Alistair Sloan, Advocate

When Privilege Gives Way: The First-tier Tribunal on Public Interest Disclosure

May 28th, 2026

I have recently written about two different FOI appeals where the thorny issue of legal privilege arose. The first was an appeal to the Court of Session under the Freedom of Information (Scotland) Act 2002 and the second was an appeal to the Upper Tribunal in relation to a request made under the Freedom of Information Act 2000 (“FOIA”). Both of those cases served to highlight the near impenetrability of legal privilege. However, last week the First-tier Tribunal (FtT) issued a decision in which it refused an appeal by the Cabinet Office against a decision of the Information Commissioner ordering it to release information subject to legal privilege.

Background and the Reuqest

On 5 December 2023 the requester made a request for information to the Cabinet Office requesting a copy of legal advice provided in or around March 2020 to ministers, including then then Cabinet Office Minister Lord Gove (as he now is), addressing the legislative basis on which the Government could or should order the first lockdown instituted in March 2020. In addition, Mr Kingsley requested related ancillary communications such as a record of any meeting in which the advice was provided to or discussed with ministers.

The request for information followed on from evidence that Lord Gove had given, on 28 November 2023, to the UK Covid-19 inquiry. The relevant passage of Lord Gove’s evidence is included within the FtT’s decision (at paragraph 6). The relevant passage of evidence came from a chapter considering why the Government proceeded under the Public Health (Control of Disease) Act 1984 and then the Coronavirus Act 2020 rather than the Civil Contingencies Act 2004. Lord Gove referred in his evidence to a debate had with government lawyers about whether the pandemic was unforeseen and that the general view was that the pandemic might not have met the threshold of having been unforeseen.

In his request for information, Mr Kingsly argued that privilege had been waived and therefore section 42 of FOIA could not apply. Mr Kingsly argued, in his initial request, that this was the case because Lord Gove had revealed the main substance or gist of the legal advice in question in a public forum and that had put “the content of the advice at issue by referencing it to explain the state of mind of key decision-makers at that time.”

The Cabinet Office replied to the request for information on 5 February 2024 confirming that it held the advice but applying section 42 to the content of the advice. The Cabinet Office also relied on section 35(1)(b) of FOIA as well. This refusal was upheld at internal review, and Mr Kingsly made a complaint to the Information Commissioner.

Information Commissioner’s Decision Notice

On 4 November 2024, the Information Commissioner issued a decision notice in which he concluded that privilege had not been waived and therefore section 42 of FOIA did apply; however, the Commissioner concluded that the public interest favoured disclosure.

Appeal to the First-tier Tribunal

The Cabinet Office appealed the Commissioner’s decision to the FtT under section 57 of FOIA. During the proceedings, the Cabinet office disclosed a redacted version of advice from the lawyers acting for the Department of Health and Social Care dated 15 March 2020.

Before the FtT there were two issues. The first related to the question of whether privilege had been waived. Mr Kingsly contended that it had while the Commissioner and the Cabinet Office contended that it had not. The second issue before the FtT was if privilege had not been waived does the public interest in maintaining the exemption outweigh the public interest in disclosing the withheld information.

Waiver of Privilege

The first issue was whether Lord Gove’s answer to the questions put to him at the Covid-19 Inquiry amounted to a waiver of privilege; this was logically the first issue to consider as if privilege had been waived then the exemption could not apply. More of the relevant chapter of evidence before the Inquiry is contained at [43]-[45] of the FtT’s decision.

The FtT divided its analysis of this issue into two separate questions. The first considered whether the concept of a waiver of privilege applied in the context of an Inquiry and, secondly, if so, whether the oral evidence of Lord Gove amounted to a waiver on the facts of the case.

In relation to the first of these two questions, the FtT held that “legal privilege is capable of being waived in evidence given before an Inquiry.” [49] The Cabinet Office had sought to distinguish between the adversarial nature of litigation, in which a party deploys evidence in order to gain an advantage over another party to the litigation, and the more inquisitorial nature of an inquiry where evidence is given in order to assist he inquiry and not to seek to gain an advantage over an opposing party. [51]

The FtT accepted that “cherry picking and fairness” were important considerations in relation to whether privilege has been waived through evidence given in proceedings which are adversarial; however, they do not operate as absolutes. Whether privilege has been waived in any context, the FtT considered, is an exercise which is acutely fact sensitive. The fact that Lord Gove’s evidence was given during proceedings which were inquisitorial, rather than adversarial, was relevant context for that assessment but was not determinative. [52]

Having concluded that it is possible to waive privilege through the giving of evidence to a statutory inquiry such as the Covid-19 Inquiry, the FtT turned to the question of whether Lord Gove had, in fact, waived privilege.

The argument advanced by the requester was that Lord Gove had revealed the main substance of the advice in his public evidence, had done so in a public forum and put the content of the advice at issue by referencing it to explain the state of mind of individuals who had been key decision-makers at the time. All of this, Mr Kingsly, argued amounted to a waiver of privilege by Lord Gove.

The Cabinet Office argued that a conclusion that the short statement of Lord Gove to the Covid-19 inquiry relied upon amounted to a waiver of privilege would be irrational. Lord Gove made no reference to legal advice and he substance of any legal advice had not, in fact, been revealed. The Cabinet office further argued that there had been no reliance by Lord Gove on the legal advice nor had there been any “cherry-picking”. The Cabinet office submitted, following a closed session during which the relevant advice was considered, that the contents of the legal advice supported the submissions on the issue of waiver.

The Commissioner argued that a passing reference, such as the one made by Lord Gove in his evidence to the inquiry, did not amount to waiver of privilege. The Commissioner contended that the context of an inquiry is different from an adversarial process and therefore there could be no unfairness or cherry-picking concerns. Lord Gove referred to a debate, but there was no indication as to whether this was an oral or written debate. Furthermore, Lord Gove did not refer to any reasoning that might have been provided in the legal advice.

The FtT concluded that, in his evidence, Lord Gove was not referring to either of the two pieces of legal advice at issue in the appeal. [59] Even if the FtT had been satisfied that Lord Gove had been referring to either or both of the pieces of advice at issue, it would have reached the conclusion that Lord Gove’s evidence did not reveal the substance or gist of the advice. [59] The FtT explained, at [59], that:

“In reaching this conclusion we have found that the exchange between Lord Gove and Counsel at the Inquiry related to the issue of why the Government did not use the CCA as opposed to the PHA or, later, the Coronavirus Act. This is plain from reading the whole of the exchange found at page 364 of the bundle, rather than just the few lines of the extract referred to in the Request. In this context, it is clear that the particular section of the exchange alighted upon by the parties, and being of most relevance, is referencing the threshold in the CCA for the passing of subordinate regulations. This is not a case in which the non-adversarial nature of Inquiries weighs materially in our analysis, as it may have done in other scenarios. This is not because there is no significance to the fact that the evidence was provided in inquisitorial rather than adversarial proceedings, or that Lord Gove was not seeking to ‘cherry-pick’ or advance a case, but rather, it is because the answer to the issue posed of the Tribunal can be swiftly identified by duly analysing the terms of the two pieces of legal advice, properly set in the context of the evidence given by Lord Gove.”

The FtT therefore concluded that there had been no waiver of privilege through Lord Gove’s evidence to the Covid-19 inquiry. [61]

Public interest balancing exercise

The FtT then went on to consider where the public interest balance rested in relation to withheld information and started with the factors in favour of maintaining the exemption. The FtT started by considering the inherent weight in the public interest in the non-disclosure of information to which privilege applies. At [70], the FtT stated:

“We, therefore, accept that the in-built public interest in non-disclosure of information otherwise protected by legal professional privilege carries significant weight, which will be considered in the balancing exercise. However, whilst in the common law context there is no requirement to engage in a balancing exercise once it is found that legal professional privilege is engaged, ostensibly because legal professional privilege is seen as the predominant public interest, this is not the position under FOIA. Parliament has chosen not to make section 42 an absolute exemption and, although significant weight must be accorded to the exemption, it must not be so heavy so as to effectively be elevated into an absolute exemption”

The FtT also had regard to the fact that the legal advice in question had been recently provided at the time of the request and remained live. At paragraph 77, the FtT stated:

“Having taken this into account we, nevertheless, attach little weight to the fact that the advice is recent and live. This was an advice produced in a matter of days very early on in the Pandemic. Furthermore, although the Legal Advice formed part of the material relating to discussions which led to such constitutionally significant political decisions, at the time of the CO’s response, most of the Coronavirus Act had expired and the restrictions in regulations made under the PHA had been repealed or revoked, with the last major update occurring in April 2022 – although we do also take cognisance of the fact that the CCA and PHA were, and are, still live pieces of legislation. Additionally, significant post-implementation learning had taken place between the date of the Legal Advice and the date of the CO’s response to Mr Kingsley. Even if there had been no subsequent learning, if the Legal Advice were to be disclosed to the public now, this would not remove it from the knowledge bank. No reason has been advanced as to why, in the event of a future emergency, the Government of the time could not draw upon this advice, if it were thought appropriate to do so, despite it having been disclosed to the world at large. Mr Hargreaves specifically accepted that this was so under cross-examination.”

