Enforcement Strategy
The Scottish Information Commissioner’s Enforcement Strategy
Version 1 May 2008
The Freedom of Information (Scotland) Act 2002 (FOISA) and the Environmental Information (Scotland)
Regulations 2004 (the EIRs) both came fully into force in 2005. Three years have passed since the two sets of
legislation were implemented and this has given Scottish public authorities sufficient time to learn about
FOISA and the EIRs, and to put in place adequate systems and resources to fulfil their responsibilities under
these regimes when responding to information requests.
Generally authorities have shown a positive approach to embracing and implementing FOISA and the EIRs.
However, there is evidence of poor practice by some authorities, sometimes repeatedly so. It is the
Commissioner’s intention to take a measured but vigorous approach to dealing with those authorities which
do not fully comply with their responsibilities. This Enforcement Strategy addresses the Commissioner’s duty
to promote good practice, together with the powers of enforcement available to him.
Promoting good practice
Under section 43 of FOISA, the Commissioner has a duty to promote the following of good practice by
Scottish public authorities in relation to FOISA and the EIRs, and the provisions of the associated codes of
practice. The Commissioner expects that all Scottish public authorities will have adequate and appropriate
resources and systems in place to deal with information requests under both regimes. It is recognised that
some authorities are very efficient and effective in dealing with requests where others are less so. The
Commissioner does, however, expect all Scottish public authorities to take their responsibilities seriously and
to maintain a high standard in responding to requests for information, including the provision of timeous and
adequate responses and the carrying out of suitable and thorough reviews.
The Commissioner will continue to provide authorities with advice and support in relation to their
performance, but will also take corrective action where necessary, for example through the use of Practice
Recommendations, where he considers it appropriate to require specific changes in practice which can be
expected to benefit the public and the authority (or authorities generally).
Through promoting good practice the Commissioner aims to:
•
•
•
•
help Scottish public authorities to improve performance;
promote openness and transparency in Scottish public authorities;
bring about a culture of willing compliance;
deliver benefits for both users of FOI and public authorities.
The factors driving good practice
Good practice can be achieved in a number of different ways, not just through the direct intervention of the
Commissioner.
Internal continuous development
Scottish public authorities can monitor and improve their compliance with FOISA and the EIRs through
reviewing their own experience of handling and responding to information requests and taking account of any
relevant decisions issued by the Commissioner. Appropriate advice should be obtained where there is still
doubt. Training for staff should be kept up to date and should be provided to staff who have joined since
FOISA/the EIRs came into effect. Such measures, along with obtaining appropriate advice and consulting with
applicants and citizens, are all valuable contributions to improving performance, transparency and
accountability.
Intervention by the Commissioner
Where it comes to the Commissioner’s attention that there are incidences where Scottish public authorities
are (or may be) persistently or seriously failing to meet the standards of good practice expected of them, the
Commissioner may intervene and take appropriate action. Any intervention taken will be proportionate to
the failing (or potential failing) on the part of the authority concerned. The interventions or actions that the
Commissioner can take include:
•
•
•
•
•
•
•
•
the provision of specific or general advice or guidance;
general or specific media comment;
negotiation;
practice assessment/audit;
Information Notices;
Practice Recommendations;
Enforcement Notices;
special reports to the Scottish Parliament.
The Commissioner’s overall approach to intervention
This Enforcement Strategy follows on from the briefings the Commissioner has issued to provide advice on
the interpretation and application of the various exemptions in FOISA and exceptions in the EIRs, which take
into account the experience which has been gained through the operation of both regimes (and in particular
the substantial body of decisions issued by the Commissioner since 2005).
It is the Commissioner’s intention to build on the positive developments that have occurred in Scottish public
authorities as a consequence of the implementation of FOISA and the EIRs. The Commissioner is now ready
to take a pro-active approach to monitoring the performance and compliance of those authorities. The focus
of the Commissioner’s enforcement work will be on improving authorities’ overall behaviour and culture,
rather than on the specifics of individual cases (unless these exhibit such serious examples of non-compliance
as would warrant consideration of broader practice issues) or punishing past failures. Individual applications
on specific cases will, of course, continue to be investigated by the Commissioner in the usual way.
2
However, past performance of Scottish public authorities will be taken into account in determining whether
those authorities are continuing to fail to meet their responsibilities and identifying appropriate action.
