Public Records (Scotland) Act 2011 and public records in the keeping of non-public bodies.

Frequently Asked Questions

Q: Will records created and held by non-public bodies under contract to a public authority become subject to existing access and freedom of information legislation because of the Public Records (Scotland) Act (PRSA)? 

A: No. The PRSA makes no change to existing laws on access and operates separately from FOI legislation.  As at present, records are subject to the Freedom of Information (Scotland) Act 2002 (FOISA) only if they are held by, or on behalf of, a ‘Scottish public authority’ within the meaning of FOISA. If a body is not subject to FOISA, then it is not obliged to respond to information requests, although it may do so for the sake of good relationships with media, customers, etc.

Q: Is this Freedom of Information by the back door?

A: No. The PRSA does not make any provision about access to records. The PRSA defines certain records as “public records” but this means only that those records must be covered by a records management plan.  

Records created and held by private or voluntary bodies which relate to functions those bodies carry out on behalf of public authorities are covered by the PRSA.  The commissioning public authorities must ensure these records are managed in accordance with their records management plans.  This will not mean that the records become subject to freedom of information legislation, if they were not already subject to it, or to any other new rights of access.  Neither does the PRSA change existing confidentiality rules and data protection obligations in relation to the records.   

Q: But if records created under contract are ‘public records’ held by non-public bodies, are members of the public not entitled to demand that the holding body provide access to them?

A: No. The PRSA will not alter how access to public information works under FOISA. The PRSA makes no provision about access issues and will have no impact on FOISA other than indirectly: by improving records and ensuring that records can be more easily located when they are requested under FOISA.

FOISA applies only to a ‘Scottish public authority’ as defined under section 3 of that Act; principally the bodies listed under schedule 1 of FOISA, bodies that are designated under section 5 of FOISA, and companies that are wholly owned by the Scottish Ministers or another Scottish public authority. Bodies that are not subject to the terms of FOISA are not required to respond to information requests. If they receive information requests they can refuse to deal with them or voluntarily comply (for good relations with customers, etc). They can also recommend that requesters contact the relevant public authority (for example, the commissioning body) which may hold information within the scope of the request. 

Obligations can be included in any contract which would in effect mean that certain information held by the contractor is deemed to be information held on behalf of the Scottish public authority.  This does not mean that FOI requests can be made to the contractor - FOISA obligations always rest with the public authority. Instead it would require that the contractor provides the public authority with the relevant information when the authority receives an FOI request, to help the authority meet its statutory responsibilities. This is a sensible and necessary contractual clause.
 
Q: What then does the Act mean by ‘Public records’?  
A: The PRSA considers ‘public records’ to be only those which must be covered by a records management plan (RMP). The first three sections of the Act are relevant. Section 3 of the Act says,

(1) In this Act, “public records”, in relation to an authority, means—
(a)	records created by or on behalf of the authority in carrying out its functions,

(b) records created by or on behalf of a contractor in carrying out the authority’s
functions,

(c) records created by any other person that have come into the possession of the authority or a contractor in carrying out the authority’s functions.

(2) In subsection (1) “contractor”, in relation to an authority, means a person to whom functions of the authority are delegated (whether under a contract or otherwise) by the authority.

In order to provide for the long term management and safety of these records and to ensure the PRSA is actively engaged in monitoring continuous public sector improvement under the Act, section 1 requires, 

(1)  (1) Every authority to which this Part applies must—
(a) prepare a plan (a “records management plan”) setting out proper arrangements for the management of the authority’s public records,

(b)	submit the plan to the Keeper for agreement, and

(c) ensure that its public records are managed in accordance with the plan as agreed with the Keeper.

Section 2 of the Act prescribes a list of bodies subject to the Act 

(1) The authorities to which this Part applies are the bodies, office-holders and other
persons listed, or of a description listed, in the schedule.

There are no non-public bodies currently listed under the schedule to the Act. The Keeper therefore has no jurisdiction over non-public bodies and the Act does not require private and voluntary bodies to do anything.

In relation to records created under contract by a public authority, it is for the public authority to ensure that these records are managed in accordance with their own RMP. To do this the public authority must satisfy itself through standard procurement mechanisms that the successful contractor has sufficient records management provision to comply with their RMP. This procedure is intended to generate public confidence that records which have been created from the public purse are properly managed over time. This is of particular importance in relation to the records of vulnerable people.  

Critically, the Act requires only that records subject to the Act be covered by a RMP.  It does not confer any new access rights or obligations. 

Q: Under what circumstances would records created by a non-public body under contract fall into the possession of the commissioning public authority?

A: The public authority’s RMP would be used to apply the appropriate disposal markings against records or record classes so that they are properly managed over the longer term by the creating body, securely destroyed when appropriate or transferred into the keeping of the public authority as necessary. Records will be transferred to the public authority where there is a requirement for them to be retained for a longer period of time than the contractor is able, or is contractually obliged, to hold on to them. 

In this way records that are not worthy of permanent preservation will be destroyed in a timely and auditable fashion. This will provide governance security for the non-public body and the public authority, as well as delivering the financial and administrative benefits that accrue from good records management practice.  Issues such as confidentiality and sensitivity to personal and private information should be agreed within the contract.

Public authorities are aware of the importance of information security. So, where records are transferred into the long term keeping of the public authority confidentiality and compliance with data protection legislation will be paramount. The transfer of records to the public authority should not make them more vulnerable to erroneous access.