Speaker 1
0:02 – 26:17
twenty twenty six. I'm David Hamilton. I'm the Scottish Information Commissioner. I don't I don't know why I always end up speaking, at conferences on FOI in in England after Scotland thumped England at rugby. So having alienated most of the audience, let me carry on. Okay. So Scottish information regime is a totally separate to The U the rest of The UK's one, And it's a bit confusing. So let me just have a quick, recap of this. As you'll see, if you look at the lower part of the section, you've got the, Freedom of Information Act 2,000, which you're all familiar with. And, of course, you have the GDPR and the data protection legislation, which is UK wide. The difference is that in Scotland, we're because we have a devolved Parliament and devolved powers, which is essentially things like education, health, policing and so on, a lot of these things are controlled by the Scottish Parliament, under Scottish legislation, they have Scottish public authorities, and therefore the FOI system is administered by the Scottish Information Commissioner, I. E. Me. So that's that's how it works. We have legislation which followed two years after, the the I was drafted two years after, their legislation the rest of The UK, but they actually started at the same time, or more or less, so in in 2005. So it's it was when it was designed, it was designed to be FOI plus or FOI plus, which may explain some of these things. And what I've been asked to do today is just to give you a quick update on that and actually try and draw across some of the other pieces which we've heard today from some of the other speakers who have been fantastic. I've really enjoyed their inputs this morning, and actually just show how sometimes actually using legislation internationally as as almost with what we're doing here, you can actually also use that to get information, so, you know, from within The UK. Okay. So in terms of the Scotland position, twenty years going, we've had one and a half million requests in that time, and some good news stories. You know, consistently, 87% of the authorities, of which there are about 600 or so, are answering those requests on time. So each time request answered in time. And on those 83%, some or all of the information is supplied. So, I mean, generally, that's a pretty good news story. About 0.7% of these cases do, however, come to my office and that's resulted in 10,000, nearly 10 and a half thousand appeals now. We've issued 4,000, probably a bit more than that now, again, 4,500 decisions. And, again, a breakdown there is 35% for the public authority, 37% for the request, and 28% for a bit of both. So that's that kind of breakdown. I've only got 11 investigators, which is a challenge, and we've got to try and get through a lot of a lot of good work there. Okay. How do I know all this? Well, this is a a dashboard which we have on our website. You'll see at the bottom, foi.scott/statistics. This is a piece of information which has been a bit of a game changer, actually, because when it was introduced, we started asking public authorities to submit data, who are they dealing with f o I and what their returns are. And that's given us a a dashboard that's, gives us a lot of intelligence, in terms of what the system's looking like. You can go to the top, left, you'll see the authority, there's drop down list, you can pick out sectors, you can compare yourself within that, and you'll see those little red lines and so on. Individual authorities can compare themselves to other where the sector average is and indeed other areas. And there's actually a map, which is a it's blank here because of a screenshot, but there's an interactive map there. Individuals can see what their local public authorities are doing, how they're performing, and research that. It's an absolute rabbit hole of information. So if you love data, you'll go in there, and I'll see you next week. The you'll you'll see also we've this is relating back to the last, you know, last eight quarters at the bottom, last four quarters at the top. So a 109,000 requests were made in Scotland, in the last four quarters of data. We're just about to release the next one. You'd expect to see that going flying up again. But the one of the other things I wanted to point out here is, for ourselves is, you'll see in the bottom left corner that there's a red line, which is has seen a sharp increase. Now in Scotland, we have a process whereby as soon as you make your request, if you're not happy with that, you can ask for a review. That's part of the the process. It's not a complaint. It's a part of the FOI system as you take a review, and we won't even look at it until you've had your request, a review, and then it comes to us. So why don't we see this these reviews going through the roof? Because many reviews come to us, that was a early heads up to us that problems coming, and I'll come on to that in a minute. So the differences themselves, as I said, this is meant to be FOI or FOIA plus, and I want to just highlight a few things from that. So first of all is the harm test. Now disclosure would cause a harm to a particular interest is, is the kind of definition