Working with authorities to improve performance in this way should give added benefit for all, by reducing
the number of complaints against those authorities.
Examples of relevant practice issues
The following are examples of areas where practice issues may arise:
•
•
•
•
•
•
•
•
•
•
•
•
Improper charging of fees or inadequacy of fees notices
Inadequacy of search
Failure to comply with statutory timescales
Failure to advise and assist applicants
Inadequacy of refusal or other notices
Failure to explain review or appeal procedures
Failure to carry out review adequately (or at all)
Inadequate staff training
Failure to adopt a publication scheme
Failure to make information in a publication scheme available
Failure to actively and systematically disseminate information (EIRs)
Records management failures including:
o failure to assign strategic responsibility;
o inadequate strategy, policy or procedures;
o inadequate destruction arrangements;
o inadequate management of electronic files.
Intelligence sources
The Commissioner will employ and utilise a range of methods (individually or in combination) to identify
potential Scottish public authorities for intervention and the type of intervention that appears appropriate in
the circumstances. Potential methods will include:
•
•
•
•
•
•
sector based research;
questionnaire and other exercises to gather data on public authority practices;
evidence gathered from dealing with complaints about public authorities;
evidence gathered from carrying out investigations into public authorities’ practices;
practice assessments/audits to measure public authorities’ compliance with FOISA, the EIRs , the
related codes of practice and their own procedures; and
Information Notices.
3
A selective approach
The Commissioner will take a responsible and proportionate approach to dealing with actual and potential
failures in following good practice. While the Commissioner will, wherever possible, seek to work in
conjunction with authorities to resolve issues and recommend the best course of action to remedy failings
where these are identified, there will be occasions where a more robust approach may be warranted,
particularly in the case of sustained or more serious failings. The factors the Commissioner will take into
account when determining what action is appropriate will include:
•
•
•
•
•
the number of times an authority has (or appears to have) failed to comply in a given area;
the nature and severity of the non-compliance(s);
evidence held by the Commissioner about the practices of the authority in question;
whether, in the circumstances, it would be more appropriate to take action in respect of a
particular public authority or a public authority sector;
the impact any action will have on the authority, other public authorities, service users and/or the
wider public, weighed against any potential benefits.
Guiding principles
In drawing up this Enforcement Strategy, the Commissioner has taken account of the six principles which are
set out in the Cabinet Office Enforcement Concordat. The Concordat (the adoption of which by regulatory
bodies is encouraged by the Scottish Ministers) sets out principles which should be followed by such bodies
when carrying out enforcement functions. Broadly, the principles are:
•
•
•
•
•
•
setting clear standards;
providing information and advice clearly;
working with regulated bodies to ensure compliance;
providing effective and accessible complaints procedures;
taking an approach to compliance which is proportionate to the risks involved;
carrying out the relevant duties in a fair, equitable and consistent manner.
Practice assessments
The Commissioner has the power to assess whether a Scottish public authority is following good practice.
Initial selection of authorities for assessment is likely to come from taking a cross section of public authorities
covered by FOISA and the EIRs. Assessments are also likely to be carried out where the Commissioner has
received a number of related complaints about an authority’s practices, or where it has come to the
Commissioner’s attention during an investigation, a series of investigations or otherwise that the authority is
not fulfilling its responsibilities and an assessment is warranted. Responses made to a questionnaire or similar
self-assessment given to the authority for completion might also form the basis for identifying which
authorities should be subject to an assessment.
4
An assessment may be carried out through correspondence, by asking the authority written questions and
obtaining copies of procedures and records, or by visiting the authority and conducting an on-site assessment
(reviewing the authority’s own procedures and its compliance with these, and carrying out interviews with
key staff). Where the Commissioner is carrying out an assessment in relation to compliance with the Section
61 Records Management Code of Practice, the assessment will be carried out following consultation with the
Keeper of the Records of Scotland. Following an assessment there are a number of possible outcomes,
including (individually or in combination):
•
•
•
•
no further action required;
agree an action/improvement plan with the authority and a timescale for implementing required
changes;
issue a Practice Recommendation;
issue an Enforcement Notice.
Practice Recommendations
Where the Commissioner considers that the practice of a Scottish public authority does not meet the
requirements of the codes of practice issued under sections 60, 61 or 62 of FOISA (i.e. the codes of practice
regulating both FOISA and the EIRs), he has the power to issue a Practice Recommendation to the authority
in question. It is likely that a Practice Recommendation will be issued where there have been persistent or
frequent breaches of the relevant code(s) of practice, or where there has been a particular breach which is so
severe that it warrants firm action.
