What next for FOI?
In this panel discussion from FOI Fest, participants discussed the challenges and opportunities for Freedom of Information, including how AI is increasingly a problem – but could also be a solution – for authorities.<br>You’ll hear from:<br><br>Louise Crow, Chief Executive, mySociety<br>Ben Worthy, Senior Lecturer in Politics, Birkbeck College<br>Carole Ewart, Director, Campaign for Freedom of Information in Scotland<br>David Hamilton, Scottish Information Commissioner<br><br><br>Please fill in our short survey to help us understand more about why and how you listen!<br><br>Transcript<br>0:00 [Gavin Freeguard] Welcome to FOI Fest 2026!<br>0:06 [Alex Parsons] So, to split this into two sets of questions. One is around the FOI reform in Scotland, and the other is this ongoing conversation of the day around technology and AI. (more…)
Top Keywords
- scottish 0.015
- requests 0.014
- government 0.009
- scotland 0.009
- information 0.009
- scottish government 0.008
- request 0.007
- freedom information 0.006
- assisted 0.005
- bill 0.005
- survey 0.005
- making 0.004
Transcript
Welcome to FOI Fest twenty twenty six. So, split this into two sets of questions. One is sort of around, like, the issue of reforming Scotland, and the other is this ongoing conversation of the day around technology and AI. So to start with, I was gonna come to Louise on, like, what are the opportunities, challenges for change in technology and FOI?
Thanks, Alex. So I think the first thing to say is that times are changing in lots of different ways. And when we think about the future of FOI, I want to zoom out a little bit and talk about, democracies, democratic institutions, democratic practices around the world being under an enormous amount of pressure. So in Hungary, the news organization that runs their equivalent of What Do They Know just had a legal victory where they had to take their government to court for falsely claiming that they engaged in espionage activities. So I just say that as a reminder that a society where we feel unsafe or illegitimate to ask questions of power is one where we genuinely are a little less safe, and we all feel a little bit closer to that fear of the knock on the door in the middle of the night. We're also in the middle of a changing physical environment. We heard from climate emergency early today, And one of the other big batch requests recently on what do they know is, about flooding provisions to, enable, newly flooded communities to understand the planning in their area. And after forty two days of rain with 71 flood warnings across The UK, That also feels like very relevant and concrete work. So what we're seeing here today and what I think the FOI bigger story is, is of an ecosystem of actors both making and answering requests and the regulators who are engaged in vital democratic practice. And I think it's good to recognize that spreading the power of information, and we're an information society now, is protecting us against a lot of threats and helping us understand and deal with new challenges. So, having said that, coming back to sort of the narrow question about technology, I'm not gonna say too much about AI and making requests because I know Ben has some some new information to share with us there. But I think that question, David put it really well, the war of the machines is a pattern we're seeing in lots of different areas where there is a sort of adversarial element. You're getting this focus on increasing amounts of adversarial text outputs and not focusing on the outcomes of the system. The reason that you're doing the whole process in the first place and, in what do they know, which was really that first FOI making technology, I suppose. We try to get people the information that they need as quickly and cheaply to everyone as possible and then distribute it as broadly as we can. So it may still be surprising to say that most of the people who use WhatDoTheyKnow don't make FOI requests. Each request is viewed 160 times or more. So most of our users are consumers of information who may not even know that it has been generated, through FOI. So, and and if we do, if people do need to make requests, we kind of focus on getting them to make a very clear request that's likely to be responded to. So I do think we need to think about how we can use AI to improve the overall outcomes of the system. And that means looking at things like proactive publication, looking at responding to requests, looking at making good requests. But I think it's that sort of global view that is gonna help us get out of what I hope is a kind of temporary situation where we are now. I did want to talk briefly about AI being used in democratic decision making because that is another change that is happening. So the UK government is spending quite a lot of money at the moment on AI systems, and they are being mostly procured from big multinational private technology companies. And I think there is a risk of gaps opening up in transparency and understanding and accountability there in part because of the nature of generative AI and LLMs where the, the processing they go through is implicit. It's based on data. The data is largely not available. And so we know that FOI has been a very good tool in uncovering algorithmic decision making. I think it's necessary but not sufficient. I think we also need to look at record keeping and, ways that we can make sure that government and suppliers to government make records about the effectiveness and the impacts of the systems that