looking at it. But under The UK, it's prejudice, but in Scotland, it's substantial prejudice. So immediately what we're doing here is the harm test for exemptions is a lot higher. And that, again, is something that can it's it's a subtle difference, but it's actually quite significant in terms of how we view, the arguments that are being made in terms of exemptions. And the substantial praise we've defined as real, actual, and of significant substance. So again, we're just putting that level up there. It's a high bar to use, the exemptions in Scotland are higher, but anyway. Looking at a timescales, much more tightly defined. As I said, it's twenty working days to respond to requests. That includes the public interest test. So whole thing done and dusted in twenty days. If you're not happy with that, you can ask for a review. Twenty days for the review, and then after that, you've got the opportunity to to report it to ourselves. So again, it's a, much, much faster, process, much more slightly defined process in terms of getting requests done as early as possible. Our cost limits, again, are different because all public authorities have to be the £600 threshold. It's not just a central government, and again, it's the how that breaks down. The maximum charge for staff time in Scotland is £15. I think it's £25, in in The UK. So it's it's the cost thresholds are different, and, again, you've got to do a a later point. So the authority has to, has a different level here that's better for the applicant in terms of getting this. And some to be honest, the a lot of the authorities think it's unfair because that's not changed in the twenty years of the legislation. And I've got a degree of sympathy with that because there's very few people, to be honest, in in the workplace are working at £15 per hour. So that may change, but that's something that the parliament has chosen not to do yet. It may do in the future. Okay. Appeal routes. In Scotland, we don't have tribunals. We just have, essentially, an appeal straight. If it comes to me and I say this, if you wanna appeal my decision, it goes straight to the court of session. Now that's quite a significant challenge because you're talking about a £20,000 bill, just to get it there, plus the admin and expenses of the other party. It's pretty cross prohibitive for a lot of people, but it's something that, it's it's the court session. It's the highest court in Scotland. That's where it takes us, what what what again, the way the system's been designed. A few problems, though, and the Lord Advocate and Crown Office, are not fully covered, and that's particularly a problem at the moment because in Scotland just now, there's a huge fury about transparency and and the issue of the Lord Advocate and how the, their relationship with the first minister because they're the dual hat in terms of, powers, as a member of the government, but also an independent prosecutor. So there's a bit of a challenge there. Not fully covered by by Scottish FOI. I've well, that's in The UK, of course, it is. If somebody wants to appeal my decision, if they're as a corporate decision, then, again, they can't do that to me. They have to go to the court session, which is, again, you might be thinking, why am I asking for that? But I just our organization thinks it's the right thing to do, that there should be an extra stage in there so that, people can challenge it. And they we also can't require the publication of datasets. We've got a model publication scheme, which we've produced. It's well, well out of date, and it's something that we hope we can see change because there is a bit of a again, quite a lot of discussion, and I'll come on to that about the reform bill, for for FOI. Okay. So, what that leads to is essentially gives us a position, in a kind of global context. You'll see here, this is created by the Canadian Centre for Law and Democracy, and it essentially takes legislation and, a kind of paper exercise that says, how are people doing, across the world? And you'll see there that, you know, some of the more established, regimes, Western Europe, and so on, are pretty poor in terms of this, whereas some of the more emerging democracies in a better position. There's always a bit of a a charpel with this because the the highest and best RTI rating, right to information is achieved by Afghanistan, which, of course, on paper is the case, but in practice, I would question whether that's still the case. But, again, this is about looking at a on a on a legislative perspective only. And in that basis, Scotland ended up getting, a score of a 102 out of a 150, which is which, although the highest in Western Europe, is still not the best by by any means in terms of the the global picture, whereas, the rest of The UK ended up with 92. And, again, that's not surprising because Scottish system was designed to be more transparent, but there's still a bit to go. FY reform bill. This is a some a piece of legislation that's been talked about for quite a while now and, has now coming to a kind of an extraordinary stage this week. So when I start first thinking about these slides, I was thinking, well, not much