Turning to the question of the so-called “chilling effect” that disclosure would have, the FtT attached “no material weight” to it. [84]

Turning to the public interest factors in favour of disclosure, the FtT stated that “it is difficult to imagine a more constitutionally significant act than the imposition on people’s lives imposed by the Covid restrictions. There can be no doubt as to the breadth of individual freedoms that this legislation impinged upon. There was, of course, also a significant financial cost the country as a consequence of the Pandemic lockdown measures.” [106]

The FtT continued by stating that the “value of disclosure lies in the opportunity it provides to the public to better understand the decision making process that took place regarding one of, if not the most, constitutionally significant acts in living memory.” [107]

The evidence of the Cabinet Office’s witness appears to have been of significance in the FtT’s conclusions. The FtT took the view that “the evidence given by Mr Hargreaves as to the role played by Parliament in the scrutiny, or lack of scrutiny, in the Regulations implemented pursuant to the PHA, does not operate at all to reduce the public interest in the debate as to why the CCA was not used as the appropriate legislative vehicle. Although not relevant to our conclusions in this appeal, we venture to suggest that anyone interested in that debate may, reading the terms of Mr Hargreaves evidence to this Tribunal, conclude that the evidence stokes the fire of the public debate, rather than helps extinguish it.” [112]

The Cabinet Office had sought to rely upon the explanations given by the Government as a factor that reduced the public interest in disclosure of the withheld information in this case. The FtT was not convinced. It stated:

“Contrary to the CO’s contention, we do not accept that, on the evidence before us, the ‘explanations’ relied upon by the CO weaken the public interest or value in transparency. Much of the evidence referred to relates to the implementation of the Coronavirus Act and not the initial decision to issue regulations under the PHA rather than the CCA. We note the ‘explanations’ also include reference to a severe risk of legal action if the CCA route were utilised, and to the need for the CCA to have been changed in order to make it usable. Insofar as the evidence impinges on the debate as to why the PHA was chosen as the relevant vehicle at the outset, rather than the CCA, we are entitled to take account of the fact that Lord Gove adopted, in his evidence to the Inquiry, a legal threshold that does not appear in the CCA. There is also an observation regarding the short life span of any CCA regulations, and reference to the CCA being designed to deal with unanticipated events. When this evidence is duly analysed in the round, we do not accept that it provides the necessary clarity of rationale for the Government’s decision making that would lead us to find that there should be reduced weight attached to the public interest factor of transparency that weighs in favour of disclosure. In addition, just because a debate cannot be authoritatively decided one way or another does not mean it without value – this is complex landscape and the Legal Advice assists with the debate.” [123]

The FtT was not persuaded that the fact that the Covid-19 inquiry was ongoing at the time of the request for information materially reduced the weight to be attached to the public interest in transparency and scrutiny of the government’s decision making. [130]

The FtT went on to state that: “[d]rawing all of this together, we do not accept the CO’s position that “[T]he main purpose that the public disclosure of the Legal Advice has already been served by alternative means that do not intrude upon the fundamentally important LPP rights”. We, further, do not accept that the features relied upon by the CO in this regard materially diminish the public interest in transparency, i.e. allowing the public to better understand the decision-making process that took place regarding one of, if not the most, constitutionally significant acts in living memory.” [132]

While it recognised the in-built public interest in withholding information to with legal professional privilege applied “commands significant weigh”, the First-Tier Tribunal had “no doubt that this is one of those rare cases where, in all the circumstances of the case and having undertaken the intensely fact sensitive evaluative judgment, the public interest in disclosing the information outweighs the public interest in maintaining the exemption.” [135] It found that the cumulative weight of the features it had identified in favour of disclosure as being very significant. [135]

Comment

As had been made clear by the Court of Session and the Upper Tribunal in the two recent cases that I have written about, there will be situations where the public interest in disclosure, while rare, will be stronger than the public interest in maintaining the confidentiality of legal advice. In this case the FtT undertook a careful balancing exercise and, by some margin it would seem, found that this was one of those rare cases in which the public interest in disclosure outweighed the public interest in maintaining the exemption.

The FtT’s decision was only given last week and so at the time of writing the time for the Cabinet Office to seek permission to appeal to the Upper Tribunal has not expired. It therefore remains possible that this case will proceed to the Upper Tribunal. However, such appeals can only be on a point of law and so the Cabinet Office would need to identify some arguable error of law on the part of the FtT rather than it simply disagree with the balancing exercise undertaken by the FtT in relation to the public interest.

_{Disclaimer: This article is for information purposes only and nothing in it should be taken as constituting legal advice.}
Non-Compliance Comes at a Cost: Upper Tribunal hands out a £15,000 fine

May 25th, 2026
The Upper Tribunal (Lady Poole and Upper Tribunal Judge Wikeley) has published its decision in Cleasby v University of Exeter and The Information Commissioner, in which the Upper Tribunal has fined the University of Exeter £15,000 after a case was certified to it by the First-tier Tribunal. This fine is in relation to the University’s failure to comply with a substituted decision notice issued by the First-tier Tribunal for more than a year after the date on which it ought to have complied with it.

The applicant, Mr Cleasby, had made a request for information to the University of Exeter on 31 October 2022. In response to that request for information, the University of Exeter disclosed some information but withheld other information. The Information Commissioner agreed with the University and Mr Cleasby appealed to the First-tier Tribunal. The University did not participate in the proceedings before the First-tier Tribunal. On 30 January 2024, the First-tier Tribunal issued its decision which contained a substituted decision notice in terms of section 58(1) of the Freedom of Information Act 2000 requiring disclosure of the withheld information within 42 days of the date on which the decision was sent to the University. The University of Exeter was therefore required to make disclosure by 12 March 2024.

The University of Exeter did not comply with the First-tier Tribunal’s substituted decision notice, and an application was made by Mr Cleasby to the First-tier Tribunal for it to certify a case to the Upper Tribunal. As part of that application, the First-tier Tribunal issued two sets of directions giving the University an opportunity to make observations in relation to Mr Cleasby’s application, neither of which were complied with by the University. Eventually, the University of Exeter entered the proceedings, but this was only to make two applications to the First-tier Tribunal to have Mr Cleasby’s application to certify struck out. The first application was made on 5 December 2024 and was dismissed by the First-tier Tribunal on 7 January 2025. The second strike-out application was made on 21 January 2025 which was eventually dismissed by the First-tier Tribunal on 27 March 2025.

After making the second strike-out application, but before it was dismissed by the First-tier Tribunal, the University of Exeter disclosed to Mr Cleasby one further document, which was a minute of a meeting which had taken place in October 2022. There was no admission by the University at this stage that it had failed to comply with the substituted decision notice made by the First-tier Tribunal. The University did not produce the withheld information nor did it provide any witness evidence to be considered y the First-tier Tribunal.