are being used in government. So I think that's a really important area to watch. The final thing I want to talk about is technology being used in responding to requests. And I really got onto this because I was thinking about that AI in democratic decision making. I thought I'll go on to what do they know, and I'll see what people are asking about AI. And the first request stopped me in my tracks, because it's, the requester is Robert Booth, and he's sending a request to the Department of Work and Pensions. And he says in your annual report, you say that you've got a lighthouse generative AI program, and you've got four governance groups, and you've got a register of projects and a risk register. And I'd like to see the minutes and the reports, and the membership of these governance groups and the risk register and the list of projects. And that gets refused under the cost threshold. And the responder says very clearly, we could not find this information in three and a half days. We could not find this information in three and a half days. And I was I couldn't understand this as a technologist. So I think there is a real opportunity to get basic information, finding systems in public authorities. And that doesn't have to be AI driven systems because this isn't rocket science. But if the Department of Work and Pensions, who are a big government department, who are responsible for decision making about super vulnerable people, if they can't find their AI governance documents in three and a half days, how are they going to make those decisions effectively? So I think there is that opportunity to look more broadly. And if there is a sort of burning platform platform around volume, and we've heard lots of evidence that there is increase in volume, and we have yet to see how much of that is due to AI across the board. But I think it's really important that we move forward from that platform instead of rolling backward. So I'm gonna pass to Ben to bring a bit more color to that aspect.
Thank you. All I'm gonna do is tell you a little bit about what I've found out about AI and FOI, and in particular, what I found out about requesters using AI to make Freedom of Information requests. So firstly, if anybody here is an FOI officer in the local government, either online or in person, thank you very much because this is based on two surveys of FOI offices. The first one was done last year between January and March, and the second one is still open now and has been filled out by almost the same number as last year. And the inspiration for this, as was mentioned by David and and also before, was the stories particularly from The United States about these kind of denial of service attacks, assisted by via by AI or created by bots, which are overwhelming public bodies or can potentially overwhelm public bodies. One of the big concerns was that it would be used, by Republicans to overwhelm, for example, electoral officers who are covered by freedom of information laws in The US. This all comes with a very big proviso, though, that, firstly, it is very hard to tell if a request has used or drawn on AI in any way. And secondly, it's very much a moving target. I think as a Scottish Commission's recent survey showed, people are only at the beginning of using AI regularly and how they use it. With that in mind, here are my five findings from last year's survey and this one, which is still ongoing. So last year when I asked, FYI offices in local government if they thought that they had had requests which were assisted in some way by AI. 30% of them said yes. This year, almost 70% of them said yes. The second issue is has there been any kind of waves or denial of service tax? So far, it doesn't look like it. But what has happened, FOI officers reported there's been kind of surges of uses. So they'll have kind of 18 or 20 requests in the space of twenty four hours or in the space of a few hours. They estimate that when I take an average of of of the estimates that they give of what percentage of requests are AI assisted, the average is 4%, which doesn't sound like a lot. But if you kind of fold in the fact that requests are already increasing and resources are already limited, actually 4% can have quite an impact. Even more importantly, particularly in the survey from what I'm seeing this year, they're reporting that AI is being used for internal reviews and appeals, which is, by its nature, gonna be more kind of complicated. How do they know? Well, they're reporting that one of the difficulties is AI assisted FOIs are extremely long. They're very difficult to understand. It's even difficult to know what exactly the request is, and they're very verbose. So they're taking on in kind of qualitative terms more time. Although a few people I've got to say have said, actually, those with AI assistants are clearer and more focused in some ways, than the others. So far, FOI officers are saying the main thing that they're using when they get an AI assisted request or possibly a bot is that they're using section eight to ask about the request identity. But a few are now reporting that, you know, some of these are coming against the cost limits or they're using the kind of advise and assist provisions. And just finally, on a positive note, we are also getting feedback from this survey to say that they can see how actually AI can have the reverse impact and make for more efficient requests. And also, there's a few mentions that their organizations are starting to use AI for, freedom of information request processing.
