What also particularly peaked my interest in this action is that it involves not only failure to respond to subject access requests but, also failure to comply with Article 21 notices of objection to processing and restriction of personal data under Article 18 of the GDPR.

The group of 51 individuals seek orders under s.167 of the Data Protection Act 2018 and compensation for non-material damages under s.168.

Reform UK party sought a strike out or summary judgment early on in the action with all legal challenges made by them rejected by the court in a decision issued on 19 June 2026 by Mr. Justice Murray. That included the primary challenge that the Good Law Project did not have standing as a “representative body” to bring the action. Mr. Justice Murray ruling he thought the Good Law Project had a reasonable basis for arguing it had standing to bring the action.

Another interest for myself was the fact that the Good Law Project has been publishing the full case history on their website. It's not often that we get to see all the minute details of the particulars, defences and other submissions and exhibits in a case like this and I have already made my way through reading all the documentation published thus far. This is a goldmine for anyone really interested in the mechanics of how these claims are run in the courts down in England.

The external auditor has now come back with her response to my objections raised to the accounts at the HWIVJB.

See the link at the bottom of the page to read the full objections and the response from The Highland Council's external auditor for the objections that have been accepted in regards to their own accounts.

Re: Section 101 Objection - The Highland Council & HWIVJB

21 Jul 2026, 14:54

From: Esther Scoburgh <escoburgh@audit.scot>

To: <redacted>, "Brian Porter (Corporate Finance) <brian.porter@highland.gov.uk>, "Carolyn Pieraccini (Corporate Finance Place)"<carolyn.pieraccini@highland.gov.uk>, Customer Service <customer.service@highland.gov.uk>, Claire Gardiner <cgardiner@audit.scot>, Frank Finlayson <frank.finlayson@highland.gov.uk>

Cc: Claire Gardiner <cgardiner@audit.scot>, Correspondence <correspondence@audit.scot>, Przemyslaw Lipa <plipa@audit.scot>

Good afternoon

Re: Highland and Western Isles Valuation Joint Board

Thank you for your submission received on 15 July 2026. | was on annual leave and have now had time to consider the submission and the matters raised in relation to the Highland and Western Isles Valuation Joint Board. | can confirm that the following elements will be treated as a statutory objection and considered under that process:

1. Note 13 is materially misstated in relation to Administration Expenses and Recharges, which are considered to be
internal recharges.

2. The Annual Governance Statement is materially misstated on the basis that The Highland Council is not in full
conformance with the Global Internal Audit Standards.

3. There is a material misstatement in the contingent liabilities disclosure relating to alleged non-compliance with the
General Data Protection Regulation (GDPR).

4. The Management Commentary is materially misstated due to inadequate explanation of the overspend relating to
legal fees.

I do not consider the other matters in your submission to fall within the scope of a statutory objection under Section 101.

Those matters may, however, be more appropriately raised as issues of concern for auditors as part of ongoing audit work.

Further information on that process is available on the Audit Scotland website: Issues of concern about the bodies we audit | Audit Scotland. If you would like any of those matters to be considered through that process, please confirm this in your response.

As part of the statutory objection process, you are entitled to request an opportunity to be heard by the auditor. This right
applies to the objector, the Assessor and VJB Officer, and any other officer named in the objection. Where that right is

exercised, arrangements would normally be made for a hearing, typically in person, although alternative arrangements such as a virtual meeting may be used where appropriate.

The purpose of a hearing is to assist our understanding of the matters that are the subject of the Section 101 objection. It
provides those directly involved with an opportunity to explain their position, provide further context and draw our attention to any additional evidence they consider relevant. For the avoidance of doubt, the scope of any hearing will be restricted to the four areas identified above and will not extend to other matters raised in your submission which are not being considered under the statutory objection provisions.

It is important to note that we will not express a view or reach any conclusions on the matters raised at the hearing stage.

The hearing forms part of our information gathering process and enables us to ensure that all relevant information and representations are considered before we reach any conclusions on the grounds of objection.

In the event that you do not wish to request a hearing, we will continue our review through other enquiries that we consider necessary and proportionate. This may involve obtaining further information from the Valuation Joint Board, seeking clarification from relevant officers, and examining supporting records and documentation. The outcome of those enquiries,together with any information provided by you, will be taken into account when assessing whether the matters identified give rise to a material misstatement in the financial statements.

If you would like a hearing to be arranged, or wish to provide any additional information, evidence, or representations in support of the grounds of objection outlined above, please notify me in writing.

I will keep you updated as our consideration of the objection progresses and will contact you again to advise of any further developments or procedural updates.

Kind regards

Esther

Esther Scoburgh CPFA

Senior Audit Manager

Audit Scotland, 102 West Port, Edinburgh EH3 SDN

T: 07879 481 058

E: escoburgh@audit.scot

I sent 5 requests to the Highland Council during the public inspection period this year. These can be seen here.

It went just how I thought it might. The Highland Council completely obstructed my section 101 rights firstly, by trying to funnel my requests into their FOI request pipeline to which I raised an immediate objection to with both the external auditors and The Highland Council.

This objection was deemed invalid by the external auditors despite demonstrating strong indications and evidence of management override regarding transparency & accountability at the Highland Council concerning the Chief Audit Executive, Donna Sutherland’s earlier blocking of my FOI requests concerning the release of Highland Council's 2026/2027 Audit Plan which showed Data Protection at the very top of the plan on code red🚨. Data Protection was followed by the Inverness & Cromarty Firth Green Freeport on code red in the Audit Plan. Are they connected? Yes, they are.. read here and watch my video.

Then the Highland Council continued to obstruct my inspection rights by insisting I make a 200 mile round trip to Glenurquhart Road to view digital files on a screen and indicating I would have to pay exorbitant amounts of money to make paper copies of digital files. I responded that it was in breach of their own policies and that other Council's such as Falkirk Council, Western Isles Council and North Ayrshire Council show on their public notices that making digital files available electronically was standard practice. I actually emailed Western Isles Council to ask them directly how they dealt with this and their CEO, Martin Boyd responded who seemed a bit bemused that it would be done any other way than sending digital files electronically - quite rightly. The Council dug their heels in anyways…. of course they did. You don't need a crystal ball to predict what the Highland Council will do - same repeat behaviour like a skipping record.

The full Highland Council shenanigans and my conversations with Highland Council's Section 95 Officer, Brian Porter and their Strategic Lead for Finance (Place), Carolyn Pieracelli can be read in full here.

The Section 101 Objection to Accounts to The Highland Council & The Highland & Western Isles Valuation Joint Board.

I have copied in all text of this objection below for the sake of getting it indexed by search engines (it's long, but, necessary) but, you can download the PDF version here instead. I also submitted a 123 page bundle of supporting evidence which I won't post here because all of it is already all over this Substack in my FOI requests and other articles.

The external auditor for The Highland Council, Claire Gardiner has now accepted 4 issues raised as objections as follows:

1. The Annual Governance Statement is materially misstated in light of disclosures that no significant issues were identified at the Highland and Western Isles Valuation Joint Board.

2. The Annual Governance Statement contains a material misstatement in stating that Internal Audit generally conforms to professional standards.

3. There is a material misstatement in the contingent liabilities disclosures relating to:

• non-compliance with the General Data Protection Regulation (GDPR); and

• the £1.466 million relating to grant clawback conditions.

4. There is a material misstatement in the accounts concerning the Council’s financial projections and position in relation to the Inverness and Cromarty Firth Green Freeport.

Now we await the external auditor from the HWIVJB, Esther Scoburgh for her response next week which I will post when I get it.. then I will post what will happen next now that some of my objections have been accepted. I will be writing to Claire Gardiner to request a hearing.

SECTION 101 OBJECTION - The Local Government (Scotland) Act 1973

Public Authority:

The Highland Council, Glenurquhart Road, Inverness IV3 5NX

External Auditor:

Claire Gardiner, Audit Director, 4th Floor, 102 West Port, Edinburgh, EH3 9DN cgardiner@audit.scot

Public Authority:

Highland & Western Isles Valuation Joint Board, Moray House, 16 – 18 Bank Street, Inverness IV1 1QY

External Auditor:

Esther Scoburgh, Senior Audit Manager, 4th Floor, 102 West Port, Edinburgh, EH3 9DN escoburgh@audit.scot

15 July 2026

INTRODUCTION

1. The objector is a resident of the Highlands in the county of Caithness and has been since 2007 and therefore, an interested person within the meaning of s.101 of the Local Government (Scotland) Act 1973 and the Local Authority Accounts (Scotland) Regulations 2014.

2. This objection is a targeted, evidence based challenge regarding severe, systemic failures in corporate governance, statutory non-compliance and active concealment of material contingent liabilities that distort the representations made in the annual governance statement and unaudited accounts.

3. The objector's investigation into these accounts was not born from speculative curiosity, but from ongoing and past successful litigation. The objector was a claimant in a successful sheriff court civil action against The Highland Council under s.167 of the Data Protection Act 2018, INV-SM2-24. That action concerned numerous compliance failures of the GDPR and unlawful processing of personal data; several orders being granted by the Sheriff against the Council in favour of the objector.

4. The objector also has a similar, ongoing follow-on civil action against The Highland & Western Isles Valuation Joint Board (HWIVJB) in their capacity as data controller and The Highland Council as the 2nd defender in their capacity as purported data processor or de facto data controller, INV-SM11-25.

5. Aside from information obtained from the natural course of litigation, much of the information and evidence supplied alongside this objection in bundle 1 has been procured largely via freedom of information requests to the HWIVJB and The Highland Council or from their own public documentation.

TRANSPARENCY AND ACCOUNTABILITY FAILURES

6. The objector lodged an initial objection on 30 JUN 2026 due to The Highland Council attempting to reclassify all 5 of the objector’s section 101 requests as FOI requests. The Highland Council has persisted in their obstruction in attempting to require a 200 mile round trip to view electronic documents on a screen and/or print PDF files at cost when they could simply provide them electronically as other Council’s already do such as Western Isles Council, Falkirk Council and North Ayrshire Council as noted in their public inspection notices. All of this a clear failure of transparency and accountability standards relating to the annual accounts.

7. The objector’s first objection was rejected by the external auditors despite it demonstrating a clear example of management override of the control environment by the CAE and other officers of The Highland Council. Under ISA (UK) 240, management override is a “presumed significant risk” present in every single entity and Audit Scotland’s own audit plans states that they are required to "consider the overall control environment and “tone at the top”. The objector objects to the inadequate testing of the control environment and failure to secure best value given the large fees paid from public funds to the external auditors totalling £556,290, Highland Council audit fee and £9,920 HWIVJB audit fee.

CORPORATE GOVERNANCE OF HWIVJB

Background

8. The objector began an investigation into the corporate governance structure of the HWIVJB after peculiar conduct of appointed officer’s of that Board in relation to the objector’s 1st court action, INV-SM2-24. Data that the Highland Council was restricted from any further use by court order of the objectors was unlawfully transferred to the HWIVJB.

9. The HWIVJB is made up of a committee of 10 elected members; 8 councillors from Highland Council and 2 councillors from Western Isles Council. The current appointed Assessor & ERO is Frank Finlayson. The Depute Assessor is Roy Christie and the Depute ERO is Mandy Thomson.

10. The objector notes that according to the Scheme of Reference and Delegation of the HWIVJB, the appointed Clerk to the Board and Solicitor to the Board is Stewart Fraser who is also the Chief Officer of Legal & Corporate Governance (COLCG) of the Highland Council. As the COLCG he is responsible for the following service areas within the Council; Legal Services, Licensing, Elections, Democratic Services, Trading Standards, Best Value, Corporate Fraud, Corporate Risk Management, Fraud investigation, Complaints, Freedom of Information and Data Protection, Internal Audit, Corporate Policy, Scottish Public Services Ombudsman, Insurance, Information Governance. He is also the Monitoring Officer and Proper Officer of the Council and holds roles as Company Secretary of Council ALEO’s High Life Highland and Highland Opportunity (Investments) Ltd.

11. The Treasurer to the Board is the s.95 Finance Officer and Chief Officer of Corporate Finance of the Highland Council; formerly Brian Porter, that position advertised for a replacement for that vacancy on 23 April 2026 of which the objector is unaware of the status of.

12. The Scheme of Delegation refers to a position of Monitoring Officer, which is at current a joint role, held by Jane MacLennan and Lorraine Dunn of Democratic Services at the Highland Council.

13. The HWIVJB also relies on the Legal, Finance, HR, Property, ICT and Internal Audit services of the Highland Council.

Objections

14. The HWIVJB’s corporate governance setup as it stands represents a terminal vulnerability to an unmitigated executive monopoly, institutional capture and total failure of separation of powers.

15. The Scheme of Reference & Delegation shows that Stewart Fraser as both the legal representation of and Clerk to the Board has been delegated wide powers that are anomalous when compared to a sample of other Schemes of Delegation of other Valuation Joint Board’s in Scotland. Whilst the appointment of Council officers to positions on VJB’s is completely normal, the wide delegations are not when considered with the full picture of Mr. Fraser’s other roles. The Assessor notably has not been delegated any powers to instruct external legal advice like what is found in other VJB Schemes; all of those powers delegated to Mr. Fraser as the legal representative to the HWIVJB and clerk.

16. The objector made an FOI request to the Board requesting information about the Monitoring Officer role at the HWIVJB. The objector is firstly, entirely dubious as to the legislative basis of this role given that s.5 of the Local Government and Housing Act 1989 which created this role does not apply to VJB’s as a relevant authority. However, on paper in the HWIVJB Scheme of Delegation, this is portrayed as a role similar to that as s.5 of the 1989 Act, but, in effect, is not given the HWIVJB is not a “relevant authority”. The monitoring officers at the HWIVJB, a joint role are in fact, subordinates of Mr. Fraser’s at The Highland Council; they are the Democratic Services Managers. It appears that neither is legally qualified which the Board is currently refusing to answer & is subject to an appeal at the Scottish Information Commissioner. Neither of them appearing on the solicitor’s roll at the Law Society of Scotland therefore, to perform that role, they must take legal advice from Mr. Fraser himself. In essence, he appears to also then be the de facto monitoring officer at the HWIVJB. Notably, as Clerk he also appears to have referral powers under the Scheme which is normally a power delegated to a monitoring officer rather than a clerk. In effect, in this setup, it appears Mr. Fraser has powers to veto a decision he may not like and refer it to the monitoring officer which eventually ends up on his desk anyways given the appointed monitoring officers need legal advice. This is a closed loop. Mr. Fraser is structurally positioned to veto or suppress any legal or ethical referrals concerning his own departments or actions, rendering the Board’s entire system of internal checks a complete constitutional facade and a Potemkinesque oversight structure designed to facilitate management override.