point spending much time about it because it's dead in the water. Well, apparently not, because when it went to the Scottish Parliament, despite the recommendation of the lead committee, the Parliament said, no, we're not. We want to have this bill, and they decided to keep it on the statute books, and it will roll over to the next session of this, Scottish Parliament next year, which is, I mean, I'm absolutely delighted because not at least because we've done a lot of work on this, but also it's what it's doing is it's strengthening and and, enforcing kind of, maybe servicing, a bit of legislation that, although 20 years old and in good nick, it still just needs a little bit loopholes closed and a few more things reflected in it. These are the the kind of headlines from it, strengthening the presumption in favor of disclosure, self explanatory, expanding designation power so that more people come under f y law. Now we've got, again, quite a quite a wide spectrum of that, but there's not been many designations as of different organizations that come under the FYI legislation, and that's because it's got to be down come down to government. So it was proposed just to look at the parliament being able to take a role in this and to put forward designations and into different sectors and so on. We're very, very keen to see, and people are very keen to see as the landscape changes, where more and more sort of public services are getting outsourced, that FOI follows that and follows that public pound as much as possible. And there's a lot of discussion about how can we do that, can we should we have gateway clauses and so on, so that it makes it strong? But the difficulty is that as as we feared would be that as a regulator, we would just spend our time looking at whether something qualified or not, so it'd be better just to to have a regular refresh of the organizations that are covered. Interested in statutory duty for proactive publication, and I kinda mentioned that earlier. This is about being proactive, a duty to publish. And we would then, establish a code of publication, and that would be for different sectors to provide information. And, again, my my question earlier was asking about standardization because this is one of the unintended benefits, if you like, the spin offs of it would be actually there is no definition of a pothole. So if you go to any county council, a local council, they I mean, portals have you got well, is that two inches, three inches, or four inches? And there's and how you know, that that's the type of thing that some standardization that's would actually help everybody, not least in their own in their own sectors. Even a country that's got a housing emergency, we don't have, a definition of what social housing is. And, again, these are the types of things that we can see a standardization would be very, very helpful. In terms of information, commissioner's powers, again, this is just from experience, been looking at things, it'd be good to be able to interview people and to speak to people and require that have that power to to do things in a way that is not there just now because we, to no surprise to you there are there are some organisations that are divisive and you need to actually have a bit of clunk and a bit of teeth about you, so that would be helpful. We also think that, our practice recommendations, which are currently voluntary, should be enforceable, legally, and that if we say you need to do this, rather than saying, yeah, we might do it, we might not, then the practice recommendation becomes something that if they don't do, it's contempt of court. The requirement to appoint an FOI officer is mirroring the data protection officer, sort of role, and it's something that I think we we recognized could be done by these same people. But essentially, what it does, it does it gives it, FOI, the same status and same attention that the DPO, has in an organisation, and again this is something that came from from, the the FOI officers themselves. They could be helpful to have that equality of arms. Close loopholes and destruction of records and extend offences, I think we've got a similar offence to what you have in UK, but, essentially, in Scotland, we have an offence whereby if you destroy stuff during your request, it's a criminal offense. But we would actually like to see that extended so that it's, if you if you destroy data to avoid it being FOI able, then that's a that should be something that's a criminal offense. Now there are big questions regarding the records retention with that, discourage and and, sort of, great against data protection and data retention things, but these are all work out, you know, we can work these all things out and I I hope we will do in the next session. And then finally, we've got still got first minister's veto power for certain exemptions and, we'd like to see that get used. It's never been used, we'd just like get get rid of it, and again that would be something that would be, again, stronger for democracy. Okay, this is, I'm showing you this because I just need to demonstrate something about the impact of demand, this is our caseload, which we publish