Response

On 27 February 2024 you requested that the Authority review this decision. The decision has been reviewed by an independent reviewer, SPA Solicitor, who was not involved in the original decision-making process.

For the avoidance of doubt, the associated Subject Access Request is outwith the scope of this review which is necessarily restricted to consideration of the recent FOI request.

I can confirm that the original decision is upheld for the following reasons.

The Authority issued a refusal notice in terms of section 18(1) of the Freedom of Information (Scotland) Act 2002 (“FOISA”), refusing to confirm or deny whether it holds any information falling within the scope of the Applicant’s FOI request. It is the Authority’s position that, if it holds any information falling within the scope of the request, it would be exempt from disclosure under section 38(1)(a) of FOISA as this information would constitute personal data of which the Applicant is the data subject.

I am satisfied that any information which the Authority may hold which falls within the scope of the request would indeed be exempt from disclosure in terms of section 38(1)(a) insofar as it would constitute personal data – as defined in section 3(2) of the Data Protection Act 2018 - relating to the Applicant.

I have therefore gone on to consider whether the Authority was entitled to conclude that it would be contrary to the public interest to disclose whether the information sought by the Applicant exists or is held by the Authority (as required in terms of section 18(1) FOISA). The rationale provided by the Authority is that information which is disclosed under FOISA is disclosed into the public domain and the public interest overwhelmingly lies in protecting individuals’ right to privacy.

I agree that any personal data disclosed under FOISA is deemed to be placed into the public domain. In my view the act of confirming or denying whether the information exists or is held by the Authority would have the effect of disclosing personal data. This would result in the Authority breaching its obligations and duties as a data controller under data protection legislation.

Accordingly, I am satisfied that the disclosure by the Authority of whether the information sought by the Applicant exists or is held by the Authority would indeed be contrary to the public interest.

You also requested case references. This information is not held by the Authority, and therefore the original decision to provide notice of this under section 17 of FOISA is upheld.