17. The objector made a complaint to the HWIVJB about the Corporate Governance at the Board which Stewart Fraser ensured was buried by claiming they did not view it as a complaint and that it would be passed to the monitoring officer for review, effectively passing it back to Mr. Fraser to review a complaint concerning his roles at the HWIVJB.

18. The complaint also pointed out the anomalous Scheme of Delegation at the HWIVJB compared to a sample of other VJB’s around Scotland largely in respect of delegation of all legal matters to Mr. Fraser and containing no necessary safeguards in place to avoid gatekeeping of the Assessor to obtain external legal advice. All emergency legal decisions also delegated to Mr. Fraser.

19. Notably, the Scheme of Delegation delegates legal authority to a specific Officer of the Highland Council, The Chief Officer of Legal and Corporate Governance with no sub-delegation rather than to an appointed Solicitor to the Board. The objector has attempted to find in historical Board minutes where Mr. Fraser was ever officially appointed as Solicitor to the Board but, cannot find any record of that.

20. The Board relies on the Highland Council’s Internal Audit service. However, Mr. Fraser is also in charge of Internal Audit at The Highland Council. The Chief Audit Executive, Donna Sutherland is his direct subordinate. It was himself that hired her and he also is in charge of her performance reviews. The Internal Audit Charter of the Council states a switching protocol is used when the Chief Audit Executives management areas are being audited. The CAE becomes audit client and her subordinate, the Corporate Audit Manager is the auditor but, ultimately, that manager is also line managed by Stewart Fraser as well ensuring there is never an independent internal audit of any of the areas Mr. Fraser is responsible for at both The Highland Council and the HWIVJB. The internal audit service at the Highland Council also has not had the required External Quality Assessment since March of 2017 therefore, none of the assurances or opinions given in the accounts from internal audit can be trusted and do not give a true and fair view of the accounts.

21. The Highland Council Annual Governance Statement in the 2025/2026 accounts states on page 33 that no significant governance issues were identified at the HWIVJB. All of these issues have already been brought to the HWIVJB’s attention to which they responded the issues would be put before the Monitoring Officer of the HWIVJB. However, it is apparent that Mr. Fraser is the de facto monitoring officer and also the officer that gives assurance to as to any governance issues identified that is objected to as it is a material misstatement.

22. The Board lacks any semblance of a separation of powers. By serving simultaneously as the legal representative to the Board, the Clerk to the Board, the de facto monitoring officer and the ultimate controller of the Board’s Internal Audit function, Stewart Fraser occupies a position of total executive monopoly. He is effectively setting the rules, executing the decisions, auditing his own compliance and providing the assurances that inform the annual governance statement. This setup creates a significant risk of management override of controls.

23. Note 13 on pages 72-73 of the HWIVJB accounts states that related party disclosures are required to allow readers to assess the extent to which the Board might be “constrained in its ability to operate independently”. The absolute concentration of executive, legal, and audit control within Highland Council’s Chief Officer of Legal & Corporate Governance proves that the Board is not merely “potentially influenced,” but is entirely institutionally captured and structurally constrained by a related party.

24. Consequently, the financial figures disclosed under “Administration Expenses” and “Recharges” do not represent transactions between free, independent parties bargaining at arm’s length. They represent internal transfers dictated by a related party that controls both sides of the ledger, rendering Note 13 a material misstatement of fact that actively conceals the true level of institutional constraint from the public and the auditor.

INTERNAL AUDIT

25. The objector objects to the Annual Governance Statement which contains a deceptive material misstatement regarding corporate assurance. On page 31, the council claims its Internal Audit service “generally conforms” to professional standards while openly admitting it has failed to clear a mandatory independent External Quality Assessment (EQA) since 2017. This is a severe breach of the GIAS. Listing a multi-year statutory breach as a mere “planned action” is a total failure of public accountability. The Council is actively misleading the public by relying on unaccredited, non-compliant internal control data to sign off on its financial statements as “true and fair”. Furthermore, because the external auditor has explicitly stated they cannot rely on this broken internal work, the council has directly inflated its external audit fees. This forces taxpayers to double-pay for a failed function, violating the statutory duty to secure best value. The Council’s strategic lead for Best Value though is also the Chief Audit Executive therefore, the objector doubts that best value is ever truly independently audited by the Internal Audit service given the other issues raised about it in this objection.

26. Page 29 of the HWIVJB accounts state that Internal Audit operates in accordance with GIAS however, the objector objects to that statement given that it is demonstrated that Internal Audit at The Highland Council is not in full conformance with GIAS standards. The audit plan of the HWIVJB also fails to include any actions to deal with the continued systemic non-compliance of the GDPR as highlighted below.

SYSTEMIC NON-COMPLIANCE WITH CHAPTER II AND IV GDPR

Unlawful Processing of Personal Data – Council Tax, Non-Domestic Rates

27. This is an objection to the revenue of The Highland Council of £334.1m in council tax and non-domestic rates on page 12 of the accounts on the basis that the underlying data processing of the HWIVJB and The Highland Council is operating entirely unlawfully.

28. The HWIVJB relies almost entirely on The Highland Council for all of its data processing. This includes most of their IT infrastructure, data centres, archiving services. Under the GDPR they are obligated to process all of that data in accordance with Chapter II and IV. It is already admitted by the HWIVJB in FOI, court papers and their own departmental reports to the committee that they are wholly non-compliant and are in violation of Articles 26, 28(1), 28(2), 28(3), 28(4), 28(10), 29, 30, and effectively 24, 25 and 32 of the GDPR. They do not have any of the required data processing agreements, sub-processing agreements, joint controller arrangements, written instructions to their processor, guarantees from the purported processor or any data security arrangements with The Highland Council. The knock on effect is that the entirety of the data processing infrastructure is fundamentally structurally unlawful under Chapter II GDPR.

29. The Highland Council is acting as de facto data controller of all of the HWIVJB’s data under Article 28(10) GDPR which is not just unlawful under the terms of Chapter II and IV of the GDPR but, may also be construed as an offence under s.170(7)(a) of the Data Protection Act 2018. The HWIVJB have been fully aware of that since September 2024 and have still failed to follow the law. The objector notes that the Letter of Representation of the HWIVJB dated 7 October 2025 was signed stating there was no known breaches of laws or regulations affecting the accounts when the HWIVJB was already fully aware of the systemic non-compliance with the GDPR and data protection law.

30. The HWIVJB and the Highland Council are processing personal data on a mass scale which includes not just the personal data of Highland residents but, also those of the Western Isles with respect to valuation data concerning the whole of the council tax list and non-domestic rates and all electoral registration data. I have included a legal analysis of the HWIVJB and The Highland Council’s position.

31. The Highland Council must recognise the major failings of their data processing given that the 2026/2027 Internal Audit Plan dated 27 May 2026 featured Data Protection at the top of the audit plan as an urgent priority with a risk score of 37. The Highland Council’s Chief Audit Executive has personally denied the objector any information under FOISA in relation to that audit. Under the GIAS, the Highland Council requires that internal audit be undertaken by an independent third party given the issues highlighted earlier and there is no indications that has been arranged.

32. Highland Council and HWIVJB have failed to disclose contingent liabilities in the accounts relating to this. The only legal and lawful outcome to solve the systemic non-compliance with the GDPR between the two public authorities is that the HWIVJB will need to move the entirety of their data processing operations from the Highland Council to a neutral third party data processor. This is because a data processor may not have an economic, financial or other interest in the outcome of the data processing of the data controller, the HWIVJB or else, the data processor is considered the data controller which is fundamentally unlawful in this scenario. The HWIVJB by virtue of it’s binding and mandatory obligations of Articles 5(1), 6(1) and 17(1) GDPR must erase all unlawfully processed data. The HWIVJB will require a massive requisition for that unbudgeted project which is currently undisclosed as a contingent liability in their accounts.

Inverness & Cromarty Firth Green Freeport

33. Given that the whole of the data processing is fundmentally unlawful, the objector also objects to the statements in the accounts as to the Council’s financial projections and position concerning the Inverness & Cromarty Firth Green Freeport on page 26. The objector also objects to the £1.466m seed grant subject to claw back conditions received thus far which is funding an operation that is based on fundamentally unlawful data processing infrastructure. The objector also objects to the failure by the Council to disclose that as a contingent liability.

LEGAL OVERSPEND HWIVJB

34. On page 18, of the HWIVJB accounts they state that the overspend on legal expenses is as follows, “There continues to be a growth in legal expenses. In particular regarding a Valuation case which was heard before the Upper Tribunal for Scotland in November 2025.” However, the HWIVJB has had a significant spend of funds in relation to a Sheriff Court case amounting to nearly £40,000 under matter codes HIG0078.004 and HIG0078.006 at Anderson Strathern and has failed to report that significant amount contributing to its overspend.

35. That spend of just under £40,000 is firstly objected to on the basis that it does not represent best value standards given that the expenditure is being used to cover up the HWIVJB’s and The Highland Council’s admitted systemic non-compliance of Chapter IV of the GDPR. The actual claim in Sheriff Court is valued at £2,000 and concerns the HWIVJB failure to comply with basic GDPR rights. The spend is grossly disproportionate to the value of the claim with expenses continuing to spiral into the 2026/2027 financial year failing best value standards.

36. Secondly, it is objected to on the basis that the spend is also being used to serve the purposes and position of the Highland Council as well as the HWIVJB.

37. Thirdly, it is objected to on the basis that nearly £4000 of the amount under matter code HIG0078.006 whose description bears the objector’s name is not lawful under FOISA. FOISA requires public bodies to approach FOI requests in an “applicant blind” manner. The matter code bearing the objector’s name demonstrates all of the FOI requests by the objector are being micromanaged by a solicitor at an exorbitant cost for a basic administrative task. The HWIVJB are already overspent on legal expenses and therefore, that spend is objected to on best value and accountability grounds as well.

38. Fourthly, that whole spend is objected to as to its lawfulness given that the HWIVJB Scheme of Delegation & Reference explicitly delegates engagement of external legal firms to the Chief Officer of Legal and Corporate Governance of the Highland Council yet, the engagement and instruction of Anderson Strathern was not approved by the HWIVJB nor the delegated person.

RECHARGES AT HWIVJB

39. The objector objects to all monies paid to the Highland Council from the HWIVJB as recharges for provision of ICT services. The HWIVJB is paying for a fundamentally unlawful provision of services completely outwith compliance with the GDPR and data protection law representing a serious risk to the public’s data security and integrity. The objector has previously obtained a draft copy of the ICT service level agreement however, it does not provide any indications of the services being paid for via recharges.

40. The objector has previously requested a copy of the service level agreement in relation to legal services provision by the HWIVJB from the Highland Council and the HWIVJB stated there is no such agreement in place. Therefore, the objector objects to all of that recharge on the basis that best value cannot be determined for those services rendered and paid for by the HWIVJB.

Response from Claire Gardiner to the Section 101 Objection on 17 July 2026.

Subject: Re: Section 101 Objection - The Highland Council & HWIVJB

17 Jul 2026, 15:16

From: Claire Gardiner <cgardiner@audit.scot>

To: <redacted>, “Brian Porter (Corporate Finance)”<brian.porter@highland.gov.uk>, “Carolyn Pieraccini (Corporate Finance Place)”<carolyn.pieraccini@highland.gov.uk>, “Derek Brown (Highland Council)”<derek.brown@highland.gov.uk>

Cc: “Correspondence” <correspondence@audit.scot>, Esther Scoburgh” <escoburgh@audit.scot>

Thank you for your submission received on 15 July 2026. | have now considered the matters raised in relation to The Highland Council and can confirm that the following elements will be treated as a statutory objection and considered under that process.

1. The Annual Governance Statement is materially misstated in light of disclosures that no significant issues were identified at the Highland and Western Isles Valuation Joint Board.

2. The Annual Governance Statement contains a material misstatement in stating that Internal Audit generally conforms to professional standards.

3. There is a material misstatement in the contingent liabilities disclosures relating to:

• non-compliance with the General Data Protection Regulation (GDPR); and

• the £1.466 million relating to grant clawback conditions.

4. There is a material misstatement in the accounts concerning the Council’s financial projections and position in relation to the Inverness and Cromarty Firth Green Freeport.

For clarity, the matters raised in your submission relating to the Highland and Western Isles Valuation Joint Board are being considered separately, and my colleague Esther Scoburgh will be in touch with you regarding that correspondence on return from leave.

The remaining matters raised in your submission do not fall within the scope of a statutory objection. We consider that these matters may be more appropriately raised as an issue of concern for auditors as part of their ongoing audit work. Further information about this process is available on the Audit Scotland website issues of concern about the bodies we audit | Audit Scotland. If this is your preferred course of action please confirm this within your response.

1 also advise that you have the right to be heard in relation to the statutory objection. This means that the objector, the Chief Executive, and any other officer named in the objection have the right, should they wish, to appear before and be heard by the auditor. In practice, this usually involves a meeting, commonly referred to as a hearing. Such hearings are generally held in person, although they may also be conducted online where appropriate.

The purpose of the hearing is to provide an opportunity for relevant parties to present information and representations in relation to the matters that are the subject of the section 101 objection, namely the four grounds set out above. Any discussion will be limited to those grounds and will not extend to other matters raised in your submission which have not been accepted for consideration under the statutory objection process. The hearing allows you to elaborate on the accepted grounds of objection and enables us to gather any further details, explanations or supporting information that may assist our consideration of those specific matters.

It is important to note that we will not express a view or reach any conclusions on the matters raised at the hearing stage. The hearing forms part of our information gathering process.

If a hearing is not requested, we will continue our consideration of the objection by making such enquiries as we consider necessary to establish the relevant facts and circumstances. This may include seeking information and explanations from the Council and reviewing supporting documentation. The information obtained will inform our assessment of the matters raised and our professional judgement as to whether there is any material misstatement in the accounts arising from the grounds set out in the objection.

Should you wish to exercise your right to be heard, submit any further information or supporting evidence relating to the accepted grounds of objection, or raise any of the remaining matters as an issue of concern, please contact me in writing. Otherwise, we will be in touch as our consideration of the objection progresses and to advise you of the next steps in the process.

Kind regards

Claire

Claire Gardiner

Audit Director

T: 07506 352 895

E: cgardiner@audit.scot

Please be aware my usual working hours are Tuesday- Friday between 8 and 4:30.

From: <redacted>

Sent: 15 July 2026 19:00

To: Brian Porter (Corporate Finance) ; Carolyn Pieraccini (Corporate Finance Place) ; Customer Service ; Esther Scoburgh ; Claire Gardiner

Subject: Section 101 Objection - The Highland Council & HWIVIB

Please find attached a copy of my section 101 objection and supporting documentation.

