Freedom of Information (Scotland) Act 2002
In forceAn Act of the Scottish Parliament giving any person a right of access to information held by Scottish public authorities, regulated by the Scottish Information Commissioner. It shares FOIA's architecture but is not a copy: several prejudice-based exemptions require substantial prejudice, a higher bar than FOIA, and the public interest test must be completed within the same 20 working days, because there is no public interest extension. The most misunderstood point is jurisdiction: a UK-wide authority operating in Scotland stays under FOIA 2000.
Identity
- Citation
- Freedom of Information (Scotland) Act 2002, asp 13
- Jurisdiction
- United Kingdom
- Regime
- Freedom of information
- Applies to
- Scotland
- Type
- Primary legislation
- Structure
- 7 Parts: access, exempt information, the Commissioner, enforcement, historical records, codes of practice, miscellaneous
- Main commencement
- 2005-01-01
The right of access came into force on 2005-01-01. The time for compliance provisions were modified by the Freedom of Information (Scotland) Act 2002 (Time for Compliance) Regulations 2016 (SSI 2016/346) from 2016-12-01.
Reads together with
- EIRS 2004
Section 39(2) exempts environmental information so that the EIRS apply instead.
- Data Protection Act 2018 and UK GDPR
Section 38 routes the requester's own data to subject access and applies the data protection principles to third-party data. Data protection stays UK-wide and is regulated by the Information Commission.
- Section 60 code of practice
Scottish Ministers' code on discharging FOISA functions, enforceable through practice recommendations (s.44).
Structure
What each Part or Chapter does, and the provisions worth knowing inside it. An orientation to the shape of the instrument, not a substitute for reading the official text.
Part 1: Access to information held by Scottish public authorities
The right of access, time limits, fees, vexatious requests, advice, refusal and review.
- s.1 General entitlement to information held by a Scottish public authority.
- s.2 Absolute exemptions and the public interest test for the rest.
- s.3 and Sch 1 Which bodies are Scottish public authorities.
- s.5 Designation of further bodies.
- s.10 Comply promptly and by the 20th working day; no public interest extension.
- s.12 Excessive cost of compliance.
- s.14 Vexatious or repeated requests.
- s.15 Advice and assistance.
- s.16 Refusal notices.
- s.17 Notice that information is not held.
- ss.20 and 21 Requirement for review and the authority's review.
Part 2: Exempt information
The exemptions, listed below with their tests.
- ss.25 to 41 Exemptions, several using a substantial prejudice test.
Part 3: The Scottish Information Commissioner
Appointment, functions and practice recommendations.
- s.44 Practice recommendations for non-conformity with the codes.
Part 4: Enforcement
Applications to the Commissioner and the notices that follow.
- s.47 Application for a decision.
- s.49 Decision notices.
- s.50 Information notices.
- s.51 Enforcement notices.
- s.52 Exception from duty to comply with certain notices (First Minister's certificate).
- s.53 Failure to comply referred to the Court of Session.
- s.55 No civil proceedings.
- s.56 Appeal to the Court of Session on a point of law.
Parts 5 to 7
Historical records, codes of practice and miscellaneous provisions, including the s.65 offence.
- s.60 Code of practice on discharging functions.
- s.61 Code of practice on records management.
- s.65 Offence of altering records with intent to prevent disclosure.
- s.73 Interpretation, including working day.
Asymmetry checklist
Ten questions every profile answers explicitly. "None found" means the point was examined and the instrument has nothing distinctive on it.
