriously and to maintain a high standard in responding to requests for information, including the provision of timeous and adequate responses and the carrying out of suitable and thorough reviews. The Commissioner will continue to provide authorities with advice and support in relation to their performance, but will also take corrective action where necessary, for example through the use of Practice Recommendations, where he considers it appropriate to require specific changes in practice which can be expected to benefit the public and the authority (or authorities generally). Through promoting good practice the Commissioner aims to:
• • • •
help Scottish public authorities to improve performance; promote openness and transparency in Scottish public authorities; bring about a culture of willing compliance; deliver benefits for both users of FOI and public authorities.
The factors driving good practice
Good practice can be achieved in a number of different ways, not just through the direct intervention of the Commissioner. Internal continuous development Scottish public authorities can monitor and improve their compliance with FOISA and the EIRs through reviewing their own experience of handling and responding to information requests and taking account of any relevant decisions issued by the Commissioner. Appropriate advice should be obtained where there is still doubt. Training for staff should be kept up to date and should be provided to staff who have joined since FOISA/the EIRs came into effect. Such measures, along with obtaining appropriate advice and consulting with applicants and citizens, are all valuable contributions to improving performance, transparency and accountability. Intervention by the Commissioner Where it comes to the Commissioner’s attention that there are incidences where Scottish public authorities are (or may be) persistently or seriously failing to meet the standards of good practice expected of them, the Commissioner may intervene and take appropriate action. Any intervention taken will be proportionate to the failing (or potential failing) on the part of the authority concerned. The interventions or actions that the Commissioner can take include:
• • • • • • • •
the provision of specific or general advice or guidance; general or specific media comment; negotiation; practice assessment/audit; Information Notices; Practice Recommendations; Enforcement Notices; special reports to the Scottish Parliament.
The Commissioner’s overall approach to intervention
This Enforcement Strategy follows on from the briefings the Commissioner has issued to provide advice on the interpretation and application of the various exemptions in FOISA and exceptions in the EIRs, which take into account the experience which has been gained through the operation of both regimes (and in particular the substantial body of decisions issued by the Commissioner since 2005). It is the Commissioner’s intention to build on the positive developments that have occurred in Scottish public authorities as a consequence of the implementation of FOISA and the EIRs. The Commissioner is now ready to take a pro-active approach to monitoring the performance and compliance of those authorities. The focus of the Commissioner’s enforcement work will be on improving authorities’ overall behaviour and culture, rather than on the specifics of individual cases (unless these exhibit such serious examples of non-compliance as would warrant consideration of broader practice issues) or punishing past failures. Individual applications on specific cases will, of course, continue to be investigated by the Commissioner in the usual way. 2
However, past performance of Scottish public authorities will be taken into account in determining whether those authorities are continuing to fail to meet their responsibilities and identifying appropriate action. Working with authorities to improve performance in this way should give added benefit for all, by reducing the number of complaints against those authorities.
Examples of relevant practice issues
The following are examples of areas where practice issues may arise:
• • • • • • • • • • • •
Improper charging of fees or inadequacy of fees notices Inadequacy of search Failure to comply with statutory timescales Failure to advise and assist applicants Inadequacy of refusal or other notices Failure to explain review or appeal procedures Failure to carry out review adequately (or at all) Inadequate staff training Failure to adopt a publication scheme Failure to make information in a publication scheme available Failure to actively and systematically disseminate information (EIRs) Records management failures including: o failure to assign strategic responsibility; o inadequate strategy, policy or procedures; o inadequate destruction arrangements; o inadequate management of electronic files.
The Commissioner will employ and utilise a range of methods (individually or in combination) to identify potential Scottish public authorities for intervention and the type of intervention that appears appropriate in the circumstances. Potential methods will include:
• • • • • •
sector based research; questionnaire and other exercises to gather data on public authority practices; evidence gathered from dealing with complaints about public authorities; evidence gathered from carrying out investigations into public authorities’ practices; practice assessments/audits to measure public authorities’ compliance with FOISA, the EIRs , the related codes of practice and their own procedures; and Information Notices.
A selective approach
The Commissioner will take a responsible and proportionate approach to dealing with actual and potential failures in following good practice. While the Commissioner will, wherever possible, seek to work in conjunction with authorities to resolve issues and recommend the best course of action to remedy failings where these are identified, there will be occasions where a more robust approach may be warranted, particularly in the case of sustained or more serious failings. The factors the Commissioner will take into account when determining what action is appropriate will include:
• • • • •
the number of times an authority has (or appears to have) failed to comply in a given area; the nature and severity of the non-compliance(s); evidence held by the Commissioner about the practices of the authority in question; whether, in the circumstances, it would be more appropriate to take action in respect of a particular public authority or a public authority sector; the impact any action will have on the authority, other public authorities, service users and/or the wider public, weighed against any potential benefits.
In drawing up this Enforcement Strategy, the Commissioner has taken account of the six principles which are set out in the Cabinet Office Enforcement Concordat. The Concordat (the adoption of which by regulatory bodies is encouraged by the Scottish Ministers) sets out principles which should be followed by such bodies when carrying out enforcement functions. Broadly, the principles are:
• • • • • •
setting clear standards; providing information and advice clearly; working with regulated bodies to ensure compliance; providing effective and accessible complaints procedures; taking an approach to compliance which is proportionate to the risks involved; carrying out the relevant duties in a fair, equitable and consistent manner.