Thank you. Carol, can I ask you a question about, like, what do you think the barriers are to change in Hawaii?
I would say government, number one. I have to say that, there's been a lot of talk about the benefits of Scottish legislation, and these kind of events are very welcome for me to remind me that the Scottish law is very good, because a lot of our work is focused on the deficits and the broader environment of FOI in Scotland. For example, the Scottish Government has for nine years been subject to a level three intervention from the Scottish Information Commissioner, and in fact successive Commissioners. It's not just the latest one. And you're supposed to lead from the front, or lead by example, and that is a very poor situation to be in. And they have, over that period of time, in 2018 they agreed an Action Plan, and the reason it's ongoing is the Action Plan is still not being delivered consistently. They have improved, then dipped, improved again, then dipped. So, to answer your question, Government is a problem. And just recently on the Bill, the Freedom of Information Reform Bill, the reason it was a Member's Bill at the Scottish Parliament was because the Scottish Government had declined, refused to bring forward legislation, despite after a parliamentary committee, in the last session recommending in May 2020 that it should bring forward reform. They didn't. The Committee's Legacy Report of 2021 urged them to do so in the next session of Parliament following the elections. They refused to do so, so that is why a Member brought forward the Bill. And when the General Principles were being agreed, one of the Scottish Government's reasons for opposing the Bill, the Progressive Bill, it was because Scotland's got a better law than England, or sorry, the rest of The UK. So that's not really the the qualification that we're looking for. We're looking for a qualification of an exemplary law, and there's an opportunity to do a whole lot better. I do think there are other blocks to FOI. We appreciate the reputational benefits of it, But one of the issues in Scotland is that the third sector have shown reluctance to use it. It's seen as aggressive and adversarial, and that is a source of, great disappointment to us. And in fact, the first Commissioner in 2007 realized it was such a problem that he commissioned some research on that, and I think, that that is also a problem. Going back to the issue of the the Scottish Government, it is rather irritating, when you go and have global conversations that people celebrate the Scottish Government's role in OGP and because they are active supporters of it. But I would just remind you about the Level three intervention ongoing for nine years. So, just to talk a wee bit about, in Scotland, I do think one of the benefits, going forward for the Bill and also the designation of the care sector is the collaborative nature of a lot of the work that goes on in Scotland. The divide and rule approach does not work, and one of the things that we in the Campaign for Freedom of Information, does is host the Scottish Public Information Forum, and I would certainly celebrate that as a model that perhaps you could replicate elsewhere. It's when the Scottish Information Commissioner, the Scottish Government, UK ICO, the public, FYI practitioners and other stakeholders get together twice a year to talk about FYI, and I think that's a really important way to share expertise and knowledge. And I know that the prompt for this event has been, the informal network. I was recently calling it the secret network because I knew nothing of it, so I'm really pleased that there is going to be the formalization of this network because I do think collaboration going forward so that we can learn from each other, is something to be celebrated. And also look at the global, we've certainly benefited from colleagues in Germany saying how that they, when there was a proposal to, abolish FOI law in 2024, the public, managed to stop it. And it was referred to earlier about Moldova. We've recently had contact with an NGO in The Netherlands who've alerted us to the fact that they're on an evaluation of their FYI law, and that would be nice to be baked into our laws that there is a periodic review, which, what they've said is it's going to include the oversight mechanisms. And that, always reminds me about one of the problems that we don't have is, strong enforceability of f o I rights because that's what makes them powerful, and that has to be a funded service as well. So I'm pleased to hear that the Commissioner is confident that there might be money for an extension of the interventions because we would certainly like to see prevention rather than, after the fact because I think that's an important thing going forward.