On 27 March 2025, the First-tier Tribunal certified the case to the Upper Tribunal for it to consider the exercise of its powers in relation to contempt of court. On 8 May 2025, more than a year after it should have complied with the substituted decision notice, the University of Exeter wrote to Mr Cleasby producing the withheld information and apologised to him. On 16 May 2025, the University wrote to the Upper Tribunal with copies. Further correspondence took place between the University of Exeter and Mr Cleasby in which the University, among other things, invited Mr Cleasby to withdraw his certification application. Mr Cleasby, concerned by the University’s apparent culture towards information requests, refused to do so. Mr Cleasby is recorded as having described the University’s attitude to the disclosure of information as “cavalier, evasive and entitled.” [5]

The University finally began to engage with the proceedings and provided to the Upper Tribunal a witness statement from its General Director of Legal and Student cases. The University identified four errors it had made, which are as follows and are set out at [6] of the Upper Tribunal’s decision:
1. The University had erroneously believed that because it had not been party to the proceedings before the First-tier Tribunal the decision was not binding upon it and therefore the Information Commissioner required to issue some kind of direction.
2. The University had wrongly considered that disclosure of minutes of meetings listing attendees was sufficient, which it had provided, overlooking the detail of the request for information.
3. The University had believed, mistakenly, that personal data of non-University individuals fell to be redacted.
4. The University wrongly thought, at one point, that it no longer held relevant information.
Before the Upper Tribunal, the University accepted that it was in contempt, a concession that the Upper Tribunal considered to have been well made. [13] Although it had not been party to the proceedings before the First-tier Tribunal, the University had been obliged to comply with the terms of the decision notice (as explained by the Upper Tribunal in Information Commissioner v Moss and the Royal Borough of Kingston on Thames [2020] UKUT 174 (AAC)). The First-tier Tribunal’s decision stated expressly that it was a substituted decision; it was therefore “inexplicable, inexcusable and disrespectful that the University thought a further decision was required from the [Information Commissioner] before it had to disclose the withheld information.” [13] Although based on erroneous beliefs, the failure by the University to comply with the decision of the First-tier Tribunal was the result of deliberate choices made by the University. [13]

In assessing the seriousness of the contempt, the Upper Tribunal was concerned by the University’s behaviour in the proceedings before the First-tier Tribunal. Instead of properly reading the decision of the First-tier Tribunal and taking appropriate legal advice, the University “relied on inadequate internal systems and insufficiently informed staff.” [14] The University proceeded on the basis of assumptions that it was not required to comply with the decision of the First-tier Tribunal which were “inexplicable” [14]. Instead of properly engaging with the proceedings before the First-tier Tribunal, the “University sought on two separate occasions to strike out the certification proceedings, wrongly maintaining it had produced all information required of it.” [14]

The Upper Tribunal accepted that the University was not motivated by an animus against the First-ter Tribunal nor was its conduct deliberately designed to flout the order of the First-tier Tribunal. However, its behaviour was “characterised by high level incompetence, inexcusable mistakes, and a failure to approach the order of the [First-tier Tribunal] with the seriousness and respect that it merited.” [15]

The Upper Tribunal considered that having regard to the whole circumstances that this was a case in which the imposition of a sanction for the University’s contempt was merited. [15]

Beyond agreeing that imprisonment was not one of the options open to the Upper Tribunal, there was a divergence between the parties as to the appropriate sanctions in this case. The University argued that publication of the judgment marking the contempt was sufficient whereas Mr Cleasby suggested a financial penalty along with a range of other orders including specific directions to the University to provide copies of the Upper Tribunal’s decision to various people, and disciplinary action against members of staff at the University. The Commissioner agreed that a sanction was appropriate but was neutral as to the appropriate level. The Upper Tribunal sets out various aggravating and mitigating factors at [18]-[19] of its decision.

The Upper Tribunal rejected the University’s contention that publication of the formal finding of contempt was sufficient. [20] In relation to the fact that the University was a public authority, the Upper Tribunal stated, at [20]:

“The information regime under the 2000 Act inevitably involves public authorities. Refusing as a matter of course to apply a financial sanction in contempt cases in the context of the 2000 Act would effectively neuter the tribunals’ enforcement powers for contempt, in a way not mandated by the 2000 or 2007 Acts. Accordingly, while the fact that a body in contempt of court is a public authority may be a relevant factor and indicate caution before imposing financial sanctions, it is not an absolute bar. Each case will turn on its own facts.”

In this case Mr Cleasby had represented himself and made no request for an order for costs, an award of costs was not suitable in this case. Having regard to the whole circumstances of the case the Upper Tribunal considered that the appropriate level of fine in this case was £15,000. The Upper Tribunal noted that but for the admission of contempt by the University the fine would have been considerably higher. [21]

Comment

Decisions from the Upper Tribunal finding that a public authority is in contempt by reason of a failure to comply with a decision of the First-tier Tribunal are rare. This latest decision, by the current President of the Administrative Appeals Chamber of the Upper Tribunal, Lady Poole, and Upper Tribunal Judge Wikeley, does not make for pleasant reading, but it is one that anyone with responsibility for implementing decisions of the First-tier Tribunal in relation requests under the Freedom of Information Act 2000 (or Environmental Information Regulations 2004) should take the time to read. It appears to be clear from the decisions that do exist that the Upper Tribunal will take a robust approach when a case is certified to it by the First-tier Tribunal. It is not uncommon for public authorities to decide not to become a party to an appeal brought by a requester under section 57 of the Freedom of Information Act 2000; however, this case should be seen as a lesson that a public authority which so choses should ensure that it has in place robust procedures to consider and act upon decisions of the First-tier Tribunal made in cases to which they did not participate. Section 58 of the Freedom of Information Act 2000 confers a power on the First-tier Tribunal to issue a substituted decision notice for the one issued by the Commissioner where it decides to allow an appeal in whole or in part.

A finding of contempt clearly carries with it reputational risk, but the penalties open to the Upper Tribunal in such cases are not restricted to simply publishing its decision. In this case the Upper Tribunal has made it clear that, notwithstanding that these cases will involve public authorities, fines for proven or admitted contempt are not off the table in appropriate cases.

_{Disclaimer: This article is for information purposes only and nothing in it should be taken as constituting legal advice.}
Privilege Holds the Line — Again

April 20th, 2026
Six years ago it was a criminal offence to leave where you were living unless you had a reasonable excuse to do so. The country, and the world, was in the midst of the early days of the Covid-19 pandemic and these laws, introduced into each part of the United Kingdom, followed a television address at which the then Prime Minister, The Rt. Hon. Boris Johnson, made on 23 March 2020 in which he said that he gave a very simple instruction: “you must stay at home.” This then resulted in a series of measures that were relaxed and tightened over the coming months and years to combat the spread of Covid-19.

In December 2020 the Cabinet Office received a request for information relating to that 23 March 2020 announcement by the then Prime Minister; specifically the requester sought information about (i) any discussion about whether to seek legal advice on the lawfulness of the lockdown declaration of 23 March 2020; (ii) whether the then Prime Minister sought such advice; and (iii) if so, the request for advice and the advice provided.

The Cabinet Office responded in January 2021 refusing to confirm or deny whether it held any information falling within the scope of the request. This decision was later upheld by the Cabinet Office following an internal review and the requester then made a complaint to the Information Commissioner under section 50 of the Freedom of Information Act 2000 (FOIA). In his complaint to the Information Commissioner, the requester argued that there was a strong public interest in knowing whether “the PM put 60 million people under house arrest without legal authority.”

The Commissioner issued a decision on 19 May 2022 requiring the Cabinet Office to confirm or deny whether it held any information falling within the scope of the request and to the extent that it does hold any such information to disclose it or issue a refusal notice in terms of section 17 of FOIA.

The Cabinet Office partly complied with the Commissioner’s decision notice in that it answered the first part of the request (relating to discussions about whether to seek advice) but appealed the decision notice to the First-tier Tribunal (FtT) insofar as it related to the second and third parts of the request. The FtT held that, on the hypothesis that the Prime Minister, sought legal advice on the lawfulness of the lockdown announced on 23 March 2020, confirmation of that fact would not reveal information to which “legal advice privilege” applied and therefore that section 42(2) of FOIA was not engaged in relation to the second and third parts of the request.

The Cabinet Office appealed to the Upper Tribunal and last week, the Upper Tribunal published its decision in relation to that appeal. The Upper Tribunal allowed the Cabinet Office’s appeal holding that the First-tier Tribunal “erred materially in law” when it made its decision in respect of the Cabinet Office’s appeal to it. [66]

It may seem obvious to any lawyer that whether the Prime Minister had sought legal advice on the lawfulness of the lockdown announced on 23 March 2020 and, if so, the request for that advice and the advice itself would clearly fall within the ambit of legal privilege. The Upper Tribunal sets out the scope of privilege insofar as it relates to advice at [48] where it states:

“The general extent of legal advice privilege may be stated as covering confidential communications between a client and their lawyer in a relevant legal context where those communications are made for the dominant purpose of receiving or giving legal advice. This will include communications that form part of a “continuum” that aims to keep the lawyer and client informed so that legal advice may be given as required.”