A Practice Recommendation will be in writing and will specify the code and the provisions of that code with
which, in the Commissioner’s opinion, the authority’s practice does not conform. The Practice
Recommendation will also set out the steps the Commissioner considers the authority should take in order
to conform to the relevant code(s) of practice.
Where the Commissioner intends to issue a Practice Recommendation in respect of a breach of the Section
61 Record Management Code of Practice, there is a requirement that consultation takes place between the
Commissioner and the Keeper of the Records of Scotland prior to that Practice Recommendation being
issued.
The Commissioner will consider the following criteria when determining whether a Practice Recommendation
is required:
•
•
•
•
•
•
The outcome of any practice assessment that has been undertaken in respect of the authority
Evidence held by the Commissioner in respect of the practices of the authority
Evidence held by the Commissioner concerning complaints made, or matters raised during the course
of an investigation, giving cause for concern regarding the authority’s practices
The number of recorded and relevant practice failures by the authority
The nature and severity of these non compliances
The outcome of such further investigation as may be required
The Commissioner will monitor public authorities to ensure that actions raised in a Practice Recommendation
are implemented by the authority concerned and may, where he considers it appropriate to do so, take
further action.
5
Enforcement Notices
Where the Commissioner is satisfied that a public authority has failed to comply with a provision of Part 1 of
FOISA, or with any of the provisions in the EIRs, then the Commissioner has the power to give an
Enforcement Notice to that public authority requiring the authority to take steps to comply with that
provision.
It is likely that an Enforcement Notice will be used where the authority has systematically failed to comply
with any relevant provision in Part 1 of FOISA or in the EIRs, or where a particular non compliance is so
severe that it warrants firm and immediate action. It may also be used in relation to a failure to comply with
the requirements of a Practice Recommendation.
An Enforcement Notice must contain information setting out:
•
•
•
•
the provision(s) in Part 1 of FOISA or in the EIRs with which the Commissioner is satisfied that the
authority has not complied;
the respects in which the Commissioner believes that the authority has not complied with the relevant
provision(s);
the steps that the authority must take and the timescale for doing so, in order to comply with the
relevant requirements;
details of the authority’s right of appeal.
Enforcement Notices may be served where a public authority has failed to adopt a publication scheme or
where it fails to make information available in accordance with this scheme, as required in sections 23 and 24
of FOISA.
The Commissioner will consider the following criteria when determining whether to issue an Enforcement
Notice:
•
•
•
•
•
•
•
Systematic, frequent or particularly serious non-compliance with Part 1 of FOISA or with the EIRs
Evidence that obligations are being deliberately or persistently ignored or not taken sufficiently
seriously
Evidence that the requirements of a Practice Recommendation have not been complied with, where
there is a breach of Part 1 of FOISA or of the EIRs.
Evidence collected during the course of a practice assessment on a public authority, where this
identifies failure to comply with particular provisions in Part 1 of FOISA, or any provisions of the EIRs
Failure to adopt a publication scheme
Failure to make information available in accordance with the authority’s publication scheme
The outcome of such further investigation as may be required
6
Decision notices
Where the Commissioner has received an application for a decision under section 47(1) of FOISA (i.e. a
decision as to whether a Scottish public authority has dealt with the applicant’s request for information in
accordance with Part 1 of FOISA or with the EIRs), he may identify issues relating to the authority’s broader
practice in the course of the subsequent investigation. Where the Commissioner finds that there has been a
breach of a provision of Part 1 of FOISA or of the EIRs as a consequence of a failure in practice, he will deal
with that breach in his decision on the application, specifying in the decision any steps the authority is
required to take to comply with the relevant FOISA requirements.
Transparency policy
Practice Recommendations and Enforcement Notices issued by the Commissioner will generally be published
on the Commissioner’s website, with additional media publicity where appropriate. Appropriate information
concerning ongoing practice assessments, and the outcomes of completed practice assessments, will also be
made publicly available.
For more information contact:
The Scottish Information Commissioner
Kinburn Castle, Doubledykes Road, St Andrews KY16 9DS
01344 464610
@
[email protected]
www.itspublicknowledge.info
7