The Commissioner has the power to assess whether a Scottish public authority is following good practice. Initial selection of authorities for assessment is likely to come from taking a cross section of public authorities covered by FOISA and the EIRs. Assessments are also likely to be carried out where the Commissioner has received a number of related complaints about an authority’s practices, or where it has come to the Commissioner’s attention during an investigation, a series of investigations or otherwise that the authority is not fulfilling its responsibilities and an assessment is warranted. Responses made to a questionnaire or similar self-assessment given to the authority for completion might also form the basis for identifying which authorities should be subject to an assessment.
An assessment may be carried out through correspondence, by asking the authority written questions and obtaining copies of procedures and records, or by visiting the authority and conducting an on-site assessment (reviewing the authority’s own procedures and its compliance with these, and carrying out interviews with key staff). Where the Commissioner is carrying out an assessment in relation to compliance with the Section 61 Records Management Code of Practice, the assessment will be carried out following consultation with the Keeper of the Records of Scotland. Following an assessment there are a number of possible outcomes, including (individually or in combination):
• • • •
no further action required; agree an action/improvement plan with the authority and a timescale for implementing required changes; issue a Practice Recommendation; issue an Enforcement Notice.
Where the Commissioner considers that the practice of a Scottish public authority does not meet the requirements of the codes of practice issued under sections 60, 61 or 62 of FOISA (i.e. the codes of practice regulating both FOISA and the EIRs), he has the power to issue a Practice Recommendation to the authority in question. It is likely that a Practice Recommendation will be issued where there have been persistent or frequent breaches of the relevant code(s) of practice, or where there has been a particular breach which is so severe that it warrants firm action. A Practice Recommendation will be in writing and will specify the code and the provisions of that code with which, in the Commissioner’s opinion, the authority’s practice does not conform. The Practice Recommendation will also set out the steps the Commissioner considers the authority should take in order to conform to the relevant code(s) of practice. Where the Commissioner intends to issue a Practice Recommendation in respect of a breach of the Section 61 Record Management Code of Practice, there is a requirement that consultation takes place between the Commissioner and the Keeper of the Records of Scotland prior to that Practice Recommendation being issued. The Commissioner will consider the following criteria when determining whether a Practice Recommendation is required:
• • • • • •
The outcome of any practice assessment that has been undertaken in respect of the authority Evidence held by the Commissioner in respect of the practices of the authority Evidence held by the Commissioner concerning complaints made, or matters raised during the course of an investigation, giving cause for concern regarding the authority’s practices The number of recorded and relevant practice failures by the authority The nature and severity of these non compliances The outcome of such further investigation as may be required
The Commissioner will monitor public authorities to ensure that actions raised in a Practice Recommendation are implemented by the authority concerned and may, where he considers it appropriate to do so, take further action. 5
Where the Commissioner is satisfied that a public authority has failed to comply with a provision of Part 1 of FOISA, or with any of the provisions in the EIRs, then the Commissioner has the power to give an Enforcement Notice to that public authority requiring the authority to take steps to comply with that provision. It is likely that an Enforcement Notice will be used where the authority has systematically failed to comply with any relevant provision in Part 1 of FOISA or in the EIRs, or where a particular non compliance is so severe that it warrants firm and immediate action. It may also be used in relation to a failure to comply with the requirements of a Practice Recommendation. An Enforcement Notice must contain information setting out:
• • • •
the provision(s) in Part 1 of FOISA or in the EIRs with which the Commissioner is satisfied that the authority has not complied; the respects in which the Commissioner believes that the authority has not complied with the relevant provision(s); the steps that the authority must take and the timescale for doing so, in order to comply with the relevant requirements; details of the authority’s right of appeal.
Enforcement Notices may be served where a public authority has failed to adopt a publication scheme or where it fails to make information available in accordance with this scheme, as required in sections 23 and 24 of FOISA. The Commissioner will consider the following criteria when determining whether to issue an Enforcement Notice:
• • • • • • •
Systematic, frequent or particularly serious non-compliance with Part 1 of FOISA or with the EIRs Evidence that obligations are being deliberately or persistently ignored or not taken sufficiently seriously Evidence that the requirements of a Practice Recommendation have not been complied with, where there is a breach of Part 1 of FOISA or of the EIRs. Evidence collected during the course of a practice assessment on a public authority, where this identifies failure to comply with particular provisions in Part 1 of FOISA, or any provisions of the EIRs Failure to adopt a publication scheme Failure to make information available in accordance with the authority’s publication scheme The outcome of such further investigation as may be required
Where the Commissioner has received an application for a decision under section 47(1) of FOISA (i.e. a decision as to whether a Scottish public authority has dealt with the applicant’s request for information in accordance with Part 1 of FOISA or with the EIRs), he may identify issues relating to the authority’s broader practice in the course of the subsequent investigation. Where the Commissioner finds that there has been a breach of a provision of Part 1 of FOISA or of the EIRs as a consequence of a failure in practice, he will deal with that breach in his decision on the application, specifying in the decision any steps the authority is required to take to comply with the relevant FOISA requirements.
Practice Recommendations and Enforcement Notices issued by the Commissioner will generally be published on the Commissioner’s website, with additional media publicity where appropriate. Appropriate information concerning ongoing practice assessments, and the outcomes of completed practice assessments, will also be made publicly available.
For more information contact: The Scottish Information Commissioner Kinburn Castle, Doubledykes Road, St Andrews KY16 9DS 01344 464610 @ firstname.lastname@example.org www.itspublicknowledge.info