The Upper Tribunal then went on to consider the judgments in Balabel v Air India and R (Jet 2.com Ltd) v Civil Aviation Authority and Law Society from which the following propositions were drawn by the Upper Tribunal (at [50]):
- That legal advice privilege and the continuum of communications must be applied broadly and not restrictively or on a nit-picking basis. And that broad approach is founded on the rationale of allowing a client and their lawyer to be unencumbered in the exchange of information when advice is being sought and given; and
- The continuum covers the request or instruction to the lawyer seeking advice as well as the advice given.
The Upper Tribunal considered that the FtT erred in failing to place “adequate weight on the need to take a broad approach to what may constitute legal advice privilege and failed to reason out adequately why answering the hypothetical question would not reveal information to which legal professional/advice privilege applied.” [57]

Having concluded that the FtT erred in law, the Upper Tribunal went on to remake the decision under section 12(2)(a) and (b)(ii) of the Tribunals, Courts and Enforcement Act 2007. Unsurprisingly, given the terms of the Upper Tribunal’s consideration of the scope of legal advice privilege, the Upper Tribunal concluded that “the correct answer to the hypothetical question posed in the preliminary issue is that answering whether or not the Prime Minister had (on the hypothesis) sought legal advice on the lawfulness of lockdown announced on 23 March 2020, would have revealed information to which legal advice privilege applied.” [68] The Upper Tribunal decided that the Cabinet Office had been entitled to neither confirm nor deny whether it held any information falling within parts 2 and 3 of the requester’s request.

Comment

This decision of the Upper Tribunal follows hot on the heels of the Opinion of the Court of Session in Scottish Ministers v Scottish Information Commissioner (about which I wrote here). Once again there is confirmation of the importance of, and near impenetrability of, legal privilege. In the case before the Upper Tribunal the issue wasn’t whether advice which had been obtained should be released; rather, it was about whether the Cabinet Office should be required to even confirm or deny whether legal advice had been sought in the first place.

Both FOIA and the Freedom of Information (Scotland) Act 2002 have resulted in a situation where public authorities can be forced to disclose information which is subject to legal privilege in the public interest. The bar does seem to be a high one before a public authority will be required to disclose information that is subject to legal privilege (which can include whether it has even sought legal advice on a particular issue) and it is probably understandably so given the importance of legal professional privilege in the wider administration of justice. However, the statutory exemptions created through FOI law cannot simply be ignored and there will be situations where the public interest (properly understood) will demand the release of information subject to legal professional privilege.

_{Disclaimer: This article is for information purposes only and nothing in it should be taken as constituting legal advice.}
Scottish Ministers v Scottish Information Commissioner: Where FOI and Legal Professional Privilege intersect

March 30th, 2026

Last week the Court of Session gave its opinion in the latest round of litigation between the Scottish Ministers and the Scottish Information Commissioner. The appeal, made under section 56 of the Freedom of Information (Scotland) Act 2002, by the Scottish Ministers was heard in January by the First Division of the Inner House (the Lord President (Lord Pentland) and Lords Malcolm and Clark).

The appeal related to a request for information, made by a journalist, concerning an earlier appeal by the Scottish Ministers to the Court of Session against a decision of the Scottish Information Commissioner. That earlier appeal had concerned whether information that fell within the scope of a request for information, about the investigation by Irish lawyer James Hamilton into whether the then First Minister, Nicola Sturgeon, had breached the ministerial code, was held by the Scottish Ministers for the purposes of the Freedom of Information (Scotland) Act 2002 (“FOISA”). In the earlier appeal, the First Division (the then Lord President (Lord Carloway) and Lords Pentland and Boyd of Duncansby) refused the appeal.

In respect of the request for information that this latest appeal concerns, the Scottish Ministers had withheld information under section 36(1) of FOISA, on the basis that the information concerned was subject to legal professional privilege and that the public interest in disclosures was outweighed by the public interest in maintaining the exemption, and also section 30(c). The journalist complained to the Scottish Information Commissioner who issued a decision notice ordering the release of the withheld information. The Scottish Ministers appealed to the Court of Session.

The submissions made on behalf of the Scottish Ministers and the Commissioner are summarised in the court’s opinion (at [15]-[18] in respect of the Ministers and [19]-[21] in respect of the Commissioner) and so I am not going to set them out in any detail in this post. Furthermore, the hearing before the First Division was livestreamed and a recording of it, for anyone who may wish to hear the full oral submissions, can be found here.

Legal professional privilege (LPP) is a cornerstone of the justice system; it is near impenetrable at common law, or as Lord Malcolm puts it in the opinion of the court, it has been “bestowed a special and largely inviolable common law status…” [23] It exists to protect the judicial process by ensuring that individuals can have frank discussions with their lawyers and can therefore, in return, receive frank advice based upon full disclosure by the client. It is designed to ensure that individuals can be totally honest with their legal advisers without being overly worried about onward disclosure. However, it is not totally absolute and can, for example, be overridden by statute. FOI law (whether that be FOISA or the Freedom of Information Act 2000 (“FOIA”)) creates a mechanism whereby a public authority can be legally required to disclose its privileged legal advice in the public interest.

While FOISA does not contain a specific exemption for LPP in the way that FOIA does (FOISA essentially includes it alongside all types of confidential information and communications), it does appear to recognise the importance of LPP by providing a specific exemption to the Commissioner’s power to compel the disclosure of information to him through the use of an information notice. Section 50(5) of FOISA means that the Commissioner cannot, for example, compel disclosure to him of legal advice concerning the authority’s compliance with FOISA, or legal advice in connection with litigation involving the Commissioner. This is the very type of information that the underlying application to the Commissioner and this appeal to the Court of Session was concerned with. The Court analyses this provision from paragraph [38]-[46]; however, as is clear from the court’s opinion, it is really obiter dicta as it was not essential to deal with it in order to resolve the appeal before the court (see the first couple of sentences in [38]).

It is worth recognising that the Commissioner was in an unusually difficult position in this case. The Commissioner was required to make a decision on the application to him without having before him the withheld information in the way that he ordinarily would. However, in enacting FOISA, the Scottish Parliament specifically legislated in a way, perhaps understandably and unsurprisingly so, that resulted in him being in that position. There may be ways of a decision being made with full sight of this sort of information which results in neither the Commissioner nor his staff ever seeing the information; however, that is a matter for the Commissioner and beyond the scope of this post.

One of the attacks made by the Ministers on the Commissioner’s decision was the emphasis that the Commissioner had placed upon the phrase “standard official level correspondence of a type expected when preparing for litigation.” It was argued that the Commissioner’s assumptions and conclusions did not properly flow from the use of that phrase, and that he had, in essence, indulged in speculation that had been unwarranted. The court saw force in those submissions by the Ministers. [30] The court wondered how, once it had been accepted (as it had been by the Commissioner) that the withheld information was subject to LPP, the fact that it had been set out in what had been described as “official level correspondence” mattered and why that would dilute the importance of maintaining privilege.[30] The court noted that where advice had been received from in-house lawyers it did not fall into a “secondary or inferior category of LPP”, nor too did internal documents prepared for the purpose of litigation. [30]

In relation to the balancing of the public interest, the court noted that “it is important that the harm to the common good risked by disclosure of LPP information is properly understood and weighed.” [32] The court noted that there were clear indications in the Commissioner’s decision, and in his earlier decision concerning a different application, that the Commissioner took the view that the conclusion of the previous appeal proceedings diminished the importance of maintaining the exemption. The court did not agree with this view. [32] The court went on, at [32], as follows:

“LPP is justified not only by protecting legal advice from the immediate adversary during the particular proceedings while they are live, but also by the general chilling effect if advice cannot be sought without any guarantee of confidentiality. It is this which has led to the aphorism that “once privileged, always privileged”. We appreciate that for public authorities the legislation has taken away that absolute assurance, but it has not removed the well-established and frequently explained damage to the proper administration of justice in the future when, without the consent of the client, legal advice or litigation material is disclosed to the public. If a public authority is being ordered to do this, it must follow a decision-making process in which it is clear that this important factor is appreciated and fully taken into account.”

The court was not satisfied that the decision-making process, and the associated reasoning in the Commissioner’s decision under consideration in this appeal, met that description.