on our website. You'll see that the website there, you can have a look at it yourselves at any time, and, essentially, the main thing to look at here is the red line, which is a rolling three month average of cases coming into our organisation. And you'll see, we talked earlier about April, it just went nuts. What what was going on there? Not entirely sure what that is. A lot of it seems to be a bit annoying because economic things are are pretty tight and services are getting cut. But you're all we're also getting feedback that because we're making an impact with FOI, people are beginning to become more aware of it. We've just done some awareness polling, which shows public awareness of FOI is through the roof. I'm not allowed to say what it is because my team will kill me, but, it'll be released released next week, but it's it's absolutely stratospheric in terms of, increases and awareness of that. And as people see their rights, they're happier to use those rights. So we're seeing a lot more of that. We're also seeing, the the impact of AI. And these yellow cases were two cases that were all AI cases. That's the difference it makes just having two cases that were AI. Now we knocked them out, and that's so we're in a through a different ways. But you can see that suddenly we're hitting a battle of machines where we're getting swamped by things. And when you start drilling into that and looking for the impact that that's gonna make, in terms of the burden upon our office and our, our people, it's it's it's absolutely astronomical. So you can see that's really having an impact on us. So in terms of AI and, you know, full disclosure, I used to be an AI engineer, so, which is probably, not something you should be too proud about. But anyway, but I I did this study this a long time ago, and actually when I studied it, it was called artificial intelligence and pattern recognition. I wish they got just kept up the pattern recognition, but I'm not the artificial intelligence because it is not intelligent, it's just following patterns. And when people understand that, they will understand why they shouldn't use it in the way they are using it. So spell check, Grammarly, all these types of tools, those are artificial intelligence. I'm just going to use that. It's me falling into the trap already. Essentially, it's looking at the patterns and it's sorting it. So something that's been around for forever, and is actually embedded into so much of our many of our systems. You can't do a Google search now without getting any AI search results returned to you. So it is coming in all the time, but it is riddled with errors and prejudices. And what I want to do is concentrate on what how people are using it to contact me as a regulator. And what we're looking at here is that it it just lacks those vital human elements. You never get a thank you for your response to this. It's angry. It's aggressive. It's trying to follow a particular line that has been fed into it at the beginning, and you see that percolating all the way through. What we're seeing is people starting with a case, often it's an AI that suggests, so can you tell me how many impacted potholes there are in the City Of London? I will say, well, I don't have that information. Do you want me to do an FYI request? Yes. Here's your FYI request. Do you want me to email it to somebody? Yes. It goes. You get the answer back. Don't have the information. And then it's, do you want to appeal that or complain about it? However or in Scotland, it was coming back to do you want a review? It goes to review. They get this review back. Do you want me to put it to the commissioner now? There is no human interface within this. It's automated. It's a machine who you're negotiating with. It It might have a human at the back of it who's got a name at the bottom, but it's not a human you're dealing with. And that's one of the big problems we have here is that we don't have a machine to fight the machine. As humans are having to do that, we're having to use existing legislation, existing rules to try and and, manage it. So so far, we've we've knocked some out for being invalid because people won't engage on those 60 FOI appeals they put to my office. They won't engage in it. Well, I'll give you an aggregate. No. What for every single one. I'm not doing that. Okay. That's invalid. We're getting rid of it. Some of them are vexatious. Some of them are frivolous. Another option we've got, but it's a real real problem for us as a regulator and not just, for myself and and for Darren's team, but for all regulators across the, the sector, and I meet with them, probably two, three months. In fact, there's a meeting today, about this, and we're we're trying to find ways that we can deal with this and manage it because every time we get swooped into one of these mega cases with AI, it means that we're not able to deal with the other cases of the people who are taking their time making no. Yeah. That that's a problem. And the other part, yeah, the denial of service attack, this is something, again, like, my eyes are very much, focused on. I'm beginning to suspect there are some bad actors, shall we say, that