Freedom of Information in Scotland — FOISA 2002

1. What FOISA is — and why it is not the UK Act

The Freedom of Information (Scotland) Act 2002 (asp 13, usually shortened to FOISA) is an Act of the Scottish Parliament. It gives any person a general entitlement to recorded information held by Scottish public authorities. It sits alongside — but entirely separate from — the UK Freedom of Information Act 2000, which covers UK-wide public authorities and bodies dealing with reserved matters. Both regimes came fully into force on 1 January 2005, and both follow the same basic shape: a written request, a 20-working-day deadline, exemptions, and an independent regulator. Beyond that shape, the details diverge in ways that matter to journalists.

FOISA is enforced by the Scottish Information Commissioner, an independent office-holder appointed on the nomination of the Scottish Parliament and based in St Andrews. The Commissioner is entirely separate from the UK Information Commissioner's Office (ICO): the ICO has no jurisdiction over FOI requests to Scottish public authorities, and the Scottish Commissioner has none over UK bodies. Send an appeal to the wrong regulator and it will simply be rejected as invalid.

2. Which regime applies: FOISA or the UK Act?

The rule of thumb is simple: the regime follows the body, not the subject. A question about Scottish policing goes to Police Scotland under FOISA; a question about welfare payments in Glasgow goes to the DWP under the UK Act, because the DWP is a UK department. Schedule 1 of FOISA lists the Scottish public authorities covered, and Scottish Ministers have extended coverage by order over the years — registered social landlords, for example, were brought under FOISA in 2019.

One wrinkle worth remembering: data protection is reserved, so the UK ICO regulates UK GDPR across the whole of the UK, including Scotland. A subject access request to a Scottish council is ultimately an ICO matter; an FOI request to the same council is a matter for the Scottish Information Commissioner.

3. How to make a FOISA request

A valid request under section 8 of FOISA must give your name, an address for correspondence (email is fine), and a description of the information you want. It must be in writing orin another form with “some permanency” — FOISA expressly accepts requests recorded on audio or video, a small but genuine difference from the UK Act's writing requirement. You do not need to mention FOISA by name, give any reason for asking, or say that you are a journalist: an authority must handle any valid written request for recorded information under the Act. Authorities also owe you a duty to provide advice and assistance, including help narrowing a request that would otherwise breach the cost limit.

Requests to the Scottish Government itself can be sent by email or post; its request-information page sets out the contact routes and confirms the 20-working-day deadline. WhatDoTheyKnowcovers Scottish public authorities too, and publishes requests and responses in public — useful for building a paper trail, less useful for exclusives.

Drafting tips that apply with extra force in Scotland:

• ›Be specific about records, dates, and formats — ask for "the dataset as held, in CSV or Excel", and cite your format preference under section 11 of FOISA.
• ›Exploit Scotland's national structures: one request to Police Scotland covers the whole country (one force, not 43), and NHS Scotland runs through 14 territorial boards — a full national picture often takes a fraction of the requests it would in England and Wales.
• ›Check the authority's disclosure log and the Scottish Government's published FOI releases before filing — the material may already be public.
• ›Search the Scottish Information Commissioner's published decisions for the same authority and subject: a decision ordering disclosure of similar information is the strongest card you can play at review.
• ›If the information is environmental — planning, pollution, energy, land — expect the request to be handled under the Scottish EIRs instead (see section 6).

4. Deadlines and fees

Section 10 of FOISA requires a response promptly, and no later than 20 working daysafter the request is received. Crucially, FOISA has no equivalent of the UK Act's provision allowing an authority to take a “reasonable” extension to weigh the public interest test — a device UK departments routinely use to sit on contentious requests for months. Under FOISA, the 20-working-day clock applies even when a qualified exemption is being considered. If a Scottish authority blows the deadline, that failure itself can be taken through review and on to the Commissioner.

The fee rules also differ from the UK Act, and are set by the Freedom of Information (Fees for Required Disclosure) (Scotland) Regulations 2004:

Compare the UK Act: a single £600 upper limit applies to allScottish authorities (there is no lower £450 band as there is for non-central UK bodies), the notional hourly rate is £15 rather than £25, and Scottish authorities can in principle charge a percentage of costs below the limit — though in practice most, including the Scottish Government, choose not to charge at all. If you receive a fees notice, you have three months to pay before the request lapses, and a fees notice can itself be challenged through review and appeal.