At the core of the Commissioner’s decision on the public interest appeared to be the contention that disclosure would contribute to the sustained public interest in relation to the inquiry by James Hamilton. Before the court, counsel for the Commissioner had been unable to provide a clear and compelling explanation as to how legal advice concerning an appeal on what essentially amounts to a technical matter of FOI law could contribute to that debate at all, or at least to such an extent as to justify overriding the strong public interest in maintaining legal privilege. [33] The court recognised that anything, however indirectly, related to the underlying inquiry will be of intense interest to many members of the public. However, the court recognised that when it comes to dealing with the public interest, what the public is interested in is not the test. [34]

The court was of the view that the Commissioner’s reasoning revealed “an unwarranted degradation of the administration of justice concerns which underpin the confidentiality of communications covered by LPP.” [35] The court noted that when public authorities are involved in litigation the issues will often be of intense public interest and therefore it is “even more important that effective and frank legal advice can be sought and received.” [35] The court noted that it found “nothing in [FOISA] which dilutes the fundamental importance of these considerations, which apply to LPP for both private individuals and public authorities.” [36]

The court was, however, clear that they are not saying that the exemption, insofar as it relates to LPP, is elevated to an absolute exemption. The court accepted that there will be occasions when the harm risked by disclosure will not outweigh the public interest in the release of such information. [37] The court went on to endorse, at [37], what Coppel, Information Rights, 5th ed, states at paragraph 30-020, that “some clear, compelling and specific justification for disclosure must be shown so as to override the obvious interest in legal professional privilege.” The court noted that they had not identified anything which could be reasonably described in that way in the Commissioner’s reasoning in this case; and therefore concluded that this constituted an “error of law which justifies upholding the Minister’s challenge to the decision.” [37]

Comment

This is an important decision from the Court of Session and will be of interest not only to those working in FOI in Scotland but those working in FOI right across the UK. It will certainly be worthwhile taking time to read and digest the court’s opinion in full. The opinion underlines the important part that privilege plays in the administration of justice; and it arguably sets a high bar (but not one that is impossible) to cross before the public interest will be served by the disclosure of information to which LPP attaches. While FOI law has provided a statutory exception to the “largely inviolable” concept of LPP, it has not diluted or undermined the importance of the concept of LPP. Like every decision involving the public interest test in FOI, each case will turn on its own specific facts and circumstances; however, it appears that the public interest in maintaining LPP is substantial and will likely take something “clear, compelling and specific” to balance the scales or tip them away from maintaining the exemption.

It is, I think (and a quick check of Westlaw appears to confirm this thought), the highest level of judicial opinion on the interaction between LPP and FOI that presently exists from any part of the UK. The Court of Appeal in Northern Ireland issued a judgment last week refusing the Police Service of Northern Ireland (PSNI) permission to appeal against a decision of the Upper Tribunal in relation to an information notice served by the (UK) Information Commissioner concerning LPP. However, it is a judgment refusing permission to appeal and so it doesn’t analyse the issues to the same extent as the opinion of the Court of Session does. In any event, the PSNI decision is concerned with an information notice requiring disclosure to the (UK) Commissioner for the purpose of his investigation, rather than in relation to a decision by the (UK) Commissioner that information covered by LPP should be disclosed to the public. Therefore, it is not wholly in point with the Court of Session decision.

_{Disclaimer: This article is for information purposes only and nothing in it should be taken as constituting legal advice.}
Request or Ruse? When SARs Cross the Line

March 25th, 2026
The European Court of Justice issued its judgment in Brillen Rottler GmbH & Co KG v TC (case C-526/24) last week (19 March 2026). This is an important judgment in relation to subject access requests and, in particular, when they can be deemed “excessive” pursuant to Article 12(5) of the GDPR.

Background

In March 2023, TC, who resides in Austria, subscribed to the newsletter of a family run opticians in Arnsberg, Germany (Brillen Rottler) by entering his personal data into a form on the company’s website for this purpose. Less than two weeks later, TC sent a subject access request to the company. The request was refused by the company, within the initial month allowed for a response, on the basis that it considered the request to be abusive in terms of Article 12(5) of the GDPR and called on TC to withdraw his request. TC pressed for a response to his subject access request and, in addition, now sought compensation in terms of Article 82 of the GDPR in the amount of €1,000. The company raised proceedings in the Local Court in Arnsberg seeking declarator that TC was not entitled to any compensation.

In support of its position, the company asserted that TC systematically and abusively makes requests for access to his personal data for the sole purpose of obtaining compensation for an alleged infringement, which he himself deliberately provokes. The company asserted that TC’s approach was to subscribe to a newsletter, then makes a subject access request and finally submit a claim for compensation.

Reference to the European Court of Justice

The Local Court in Arnsberg referred eight questions for a preliminary ruling under Article 267 of the TFEU. In essence, those questions sought a preliminary ruling on the following issues:
1. Whether it is possible that a first subject access request made to a controller by a data subject may be regarded as excessive within the meaning of Article 12(5) and, if so, in what circumstances.
2. Whether the right to compensation under Article 82 of the GDPR conferred a right to compensation resulting from an infringement of the right of access provided for in Article 15.
3. Whether Article 82(1) of the GDPR includes non-material damage suffered by the data subject for the loss of control over their personal data or their uncertainty as to whether the data have been processed.
4. Whether a subject access request from a data subject constitutes processing within the meaning of Article 4 of the GDPR.
Judgment of the European Court of Justice

The first issue: abusive subject access requests

The ECJ answered this in the affirmative holding that a first subject access request by a data subject can be regarded as excessive where the data subject has an abusive intention in making the request. The starting point for the ECJ was that, in the absence of a definition of what amounts to excessive in the GDPR, it was necessary in interpreting the concept “to consider not only the wording of article 12(5) of that regulation, by reference to its usual meaning in everyday language, but also the context in which that provision occurs and the objectives pursued by the rules of which it is part.” [24] This approach by the ECJ is entirely in line with the domestic approach to statutory interpretation and therefore the ECJ’s answer is likely going to be a very good indication as to the approach the domestic courts will take in interpreting the equivalent provision in what is now the United Kingdom General Data Protection Regulation (“UK GDPR”).

The court went on to hold that the everyday meaning and usage of the word “excessive” did not rule out the possibility that a first request made to a controller by a data subject may be excessive. [25] The use of the words “repetitive character” in Article 12(5) was only by way of an example, there does not need to be a large number of requests to the controller from a data subject before a request may be deemed excessive. [26]

The court then went on to hold that this conclusion was supported by the context of the provision. Article 12(5) provides an exception to the obligation on controllers to facilitate the rights of data subjects (in this context, the right of access) in the face of a request which is manifestly unfounded or excessive. [29] The court went on to state that the interpretation of the concept of “excessive requests” in Article 57(4) could be transposed to the present case, under reference to the court’s judgment in Österreichische Datenschutzbehörde v FR. [30] Therefore, even in relation to a first request, a controller can rely upon the exception to their general obligation found in Article 12(5) where they establish that there has been an abusive intention on the part of the data subject. [31] In this context abusive refers to an abuse of rights rather than to the content of the request being abusive. The court goes on to state, at [34], in the context of the non-absolute nature of the right to protection of personal data and the need to balance it against other fundamental rights:

“Therefore, in order to ensure that that balance is achieved by means of that exception, and that it is effective, the relevant criterion for a finding of abusive conduct is the excessive character for the request for access, which is to be assessed qualitatively, in accordance with paragraph 26 of the present judgment, and which cannot depend solely on the number of requests for access made by the data subject and thus on whether it is the data subject’s first request.”