are out there in terms of doing this because you can swamp it. We've seen it in America, and there's no reason to say why it wouldn't come here, so super alert to that. Are people going to try and swamp the system as they're doing in Ukraine, where Russians are currently swamping the system with FOI requests to try and slow up the system, the bureaucracy? So aware of it and it's something we're monitoring with others. Other areas, we've got an extension to the care sectors or extension of the FOI provision to the care sector that will bring, I think, about 3,000 care organisations into play, under FOI and, again, this is the problem where, traditionally, if a local authority had a nursing home, you could ask them for how many nurses were on on a particular date and they would give you an answer When you have a outsourced version, how many were on? Says, well, contractually, they should have five on. That's that's not what I asked. I'm asking how many did they have on it, but they're not covered by that. So extension to the care sector would mean that private sectors, private providers would be brought into that umbrella, and, you'd have the same rights of information that you would get had it been a local authority home, as as it used to be. The revision of section 60 code, which is our code of practice, we're currently going through that just now, and that's gonna, again, just gonna be some more clarifications and, tighten up on a few bits and pieces, but that's under out for consultation. And finally, on interventions, this is where we're going upstream. We're looking at the problems using that graph we had at the beginning, of our dashboard, seeing where we see individual authorities having problems. I mean, using that as an intelligence system to allow us to say, you're struggling here. What's the problem? Usually, it's because they're not supported by senior managers. So that then means I go see the senior managers, the board, the chief executive, say, you fix this. Otherwise, there's pain coming your way, and they fix it. That's essentially how the interventions work, and it's been very, very successful because everyone hates us coming in to start it, and they're sorry to see us leave because the the journey is usually a very positive one where FOI teams feel totally supported at the at the end of it, and they have a status in the organisation that is, that is much, much better than it was. And finally, there's one question, and I don't know if this is recognized down here, but why is everyone so angry? The the public discourse in Scotland is absolutely it's polarized. I don't know why that is, but, it's been mentioned, that, one mentioned earlier on in terms of what we see, not just to our own staff in terms of the the the kind of discourse, public discourse, but also from people speaking to public authorities and so on. And, actually, public authorities as well being pretty rubbish to, requesters, and it's something that I'm always urging the public authorities at least to try and bring the tempo down, try and be the bigger person, but it applies equal to requesters in terms of keeping it civil, keeping it sensible, and having an understanding of that. There's a lot of pressure out there for people, but, I think we do need to sort of try and just reset some of the the atmosphere. So, conclusion, Voisier, good place. It it is generally, but it needs a little service, a little tweak, and that's what their their reform will hopefully do. Transparency is gonna be a massive thing in Scotland with this election. We've got, Scottish Parliament elections in May. The phrase secret Scotland is now almost every day on front pages, because people are talking about different authorities, not just government, but, NHS boards, local authorities, all keeping stuff secret. Now whether that's fair or not, that's for others to judge. I only look at individual cases and take that on board, but it's becoming a massive, massive electoral topic, and I suspect, heavily in in voting intentions. To be honest, I'm quite I'm optimistic, refunding our expanding our interventions capability, but having a dedicated resource to that, and I think that's one way that we can help try and cut down our problems, in terms of a demand management. The expansion to care sector, that'll probably be next year. That'll be, again, quite significant, but, again, it was mentioned, I think, one mentioned today about that. But we last time we did an expansion, we brought in registered social landlords into the Scottish regime. They've said, we can't do this. It's gonna cost a fortune. It's gonna have huge problems, but we supported them, trained them up on it, got them ready for it, and they're our best performing sector. And they all and they've all we surveyed them before, surveyed them after, and said, this is much better than we thought it was gonna be. And that's actually a kind of poster, poster sector, if you like, for for the care sector now. So, yeah, business is booming. And to do a little bit of a break, but, here you go. There you go. That's it. So So that's me folks. Thank you very much. So I will take a round of questions from the audience.