Thank you for your time & attention.

Kind regards.

Response from Esther Scoburgh to the Section 101 Objection below….

Due: 30 July 2026

1 July 2026

Dear Sirs,

Please provide the following information:

1. Itemised Invoices & Narratives.

1.1 Copies of all invoices/fee notes etc. submitted to the HWIVJB by Anderson Strathern in relation to engagement for INV-SM11-25 and the Data Processing Agreement and any other related matters (FOI etc.) under matter code HIG00078 from 1 May 2026 to the present date 1 July 2026. This should include total fee, VAT, and outlays for each month.

1.2 For each invoice, please provide the itemised narrative of work performed, the time spent per task, the hourly rate charged, and the grade/seniority of the fee earner involved.

Note: Whilst specific legal advice may be redacted, the nature of the task (”drafting defence” or “meeting with client” etc.) and the associated costs are not privileged and should be disclosed. The requester recognises your raised exemptions in the last requests however, there is an overriding public interest in whether the Board is meeting Best Value standards notwithstanding that these invoices should also be available for inspection once a year by the public in any case under s.101 of the Local Government Scotland Act 1973.

2. Transaction Detail Reports

2.1 A report from your financial management system (Integra or Oracle etc.) showing all transactions recorded against account code and cost centre specifically relating to Anderson Strathern from 30 April 2026 to 1 July 2026.

3. Budget Profile & Virements

3.1 The current annual budget allocation for the specific ledger code used for these payments.

3.2 Records of any budget virements (transfers) or “supplementary estimates” authorised to increase the funding available in this code since this engagement began.

4. Correspondence & Reports

4.1 All internal correspondence (emails, memos, or notes) of the HWIVJB treasurer, assessor, legal representative or Highland Council regarding funding approval or budgetary matters relating to these costs. The Committee minutes report that the HWIVJB is overspent on legal expenses, please provide correspondence including that of the Treasurer relating to approval of these costs given the budgetary circumstances.

4.2 Any external correspondence between the HWIVJB & Anderson Strathern in relation costs of the engagement.

4.3 Any reports to the HWIVJB committee by the Assessor in relation to funding or budgetary matters in relation to the engagement.

Thank you for your time & attention.

Kind regards.

Due: 30 July 2026

Received: 24 July 2026

Review Sent: 28 July 2026

Review Due: 26 August 2026

Review Response Received: 25 August 2026

25 August 2026

28 July 2026

Dear Sirs,

Thank you for your response to my FOI concerning the Report to Those Charged With Governance 2024/2025. The report clearly states that representations were requested from the Treasurer on certain aspects to the accounts and the present FOI request is targeting specifically communications between the Treasurer (or any other appointee, officer, employee of the Board) and the External Auditor in relation to irregularities, fraud and/or non-compliance with laws as part of the external auditors testing procedures.

Specifically, at page 5 it says that part of the testing procedures includes direct inquiries on the matter. It states,

“inquiring of Treasurer as to other laws or regulations that may be expected to have a fundamental effect on the operations of the Highland and Western Isles Valuation Joint Board”

I require all correspondence, representations and all other information held in relation to those inquiries.

You have disclosed a single page of email correspondence dated 3 February 2025 concerning the 24/25 External Audit Planning meeting which is not really what was requested.

If you could please review your response to that FOI and disclose the information requested at your earliest opportunity, I shall be grateful.

Thank you for your time & attention.

Kind regards.

24 July 2026

1 July 2026

Dear Sirs,

Please provide the following information:

1. All correspondence between the external auditor and the Board Treasurer, Brian Porter or any other employee or appointee of HWIVJB during the audit of 2024/2025 relating to inquiries made in relation to irregularities, fraud, or instances of non-compliance with laws and regulations mentioned at page 5 of “Highland and Western Isles Valuation Joint Board (Those Charged with Governance)Highland and Western Isles Valuation Joint Board Audit of 2024/25 annual accounts” dated 7 October 2025.

Thank you for your time and attention.

Kind regards.

Moray House

16 – 18 Bank Street

Inverness

IV1 1QY

29 June 2026

ARTICLE 15 GDPR SUBJECT ACCESS REQUEST

ARTICLE 21(1) NOTICE OF OBJECTION TO UNLAWFUL PROCESSING

Dear Sirs,

Article 15 Subject Access Request

Please provide all information and personal data undergoing processing under Article 15(1) and Article 15(3) GDPR in relation to the data subjects and their property, this includes but, is not limited to, copies of all database extracts and internal and external communications including emails, letters, Microsoft Teams chat logs and any other data from messaging applications, all communications to Anderson Strathern regarding matter code HIG0078.006 that contains the data subjects name in that matter code and all other data relating to the data subjects. A schedule of any withheld data, withheld wholly or partially along with any exemptions raised should be supplied.

Given that Recital 63 GDPR clarifies that the purpose of access rights of data is to be aware of and confirm that the personal data undergoing processing is lawful, the data subjects also require a copy of Microsoft e-Discovery search exports summary.csv and items.csv using the appropriate search terms to verify the extent of the unlawful processing being undertaken.

Article 21(1) Notice of Objection to Unlawful Processing

It is established by your own judicial admissions on the court record, FOI responses, Committee Meeting Reports that the Assessor for the HWIVJB continues to unlawfully process all of the personal data of all residents of the Highlands & Western Isles subject to your statutory functions including that of the named data subjects.

This includes processing all that data in breach of Articles 26, 28(1), 28(2), 28(3), 28(4), 28(10), 29, 30 and 32 and effectively Articles 24 and 25 representing a total collapse of the Assessor’s data processing operations. The Assessor has readily admitted that despite wholly relying on the Highland Council for all of its data processing infrastructure, the parties have no joint controller arrangements, no data processing agreements, no sub-processing agreements, no written instructions from the data controller to the purported data processor, The Highland Council. Given that The Highland Council has an economic and financial interest in the outcome of the processing, the Highland Council may not be a data processor for the Assessor of HWIVJB and the continuance of reliance on The Highland Council for that data processing either with or without the required agreements are strict liability infringements of the GDPR, in particular Article 28(10) GDPR.

Material misstatements were also made in the HWIVJB Letter of Representation to the External Auditor in October of 2025 that the HWIVJB was operating in compliance with all laws and regulations when the Assessor was perfectly aware of the systemic non-compliance of Chapter IV of the GDPR. These will be brought to the external auditors attention given the seriousness of the misstatements in that regard.

The Data Protection Officer of the Highland Council, Miles Watters provided Article 19 GDPR notice to the HWIVJB on 18 June 2025, explaining that the court orders granted against the Highland Council including an Article 18 GDPR restriction order had a direct effect on data subject to that restriction that was unlawfully transferred to yourselves and that the Assessor had an obligation also to immediately restrict that data.

The Assessor did not heed that notice from the Data Protection Officer and continued to process that data in direct defiance of a court order. Despite the Highland Council’s DPO’s expert opinion on those matters, Stewart Fraser, Solicitor and Clerk to the Board and Chief Officer of Legal and Corporate Governance of the Highland Council advised the Assessor to do the exact opposite and advised to continue to process the data in direct violation of the court order as evidenced by the letter of 10 October 2025 from yourselves to the data subjects.

Article 18 GDPR restrictions apply to the data regardless of the party or recipient processing it. CJEU C-154/21 Österreichische Post AG (Opinion) [para. 31] The Assessor now continuing to seek to harass the data subjects with that data in direct defiance of that court order.

Article 21(1) requires that all data must be immediately restricted under the terms of Article 18(1)(d) pending verification of whether the data controller has an overriding interest in the processing of the data. Given the admitted systemic non-compliance of Chapter IV of the GDPR, the Assessor is unable to demonstrate any overriding legitimate interest in the processing given that The Highland Council are acting as a de facto controller of all of the Assessor’s data at current. The Highland Council does not have a lawful basis under Article 6(1) GDPR to be processing any personal data as a de facto controller of any of the Assessor’s data. Therefore, all of the data processing is unlawful. The Assessor has a standalone binding and mandatory obligation to erase all unlawfully processed data under the terms of Article 17(1) GDPR. CJEU C-46/23 Újpesti Polgármesteri Hivatal.

I look forward to your urgent response to this notice and request and to confirm that all data has now been restricted according to the terms of the GDPR. This letter will be published at article79.co.uk.

Thank you for your time and attention.

Regards.

If you missed my previous article, click the link below to find out how to exercise your rights of public inspection and objection to the unaudited accounts of The Highland Council and related bodies under Section 101 of the Local Government (Scotland) Act 1973.

If you have public spending concerns in any service area of The Highland Council, now is the time to make those requests for information folks! Find out what you can request and how you can object to any part of the accounts. 👇

Section 101 Requests Made to The Highland Council for Public Inspection.

Click to view the full PDF.

26 June 2026

1. Inverness & Cromarty Firth Green Freeport

2. Recharges & Service Level Agreements & Related Contracts for ICT Services Provision - Highland & Western Isles Valuation Joint Board & Highland Council

3. Account HIG0078 of the HWIVJB at Anderson Strathern and recharges and related Service Level Agreements for legal services provision by the HWIVJB from The Highland Council.

4. Chain of Assurance Documentation & Working Papers Re the Annual Governance Statement etc.

5. Scottish Water Council Tax Financial Records

For example, Scottish law campaigner Peter Cherbi made 38 requests to the Scottish Legal Complaints Commission's in 21 months and the SIC determined that that was not excessive. 25 requests in 18 months is not that many by comparison. Click to view Decision Notice 209/2010 in Peter Cherbi's favour.

2 of my early requests they completely ignored which I did not appeal to the SIC.

7 other requests were ignored that went to appeal to the SIC and the SIC issued 7 decision notices in my favour for the council failing to respond.

That's 36% of requests totally ignored.

The council have finally responded to some of the decision notices. 2 of them, 077/2026 and 078/2026, I had to appeal for a second time to the SIC for poor responses which are pending determination.

3 responses to the decision notices they have now responded to satisfactorily.

1 appeal that had been validated at the SIC that was awaiting a decision notice the council decided to finally respond to that request but, then did not respond satisfactorily to it and that has now had to go for its second appeal to the SIC, the first appeal having been withdrawn.

This appeal raises issues surrounding the facts that the Highland Council staff member who was allocated this request and a related request was caught behind the scenes asking who the requestor was and then trying to paint me as vexatious without even having as so much as looked at the request and how much time it would take him to deal with. The same staff member was the subject of much of the court action, INV-SM2-24 therefore, he should have never been allocated the FOI request in the first place.

FOI requests must be dealt with in what they call an “applicant blind” manner. The council should not treat an FOI request differently just because of the person who is making it.

The council have continued to lie to the SIC that somehow I correspond with them on "different channels”. Of course I do not, the only communications I have with this Council is through numerous Court actions data protection matters and freedom of information matters - that's it. As if I would actually want to communicate with them about anything else - it's a joke.

Over at the Highland & Western Isles Valuation Joint Board whose solicitor to that board and clerk to that board is the Chief Officer of Legal and Corporate Governance of the Highland Council, Stewart Fraser, he has deployed a top FOI solicitor and director at Anderson Strathern and former employee of the SIC, Lorraine Currie, to deal with all of my requests that have been made to the board. They have spent almost £4,000 between January 2026 and the end of March 2026 on that solicitor to deal with my requests.

When the councils 2026 / 2027 internal audit plan came out on the 27th of May 2026 I made five FOI requests relating to this internal audit. The problem is that Donna Sutherland who is the chief audit executive for the council and in charge of internal audit is also in charge of freedom of information, data protection and information management. The council have now issued a mass refusal by an anonymous staff member of all of those requests - all five. There is a clear conflict of interest on the decisions on these requests, given that the FOI requests all pertain to internal audit.

Visit the FOI Archive to find out what the Highland Council does not want to answer!

The Citizen's Audit of The Financial Underbelly of Local Government Services, Projects & Spending.

Are you fed up with how The Highland Council is mismanaging public funds?

Are you fed up with the Highland Council redirecting funding & resources to the massively unpopular industrialisation of the Highlands in renewable energy & other other related development projects?

Are you fed up with our Poor Roads? Understaffed Schools? Terrible Waste Management? Etc… the list goes on!

Often, many of us citizens & activists spend a lot of energy on fighting certain issues in the arena where the problems develop.. like fighting planning decisions via objections or writing to councillors about roads, education or other services etc. but, when the people's views are being ignored on certain issues for so long & nothing seems to change for the better… then, it's time to FOLLOW THE MONEY.

This is your once a year chance to exercise your rights to fully inspect contracts awarded, receipts, ledgers, accounts, financial transactions, bills, vouchers, deeds & receipts.

The Council must allow you to inspect these or you can object directly to their external auditor if they don't allow you to see them.

You can also make direct objections to the external auditor if you find any transactions or accounting that appears unlawful, not properly accounted for or failing to achieve “best value” & accountability standards.

You may also object to issues related to internal audit, corporate governance, breaches of laws or regulations, potential contingency risks, material misstatements in the unaudited accounts or annual governance statement and any other issue that may directly undermine the accuracy or true representation of the Council's annual accounts.

I will be making several objections to the external auditor this year & I will post these objections in full on this Substack. Subscribe to Article 79 for updates to your inbox! 📥

Audit Scotland gives a really good technical guide which shows you exactly how the public inspection of accounts and objection process works. Click the button for the PDF.

OBJECTIONS - AUDIT SCOTLAND

The Public's Right of Inspection & Objection - Section 101 of the Local Government (Scotland) Act 1973

Everyone already knows about our rights to request information from councils & other public bodies under Freedom of Information laws, however, there is a much older and more powerful right individuals can exercise in a short 15 working day window every year! This year, the public inspection period at The Highland Council & related bodies runs from 26 June - 16 July 2026.

Every year, your local council must release their unaudited accounts of the previous financial year for free inspection by any interested person or member of the public. This means you can request to see all financial transactions including the accounts to be audited and all books, deeds, contracts, bills, vouchers and receipts relating thereto and make copies of all or any part of the accounts and those other documents.

That inspection period must be announced by the 17th of June every year and notice posted on your council's website. The full Council will vote to approve the unaudited accounts on 25 June 2026 and you can see the agenda & reports for that full Council meeting here.

This right of inspection and objection of accounts comes from Section 101 of the Local Government (Scotland) Act 1973 and the related more recent regulations, Local Authority Accounts (Scotland) Regulations 2014. It's worth checking out the short, easy to read regulations guiding this process.