5. Exemptions under FOISA (Part 2, ss.25–41)

FOISA's exemptions occupy sections 25 to 41 — different numbering from the UK Act, so never cite “section 40” to a Scottish authority expecting the personal-data exemption (in Scotland that is section 38; section 40 is audit functions). As under the UK Act, exemptions are either absolute or qualified. Qualified exemptions are subject to the public interest test in section 2: information may be withheld only if the public interest in disclosure is outweighedby the public interest in maintaining the exemption — so a tie goes to disclosure.

Two structural points favour requesters in Scotland. First, FOISA's harm-based exemptions require substantial prejudice, a higher bar than the UK Act's bare “prejudice”. Second, the list of absolute exemptions is shorter: only s.25 (otherwise accessible), s.26 (disclosure prohibited by other law), s.36(2) (actionable breach of confidence), s.37 (court records) and parts of s.38 (personal information) escape the public interest test. There is no Scottish equivalent of the UK Act's absolute security-bodies exemption — national security under s.31 is a qualified exemption. FOISA also lets an authority refuse to confirm or deny that information exists (s.18), and the First Minister holds a certificate power (s.52) equivalent to the UK ministerial veto, but far narrower — it is limited to information of exceptional sensitivity held by the Scottish Administration and has never been used to date.

6. Environmental information: the Scottish EIRs

Environmental information held by Scottish public authorities is handled not under FOISA but under the Environmental Information (Scotland) Regulations 2004(SSI 2004/520) — Scotland's counterpart to the UK EIRs. “Environmental” is construed broadly: emissions, planning, land use, energy, water, noise, and measures or policies affecting any of them. If your request touches these areas, the authority should apply the Scottish EIRs automatically, and section 39(2) of FOISA exists precisely to hand such requests over.

The regulations matter to journalists because their exceptions are generally more requester-friendly than FOISA's exemptions: every exception is subject to the public interest test, with an express presumption in favour of disclosure. The trade-offs: the deadline can be extended to 40 working days for complex, voluminous requests, and the charging rules differ from the FOISA fees regulations. Enforcement is identical — review, then the Scottish Information Commissioner. For the UK-wide picture, see our EIR guide.

7. Appeals: review, Commissioner, Court of Session

The appeal ladder in Scotland is shorter and more tightly time-limited than the UK route. The deadlines below are statutory — miss them and you generally lose the right to appeal, which is stricter than the UK Act's more elastic practice.

1. 1

   Requirement for review (internal review)

   Write to the authority asking it to review its response — you must do so within 40 working days of receiving the response (or of the date one was due, if it never came). Identify what you are dissatisfied with: the exemption claimed, the public interest reasoning, a fees notice, or silence. The authority has 20 working days to complete the review. Our internal review template adapts to Scottish requests — just swap the section numbers for their FOISA equivalents.

2. 2

   Appeal to the Scottish Information Commissioner

   If the review leaves you unhappy — or the authority ignores it — apply to the Commissioner within six months of receiving (or being due) the review response. The Commissioner's appeal page provides an application form, though any permanent form — email, post, even an audio or video recording — is valid. The Commissioner investigates, obtains the withheld material from the authority, and issues a legally enforceable decision notice. Published decisions on foi.scot are a rich seam of precedent: cite the closest ones in your application.

3. 3

   Court of Session — point of law only

   Either side may appeal a decision notice to the Court of Session, but only on a point of law. There is no Scottish equivalent of the First-tier Tribunal — no cheap, informal second look at the merits. That cuts both ways: authorities rarely appeal, so a favourable decision notice usually sticks; but if the Commissioner rules against you, court is expensive and strict time limits apply. Make the Commissioner stage count.

8. Key differences from the UK Act at a glance

• ›Separate regulator: the Scottish Information Commissioner (foi.scot), not the ICO — appeals sent to the wrong one are invalid.
• ›No public-interest-test extension: 20 working days means 20 working days, even for qualified exemptions.
• ›Higher harm threshold: FOISA's prejudice-based exemptions require substantial prejudice, not mere prejudice.
• ›Different section numbers: personal data is s.38 (not s.40), policy formulation s.29 (not s.35), future publication s.27 (not s.22).
• ›The future-publication exemption only covers publication planned within 12 weeks of the request.
• ›Fewer absolute exemptions — legal privilege (s.36(1)) and national security (s.31) both get a public interest test in Scotland.
• ›Fees: first £100 free, then at most 10% of costs above it at up to £15/hour; a single £600 upper limit for every authority.
• ›Statutory appeal deadlines: 40 working days to request a review, six months to reach the Commissioner.
• ›No tribunal tier: after the Commissioner, the only route is the Court of Session on a point of law.
• ›The Scottish ministerial veto (s.52) is far narrower than the UK's and has never been used to date.

Frequently asked questions