| # | Point | Finding | Notes |
|---|---|---|---|
| 1 | Territorial extent | Asymmetry found | Scotland only, and only Scottish public authorities. UK-wide authorities operating in Scotland are under FOIA 2000. Freedom of information is devolved, the reverse of data protection, so Scotland has its own Act and Commissioner. |
| 2 | Commencement | None found | Fully in force since 2005-01-01. The time for compliance provisions were modified by SSI 2016/346 from 2016-12-01, without changing the 20 working day standard. |
| 3 | Sunset / mandatory review | None found | No sunset or statutory review clause. Coverage has been widened by designation orders under s.5 rather than by review. |
| 4 | Criminal liability | Asymmetry found | One offence, s.65: altering, defacing, blocking, erasing, destroying or concealing a record with intent to prevent disclosure after a request. Summary only, fine not exceeding level 5. |
| 5 | Civil liability | None found | None. The Act gives no right of civil proceedings for failure to comply (s.55). The routes are review by the authority, application to the Commissioner, and appeal to the Court of Session on a point of law. |
| 6 | Regulatory enforcement toolkit | Asymmetry found | No monetary penalties. Decision, information and enforcement notices (ss.49 to 51) and practice recommendations (s.44). Failure to comply can be referred to the Court of Session and dealt with as contempt (s.53). The First Minister can certify an exception from certain notices (s.52). |
| 7 | Personal / director liability | Asymmetry found | The s.65 offence can be committed by the authority and by any person employed by it, an officer of it or subject to its direction. |
| 8 | Public vs private sector split | Asymmetry found | Public sector only: bodies in Schedule 1, bodies designated under s.5, and publicly-owned companies. Designation orders have extended coverage to some bodies delivering public services. |
| 9 | Legal-person coverage | Asymmetry found | Any person may request, including companies and campaign groups. |
| 10 | Exemptions, with their conditions | Asymmetry found | Part 2 exemptions are absolute or subject to the public interest test. Several prejudice-based exemptions require substantial prejudice, a higher threshold than FOIA. The public interest test must be completed within the 20 working day limit; unlike FOIA s.10(3), there is no extension for it. |
Criminal liability
A distinct track, separate from the regulatory penalties below. The same failure can attract both: a penalty notice against the organisation and a prosecution of the individual.
s.65: Altering etc. records with intent to prevent disclosure
Where a request has been made and the applicant would have been entitled to the information, it is an offence for the authority, or a person employed by it, an officer of it or subject to its direction, to alter, deface, block, erase, destroy or conceal a record held by the authority with the intention of preventing its disclosure.
- Mens reaMens reaThe mental element an offence requires, such as intention, knowledge or recklessness. Most DPA 2018 offences need knowledge or recklessness.Defined in: General criminal law
- Intention to prevent disclosure
- Penalty
- Fine not exceeding level 5 on the standard scale; summary only
- Imprisonment
- Not available
Civil liability
No civil proceedings (s.55). Review by the authority, then application to the Scottish Information Commissioner, then appeal on a point of law to the Court of Session.
- s.47 application
Scottish Information Commissioner : Within six months of the review outcome or deadline.
- s.56 appeal
Court of Session : On a point of law only.
Regulatory enforcement
- Penalty ceiling
- No monetary penalties. Non-compliance referred to the Court of Session as contempt (s.53).
- Decision notice s.49
Decides an application and can require disclosure.
- Information notice s.50
Requires information for an investigation.
- Enforcement notice s.51
Requires steps to comply with Part 1.
- Practice recommendation s.44
Recommends conformity with the codes.
Personal / director liability
- Available
- Yes
- Basis
- s.65
Employees, officers and anyone subject to the authority's direction can be prosecuted personally.
Legal-person coverage
- Covers legal persons
- Yes
Any person may request, including legal persons.
Public / private sector split
- Separate regimes
- Yes
Scottish public authorities only.
- Schedule 1
Listed Scottish public authorities.
- s.5 designation
Bodies designated by the Scottish Ministers.
- Publicly-owned companies
Companies wholly owned by Scottish public authorities.
Exemptions
Recorded with their trigger conditions, not as bare names, most are conditional tests applied case by case rather than blanket carve-outs.
s.25, Information otherwise accessible
Trigger
Absolute. The applicant can reasonably obtain the information other than by requesting it.
s.26, Prohibitions on disclosure
Trigger
Absolute. Disclosure is prohibited by an enactment, incompatible with a Community obligation preserved in law, or would be contempt of court.
s.27, Information intended for future publication
Trigger
Subject to the public interest test. Held with a view to publication within 12 weeks of the request, and reasonable to withhold until then; also covers ongoing research programmes.
s.28, Relations within the United Kingdom
Trigger
Subject to the public interest test. Disclosure would, or would be likely to, prejudice substantially relations between administrations in the UK.
s.29, Formulation of Scottish Administration policy
Trigger
Subject to the public interest test, class-based. Information held by the Scottish Administration relating to policy formulation, ministerial communications, Law Officers' advice or a ministerial private office.
s.30, Prejudice to effective conduct of public affairs
Trigger
Subject to the public interest test. Disclosure would, or would be likely to, prejudice substantially the free and frank provision of advice or exchange of views, or the effective conduct of public affairs.
s.31, National security and defence
Trigger
Subject to the public interest test. Required for safeguarding national security, or disclosure would prejudice substantially defence.
s.32, International relations
Trigger
Subject to the public interest test. Disclosure would prejudice substantially international relations, or confidential information from another State or international organisation.