The full text of the Highland Council's notice for the 2026 inspection is at the bottom of this page or click the button below for the PDF on the Council's website which contains direct links to copies of the unaudited accounts.

PUBLIC INSPECTION OF ACCOUNT 2025/2026

Further useful links:

• Highland Council - Annual Accounts

THE HIGHLAND COUNCIL

THE HIGHLAND COUNCIL PENSION FUND

HIGHLAND CHARITIES TRUST

HIGHLAND COUNCIL CHARITABLE TRUSTS

HIGHLAND & WESTERN ISLES VALUATION JOINT BOARD

HIGHLANDS AND ISLANDS TRANSPORT PARTNERSHIP

Unaudited Annual Accounts for the period from 1st April 2025 to 31st March 2026 public notice is given in accordance with the Local Authority Accounts (Scotland) Regulations 2014, that:

(a) A copy of the Unaudited Annual Accounts of the above mentioned Authorities from 1st April 2025 to 31st March 2026 will be available for inspection at the following websites from 26 June 2026 to 16 July 2026, both dates inclusive.

The Highland Council:

Highland Council – Unaudited Accounts – 2025-26

The Highland Council Pension Fund:

2025-26 – Pension Fund – Annual Report and Unaudited Annual Accounts

The Highland Charities Trust and the Highland Council Charitable Trusts:

Highland Council Charitable Trust Fund Unaudited Annual accounts – 2025-26

Highland and Western Isles Valuation Joint Board:

Valuation Joint Board – 2025-2026 Unaudited Accounts

Highland and Islands Transport Partnership:

HITRANS – 2025/2026 – Accounts – Unaudited

(b) Any person interested may request to inspect other documents related to these accounts and may take copies at no charge of any or all parts of the accounts. However, if they wish to be provided with copies a charge of 20p per A4 sheet and 40p per A3 sheet will be incurred. As all documents are not held in one location such inspection requests should be made to the Chief Officer Corporate Finance (email:customer.service@highland.gov.uk) during the 15 working day statutory inspection period indicated above.

Arrangements will then be made to make the appropriate documents available as soon as possible.

(c) Any person interested may object to the annual accounts or to any part of those statements, no later than 17 July 2026, by:

(1) sending their objection in writing, together with a statement of the grounds thereof to:

The Highland Council – Claire Gardiner, Audit Director, 4th Floor, 102 West Port, Edinburgh, EH3 9DN

The Highland Council Pension Fund – Claire Gardiner, Audit Director, 4th Floor, 102 West Port, Edinburgh, EH3 9DN

Highland and Western Isles Valuation Joint Board – Esther Scoburgh, Senior Audit Manager, 4th Floor, 102 West Port, Edinburgh, EH3 9DN

Highland and Islands Transport Partnership – Adam Haahr, Senior Audit Manager, 4th Floor, The Athenaeum Building, 8 Nelson Mandela Place, Glasgow G2 1BT.

(2) sending a copy of that objection and statement to the Chief Officer Corporate Finance (email: customer.service@highland.gov.uk) and any officer of the Authorities who may be concerned.

If it's underlined.. it's a link worth clicking. 🔗

Is this a hitpiece on our national information regulator, The Information Commissioner's Office (ICO) ?

Kind of… yes. Let me explain.

Just as I was about lodge my data protection court action in INV-SM2-24 in March 2024 against the Highland Council, I had come across a newspaper article in the John O' Groat Journal which is part of the HNMedia group. The article was written by Ally Tibbitt, who is also well known as a co-founder of the Scottish investigative journalism cooperative, The Ferret.

The article [PDF version] I must admit made me chuckle at first knowing what I knew about what a shambles the Highland Council's planning enforcement team was.

As you scrolled further into the article you find a chart of formatted data collated from a FOI/EIR made by the reporter, Ally Tibbitt at the website of WhatDoTheyKnow.com. There was a link in the article where you could click through to the request at WDTK.

If you scroll to the bottom of the page of the request at WDTK, you will find an annotation from the CEO of WDTK, Louise Crow stating that the spreadsheet provided was deleted due to a data breach. It gave identifying details of some 333 landowners around the Highlands that were currently being investigated for planning enforcement breaches. I could identify myself in that spreadsheet in mere seconds and in fact, what actually really made me miffed was I learned more details about the Council's bogus investigation into a non-existent “unauthorised business” in relation to my property than I had learned from the Council from my own enquiries. The Council having completely ignored my requests for information and subject access request which later became the basis of my successful court action against the Council in INV-SM2-24.

Ally Tibbitt was pushing the Council for the names of the landowners in this request. Well, Ally Tibbitt should have known better and likely certainly did know better but, luckily the Council wasn't stupid enough to disclose that information.

Absolutely anyone can fill in a form at the Council website and report you for all manner of bogus planning breaches. Why should the victims of bogus complaints end up exposed in some newspaper Ally Tibbitt writes for because the Council are hellbent on harassing anyone they happen to get a complaint about? The Council will literally believe any old rubbish they are told, then “invisibly process” your data, gather gossip from anyone to act on, unlawfully disclose your data to members of the public and other public authorities without your knowledge and then send unqualified and untrained “officers” completely clueless about planning law to harass you or perhaps spy on you as well.

💡In fact, if anyone ever reports you to the Highland Council for similar, my biggest tip for you is to get a mate to then also report you to the Council for the same bogus planning breach. That way, your mate will be fed back all manner of personal and private data of yours and information from the Council about their “McInvestigation” of you than they will ever give yourself as the subject of the investigation.

By the way… the days of anonymity of planning breach reporters are well and truly over… see here.

To grasp just how clueless this journalist & councillors are about what is really going on in Highland Council's planning enforcement team you only need to see the follow up article.

The only thing to come of this article was to make the problems worse. The Council then proceeded to assign Access Officers completely untrained & totally incompetent in planning law, which is clearly a highly complex area of law, which also has serious implications for individuals subject to these investigations, who then went on to create absolute havoc around the Highlands. It is even becoming evident at the Directorate of Planning & Environmental Appeals (DPEA) own public documents.

There is no backlog of planning breach complaints. There is a plethora of malicious individuals and busybodies who report others for all manner of totally false allegations and nonsense to use the Council as a vehicle for indirect harassment as well as a Council that's either too thick to be able to triage complaints properly or they actually enjoy harassing people. Frankly, I think it's a bit of both - I have ample experience & evidence to give a fairly authoritative assessment on the matter. After all, my compliance order in INV-SM2-24 completely shut down the Council's use of 17 years worth of my data in relation to planning, the Sheriff having determined that the entirety of the processing was unlawful.

Data Breach Reported & Investigating the Investigative Reporters.

I reported this data breach in the spreadsheet from Ally Tibbitt's request to the Highland Council. They, of course, ignored it. I then reported it on the website of WDTK. It was very quickly hidden by WDTK and they began an investigation into the data breach which included immediate correspondence with the Council over it. They also treated this report as an Article 17 GDPR erasure request.

In short, the Highland Council tried to squirm out of it by telling WDTK a load of porkie pies about it. I was then forced to explain in detail why it was a data breach to WDTK. WDTK initially refused the erasure request which was very strange. I then did a little digging and found out that despite WDTK's website and their parent organisation MySociety not showing these details… it turned out that Ally Tibbitt was in fact, recently made a trustee of MySociety. So, in essence WDTK's own trustee was involved in the debacle and seemingly pushing for an even bigger data breach in his request to the Highland Council?

I asked the folks at WDTK about whether they perhaps had a conflict of interest over refusing the erasure request by failing to state that the requestor was in fact, one of their own trustees. I had also discovered that WDTK and The Ferret had a business relationship wherein The Ferret offered Freedom of Information courses to members of the public and in return, course takers got a free pro subscription for a period at WDTK. 5 days later after bringing all of this to WDTK's attention, Ally Tibbitt is announced on MySociety's website as one of their trustees and a week or so after that I have a long letter in my email inbox from MySociety's CEO, Louise Crow now stating they have accepted my erasure request and she had annotated the request as a data breach and permanently removed the data.

I had also noticed that another Ferret co-founder, Billy Briggs had been poking around at the Highland Council only a few months previous to Tibbitts request via FOI at WDTK specifically about data breaches. That's all I'm saying about that, but, it should be noted.

The Spreadsheet Tickers Down in Wilmslow & Thou Shalt Not Mention Joint Controllership.

I have never used the website of WhatDoTheyKnow in my puff for making requests & never will. Frankly, I never liked their model. Whilst Freedom of Information rights are clearly to the benefit of everyone - there are several problems with that website. I am not alone in my thoughts on this.

First & foremost, yourself as the requestor nor the public authority answering your request there have zero control over what occurs once a request or upload is made there. If there is an accidental data breach, the public authority cannot just go click delete - they must contact WDTK who then has a say in the matter which is the very definition of “converging decisions” by the way. WDTK point requestors to their privacy notices, but, frankly, I've already seen how hard it is to remove my own data when it was caught up in a data breach so, I dread to think the challenge one might have removing a request or other personal data there.

In my view, WDTK massively overreaches on your rights in this regard, stripping the requestor of user autonomy. Section 1 of FOISA did not create a relationship that includes WDTK as an intervenor or beneficiary. WDTK claims all of this is for transparency, democracy and information rights blah blah but, if it were for that, control and autonomy would remain with the requestor, who was afforded the right in the first place to make that request.

By creating this trilateral relationship with a view to making this archive of requests a permanent archive, as is WDTK's mission statement, which also contains your personal data given you are required to use your real name which you cannot control without engaging with WDTK & only allowing public authorities reactive moderation via WDTK, they have also created another status for themselves - a joint controller under Article 26 GDPR for which they have no arrangements with with any of these public authorities for as required under the GDPR.

The reality is this - WhatDoTheyKnow and MySociety have introduced an intervening and converging interest in the processing for their own benefit. The processing between WDTK and the public authority has inextricably linked purposes. They are therefore, joint controllers for those processing operations.

You need not be a data protection expert to recognise this. One only needs to read the European Data Protection Board's Guidelines 07/2020 on the concepts of controller and processor in the GDPR to understand that this is undoubtedly the case.

There have also been numerous CJEU decisions in relation to this very issue confirming this, including decisions:

CJEU C-604/22 IAB Europe

CJEU C-40/17 Fashion ID

CJEU C-25/17 Jehovan Todistajat

CJEU C-210/16 Wirtshaftacademie

When WDTK refused to initially delete my data comprising the data breach from the website, I lodged a complaint with the ICO. My complaint to them heavily focussed on the fact that WDTK were acting as a joint controller with regard to the data breach as it was them who had the overriding determination as to whether the data should be deleted or not, not the Highland Council and in essence my complaint was against both; The Highland Council for the initial breach and WhatDoTheyKnow for their handling of it.

It's important to point out that the ICO and WhatDoTheyKnow have a rather cosy relationship. The ICO themselves recommends and promotes on their own website that people utilise WDTK for making Freedom of Information requests. They also conduct studies on statistics in conjunction with WDTK.

I got the impression fairly quickly that the ICO was a bit uncomfortable with my complaint and my angle on the joint controllership issue between WDTK and The Highland Council.

Why would the ICO be uncomfortable with this you ask? Put simply, joint controllership means joint & several liability. The ICO have heavily fined many public authorities for data breaches resulting from accidently publishing of data at the website at WhatDoTheyKnow.

In the well known Police Service of Northern Ireland penalty notice case which resulted in a £750k fine by the ICO, wherein home addresses of serving members of the police force were disclosed to the public at WhatDoTheyKnow, it doesn't take much working out to realise that the WDTK platform serves as a severity multiplier.

A mistake in a FOI department of a public authority can mean life or death circumstances at the click of a button for victims of the data breach, as was the potential in this case.

A normal FOI that is not immediately disclosed to the public at large where the public authority also remains in more control of the situation with no 3rd party intervenor to deal with demonstrates that this trilateral relationship has made data breach implications more severe - not less.

For example, quite recently, the Scottish Legal Complaints Commission carelessly sent me a massive data breach in a spreadsheet which disclosed details and personal data of hundreds of complainers, solicitors, law firms, court actions and private information of their own staff members. Had this been an upload to WDTK instead of directly to my inbox where I then immediately notified them, the consequences for the SLCC would have been severe. But, the SLCC also failed to report that data breach to the ICO which I now have and they refused to acknowledge the breach at all. More on this soon… 👀

And so, why are WDTK, acting as intervenors, severity multipliers and joint controllers, not being penalised as well?

I think WDTK would have a very difficult time demonstrating that they are in no way responsible for the event giving rise to the damage under Article 82 GDPR. After all, they provide the public platform as an intervenor for their own distinct purposes for creating a permanent archive which serves as a severity multiplier. They strip user and damage mitigation control from the controller and then position themselves as a mediator with an overriding decision power, therefore, I'd argue WDTK is certainly in part responsible.

Also, why should victims of data breaches have to battle not just the public authority responsible for the breach but, also WhatDoTheyKnow for erasure? If they are jointly responsible, they should be jointly & severally liable & penalised as the law intended.

Don't Poke The Bear: The ICO Secretly Close the Book & Then Promptly Re-Open It & Bring Out The Hammer.

This is where it gets rather eye-opening... In my complaint, the ICO did what they did best and merely ticked an infringement off on their spreadsheet and called it a day. Who did they record an infringement against? The Highland Council.

The ICO released their quarterly statistics a few months later where I only then discovered that was what they had done and it ended up in one of my court bundles in INV-SM2-24.

Much to Highland Council's Data Protection Officer's and Legal Manager's surprise and my surprise - the Highland Council knew nothing about it and they had zero contact from the ICO in regard to the data breach. The ICO recorded that data breach of 333 Highland landowners data at WDTK as an infringement under Article 5(1)(f) GDPR and hadn't even as much as sent an email to the Highland Council about it. 🤔

So.. did the ICO respond to the DPO poking the bear? They certainly did and they rapidly re-opened the case only hours later on the same day and brought out the hammer. Don't think I've ever seen our normally glacial moving regulator down in Wilmslow move so fast. 👀

Did the Highland Council respond? NO. On 28 March 2025 the ICO wrote again:

Did the Highland Council finally respond this time?? NO. The ICO wrote again on 3 April 2025:

Surely, the Highland Council finally responded?? NO they did not. The ICO went on to leave a voicemail on 9 April 2025, wrote another email on 5 June 2025 and finally… went on to record an infringement of the GDPR under Article 31 for failing to cooperate with the Commissioner on 23 June 2025.