Turning to the specific circumstances in which a data subject’s first subject access request may be excessive within the meaning of Article 12(5), the court pointed to the aim of Article 15, as read with recital 63, “is to confer on a data subject the right of access to personal data which have been collected concerning him or her and to exercise that right easily and at reasonable intervals in order, inter alia, to be aware of the processing of those personal data and to verify the lawfulness of that processing, thereby enabling the data subject to exercise, depending on the circumstances, his or her right to rectification, right to erasure or right to restriction of processing, and his or her right to object and right of action where he or she suffers damage.” [37]

The court state that, in relation to the subjective element, the controller will require to “establish, having regard to all the relevant circumstances of each case, that there has been an abusive intention on the part of the data subject.” [40] It continued that where the request has been made for a purpose other than that of being aware of the processing being undertaken and verifying the lawfulness of that processing, in order to enable the protection of the data subject’s other rights under the GDPR, may be a situation where a request might be excessive within the meaning of Article 12(5). [40] The court confirmed that, in the present case, public information about TC’s tactics could be taken into account in determining whether there had been an abusive intention to the request. [43]

Second issue: compensation resulting from an infringement of the right of access

The court also answered this issue in the affirmative. Article 82 refers to an infringement rather than to a right to compensation in relation to damage arising from the processing of personal data, therefore the right in Article 82 cannot be limited to the latter. [48]

This conclusion, the court states, is supported by a contextual analysis of Article 82 when read along with recitals 141 and 146. [49]-[50] Therefore, where there is an infringement of the GDPR that does not, in effect, involve the processing of personal data there still exists a right to compensation under Article 82, subject to the need to prove actual damage (material or non-material). [54]

Third issue: compensation for loss of control or uncertainty

The court confirmed that, subject to the data subject proving that they have actually suffered non-material damage, the right to compensation under Article 82 does encompass the loss of control over personal data or a data subject’s uncertainty as to whether their personal data has been processed. [67]

Fourth issue: whether a subject access request constitutes processing

In light of how it treated what I have termed in this post “the second issue” (being questions five and six of the referring court), the court considered that there was no need to answer this question in the context of this reference.

Application to the UK GDPR

Since the UK left the European Union, judgments of the European Court (in relation to EU law remaining part of the domestic law in the UK) which have been issued after 31 December 2020 are not binding on courts in the UK, but remain persuasive in terms of the European Union (Withdrawal) Act 2018.

This judgment is therefore likely to be highly persuasive to courts in the UK who are faced with questions concerning the meaning of Article 12(5) of the UK GDPR and also in relation to Article 82 of the UK GDPR. As indicated above, the approach adopted in relation to the interpretation of the GDPR as it relates to the first issue, is in all material respects in line with the modern domestic approach to statutory interpretation as set out in cases such as R (N3 and another) v Secretary of State for the Home Department; therefore, the domestic courts are likely to reach a the same conclusion even without reference to this judgment.

The judgment, especially when considered alongside the amendments made to data protection law by the Data (Use and Access) Act 2025, is likely to give controllers a great deal of latitude in refusing a request, particularly where they have evidence to suggest that a data subject is making a request for purposes other than a genuine attempt to establish the nature and extent of the processing of personal data concerning them and the lawfulness of any such processing. However, a controller who wrongly applies the exemption in Article 12(5) (and thus infringes the UK GDPR by not providing a substantive response) could, subject to the data subject proving material or non-material damage, open themselves up to a claim for compensation. It does not seem that this judgment conflicts with domestic case law, such as Dawson-Damer v Taylor Wessing LLP which concern “collateral” purposes rather than a purely abusive exercise of rights.

_{Disclaimer: This article is for information purposes only and nothing in it should be taken as constituting legal advice.}
Scottish Government Consultation on FOI and Care Home Services

January 8th, 2026

The Scottish Government has opened its long-awaited consultation on designating the private and third sector providers of care home and care at home services as Scottish public authorities for the purposes of the Freedom of Information (Scotland) Act 2002 (“FOISA”) and the Environmental Information (Scotland) Regulations 2004 (“Scottish EIRs”). The consultation opened on 5 January 2026 and will run until 30 March 2026.

The discussion on whether care homes operated by private and third sector organisations should be covered by freedom of information legislation has been going on for some years now. The question came to prominence in 2020 during the Covid-19 pandemic; however, it would be fair to say that it was going on even before the pandemic.

Scottish Ministers have specific powers under section 5 of FOISA to designate, by order, certain persons as Scottish public authorities for the purposes of FOISA (and consequently the Scottish EIRs as well). Three orders have been made under section 5 of FOISA by the Scottish Ministers, the most recent being in 2019 which designated Registered Social Landlords as Scottish public authorities.

In Scotland both care home services and care at home services require to be registered with Social Care and Social Work Improvement Scotland (“the Care Inspectorate”) who is responsible for registering and regulating care services in Scotland. As the consultation notes, there are existing statutory definitions of care home services and care at home services in schedule 12 to the Public Services Reform (Scotland) Act 2010. Under the 2010 Act, it is the individual service rather than the provider which is registered with the Care Inspectorate. For example, if a single company operates 10 separate care homes in Scotland, each care home has to be separately registered with the Care Inspectorate as a service.

It doesn’t seem clear from the consultation document whether the Scottish Ministers are intending on designating individual services as Scottish public authorities or the provider themselves. The ministerial forward states that “the Scottish Government has been clear that it sees a case in principle that these services may be considered to be public functions, and that statutory FOI obligations should therefore be extended to private and third sector providers of such services.” (my emphasis) However, the consultation then goes on to refer to the statutory definitions in the 2010 Act, and the consultation question asks about services (my emphasis) which are operated by private and third sector organisations rather than the providers of such services. Designation of the individual services rather than the provider of the services may not be within the Scottish Minister’s powers; section 5 of FOISA confers a power to designate a person or persons exercising functions of a public nature (section 5(2)(a)) rather than designation of services of a public nature. Some clarity will be needed around this if designation is to go ahead.

There is to be a general election to the Scottish Parliament on 7 May 2026 and so it will be for whoever forms the next administration in Edinburgh to consider the results of the consultation and make a decision on whether (and to what extent) to exercise the powers under section 5 of FOISA in relation to care homes and care at home services. It will therefore be some time before we know what the results of the consultation are and what decision the Scottish Government will take on the question. If the eventual decision is to designate, it is unlikely that designation will take place before 2027 allowing for the election period and any period allowed for designees to prepare for becoming a Scottish public authority after the order has been made (when the designation power in section 5 has been used in the past, there has been a period of around six months between the order being made and it coming into force).

_{Disclaimer: This article is for information purposes only and nothing in it should be taken as constituting legal advice.}
Section 166: a continued disappointment for dissatisfied data subjects

January 6th, 2026

In my first blog post of 2026, I return to a subject that I have written about before: section 166 of the Data Protection Act 2018.

Those who frequently look at decisions of the First-tier Tribunal exercising its information rights jurisdiction will be well aware that in 2025 there were a substantial number of applications under section 166 of the Data Protection Act 2018 struck out by the tribunal (and that this is a continuing trend from previous years). The end of 2025 was no exception with a number of such decisions being published over the Christmas and New Year period.

There continues to be a wide-spread misunderstanding by data subjects as to what section 166 provides. Data subjects have a right, under Article 77 of the UK GDPR and/or section 165 of the Data Protection Act 2018, to complain to the Information Commissioner about how a controller has dealt with a request to exercise their rights (most commonly their right of subject access but it could be other rights such as rectification or erasure). In response to such a complaint the Commissioner has an obligation to investigate the complaint “to the extent appropriate” and to inform the data subject about the progress of the complaint, including whether any further investigation is necessary. If the Commissioner does not provide an update or outcome within three months (or at intervals of three months after each update if no outcome has been reached), the First-tier Tribunal has the power, under section 166(2) of the Data Protection Act 2018 to make an order which requires the commissioner to either take appropriate steps to respond to the complaint or to inform, within a period specified in the order, the data subject of the progress of the complaint or of the outcome of the complaint.

Section 166 does not provide a substantive right of appeal against the outcome of such a complaint. It is a procedural jurisdiction only and is concerned with ensuring that data subjects get a final response to their complaint and are kept up to date with the progress of any investigation that the Commissioner deems to be appropriate. The Court of Appeal (England and Wales) determined in R (Delo) v Information Commissioner that the Commissioner is provided with a broad discretion to decide the level of intensity of any investigation and what action, if any, to take in response to such a complaint (including a decision to take no further action in response to a complaint). The terms of section 166 of the Data Protection Act 2018 therefore do not confer a jurisdiction on the First-tier Tribunal to review the decision of the Commissioner similar to that which is conferred on it by section 57 of the Freedom of Information Act 2000.

It is well known in data protection circles that the Commissioner rarely, if ever, takes any formal enforcement action in response to an individual complaint. Indeed, his office rarely, if ever, carries out an investigation of sufficient intensity to, for example, require a data controller to disclose material withheld in response to a subject access request. The Commissioner does have the tools and power to do so; but does not use his resources in that way. It is open to people to agree or disagree with the Commissioner’s approach, and I shall refrain from commenting on that debate in this post.