s.33, Commercial interests and the economy
Trigger
Subject to the public interest test. Trade secrets, or disclosure would prejudice substantially commercial interests or the economic interests of the UK or the Scottish Administration.
s.34, Investigations and proceedings
Trigger
Subject to the public interest test, class-based. Information held for criminal investigations and proceedings, and certain other investigations.
s.35, Law enforcement
Trigger
Subject to the public interest test. Disclosure would prejudice substantially the prevention or detection of crime, the administration of justice or other listed functions.
s.36(1), Legal professional privilege (confidentiality of communications)
Trigger
Subject to the public interest test. Information in respect of which a claim to confidentiality of communications could be maintained in legal proceedings.
s.36(2), Information provided in confidence
Trigger
Absolute. The information was obtained from another person and disclosure would constitute an actionable breach of confidence.
s.37, Court records
Trigger
Absolute. Information held only by virtue of documents filed with, or created by, a court or tribunal for proceedings.
s.38, Personal information
Trigger
Absolute for the applicant's own personal data and for third-party data where disclosure would contravene the data protection principles; other limbs subject to conditions.
The applicant's own data is handled as subject access under UK-wide data protection law.
s.39, Health, safety and the environment
Trigger
Subject to the public interest test. Disclosure would, or would be likely to, endanger health or safety; s.39(2) routes environmental information to the EIRS.
s.40, Audit functions
Trigger
Subject to the public interest test. Disclosure would prejudice substantially an audit function.
s.41, Communications with Her Majesty and honours
Trigger
Subject to the public interest test. Communications with the Royal Family and Household, and honours.
s.12, Excessive cost of compliance
Trigger
Not an exemption: a ground for refusal where the cost of complying exceeds the prescribed amount. Advice and assistance should be offered (s.15).
s.14, Vexatious or repeated requests
Trigger
Not an exemption: a ground for refusal where the request is vexatious or repeats a recent identical or substantially similar request.
Interactions and conflicts
The cross-instrument texture that profiling an Act in isolation misses, including where the real answer to a question about this Act is found in a different one.
| Instrument | Relationship | Note |
|---|---|---|
| Freedom of Information Act 2000 | Cross-reference | UK-wide authorities stay under FOIA even for information about Scotland. Do not use a FOIA template for a FOISA response without checking each step. |
| EIRS 2004 | Cross-reference | Environmental information is routed to the EIRS by s.39(2). |
| Data Protection Act 2018 | Reads with | Section 38 applies UK-wide data protection law, regulated by the Information Commission, inside a FOISA request regulated by the Scottish Information Commissioner. |
Tools, maps and checklists for this instrument
Which access regime applies?
Route an information request to the right law and regulator: subject access, FOIA, EIR, FOISA or the Scottish EIR.
Scottish FOI and EIR response (FOISA 2002, EIRS 2004)
Work a request to a Scottish public authority, under FOISA 2002 or, for environmental information, the EIRS 2004.
Explainers
- Who counts as a public authority for FOI and the EIR?Public authorities
- What is the public interest test in FOI?Public interest test
- When can an authority refuse an FOI request on cost?Cost limit
- What is a vexatious request?Vexatious requests
- What is an internal review, and when must an authority carry one out?Internal review
- What is a publication scheme, and who needs one?Publication scheme
- Does FOIA or FOISA apply to a Scottish body?FOIA or FOISA
- How do you complain or appeal about an FOI response?Complaints and appeals
Activities this instrument governs
| Activity | Role here | Provisions |
|---|---|---|
| Requests for a person's own data | Interacts | s.38 |
| FOI requests for someone else's personal data | Primary | s.38 |
| Requests for environmental information | Interacts | s.39 |
Codes of practice and guidance
- Scottish Ministers' code of practice on FOISA functionsStatutory code, FOISA 2002 s.60
- Scottish Ministers' code of practice on records managementStatutory code, FOISA 2002 s.61
Regulators, tribunals and prosecutors
- Scottish Information CommissionerRegulator for FOISA 2002 and the EIRS 2004 for Scottish public authorities. No data protection role.
- Court of SessionScotland's supreme civil court. Hears appeals on points of law from the Scottish Information Commissioner, and data protection compensation claims in Scotland.
Sources
- Primary Freedom of Information (Scotland) Act 2002 (asp 13) legislation.gov.uk
- Primary Freedom of Information (Scotland) Act 2002, section 10 legislation.gov.uk
- Regulator Scottish Information Commissioner Scottish Information Commissioner
Updated