Look at that timeline closely again, quite rightly in my view, Highland Council's Data Protection Officer made enquiries on 27 February 2025 about this infringement of the GDPR having been recorded against them without their knowledge. What he certainly wasn't expecting I am sure was the ICO coming back to him the same day, with zero apologies for the ICO's failure to contact them I might add, reopening the case and then demanding answers over this data breach. But, then he made his own mistake by then continuing to ignore the ICO, which is never a good idea. Then the ICO recorded the Article 31 infringement against them for failing to cooperate with the Commissioner. But, what did the ICO actually record in their own records?? They recorded a second Article 5(1)(f) for the same data breach. This same breach was already recorded in a previous spreadsheet.

What happened here in my view is that the ICO didn't like my complaint regarding WhatDoTheyKnow's part in this as a joint controller and was therefore partly liable in my view and fully liable in their own right for messing me about on the erasure request because WDTK's own trustee had made the original request. The ICO did not want to touch that with a barge pole so they secretly recorded an infringement against the Highland Council to get my complaint off their desk without having to deal with their mates over at WDTK. Then the email from the DPO blew the cover on the secret infringement recording, hence the aggressive & rapid response from the ICO.

Go look on LinkedIn.. do you see any data protection specialists or lawyers over there that have a good word to say about the ICO? No.. not really. Absolutely toothless & largely useless organisation that should be entirely overhauled or done away with to start afresh. With the Data Use & Access Act 2025 now commencing, expect precious nothing out of them over complaints. You will need to take these data controllers to court which in my view will be far more effective in the long run in cleaning up the lax attitudes of organisations with poor data protection practices.

The current Information Commissioner, John Edwards, is currently off work, swanning about on full pay under investigation for “something" with a “case to answer for” according to the ICO's website. Suffice to say, there is obviously plenty rotten lurking down in Wilmslow.

I sent an FOI to the Highland Council to try and find out what went on behind the scenes with regard to their handling of this complaint at the ICO & WDTK and they ignored the FOI too which ended up in Decision Notice 078/2026 being issued by the Scottish Information Commissioner for failure to respond. The request is now subject to a second application to the SIC as they failed to disclose all information that they held in respect of it.

The ICO have been aware for quite some time that the Highland Council and the Highland & Western Isles Valuation Joint Board are in total systemic non-compliance with Chapter IV of the GDPR and have thus far done absolutely nothing about it.

Even the Highland Council has been forced to quietly sound the alarm where on 27 May 2026, Internal Audit produced their Audit Plan for 2026/2027 to the Audit Committee showing Data Protection is now code red 🚨 at the top of the list.

The Highland Council now refusing to answer any FOI in relation to those matters.

All in all… suffice to say, I am not impressed by any of it.

I don't know about you, but, £38,657 seems rather extreme for a little Valuation Joint Board to be spending to avoid complying with a subject access request and erasure request for unlawfully processed data. For comparison, The Highland Council might spend on average, around £55k on a high stakes judicial review in the Court of Session on solicitors and an advocate like they did in Academy Street debacle Judicial Review in 2024 which they lost. You can see that FOI confirming legal expenses here.

Maybe this little court case is just the canary in the coal mine? Yes, I think so. The facts are straightforward. The data processing infrastructure at The Highland Council who operates as the data processor for the Highland & Western Isles Valuation Joint Board has completely collapsed. It is a structurally unlawful operation. This is fully admitted by both the Highland Council & the HWIVJB on the court record and even in their own FOI responses.

Roy Christie seems to run most of the show over at the HWIVJB. I quite like him actually… seems like a nice chap & by far the most efficient bureaucrat they have over there. ICT at Highland Council has a security alert in October 2024 after I started poking around exactly one month previous to this. 🚨👇

Despite the HWIVJB being wholly reliant on the Highland Council for all of their IT infrastructure, data centres, archive service and data processing.. turns out they have none of the required contracts. No data processing agreement, no sub-processing agreements, no ICT service level agreements. The entire operation is unlawful under the GDPR.

It might be easy to assume lots of it are just contracts that can easily be fixed. NO, I'm afraid not. These are major infringements of the GDPR and could make both parties subject to Tier 1 and Tier 2 fines by the ICO and the contracts are *NOT* retroactive - meaning what was done was done and no going back fixing the previous mess with a new contract.

I explain this situation in full detail in a Facebook post here. You should give a follow over there if you are not already as I post some info over there that is not here.

The Highland Council & the VJB are currently in ongoing major infringements of Chapter II & IV of the GDPR.

But, the real problem isn't even about missing contracts though. The real problem is that data processors under the GDPR must be neutral and process data only on behalf of the data controller (HWIVJB). The processor should be completely indifferent as to the product or outcome of that data processing. The data processor may not have an interest, financial, economic or otherwise in the outcome of the processing; or for then, they become the controller rather than the processor under Article 28(10) GDPR.

But, the HWIVJB is of course the Highland Council's revenue generation machine. Without them, they generate zero revenue from the council tax & non- domestic rate payers.

However, the Highland Council may not be a data controller for any of the HWIVJB's data processing. The Assessor of the HWIVJB is an independent office subject to his own set of special laws, for which the Highland Council may not go anywhere near. But, they have. So, officially, the Highland Council are currently what is known in data protection law as a “rogue processor". The entirety of the processing is therefore unlawful. Real simply, this means that the Assessor of the HWIVJB has a standalone positive obligation to erase all of that unlawfully processed data under Article 17 GDPR. The entire tax assessment database that the Highland Council relies on to charge you council tax and non-domestic rates should in strict legal terms be completely erased. 👀

You can request that they erase your data by the way too, which is exactly what my court case is all about in INV-SM11-25.

Sound extreme? Similar has happened before…

See CJEU C-46/23 Újpesti Polgármesteri Hivatal. 😮

Data Protection Goes Code Red at the Highland Council 🚨.

🚨Red Alert Folks!🚨 What have we here? The Highland Council produced their 2026/2027 Audit Plan to the Audit Committee on 27 May 2026 and what was at the very top on code red?

DATA PROTECTION.

I could find nowhere in the Council's audit plans in the past 10 years where they have even so much as had data protection anywhere on the audit plan. Did you know that Donna Sutherland is the Strategic Lead in charge of data protection as well as being the lead Internal Auditor for the Council? 🤔

Can anyone guess why data protection might be at red alert at the top of the audit plan? Not a single councillor on the Audit Committee could guess correctly, I can tell you that! Go have a look for yourself…

Freeport in Free Fall?

What else do we see at the top of the audit plan for 2026/2027? The Inverness & Cromarty Firth Green Freeport. This is the Highland Council's flagship Freeport project wherein they are the “accountable body". They are relying on £25 million pounds in staged grant funding from the UK Treasury to build the framework for this project. What do they get in return?? Just over half a billion 💰 pounds over 25 years in retention of non-domestic rates from businesses within the Freeport. What does it all rely on?? It relies on the Highland Council's non-domestic rates assessment data processing at the Assessor of the Highland & Western Isles Valuation Joint Board to be running tickety boo. 👌Except… all is clearly not tickety boo with the red alerts going on!

The Section 95 Finance Officer needs to assure all these parties that there are no contingency risks or breaches of regulations which undermine the financial stability of the Freeport project and at current.. he maybe has a tough time doing just that, do ye think?

The Highland & Western Isles Valuation Joint Board are about to have a meeting on 11 June 2026 and guess what is on their minds over there??

Freeport.. 👆 No data processing agreements & IT disaster plans. 👇

A data processing agreement with the Highland Council is no good. Repeat the mantra.. a data processor may not have a financial, economic or other interest in the outcome of the processing of the Assessor. The HWIVJB needs to move the entirety of its processing operations to a neutral data processor.. period! Anything less will remain unlawful.

Section 95 Finance Officer of The Highland Council Off Like A Fart in The Wind. 💨

Where's Brian gone? From the photo, Brian looks a touch worried, but, let's face it, any finance officer responsible for The Highland Council's current financial situation & staring down the big £1.4 billion black abyss would probably look exactly the same. 😂 But, Brian has been employed by the Highland Council for 35+ years…. has he just wandered off on retirement or?!

We sent some FOI to try and find out more details about Brian's interesting departure time, the vacancy was advertised in late April. Stay tuned folks and head to the FOI Archive to see what answers might await us shortly… you will see, we also begin to audit the auditors!

Have you scheduled your trip to the offices of “Wee Can't” on Glenurquhart Road for public inspection of the Council's accounts coming up in late- June/July? Hope they get the kettle on, because The Audit at Article 79 is going straight into the belly of the beast to find out just how many other spanners have been thrown into the gears of Highland Council's money generation machine.

Maybe now it might be a bit clearer why they got the moneybag bazooka out still taking potshots at the canary in the coal mine. 🔥

Due: 1 July 2026

Response Received: 16 June 2026

Review Sent: 16 June 2026

Review Due: 14 July 2026

Review Response Received: 23 June 2026

SICO Appeal Lodged: 23 June 2026

FS-Case-843492193

23 June 2026

Thank you for your email requesting a review of the Council’s response dated 16 June 2026 in relation to the following requests:

FS-Case-842712920 – Data Protection Audit 2026/27

FS-Case-842714061 – Internal Audit – Freeport

FS-Case-842714804 – Internal Audit – EQA Information

FS-Case-843489398 – Resignation of Section 95 Officer

FS-Case-843492193 – Non-Disclosure Agreements etc.

The Council has carefully considered your correspondence and notes your disagreement with the application of section 14(1) of the Freedom of Information (Scotland) Act 2002 (FOISA).

Having reviewed the requests, the associated correspondence, and the wider context in which they were submitted, I am satisfied that the Council was entitled to determine that the requests were vexatious in terms of section 14(1) of FOISA. In reaching this view, consideration has been given to the volume, frequency, and cumulative impact of requests submitted to the Council.

Section 21(8)(b) of FOISA provides that a public authority is not required to carry out a review where the original request was considered vexatious under section 14(1). Having considered the terms of your review request and the circumstances surrounding the original requests, the Council remains satisfied that the requests were correctly refused under section 14(1) FOISA.

Accordingly, the Council is not obliged to conduct a review and will not do so in terms of section 21(8)(b) of FOISA.

If you are dissatisfied with this decision, you have the right under section 47(1) of FOISA to apply directly to the Scottish Information Commissioner for a decision. Any such application must be made within six months of receiving this notice.

Information about how to make an application to the Commissioner is available from:

Scottish Information Commissioner

Kinburn Castle

Doubledykes Road

St Andrews

Fife

KY16 9DS

Email: enquiries@itspublicknowledge.info

Yours sincerely,

Donna Sutherland - Strategic Lead

Corporate Audit & Risk

16 June 2026

Dear Sir or Madam,

This is a request for a review to the combined decision in relation to:

1 June 2026 / FS-Case-842712920 – ‘Data Protection Audit 2026/27’

1 June 2026 / FS-Case-842714061 – ‘Internal Audit – Freeport’

1 June 2026 / FS-Case-842714804 – ‘Internal Audit – EQA Information’

2 June 2026 / FS-Case-843489398 – ‘Resignation of Section 95 Officer’

2 June 2026 / FS-Case-843492193 – ‘Non-Disclosure Agreements etc.’

I am dissatisfied with your anonymous combined refusal notice dated 16 JUN 2026 and I require a formal internal review under s.20 of FOISA.

I do not accept that these five distinct public interest requests are vexatious under s.14(1). If the Council intends to rely on s.21(8)(b) to refuse to conduct this review, please issue your statutory notice immediately so that this matter can proceed directly to the SIC for determination.

Thank you for your time & attention.

Kind regards.

16 June 2026

Thank you for your requests for information submitted under the Freedom of Information (Scotland) Act 2002 (FOISA) –

1 June 2026 / FS-Case-842712920 – ‘Data Protection Audit 2026/27’

1 June 2026 / FS-Case-842714061 – ‘Internal Audit – Freeport’

1 June 2026 / FS-Case-842714804 – ‘Internal Audit – EQA Information’

2 June 2026 / FS-Case-843489398 – ‘Resignation of Section 95 Officer’

2 June 2026 / FS-Case-843492193 – ‘Non-Disclosure Agreements etc.’

We have considered each request individually and within the wider context of your correspondence with the Council, we are refusing to comply with these requests under section 14(1) of FOISA, on the basis that they are considered vexatious.

Since May 2025, you have submitted 25 information requests, including 12 in 2026 to date, many relating to the Council’s Data Protection and Audit functions. The volume and frequency of these requests impose a significant and disproportionate burden on both the Complaints and Information Team and the service areas required to identify, retrieve, and review information.

The Complaints and Information Team is a small team, and this level of demand places a substantial strain on its limited capacity, impacting its ability to manage requests efficiently and within statutory timescales. Where responses are challenged, this leads to requests for review, which require further independent reconsideration and input from senior officers. This process is resource-intensive and creates a compounding and ongoing impact on the Council’s resources.

While requests may appear reasonable in isolation, their pattern, persistence and cumulative effect, represents a sustained high level of demand that exceeds what would be considered reasonable. We have also considered the impact on staff, which is a recognised factor in determining vexatiousness. The volume and frequency of requests, including multiple submissions within short timeframes, have had a negative impact on staff and are reasonably considered to contribute to a harassing effect.

We remain willing to consider future requests where they are reasonable in scope and frequency, and do not impose a disproportionate burden on the Council.

Under Section 20 of Freedom of Information (Scotland) Act 2002, you have the right to request that the Highland Council reviews any aspect of how it has dealt with your requests. This requirement for review should be requested to the Freedom of Information Officer, Highland Council, Glenurquhart Road, Inverness IV3 5NX, or foireview@highland.gov.uk, within 40 working days of receipt of this response. The request should include details of the information requested and the aspects of the Highland Councils response which you are not satisfied with.

If you are subsequently dissatisfied with the outcome of the Councils review, you have the right to appeal to the Scottish Information Commissioner under Section 47 of the Freedom of Information (Scotland) Act 2002, within six months of receiving the Councils review response.

Yours sincerely,

Complaints and Information Team

The Highland Council

Glenurquhart Road

Inverness IV3 5NX

ComplaintsandInformation@highland.gov.uk

Unless related to the business of The Highland Council, the views or opinions expressed within this e-mail are those of the sender and do not necessarily reflect those of The Highland Council, or associated bodies, nor does this e-mail form part of any contract unless so stated.

2 June 2026

Please provide a log of all employment settlement agreements, compromise agreements, or severance contracts containing non-disclosure or confidentiality clauses entered into between Highland Council and its employees from 1st January 2020 to the present date.

For each agreement, please provide the following recorded information:

1. The calendar year (or financial year) in which the agreement was finalised.

2. The specific Service or Team the employee belonged to at the time of their departure (e.g., Corporate Finance, Legal, Waste Management, Transport, Communities and Place).

