Section 36: Confidentiality

When disclosure would constitute a breach of confidence actionable in court.

Confidentiality#

Section 36 of FOISA contains two very different exemptions under one heading. Section 36(1) covers legal professional privilege - communications between an authority and its solicitors. Section 36(2) covers information given in confidence where disclosure would amount to an actionable breach of confidence. Despite sharing a section number, these exemptions work differently and should be considered separately.

In plain terms#

If the authority cites section 36(1), it’s saying: this is a communication between us and our solicitors, protected by legal professional privilege. Releasing it would undermine our ability to get frank legal advice.

If the authority cites section 36(2), it’s saying: someone gave us this information in confidence, and disclosing it would breach that confidence in a way they could take to court.

Section 36(1) example: You ask a council for legal advice it received about a planning dispute. The council refuses under section 36(1), saying the information is a privileged communication between the council and its solicitors.

Section 36(2) example: You ask a health board for information provided to it by a whistleblower about clinical standards. The health board refuses under section 36(2), arguing that releasing the information would breach the confidence in which it was shared.

The legal detail#

Section 36(1) exempts information in respect of which a claim to confidentiality of communications could be maintained in legal proceedings. In practice, this means legal professional privilege - both advice privilege (communications between client and solicitor for the purpose of giving or receiving legal advice) and litigation privilege (communications made in connection with or in contemplation of legal proceedings).

Section 36(2) exempts information that was (a) obtained by the authority from another person, and (b) whose disclosure would constitute a breach of confidence actionable by that person or any other person.

For section 36(2), three elements must be present: the information must have the quality of confidence (it’s not trivial or already public), it was shared in circumstances creating an obligation of confidence, and disclosure would cause detriment to the person who shared it.

Absolute or qualified?#

These two limbs are treated differently - and this distinction matters.

Section 36(1) is qualified. The public interest test applies. Even where legal professional privilege exists, the authority must weigh the public interest in disclosure against the interest in maintaining the privilege.

Section 36(2) is absolute. There is no public interest test under FOISA. If the information was given in confidence and disclosure would amount to an actionable breach, the exemption applies without further balancing.

However, the law of confidence itself contains a public interest defence. Under Scots law, a breach of confidence is not actionable if the public interest in disclosure outweighs the interest in maintaining the confidence. So while FOISA doesn’t apply its own public interest test to section 36(2), public interest still plays a role through the underlying law.

See What can they refuse? for more on how the public interest test works for qualified exemptions.

How it’s used in practice#

Legal professional privilege - section 36(1)#

Authorities apply section 36(1) to legal advice, opinions from solicitors, and correspondence with legal teams. The Commissioner has recognised that there is an inherent public interest in authorities being able to seek and receive candid legal advice. But this doesn’t make the exemption automatic.

Where legal proceedings have concluded and the issues that prompted the advice have been resolved, the case for maintaining privilege weakens. The Commissioner has ordered disclosure of legal advice in cases where the proceedings are over, the public interest in understanding the authority’s decision-making is strong, and maintaining the privilege serves no ongoing purpose.

Section 36(1) only covers communications that would attract privilege in legal proceedings. Internal policy discussions, even if they mention legal risks, are not covered unless they form part of a communication between the authority and its solicitor (or in-house legal team acting in a legal advisory capacity).

Breach of confidence - section 36(2)#

Section 36(2) requires an actionable breach - not just a label. The fact that someone stamped “confidential” on a document, or that a contract contains a confidentiality clause, does not automatically make the information legally confidential under the law of confidence. The authority must show all three elements: quality of confidence, obligation of confidence, and detriment from disclosure.

Information that is already publicly available cannot be confidential, even if it was originally shared in confidence. If the substance of the information has been published, reported, or is otherwise accessible, the confidence has gone.

Authorities sometimes confuse section 36(2) with section 33 (commercial interests). These are different exemptions. Information can be commercially sensitive without being confidential, and information shared in confidence may have nothing to do with commerce. Each exemption has its own test and should be applied separately.

How to challenge it#

For section 36(1) - legal professional privilege#

Ask whether the information truly consists of legal advice or solicitor-client communications. Internal discussions about policy or strategy that happen to mention legal considerations are not privileged. The privilege attaches to communications with legal advisers, not to any document that refers to the law.

If the legal proceedings or dispute has been resolved, argue that the purpose of the privilege has been served. The public interest in maintaining privilege is strongest while litigation is live or legal advice is directly informing a pending decision.

For section 36(2) - breach of confidence#

Check whether the authority has demonstrated all three elements: quality of confidence, obligation of confidence, and detriment. A refusal letter that says only “this was given in confidence” without explaining these elements is inadequate.

Consider whether the information is already in the public domain. Confidence can only attach to information that is not publicly known. If the substance of the material has been reported, published, or made available through other channels, the confidence may have been lost.

If the authority claims confidentiality based on a contractual clause, consider whether that clause is reasonable and whether it genuinely reflects the circumstances. Public authorities sometimes agree to confidentiality clauses in contracts without proper justification. The Commissioner has questioned such clauses where they appear to have been included routinely rather than because the information is genuinely sensitive.

See What to do if refused for the full process.

You can also use our interactive challenge tool for this exemption to work through these questions step by step and draft a review request.

Good to know: Section 36(1) generally cannot apply to information more than 30 years old. Section 36(2) generally cannot apply to information more than 30 years old. Neither confirm nor deny (NCND) is not available for section 36 - it is not listed in section 18 of FOISA.