During the passage of the Data (Use and Access) Act 2025 attempts were made, notably by Liberal Democrat Peer Lord Clement-Jones, to introduce provisions which would have conferred upon the First-tier Tribunal a substantive jurisdiction in relation to data subject complaints. In essence, Lord Clement-Jones’ proposals would have had the effect of transferring the compliance order and compensation jurisdictions from the courts to the First-tier Tribunal. The proposals were not adopted by Parliament.

Data subjects almost never have legal advice or representation when they make applications under section 166 of the Data Protection Act 2018 to the First-tier Tribunal. It is very easy to see how an unrepresented data subject could read section 166 as conferring such a right (especially if they are familiar with the First-tier Tribunal’s role in relation to decisions of the Commissioner made under section 50 of the Freedom of Information Act 2000) and would proceed without knowledge of the existence of key decisions such as Delo and Killock v Information Commissioner.

So, what options are open to a dissatisfied data subject following a complaint to the Information Commissioner (soon to be replaced by the Information Commission)? Well, specifically in relation to the Commissioner’s decision there is the option of judicially reviewing it in the High Court, the High Court in Northern Ireland or the Court of Session depending on where the data subject is located. That is likely to be an unattractive option because judicial review is also concerned with process and procedure rather than a review of the substantive decision; a successful judicial review would most probably only result in the Commissioner’s decision being reduced/quashed and him having to make a new decision exercising his broad discretion. In short, a judicial review is very unlikely to result in a data subject, for example, receiving personal data withheld in response to a subject access request.

The other option doesn’t involve the Commissioner at all and can be taken without even complaining to the Commissioner: to seek a compliance order against the controller under section 167 of the Data Protection Act 2018. Compliance orders can be sought in the Sheriff Court or Court of Session (in Scotland) or the County Court or High Court (in England and Wales or Northern Ireland). The courts can, in response to an application under section 167 perform what might be termed “a full merits review” of the controller’s handling of the request. The courts can specifically order, for example, the disclosure of incorrectly withheld information (in response to a subject access request) or the rectification or the erasure of personal data where that has been incorrectly refused. The Data (Use and Access) Act 2025 has fixed a lacuna that has existed since 2018 making it clear that the courts can require controllers to make available such information as is available to the controller for inspection by the court without it being disclosed to the data subject until after a final determination in favour of the data subject.

Whether either of these solutions are realistic given their costs and, where it is technically possible to get, the availability of solicitors willing to provide legal aid services for such applications is an entirely separate matter on which I shall offer no commentary in this post. Section 167 applications appear comparatively rare; whether that is down to their cost (and the potential for an adverse award of expenses/costs if unsuccessful), a lack of knowledge on the part of data subjects or a combination thereof is not clear.

I suspect that 2026 will continue to see a flow of struck out section 166 applications as data subjects dissatisfied (rightly or wrongly) with the decision of the controller in relation to their request and the outcome of their complaint to the Commissioner continue to seek to challenge those decisions.

_{Disclaimer: This article is for information purposes only and nothing in it should be taken as constituting legal advice.}
Clarifying Costs: The Proper Approach under Section 12 of the Freedom of Information (Scotland) Act 2002

October 12th, 2025

Last week the Second Division of the Inner House of the Court of Session (Lord Justice Clerk and Lords Malcolm and Armstrong) refused an appeal under section 56 of the Freedom of Information (Scotland) Act 2002 (“FOISA”) against a decision of the Scottish Information Commissioner. The decision appealed against concerned the application of section 12 of FOISA by the Police Investigations and Review Commissioner (“PIRC”) in relation to the appellant’s request for information to PIRC.

The Appellant had made a request for information to PIRC seeking the information as to the number of police officers it had arrested since it came into being in 2013. PIRC issued a response to the Appellant advising that the cost of complying would be £108,390, well in excess of the £600 limit applicable in terms of FOISA and the Regulations. PIRC said that in order to comply with the request for information it would need to review 433,588 files as the information requested was not recorded as a matter of routine. Unhappy with this response, the Appellant eventually made an application to the Scottish Information Commissioner for a decision in terms of section 47(1) of FOISA. The Commissioner issued a decision notice upholding the decision of the PIRC; however, the Commissioner also found that PIRC had failed to provide advice and assistance in terms of section 15 of FOISA. The Appellant thereafter appealed to the Court of Session.

The Appellant argued that the Commissioner had failed to take into account the public interest in disclosure of the information in reaching decision that he did. The Court held, at [4], that this proposition was “misconceived.” The public interest test only arises “if a request is refused because of an exempt category of information” in Part 2 of FOISA. [4] Section 12 applies to all request and there was no reliance upon an exemption within Part 2 of FOISA in relation to the Appellant’s request. [4]

The Appellant sought a declarator from the court that PIRC owed a duty of care to keep the public informed as to police officer’s conduct. The court held, at [5], that it had no power to make such a declarator. The functions of PIRC are set out in section 62 of the Police and Fire Reform (Scotland) Act 2012. The court was concerned, in this case, with an appeal against a decision of the Scottish Information Commissioner and whether the Commissioner had erred in law (see [3] and [5]). In any event PIRC were not party to the proceedings (which is very much the norm in Scottish FOI appeals given that the Court of Session does not have the power to order disclosure of withheld information, merely to reduce the decision of the Commissioner and remit it back to him for a fresh determination if the Commissioner has erred in law); the court was unable to “embark upon a review of its performance in general, nor of its record-keeping and data retrieval systems.” [5]

The Appellant argued, in what the court considered as “an arguable error of law” [6], that the Commissioner had erred in law because he had based his decision on PIRC’s current systems for the storage of data. The Appellant considered that PIRC’s systems were “out of date, highly efficient and conducive to a lack of transparency and accountability.” [6] The Appellant argued that the cost estimate given by PIRC “could not be regarded as sensible, realistic and supported by cogent evidence.” The Appellant continued that the Commissioner ought to have had regard to modern automated systems potentially allowing for a less costly response to her system; the Commissioner should have sought expert advice on the subject as part of his investigation.

In refusing the appeal, the Court had regard to the decision of the Upper Tribunal in Kirkham v Information Commissioner [2024] UKUT 127 (AAC), which concerned the equivalent provisions within the Freedom of Information Act 2000 (“FOIA”). The Court, at [10]-[11], cited, with approval, paragraphs 17-20 of Kirkham. In essence, the cost estimate is based upon the way in which the authority actually holds the information at the time the request is made. The Court held that “the Commissioner would have erred had he concluded that the information should be disclosed because the cost of compliance could be reduced to an amount below the limit if PIRC upgraded its systems.” [11] It is not the Commissioner’s role to police the data management procedures of public authorities such as PIRC; his only role is to consider whether it has complied with its duties under FOISA and that is a question which depends upon the terms of the Act. [11]

The Appellant also challenged the Commissioner’s finding that PIRC had failed to comply with the requirements of section 15 of FOISA. The Court was not satisfied that these amounted to an error of law on the part of the Commissioner. [14] These were matters for the Commissioner as a specialist. [14]

The Appellant made other challenges which did not have any merit to them and are dealt with, briefly, at paragraph [12] of the court’s opinion.

As will be known to anyone familiar with FOISA and FOIA, an appeal against a decision of the Scottish Information Commissioner is only on a point of law; there is no full merits appeal from his decisions in the way there is of decisions of the Information Commissioner under FOIA. The Court of Session took the opportunity to affirm that as the Commissioner is a specialist statutory decision-maker, it will afford a degree of institutional respect in relation to decisions within his area of competence. [3] and [14]

The Opinion of the Court in this appeal confirms that the approach to section 12 of FOISA is the same the approach to section 12 of FOIA as explained in Kirkham. If a Scottish public authority has a records management system that is so inefficient and out-dated that it results in it being too costly to search, locate and retrieve information that falls within the ambit of a request for information then the requester simply has to take the authority’s records management system as it exists.

_{Disclaimer: This article is for information purposes only and nothing in it should be taken as constituting legal advice.}
First-tier Tribunal Gives Short Shrift to FOI Enforcement Notice Appeal

August 8th, 2025

In March 2024, the Information Commissioner issued an Enforcement Notice to Bristol City Council under section 52 of the Freedom of Information Act 2000 (FOIA) following the issuing of a practice recommendation to the Council in August 2023. The Enforcement Notice was concerned with the Council’s compliance with the requirements of section 10 of FOIA and, in particular, the sizeable number of requests not responded to by the Council within the statutory period. The Council exercised its right of appeal to the First-tier Tribunal which has now (after refusing two strike-out applications made by the Commissioner) dismissed the Council’s appeal.