3. The exact job title held by the employee if in paygrade tiers HC11-HC15 or Executive tier.

4. The total financial payout associated with the exit, broken down by severance payment, compensation for loss of office, and any associated pension strain costs.

5. The number of similar agreements currently still in negotiation at the time of this request broke down by service area or team & paygrade tier.

Thank you for your time & attention.

Kind regards.

Due: 1 July 2026

Response Received: 16 June 2026

Review Sent: 16 June 2026

Review Due: 14 July 2026

Review Response Received: 23 June 2026

SICO Appeal Lodged: 23 June 2026

FS-Case-843489398

23 June 2026

Thank you for your email requesting a review of the Council’s response dated 16 June 2026 in relation to the following requests:

FS-Case-842712920 – Data Protection Audit 2026/27

FS-Case-842714061 – Internal Audit – Freeport

FS-Case-842714804 – Internal Audit – EQA Information

FS-Case-843489398 – Resignation of Section 95 Officer

FS-Case-843492193 – Non-Disclosure Agreements etc.

The Council has carefully considered your correspondence and notes your disagreement with the application of section 14(1) of the Freedom of Information (Scotland) Act 2002 (FOISA).

Having reviewed the requests, the associated correspondence, and the wider context in which they were submitted, I am satisfied that the Council was entitled to determine that the requests were vexatious in terms of section 14(1) of FOISA. In reaching this view, consideration has been given to the volume, frequency, and cumulative impact of requests submitted to the Council.

Section 21(8)(b) of FOISA provides that a public authority is not required to carry out a review where the original request was considered vexatious under section 14(1). Having considered the terms of your review request and the circumstances surrounding the original requests, the Council remains satisfied that the requests were correctly refused under section 14(1) FOISA.

Accordingly, the Council is not obliged to conduct a review and will not do so in terms of section 21(8)(b) of FOISA.

If you are dissatisfied with this decision, you have the right under section 47(1) of FOISA to apply directly to the Scottish Information Commissioner for a decision. Any such application must be made within six months of receiving this notice.

Information about how to make an application to the Commissioner is available from:

Scottish Information Commissioner

Kinburn Castle

Doubledykes Road

St Andrews

Fife

KY16 9DS

Email: enquiries@itspublicknowledge.info

Yours sincerely,

Donna Sutherland - Strategic Lead

Corporate Audit & Risk

16 June 2026

Dear Sir or Madam,

This is a request for a review to the combined decision in relation to:

1 June 2026 / FS-Case-842712920 – ‘Data Protection Audit 2026/27’

1 June 2026 / FS-Case-842714061 – ‘Internal Audit – Freeport’

1 June 2026 / FS-Case-842714804 – ‘Internal Audit – EQA Information’

2 June 2026 / FS-Case-843489398 – ‘Resignation of Section 95 Officer’

2 June 2026 / FS-Case-843492193 – ‘Non-Disclosure Agreements etc.’

I am dissatisfied with your anonymous combined refusal notice dated 16 JUN 2026 and I require a formal internal review under s.20 of FOISA.

I do not accept that these five distinct public interest requests are vexatious under s.14(1). If the Council intends to rely on s.21(8)(b) to refuse to conduct this review, please issue your statutory notice immediately so that this matter can proceed directly to the SIC for determination.

Thank you for your time & attention.

Kind regards.

16 June 2026

Thank you for your requests for information submitted under the Freedom of Information (Scotland) Act 2002 (FOISA) –

1 June 2026 / FS-Case-842712920 – ‘Data Protection Audit 2026/27’

1 June 2026 / FS-Case-842714061 – ‘Internal Audit – Freeport’

1 June 2026 / FS-Case-842714804 – ‘Internal Audit – EQA Information’

2 June 2026 / FS-Case-843489398 – ‘Resignation of Section 95 Officer’

2 June 2026 / FS-Case-843492193 – ‘Non-Disclosure Agreements etc.’

We have considered each request individually and within the wider context of your correspondence with the Council, we are refusing to comply with these requests under section 14(1) of FOISA, on the basis that they are considered vexatious.

Since May 2025, you have submitted 25 information requests, including 12 in 2026 to date, many relating to the Council’s Data Protection and Audit functions. The volume and frequency of these requests impose a significant and disproportionate burden on both the Complaints and Information Team and the service areas required to identify, retrieve, and review information.

The Complaints and Information Team is a small team, and this level of demand places a substantial strain on its limited capacity, impacting its ability to manage requests efficiently and within statutory timescales. Where responses are challenged, this leads to requests for review, which require further independent reconsideration and input from senior officers. This process is resource-intensive and creates a compounding and ongoing impact on the Council’s resources.

While requests may appear reasonable in isolation, their pattern, persistence and cumulative effect, represents a sustained high level of demand that exceeds what would be considered reasonable. We have also considered the impact on staff, which is a recognised factor in determining vexatiousness. The volume and frequency of requests, including multiple submissions within short timeframes, have had a negative impact on staff and are reasonably considered to contribute to a harassing effect.

We remain willing to consider future requests where they are reasonable in scope and frequency, and do not impose a disproportionate burden on the Council.

Under Section 20 of Freedom of Information (Scotland) Act 2002, you have the right to request that the Highland Council reviews any aspect of how it has dealt with your requests. This requirement for review should be requested to the Freedom of Information Officer, Highland Council, Glenurquhart Road, Inverness IV3 5NX, or foireview@highland.gov.uk, within 40 working days of receipt of this response. The request should include details of the information requested and the aspects of the Highland Councils response which you are not satisfied with.

If you are subsequently dissatisfied with the outcome of the Councils review, you have the right to appeal to the Scottish Information Commissioner under Section 47 of the Freedom of Information (Scotland) Act 2002, within six months of receiving the Councils review response.

Yours sincerely,

Complaints and Information Team

The Highland Council

Glenurquhart Road

Inverness IV3 5NX

ComplaintsandInformation@highland.gov.uk

Unless related to the business of The Highland Council, the views or opinions expressed within this e-mail are those of the sender and do not necessarily reflect those of The Highland Council, or associated bodies, nor does this e-mail form part of any contract unless so stated.

2 June 2026

Please provide access to all recorded information held regarding the resignation, departure, and contractual exit of the former Chief Officer (Corporate Finance) and Section 95 Officer, Brian Porter, and the subsequent vacancy advertising campaign initiated under job reference HGH20961.

Please provide the following:

Formal Documentation

1. The formal letter of resignation or written notice of departure submitted by Brian Porter, alongside any formal acknowledgement, reply, or exit-interview records issued by the Chief Executive, Assistant Chief Executives, Head of HR or any other relevant member or officer.

Financial and Settlement Records

2. Any settlement agreement, compromise agreement, or contract containing non-disclosure/confidentiality clauses signed by Brian Porter and Highland Council, alongside a full, itemised breakdown of any financial packages, severance payouts, ex-gratia payments, or pension strain costs.

Internal Executive Correspondence

3. All internal correspondence (including emails, memos, and MS Teams chat logs) discussing the reasons for his departure and the timing of the vacancy relative to the statutory deadlines for the Unaudited Annual Accounts and the Annual Governance Statement. This search should focus on communications involving the Chief Executive, Assistant Chief Executives, the Head of HR, and the Leader of the Council.

Partnership Communications

4. All official correspondence, notifications, or emails exchanged between Highland Council executive staff/HR and representatives of external boards where Brian Porter served as an ex-officio officer, specifically focusing on his roles as Treasurer to the Highland and Western Isles Valuation Joint Board and Treasurer to the Highlands and Islands Transport Partnership (HITRANS) concerning his resignation, termination of duties, or the appointment of interim financial cover.

Committee and Governance Material

5. Any exempt minutes, briefing notes, or background papers from private business sessions of the Audit and Scrutiny Committee, Corporate Resources Committee, or the Senior Management Team where his departure or the transition of Section 95 duties was tabled.

External & Internal Audit Communications

6. All correspondence, emails, meeting notes, or formal advisories exchanged between Brian Porter and Claire Gardiner (or the wider Audit Scotland external audit team) and Donna Sutherland (Chief Audit Executive) Jason Thurlbeck (Corporate Audit Manager) concerning the preparation, verification, or concerns regarding the Unaudited Annual Accounts and the Annual Governance Statement in the 60 days leading up to his departure date.

Interim Cover & Hiring

7. Please provide the name and position of any individual who provided interim cover if applicable and the dates of the interim cover and the number of applications received for the job vacancy, the number of interviews conducted for the vacancy as well as the name of the individual hired to replace Mr. Porter, if known at the present time.

Public Interest

As the Section 95 Officer holds a core statutory duty to the public for the administration of council finances, the threshold for personal privacy under Section 38(1)(b) is heavily diminished. The public has an absolute right to transparency regarding a chief financial departure.

Thank you for your time & attention.

Kind regards.

Due: 30 June 2026

Response Received: 16 June 2026

Review Sent: 16 June 2026

Review Due: 14 July 2026

Review Response Received: 23 June 2026

SICO Appeal Lodged: 23 June 2026

FS-Case-842714804

23 June 2026

Thank you for your email requesting a review of the Council’s response dated 16 June 2026 in relation to the following requests:

• FS-Case-842712920 – Data Protection Audit 2026/27

• FS-Case-842714061 – Internal Audit – Freeport

• FS-Case-842714804 – Internal Audit – EQA Information

• FS-Case-843489398 – Resignation of Section 95 Officer

• FS-Case-843492193 – Non-Disclosure Agreements etc.

The Council has carefully considered your correspondence and notes your disagreement with the application of section 14(1) of the Freedom of Information (Scotland) Act 2002 (FOISA).

Having reviewed the requests, the associated correspondence, and the wider context in which they were submitted, I am satisfied that the Council was entitled to determine that the requests were vexatious in terms of section 14(1) of FOISA. In reaching this view, consideration has been given to the volume, frequency, and cumulative impact of requests submitted to the Council.

Section 21(8)(b) of FOISA provides that a public authority is not required to carry out a review where the original request was considered vexatious under section 14(1). Having considered the terms of your review request and the circumstances surrounding the original requests, the Council remains satisfied that the requests were correctly refused under section 14(1) FOISA.

Accordingly, the Council is not obliged to conduct a review and will not do so in terms of section 21(8)(b) of FOISA.

If you are dissatisfied with this decision, you have the right under section 47(1) of FOISA to apply directly to the Scottish Information Commissioner for a decision. Any such application must be made within six months of receiving this notice.

Information about how to make an application to the Commissioner is available from:

Scottish Information Commissioner
Kinburn Castle
Doubledykes Road
St Andrews
Fife
KY16 9DS

Email: enquiries@itspublicknowledge.info

Yours sincerely,

Donna Sutherland - Strategic Lead

Corporate Audit & Risk

16 June 2026

Dear Sir or Madam,

This is a request for a review to the combined decision in relation to:

1 June 2026 / FS-Case-842712920 – ‘Data Protection Audit 2026/27’

1 June 2026 / FS-Case-842714061 – ‘Internal Audit – Freeport’

1 June 2026 / FS-Case-842714804 – ‘Internal Audit – EQA Information’

2 June 2026 / FS-Case-843489398 – ‘Resignation of Section 95 Officer’

2 June 2026 / FS-Case-843492193 – ‘Non-Disclosure Agreements etc.’

I am dissatisfied with your anonymous combined refusal notice dated 16 JUN 2026 and I require a formal internal review under s.20 of FOISA.

I do not accept that these five distinct public interest requests are vexatious under s.14(1). If the Council intends to rely on s.21(8)(b) to refuse to conduct this review, please issue your statutory notice immediately so that this matter can proceed directly to the SIC for determination.

Thank you for your time & attention.

Kind regards.

16 June 2026

Thank you for your requests for information submitted under the Freedom of Information (Scotland) Act 2002 (FOISA) –

1 June 2026 / FS-Case-842712920 – ‘Data Protection Audit 2026/27’

1 June 2026 / FS-Case-842714061 – ‘Internal Audit – Freeport’

1 June 2026 / FS-Case-842714804 – ‘Internal Audit – EQA Information’

2 June 2026 / FS-Case-843489398 – ‘Resignation of Section 95 Officer’

2 June 2026 / FS-Case-843492193 – ‘Non-Disclosure Agreements etc.’

We have considered each request individually and within the wider context of your correspondence with the Council, we are refusing to comply with these requests under section 14(1) of FOISA, on the basis that they are considered vexatious.

Since May 2025, you have submitted 25 information requests, including 12 in 2026 to date, many relating to the Council’s Data Protection and Audit functions. The volume and frequency of these requests impose a significant and disproportionate burden on both the Complaints and Information Team and the service areas required to identify, retrieve, and review information.

The Complaints and Information Team is a small team, and this level of demand places a substantial strain on its limited capacity, impacting its ability to manage requests efficiently and within statutory timescales. Where responses are challenged, this leads to requests for review, which require further independent reconsideration and input from senior officers. This process is resource-intensive and creates a compounding and ongoing impact on the Council’s resources.

While requests may appear reasonable in isolation, their pattern, persistence and cumulative effect, represents a sustained high level of demand that exceeds what would be considered reasonable. We have also considered the impact on staff, which is a recognised factor in determining vexatiousness. The volume and frequency of requests, including multiple submissions within short timeframes, have had a negative impact on staff and are reasonably considered to contribute to a harassing effect.

We remain willing to consider future requests where they are reasonable in scope and frequency, and do not impose a disproportionate burden on the Council.

Under Section 20 of Freedom of Information (Scotland) Act 2002, you have the right to request that the Highland Council reviews any aspect of how it has dealt with your requests. This requirement for review should be requested to the Freedom of Information Officer, Highland Council, Glenurquhart Road, Inverness IV3 5NX, or foireview@highland.gov.uk, within 40 working days of receipt of this response. The request should include details of the information requested and the aspects of the Highland Councils response which you are not satisfied with.

If you are subsequently dissatisfied with the outcome of the Councils review, you have the right to appeal to the Scottish Information Commissioner under Section 47 of the Freedom of Information (Scotland) Act 2002, within six months of receiving the Councils review response.

Yours sincerely,

Complaints and Information Team

The Highland Council

Glenurquhart Road

Inverness IV3 5NX

ComplaintsandInformation@highland.gov.uk

Unless related to the business of The Highland Council, the views or opinions expressed within this e-mail are those of the sender and do not necessarily reflect those of The Highland Council, or associated bodies, nor does this e-mail form part of any contract unless so stated.

31 May 2026

Please provide the following information:

1. The exact date on which the last independent External Quality Assessment (EQA) of the Highland Council’s Internal Audit service was fully completed, finalised, and signed off.

2. Copies of all formal reports, letters, or closing notices received by the council from the external validator who conducted that most recent EQA.