Thank you. David, any reflection on any of that? And also just to tag an online question to go on some of the carols. Does the fact that you're sort of, funded via the parliament rather than the government affect your relationship with the government or the parliament in any way, or is it a bit either way? I I think it's really important to have that distinction
that appointed by the king, nominated by the parliament. Government's got nothing to do with it. I think that's a really if nothing else, optically is the right thing to to be a space to be in. I mean, I I think the we actually have obviously have a very good relationship with with government and and have to. On one side of the fence, which is about the the sort of whole system perspective and policy and so on, we have a little thornier relationship in terms of, some of the, the practical delivery of of that, but we see them as two separate entities. And I mean, it's not personal, of course. It's just it's just that it's institutional grit, shall we say, when it comes to dealing with appeals and requests. But I mean, I think there's there's a I think as Carol says, it's important it's important to reflect that that the system is generally good. It's just needing to be better, and there's always room for improvement. And I think the what we're seeing just now is a few, bits where it'd be better to have wider things, better scope, and to stay reflect and evolving, our our evolving sort of political landscape, political a small p in terms of how services are delivered and, and so on. But I, with that, I just wondered if I could just go back on the the AI side of things in terms of a solution. Carol mentioned there about proactive publication, as as being something, and that's that's so important to to have that. And AI really gives a solution to that. And, you know, I think the, you know, nine we are drowning in data now. In the last two years, 90% of all the data we store in the world was generated in the last two years. That's, I mean it's staggering and we are on an exponential increase into zettabytes, that's one followed by 27 zeros, of data getting stored across the world in servers and you know, freedom of information only works if you can find it. And, you know, this is where the the real challenge I think has to be about, authorities not having to deal with requests, put it out there proactively, then you don't have to deal with the costs on it. I keep saying this to organisations, say, oh, it's just too expensive. Well, publish it. If you publish it, you don't need to you don't need to answer requests, you know, certainly not to the same degree. And, I mean, to be honest, if they were smart about it, they would actually be able to shape the data in a way that's better and give context to it as well, which would, would be helpful for everyone. But, there seems to be this secret Scotland that's where people are just naturally not wanting to do that. It's not just secret Scotland. I mean, it's it's a it's perhaps a human thing where you have a, that personal privacy thing rolls over to corporate privacy. But, we need to kind of get over that. And my challenge to people is, and I say I I, you know, more more guilty secrets from the past, I used to be a police officer. And I we looked at a project, we looked at the data which we held as a police force and discovered that only about 5% of it was actually sort of sensitive. In a tiny bit, everyone assumes that oh it's tons of stuff, well it's not really, it holds very little, most of it's just junk frankly. And you know you say could could you turn your your drive inside out if you could if you could redact all the personal information? Could you actually have an open drive? And that's the kind of question that people need to ask these questions. We've always we always do this in teams in terms of protection, protection, protection, but actually, when it comes to some of this information, maybe you're looking at it the wrong way. Let's look at it the other end of the telescope. And, you know, there's obviously there's a discussion needs to be had there because as long as we are just going protection, we make it harder and harder and actually just having stuff in open plain sight. And, you know, my my aspiration for my organization is that our corporate data is all online and it's live data. So that's why I've got my, you know, my bar graphs and report and stuff where we have our senior management meetings. We're sitting down, we're looking at that. That's what it was at 02:00 this morning. That's what we're looking at. We're not, we're making decisions upon that. We're not looking at a report that was prepared three months ago to approve it for publication and so on. It's out there. That's what that's what it is. And it's I mean, we can't change that. It just is what it is. The the big test is what we do about it, and that's what we're judged upon. So it's a a governance model. It's a way of thinking as an organization that I think we need to challenge a bit more as well. And when people move into that sphere, then you're in a much more open position.
Thank you.
We have just enough time to take a few quick questions to the audience. Would we Sorry, Craig? Yeah. It's not so much a question, just, just a comment. It's so heartening to hear David say from a public authority's perspective, you know, that I don't have to control a narrative about statistics. You know, I just put it there. It is what it is. That I think I obviously got I'm I'm a journalist, you know, died in the world journalist, But, that's that's what everyone wants. You know, that's that's what we're half the time when you're making a f y request, that's exactly what you're after. So, yeah, that's all I wanna say. Just just great to hear. Thank you very much to David's World's Palace. Thank you.
Hello to our most completest listeners. If you're still listening, thank you so much for sticking with this right to the end. I'm Miff from mySociety, and it's my job to put these podcasts together. And you know what? It would be really helpful for us to know a bit more about how and why you are listening to them. So if you have a moment, please do take a look at the show notes where you'll find a link to a very short survey. Survey. It'd help us so much if you could fill that in. Thank you.