The issue for the First-tier Tribunal was a narrow one which essentially boiled down to whether the Commissioner ought to have exercised his discretion differently when he decided to issue the Enforcement Notice. The Council contended that there was an error in the Enforcement Notice about what had been required by the practice recommendation previously issued by the Commissioner in relation to the creation, by the Council, of an action plan. The Enforcement Notice stated that the practice recommendation required an action plan which incorporated a recovery plan concerning the backlog of FOIA requests that the Council had. The Council, on appeal, argued that the practice recommendation did not reference the backlog.

The Tribunal gave, it is fair to say, the Council short shrift stating at [32]:

“Having considered all the evidence, we refuse the Appellant’s appeal and conclude that the ICO exercised it’s discretion correctly (it is not suggested that the decision was not in accordance with the law and we do not find that it was). Even if we are wrong on this, we have reviewed the evidence and made our own assessment.”

The Tribunal continued at [34]:

“In the Practice Recommendation, the Council were being asked to achieve 90% compliance – the ICO did not state this was only in relation to the new applications, we note in particular that the ICO did not explicitly exclude the backlog from this 90% target. We have particular regard to the fact that a vast number of messages were exchanged between the parties specifically on the subject of the backlog before the enforcement notice was issued.”

The Tribunal recognised, at [33], that an enforcement notice is not issued solely because a public authority has failed to comply with a practice recommendation and that there is no requirement that the failures to comply with Part 1 of FOIA must have been explicitly raised in a practice recommendation. [33] An Enforcement Notice is not something to ensure compliance with a practice recommendation issued by the Commissioner; it is a tool to ensure compliance with Part 1 of FOIA and carries with it the potential of being dealt with as if in contempt of court if it is not complied with.

What, I think, is far more significant than the overall result in this case, is what the First-tier Tribunal stated at [36] of its decision. It challenges directly a complaint that is often made by stretched public authorities when it comes to FOI: that takes resources away from other areas. Some public authorities continue to see FOI more as a “nice to have” rather than a core statutory requirement. The First-tier Tribunal states:

“We accept the difficulties public authorities have in allocating their scarce resources we accept that complying with these requirements takes resources away from other areas, however the requirement to do so is a regulatory requirement and relates to the statutory right of applicants. It is vital that a public authority abides by such requirements. Significant delays can cause real difficulties to applicants, who often need information within a particular period of time for important reasons.”

This is a clear reminder from the First-tier Tribunal, some 20 years after FOIA entered into force, that FOI is part of every public authority’s core functions. Both FOIA and the Freedom of Information (Scotland) Act 2002 contain carefully calibrated provisions to ensure that FOI spending doesn’t present an unacceptable level of burden on a public authority’s resources; the balance between spending on this core function and on other core functions has been struck by Parliament in the legislation.

_{Disclaimer: This article is for information purposes only and nothing in it should be taken as constituting legal advice.}
The Data (Use and Access) Act 2025: Implementation Begins

July 28th, 2025

After much procedural back and forth between the House of Commons and the House of Lords, the Data (Use and Access) Act 2025 (“DUAA”) was enacted by Parliament back in June. The vast majority of the DUAA requires to be commenced by way of Regulations made by the Government and so its implementation will happen in tranches. On 21 July 2025, The Data (Use and Access) Act 2025 (Commencement No. 1) Regulations 2025 were made bringing into force, with effect from 20 August 2025, a number of important provisions of the Act pertaining to data protection. The provisions of the 2025 Act which are coming into force are set out in Regulation 2. There are provisions coming into force on 20 August 2025 which I think deserve particular mention.

Court’s Powers in subject access and data portability cases

The newly inserted section 180A of the Data Protection Act 2018, inserted by section 104 of the DUAA, will be in force from 20 August 2025. This provision relates to proceedings brought in the courts concerning subject access requests under Article 15 of the UK GDPR, section 45 of the Data Protection Act 2018 or section 94 of the Data Protection Act 2018 as well as data portability rights under Article 20 of the UK GDPR . This was a provision that I was surprised was not commenced right away, but it is in the first tranche of provisions to be commenced by way of Regulations.

Section 180A of the 2018 Act will, from 20 August 2025, give courts the power to require a controller to make available to the court, for inspection by it, information which is available to the controller where there is a dispute about whether the data subject is entitled to that information under those data subject rights. It also provides, expressly, that until the substantive question of whether the data subject is entitled to the information has been determined in favour of the data subject, the information made available to the court under this section is not to be disclosed to the data subject or their representatives (including by way of recovery of documents). The court cannot require the controller to carry out a search that is more extensive than the reasonable and proportionate search which the controller would ordinarily be required to carry out.

This provision is important because courts could very well be required to consider whether personal data has been properly withheld and, in the vast majority of situations, they cannot (certainly at first instance) really be expected to do so without seeing the withheld information. Supplying the withheld information to the data subject would defeat the object of the proceedings and so, it cannot really be lodged with the court (at least in Scotland) in the normal way.

Consideration will need to be given as to how these procedures will work in practice to avoid issues arising under Article 6 of the European Convention on Human Rights. If the court is going to be determining issues in relation to material that only it and one other party has seen an issue of fairness arises. There may well, in the future, be an Act of Sederunt setting out a procedure to be followed in the Scottish courts, but whether one will come and whether it will be in place in time for the 20 August 2025 remains to be seen. Controllers who find themselves on the receiving end of a section 167 application which challenges the application of exemptions in the context of a subject access request (and those representing them) will likely need to turn their minds early to whether an order under section 180A will be necessary and, especially in the early days if there is no Act of Sederunt, have suggestions as to how the process can be conducted in a manner that is Article 6 compliant and which does not restrict the principles of open justice any more than is strictly necessary.

Duties of the Information Commissioner in carrying out his functions

Sections 120A, 120B, 120C and 120D of the Data Protection Act 2018 will also be coming into force on 20 August 2025. Section 120A is worth particular mention because it provides that the Commissioner’s principal objective when carrying out his functions under the data protection legislation is to (a) secure an appropriate level of protection for personal data, having regard to the interests of data subjects, controllers and others and matters of general public interest, and (b) to promote public trust and confidence in the processing of personal data. However, this is somewhat tempered by section 120B where the interests of data subjects, other than children, are completely absent.

Sections 120A, 120B, 120C and 120D, at the time of writing, do not appear on the version of the Data Protection Act 2018 published on legislation.gov.uk and so reference will, for the time being, need to be had to section 91 of the DUAA for the wording of the sections. Hopefully, the version of the Data Protection Act 2018 on legislation.gov.uk will be updated to include these provisions before 20 August. Whether these provisions will have any material impact upon the way in which the Information Commissioner regulates and enforces under the UK GDPR and Data Protection Act 2018 remains to be seen, but I suspect that they will not.

Establishment of the Information Commission

The Information Commission will also formally be established as a body corporate on 20 August 2025. It will not, however, replace the office of the Information Commissioner on that date. The provisions of the DUAA which are coming into force with respect to the Commission are those which establish it, not the assumption of the Commissioner’s powers.

With the Commission being formally established, it will allow the necessary preparatory work to be undertaken to enable the Commission to get into a position whereby it can assume the powers, duties and responsibilities of the Information Commissioner. It will allow, for example, the appointment of non-executive members of the Commission by the Secretary of State under Paragraph 3(2)(b) of Schedule 12A to the Data Protection Act 2018. John Edwards doesn’t need to be appointed separately as Chair of the Commission because he will automatically, by operation of law, be the first Chair of the Commission as the person holding office as Information Commissioner on 19 August 2025 (unless something dramatic happens in the next 3 weeks or so).

Amendments to the Privacy and Electronic Communications (EC Directive) Regulations 2003

Some, but not all, of the DUAA amendments in relation to Privacy and Electronic Communications (EC) Directive Regulations 2003 (PECR) are coming into force on 20 August 2025. Regulation 5A(2) will be amended to require notification to the Information Commissioner of personal data breaches under PECR to be made without undue delay “and, where feasible, not later than 72 hours after having become aware of it.” Currently only the “undue delay” requirement appears in Regulation 5A.

^{Disclaimer: This article is for information purposes only and nothing in it should be taken as constituting legal advice.}