3. All internal correspondence, memos, and briefing notes sent between the Chief Audit Executive, the Chief Executive, and the Chair of the Audit Committee from January 2022 to May 2026 regarding the delay, rescheduling, or failure to complete the mandatory five-year EQA required under public sector internal audit frameworks.

4. Any written formal risk disclosures, board notifications, or impact assessments compiled under Standard 12.3 (External Quality Assessment) of the new Global Internal Audit Standards (GIAS) detailing how the lack of an independent external validation impacts the department’s legal right to state that its audit work “conforms with the Global Internal Audit Standards” in public committee reports.

Kind regards.

Due: 30 June 2026

Response Received: 16 June 2026

Review Sent: 16 June 2026

Review Due: 14 July 2026

Review Response Received: 23 June 2026

SICO Appeal Lodged: 23 June 2026

FS-Case-842714061

23 June 2026

Thank you for your email requesting a review of the Council’s response dated 16 June 2026 in relation to the following requests:

FS-Case-842712920 – Data Protection Audit 2026/27

FS-Case-842714061 – Internal Audit – Freeport

FS-Case-842714804 – Internal Audit – EQA Information

FS-Case-843489398 – Resignation of Section 95 Officer

FS-Case-843492193 – Non-Disclosure Agreements etc.

The Council has carefully considered your correspondence and notes your disagreement with the application of section 14(1) of the Freedom of Information (Scotland) Act 2002 (FOISA).

Having reviewed the requests, the associated correspondence, and the wider context in which they were submitted, I am satisfied that the Council was entitled to determine that the requests were vexatious in terms of section 14(1) of FOISA. In reaching this view, consideration has been given to the volume, frequency, and cumulative impact of requests submitted to the Council.

Section 21(8)(b) of FOISA provides that a public authority is not required to carry out a review where the original request was considered vexatious under section 14(1). Having considered the terms of your review request and the circumstances surrounding the original requests, the Council remains satisfied that the requests were correctly refused under section 14(1) FOISA.

Accordingly, the Council is not obliged to conduct a review and will not do so in terms of section 21(8)(b) of FOISA.

If you are dissatisfied with this decision, you have the right under section 47(1) of FOISA to apply directly to the Scottish Information Commissioner for a decision. Any such application must be made within six months of receiving this notice.

Information about how to make an application to the Commissioner is available from:

Scottish Information Commissioner

Kinburn Castle

Doubledykes Road

St Andrews

Fife

KY16 9DS

Email: enquiries@itspublicknowledge.info

Yours sincerely,

Donna Sutherland - Strategic Lead

Corporate Audit & Risk

16 June 2026

Dear Sir or Madam,

This is a request for a review to the combined decision in relation to:

1 June 2026 / FS-Case-842712920 – ‘Data Protection Audit 2026/27’

1 June 2026 / FS-Case-842714061 – ‘Internal Audit – Freeport’

1 June 2026 / FS-Case-842714804 – ‘Internal Audit – EQA Information’

2 June 2026 / FS-Case-843489398 – ‘Resignation of Section 95 Officer’

2 June 2026 / FS-Case-843492193 – ‘Non-Disclosure Agreements etc.’

I am dissatisfied with your anonymous combined refusal notice dated 16 JUN 2026 and I require a formal internal review under s.20 of FOISA.

I do not accept that these five distinct public interest requests are vexatious under s.14(1). If the Council intends to rely on s.21(8)(b) to refuse to conduct this review, please issue your statutory notice immediately so that this matter can proceed directly to the SIC for determination.

Thank you for your time & attention.

Kind regards.

16 June 2026

Thank you for your requests for information submitted under the Freedom of Information (Scotland) Act 2002 (FOISA) –

1 June 2026 / FS-Case-842712920 – ‘Data Protection Audit 2026/27’

1 June 2026 / FS-Case-842714061 – ‘Internal Audit – Freeport’

1 June 2026 / FS-Case-842714804 – ‘Internal Audit – EQA Information’

2 June 2026 / FS-Case-843489398 – ‘Resignation of Section 95 Officer’

2 June 2026 / FS-Case-843492193 – ‘Non-Disclosure Agreements etc.’

We have considered each request individually and within the wider context of your correspondence with the Council, we are refusing to comply with these requests under section 14(1) of FOISA, on the basis that they are considered vexatious.

Since May 2025, you have submitted 25 information requests, including 12 in 2026 to date, many relating to the Council’s Data Protection and Audit functions. The volume and frequency of these requests impose a significant and disproportionate burden on both the Complaints and Information Team and the service areas required to identify, retrieve, and review information.

The Complaints and Information Team is a small team, and this level of demand places a substantial strain on its limited capacity, impacting its ability to manage requests efficiently and within statutory timescales. Where responses are challenged, this leads to requests for review, which require further independent reconsideration and input from senior officers. This process is resource-intensive and creates a compounding and ongoing impact on the Council’s resources.

While requests may appear reasonable in isolation, their pattern, persistence and cumulative effect, represents a sustained high level of demand that exceeds what would be considered reasonable. We have also considered the impact on staff, which is a recognised factor in determining vexatiousness. The volume and frequency of requests, including multiple submissions within short timeframes, have had a negative impact on staff and are reasonably considered to contribute to a harassing effect.

We remain willing to consider future requests where they are reasonable in scope and frequency, and do not impose a disproportionate burden on the Council.

Under Section 20 of Freedom of Information (Scotland) Act 2002, you have the right to request that the Highland Council reviews any aspect of how it has dealt with your requests. This requirement for review should be requested to the Freedom of Information Officer, Highland Council, Glenurquhart Road, Inverness IV3 5NX, or foireview@highland.gov.uk, within 40 working days of receipt of this response. The request should include details of the information requested and the aspects of the Highland Councils response which you are not satisfied with.

If you are subsequently dissatisfied with the outcome of the Councils review, you have the right to appeal to the Scottish Information Commissioner under Section 47 of the Freedom of Information (Scotland) Act 2002, within six months of receiving the Councils review response.

Yours sincerely,

Complaints and Information Team

The Highland Council

Glenurquhart Road

Inverness IV3 5NX

ComplaintsandInformation@highland.gov.uk

Unless related to the business of The Highland Council, the views or opinions expressed within this e-mail are those of the sender and do not necessarily reflect those of The Highland Council, or associated bodies, nor does this e-mail form part of any contract unless so stated.

31 May 2026

Please provide the following information regarding the Inverness and Cromarty Firth Green Freeport project:

1. Copies of all formal letters of assurance, compliance certificates, or annual written assurance statements submitted by the Highland Council’s Section 95 Officer (Chief Financial Officer) to the UK Government (including the UK Treasury and the Scotland Office) and/or the Scottish Government for 2024/2025 and 2025/2026. This refers specifically to the mandatory annual assurance requirements regarding the Freeport’s processes for the proper administration of financial affairs.

2. A copy of the complete log of the specific steps and checks or internal control reviews that the Section 95 Officer undertook and recorded to justify the signing and submission of those letters of assurance.

3. The exact names of the specific government departments, units, or central oversight teams to which each of these Section 95 assurance statements were officially provided and need to be provided to in future.

4. Any formal correspondence or briefing notes sent by the Section 95 Officer to the Chief Executive or the Leader of the Council between January 1, 2026, and May 31, 2026, concerning legal, data compliance, or financial “contingency risks” that could impact the validity of these signed letters of assurance.

5. Any correspondence, notes or other paperwork exchanged between the Section 95 Officer and the Chief Audit Executive regarding the required assurance statements in paragraph 1.

6. All internal background papers and correspondence, working files, and risk assessment documentation utilised by the Internal Audit team to assign the high-priority risk score of 37 to the Freeport project in the 2026/27 internal audit plan; this request specifically encompasses all raw risk scoring matrices and evaluation worksheets, the overarching audit planning memorandums, any dedicated service risk register entries or “gaps in control” logs tracking the Council’s vulnerabilities as the project’s Accountable Body, and all internal minutes or regulatory alert files concerning external compliance pressures or audit liaison warnings linked to this specific risk escalation.

7. The name & position of the individual(s) who will be conducting the planned audit of the Freeport on the audit plan.

Thank you for your time & attention.

Kind regards.

Due: 30 June 2026

Response Received: 16 June 2026

Review Sent: 16 June 2026

Review Due: 14 July 2026

Review Response Received: 23 June 2026

SIC Appeal Lodged: 23 June 2026

FS-Case-842712920

Right Over The Target 🎯

Nothing says you are right over the target more than a mass refusal of 5 requests full of obstructive & bizarre responses by our friendly bureaucrats over at the offices of “We Can't" on Glenurquhart Road. Highland Council is clearly feeling the heat. 🔥

🚨 Data Protection goes code red on Highland Council's Internal Audit Plan for 2026/2027. 🚨

23 June 2026

Thank you for your email requesting a review of the Council’s response dated 16 June 2026 in relation to the following requests:

FS-Case-842712920 – Data Protection Audit 2026/27

FS-Case-842714061 – Internal Audit – Freeport

FS-Case-842714804 – Internal Audit – EQA Information

FS-Case-843489398 – Resignation of Section 95 Officer

FS-Case-843492193 – Non-Disclosure Agreements etc.

The Council has carefully considered your correspondence and notes your disagreement with the application of section 14(1) of the Freedom of Information (Scotland) Act 2002 (FOISA).

Having reviewed the requests, the associated correspondence, and the wider context in which they were submitted, I am satisfied that the Council was entitled to determine that the requests were vexatious in terms of section 14(1) of FOISA. In reaching this view, consideration has been given to the volume, frequency, and cumulative impact of requests submitted to the Council.

Section 21(8)(b) of FOISA provides that a public authority is not required to carry out a review where the original request was considered vexatious under section 14(1). Having considered the terms of your review request and the circumstances surrounding the original requests, the Council remains satisfied that the requests were correctly refused under section 14(1) FOISA.

Accordingly, the Council is not obliged to conduct a review and will not do so in terms of section 21(8)(b) of FOISA.

If you are dissatisfied with this decision, you have the right under section 47(1) of FOISA to apply directly to the Scottish Information Commissioner for a decision. Any such application must be made within six months of receiving this notice.

Information about how to make an application to the Commissioner is available from:

Scottish Information Commissioner

Kinburn Castle

Doubledykes Road

St Andrews

Fife

KY16 9DS

Email: enquiries@itspublicknowledge.info

Yours sincerely,

Donna Sutherland - Strategic Lead

Corporate Audit & Risk

16 June 2026

Dear Sir or Madam,

This is a request for a review to the combined decision in relation to:

1 June 2026 / FS-Case-842712920 – ‘Data Protection Audit 2026/27’

1 June 2026 / FS-Case-842714061 – ‘Internal Audit – Freeport’

1 June 2026 / FS-Case-842714804 – ‘Internal Audit – EQA Information’

2 June 2026 / FS-Case-843489398 – ‘Resignation of Section 95 Officer’

2 June 2026 / FS-Case-843492193 – ‘Non-Disclosure Agreements etc.’

I am dissatisfied with your anonymous combined refusal notice dated 16 JUN 2026 and I require a formal internal review under s.20 of FOISA.

I do not accept that these five distinct public interest requests are vexatious under s.14(1). If the Council intends to rely on s.21(8)(b) to refuse to conduct this review, please issue your statutory notice immediately so that this matter can proceed directly to the SIC for determination.

Thank you for your time & attention.

Kind regards.

16 June 2026

Thank you for your requests for information submitted under the Freedom of Information (Scotland) Act 2002 (FOISA) –

1 June 2026 / FS-Case-842712920 – ‘Data Protection Audit 2026/27’

1 June 2026 / FS-Case-842714061 – ‘Internal Audit – Freeport’

1 June 2026 / FS-Case-842714804 – ‘Internal Audit – EQA Information’

2 June 2026 / FS-Case-843489398 – ‘Resignation of Section 95 Officer’

2 June 2026 / FS-Case-843492193 – ‘Non-Disclosure Agreements etc.’

We have considered each request individually and within the wider context of your correspondence with the Council, we are refusing to comply with these requests under section 14(1) of FOISA, on the basis that they are considered vexatious.

Since May 2025, you have submitted 25 information requests, including 12 in 2026 to date, many relating to the Council’s Data Protection and Audit functions. The volume and frequency of these requests impose a significant and disproportionate burden on both the Complaints and Information Team and the service areas required to identify, retrieve, and review information.

The Complaints and Information Team is a small team, and this level of demand places a substantial strain on its limited capacity, impacting its ability to manage requests efficiently and within statutory timescales. Where responses are challenged, this leads to requests for review, which require further independent reconsideration and input from senior officers. This process is resource-intensive and creates a compounding and ongoing impact on the Council’s resources.

While requests may appear reasonable in isolation, their pattern, persistence and cumulative effect, represents a sustained high level of demand that exceeds what would be considered reasonable. We have also considered the impact on staff, which is a recognised factor in determining vexatiousness. The volume and frequency of requests, including multiple submissions within short timeframes, have had a negative impact on staff and are reasonably considered to contribute to a harassing effect.

We remain willing to consider future requests where they are reasonable in scope and frequency, and do not impose a disproportionate burden on the Council.

Under Section 20 of Freedom of Information (Scotland) Act 2002, you have the right to request that the Highland Council reviews any aspect of how it has dealt with your requests. This requirement for review should be requested to the Freedom of Information Officer, Highland Council, Glenurquhart Road, Inverness IV3 5NX, or foireview@highland.gov.uk, within 40 working days of receipt of this response. The request should include details of the information requested and the aspects of the Highland Councils response which you are not satisfied with.

If you are subsequently dissatisfied with the outcome of the Councils review, you have the right to appeal to the Scottish Information Commissioner under Section 47 of the Freedom of Information (Scotland) Act 2002, within six months of receiving the Councils review response.

Yours sincerely,

Complaints and Information Team

The Highland Council

Glenurquhart Road

Inverness IV3 5NX

ComplaintsandInformation@highland.gov.uk

Unless related to the business of The Highland Council, the views or opinions expressed within this e-mail are those of the sender and do not necessarily reflect those of The Highland Council, or associated bodies, nor does this e-mail form part of any contract unless so stated.

31 May 2026

Please provide the following information in relation to the Council’s internal audit plan for 2026/2027 and in relation to “Data Protection” appearing at the top of the newly added audits with a high priority and risk score of 37:

1. A copy of the formal Terms of Reference, Audit Brief, or Scoping Document issued to the internal audit team defining the parameters and objectives of the 30-day Data Protection audit and any other related working papers.

2. All internal correspondence (emails, teams chat logs), briefing notes, or reports generated by Audit and Risk teams detailing the methodology, mathematical calculation, or administrative justification used to escalate the Data Protection risk score to 37.

2.1 Please include all correspondence between the Chief Exec, Monitoring Officer, Assistant Chief Executive of Corporate, s.95 Officer, Chief Audit Executive, Corporate Audit Manager, Data Protection Officer, ICT staff, legal staff and the Assessor & Depute Assessor of the HWIVJB relating to internal audit of Data Protection matters.

2.2 Please include any correspondence between the Council and any external parties such as the External Auditor, the ICO etc in relation to the internal audit of Data Protection.

3. Copies of any active Non-Compliance Registers, Gap Analysis reports, or Data Flow Inventories compiled by the internal audit team or Information Governance department regarding the data processing infrastructure between The Highland Council and the Highlands & Western Isles Valuation Joint Board (VJB).

4. Any formal Internal Risk Appraisals or Legal Briefings assessing the council’s corporate liability regarding active regulatory investigations or enforcement notifications from the UK Information Commissioner’s Office (ICO).

5. Copies of all current risk register entries related to Data Protection, ICT and Freedom of Information.

6. Copies of all Risk Amendment Forms, Change Request logs, and Risk Evaluation templates generated between 1 February 2026 and 27 May 2026 relating to the alteration, escalation, or amendment of the Data Protection risk profile on the Corporate Risk Register.

7. All minutes, operational notes, and action logs from internal management meetings, including but not limited to the Chief Officers’ Board, Corporate Risk Management groups, or internal audit planning sessions, where the decision to amend the Data Protection risk score to 37 was formally discussed or approved.

8. The exact qualitative and quantitative criteria matrix used to calculate the impact and likelihood scores that resulted in the final risk score designation of 37 for Data Protection.

9. Fee notes/invoices and instruction letters & authorisations of any external legal advice undertaken in relation to Data Protection by the Highland Council since 1 September 2024.

10. Referring to my recent FOI, FS-Case-798209673, and in reference to GIAS standard 7.1, given that the Chief Audit Executive Donna Sutherland is also the Strategic Lead for Data Protection and her line manager, Stewart Fraser is also the Chief Legal Officer, whose in-house team is involved in ongoing data protection litigation, can the Council please provide the documentation or reports supplied to the Audit Committee about actual impairments reported, safeguards in place and information as to which independent third party will be appointed to oversee assurance activities. Please also provide any methodologies the Council has in place to meet the standards of 7.1 of the GIAS.

Kind regards.

Numerous people around the Highlands are being wrongly charged for wastewater.

Where is all the money 💰going??

Less than a fortnight after that FOI, Scottish Water appears at my property to do an on-site chlorine test of my water to see if it's mains water or not and they came up EMPTY. 💧

Shall we see how often Highland Council send Scottish Water round to carry out these tests? 👇

Due: 23 June 2026

Review Sent: 2 June 2026

Review Due: 1 July 2026

On 2 June 2026, Scottish Water said…

“To help explain, Scottish Water does not carry out on-site chlorine testing for Highland Council. The Council has its own Environmental Health and Facilities Teams, which undertake this sampling under a range of regulatory regimes. Scottish Water does not receive any information about the Council’s on-site testing and therefore do not have knowledge of its testing programme. You may wish to contact Highland Council to request the information you seek.”

Well… that's awkward. 🤔

2 June 2026

Dear Sir or Madam,

If you could please review your response to this request I shall be grateful.

I have now supplied the following alongside this request for review:

1. An email dated 20 May 2026 from Highland Council’s solicitor, Oksana Khusainova to the clerk at the First Tier Tribunal of Scotland Taxation Chamber requesting a sist until Scottish Water made a site visit at Highland Council’s request.

2. A video from 25 May 2026 of a Scottish Water technician conducting on-site chlorine testing of a private water supply at a domestic property at the request of Highland Council.

Therefore, information must be held that was requested in my original request.

If you could also provide the statutory basis for these site visits on behalf of Highland Council I shall also be grateful.

Thank you for your time and attention.

Kind regards.

2 June 2026

INFORMATION REQUEST

Thank you for your request for information. Scottish Water has determined that this was a request for Environmental Information and therefore we are required to deal with your request under the Environmental Information (Scotland) Regulations 2004 (EIRs). We have applied the exemption contained in section 39(2) of FOISA and will deal with your request for environmental information under the EIRs alone.

The Environmental Information (Scotland) Regulations 2004 (EIRs) sit alongside Scotland’s FOI Act and govern access to environmental information held by Scottish public authorities.

Your request for information was for the following:

1. A breakdown by year of how many occasions Scottish Water has been requested by the Highland Council to perform onsite chlorine tests at domestic properties in the Highland Council’s area in the last 5 years up to and including the current date, 25 May 2026.

2. Please provide the dates of the requests from the Highland Council, which team at the Highland Council requested the test and the general reasons for all the requests and the results of those requests (positive or negative).

We always aim to provide information where we can. In this case, however, we do not hold the information you have asked for. To help explain, Scottish Water does not carry out on-site chlorine testing for Highland Council. The Council has its own Environmental Health and Facilities Teams, which undertake this sampling under a range of regulatory regimes. Scottish Water does not receive any information about the Council’s on-site testing and therefore do not have knowledge of its testing programme. You may wish to contact Highland Council to request the information you seek.

Exceptions Applied

EIR Regulation 14(1) – Transfer of a request

Where we have advised you to contact Highland Council, this is in accordance with Regulation 14(1)(b) of the Environmental Information (Scotland) Regulations 2004.

The text of Regulation 14(1)(b) is reproduced below;

14(1) Where a Scottish public authority has received a request to make environmental information available and does not hold that information but believes that another public authority holds the information requested then it shall,-

(b) supply the applicant with the name and address of that other authority.

Complaints and Information Team

Highland Council Headquarters

Glenurquhart Road

Inverness

IV3 5NX

Email: complaintsandinformation@highland.gov.uk

Website: Freedom of Information - Highland Council

EIR Regulation 10(4)(a) - Information Not held

Where we have advised above that we do not hold some or all the information you have requested, this is refused under regulation 10(4)(a) of the EIRs. Under this exception, we are allowed to refuse requests if the information is not held. While there is public interest in sharing environmental information, it is not possible to disclose what is not held. Confirming that the information is not held is itself transparent and prevents misinformation. Therefore, the public interest favours maintaining the exception in these circumstances. I appreciate this exception may appear odd, but this is essentially a technical point as we are obliged under the legislation to carry out a public interest test for this exception, but we cannot provide information which we do not hold.

If you have any queries regarding your Freedom of Information request, please feel free to contact us and we will be happy to assist. You can do this by contacting the following email address FOI@scottishwater.co.uk.

You can seek a review of this response within forty working days and thereafter appeal to the Scottish Information Commissioner.

Further information on the appeals procedure can be obtained from the attached document and the Commissioner’s website at www.itspublicknowledge.info/Appeal.

Yours sincerely

Freedom of Information Team

Scottish Water

The Bridge

Buchanan Gate Business Park A

Cumbernauld Road

Stepps

Glasgow

G33 6FB

Managed email Service: FOI@scottishwater.co.uk

Scottish Water - Trusted to serve Scotland

The information disclosed to you is prepared for Scottish Water’s internal purposes only and in relation to Scottish Water’s operational requirements at the time of preparation of the disclosed information. Scottish Water accepts no responsibility or liability for any use of, or reliance upon, the disclosed information, howsoever arising. Scottish Water hereby gives notice that the disclosed information, represents the opinion/ position/ forecast/ analysis/evaluations/projections/views/situation at a point in time and the aforementioned opinion/position/forecast/analysis/evaluations/projections/views/situation may become outdated/inaccurate/incomplete within a short space of time after the date of the disclosed information being compiled. Apart from compliance with intellectual property laws (dealt with below), any use of the disclosed information is entirely at your own risk and no warranty is given in relation to fitness for any particular purpose, accuracy or completeness.

FREEDOM OF INFORMATION GIVES YOU THE RIGHT TO READ THE INFORMATION FOR YOUR PERSONAL USE. THE DISCLOSED INFORMATION MAY CONTAIN INTELLECTUAL PROPERTY RIGHTS, SUCH AS COPYRIGHT. ACCORDINGLY, IF YOU WANT TO RE-USE THE INFORMATION, YOU SHOULD ENSURE THAT YOU HAVE RELEVANT PERMISSIONS TO DO SO FROM THE OWNERS OF INTELLECTUAL PROPERTY RIGHTS.

Privileged and confidential information may be contained in this email and any attached files, hyperlinks, or similar transmitted with it. If you are not the intended recipient, you should not retain, copy, or use this email for any purpose, nor disclose any part of its contents to any person. If you have received this email in error, please notify the sender immediately and delete this email along with any attached files, hyperlinks, or similar from your systems.

Opinions, conclusions, and other information in this email that do not relate to the official business of Scottish Water or any of Scottish Water’s subsidiaries, affiliates, or holding companies (collectively “Group Companies”), including Scottish Water Horizons Limited, should be understood as neither given nor endorsed by them. The contents of emails sent and received are monitored.

WARNING: Neither Scottish Water or any of its Group Companies make any representations or give any assurances or warranties regarding the safety, reliability, or any other attribute of this email, including any attachments, files, images, hyperlinks, or similar. By accessing or otherwise making use of these, any recipient of this email acknowledges and agrees that they do so voluntarily at their sole risk, and Scottish Water and its Group Companies shall not be liable for any loss or damage arising from the use of this email.

To understand how we process personal information, see Data Privacy.

Scottish Water www.scottishwater.co.uk

25 May 2026

Dear Sir or Madam,

Please provide the following information under FOI/EIR:

1. A breakdown by year of how many occasions Scottish Water has been requested by the Highland Council to perform onsite chlorine tests at domestic properties in the Highland Council’s area in the last 5 years up to and including the current date, 25 May 2026.

2. Please provide the dates of the requests from the Highland Council, which team at the Highland Council requested the test and the general reasons for all the requests and the results of those requests (positive or negative).

Thank you for your time & attention.

Kind regards.

In another stunning display of institutional arrogance & defiance of the law by The Highland Council, the Scottish Information Commissioner has issued 3 more decision notices in my favour against the Highland Council for completely failing to respond.

Who's in charge of Freedom of Information at the Highland Council?? 👇

The officer in charge of the FOI team at the Highland Council is none other than Stewart Fraser. The Monitoring Officer no less… who is under an enhanced legal & ethical duty to make certain the Council acts within the law… and issue reports to the full Council where he is made aware of any acts or omissions by the Council that are in contravention of the law.

The Commissioner is done messing about with this lot by the looks. The first application I made to the Commissioner resulting in Decision 015/2026 took well over 6 months from start to finish. The latest Decision Notices numbers 077/2026, 078/2026, 086/2026, 113/2026, 114/2026 and 115/2026 have all been coming in within about 2 months of the application going in. Why? Because in 5 out of 7 of these applications, The Highland Council refuses to reply not only to me but, also, to the Commissioner. The Highland Council think they are above the law.

This particular current Commissioner, David Hamilton, is not to be trifled with either as we have seen in recent months regarding court action between his office and The Scottish Government.

Although the court may not always agree with him, Hamilton seems intent on public information access rights being upheld and he refuses to show deference to public authorities just because they think they are entitled to it… and he should be applauded for that alone.

My last 3 decision notices all came in on the same day, 15 May 2026. Here's what they were:

Decision Notice 113/2026

The Highland Council has been unlawfully transferring personal data of Highlands residents to the Assessor/ERO for many, many years. It even appears from recent committee minutes they are transferring more and more sensitive data to them without residents being made aware including health data from Blue Badge applications and even your children's education records - all in violation of data protection law.

🚨 Keep in mind that you are entitled to erasure & compensation for damages for unlawfully transferred data.

See the full FOI 👉 [HERE]

Decision Notice 114/2026

This was simply an FOI about what the Council's plans were to implement s.164A of the Data Protection Act 2018. This was brought in via the Data Use & Access Act 2025 and it fully commences in June 2026 meaning preparations should have been well under way many months ago at the Council as it will change the way that data subjects can complain about data rights issues.

See the full FOI request 👉 [HERE]

Decision Notice 115/2026

The Highland Council does not have a Record of Processing Activities (RoPA) as legally required under Article 30 GDPR. It's not optional either. So, what does the Highland Council have to say about it? They claim they are special and are the only public authority in the UK (and EU no less) who doesn't require one of course. 😂 No, really… they actually said that… in a signed, sworn, 17 page affidavit by their Data Protection Officer lodged in Sheriff Court in March of 2025. They claim that because they have privacy policies, DPIA's, retention schedules (that they don't follow) and an information asset register… it's covered - No RoPA required. This only tells me that they have zero clue what a RoPA is or even what it is for. Given their pride over their Information Asset Register, I asked them for it. How did they respond?? “WE CAN'T” and we won't so we will just ignore you… and the Scottish Information Commissioner.

Read the full FOI request 👉 [HERE]

Due: 16 June 2026

Received: 12 June 2026

Review Sent: 18 June 2026

Review Due: 16 July 2026

Ref: FS-Case-838013039

See the accompanying FOI to Scottish Water in relation to Wastewater Charged in the Highland Council region. 👇

22 June 2026

Further to your email of 18th June. I confirm that I am treating this as a request for a review and I will provide you with a further response as soon as I have completed my enquiries.

Kind regards,

Leanne Macaulay

Senior Complaints & Information Officer

18 June 2026

Dear Sir or Madam,

This is a request for review of the below FOI request.

Question 1.

If you could provide the financial records requested in question 1(c) I shall be grateful.

Question 4.

The Highland Council appears to utilise modern software platform, TechnologyOne ERP which has integrated data reporting and financial auditing features. A manual search is not required. This information is not retrieved by manually clicking through thousands of customer files, but by running a centralised query to extract the specific financial adjustment codes, refund transaction markers, or historic account flags etc. If you could review that search methodology and provide the information at your earliest opportunity, I shall be grateful.

Thank you for your time & attention.

Kind regards.

12 June 2026

Download full spreadsheet here.

Original FOI request: Domestic Wastewater Charges

1. A breakdown by year of the last 5 financial years of the following:

(a) the gross amount of wastewater charges billed to domestic council tax accounts

(b) the total amount collected

(c) the total amount transferred/paid over to Scottish Water from Highland Council including receipts.

(d) the amount retained by or paid to The Highland Council as an administrative fee or commission for collecting and handling those charges for Scottish Water including any receipts or invoices.

Please see the attached spreadsheet for the information requested in Question 1a to 1d above.

2. A list of all postcode sectors (IV1 1, KW1 4 etc) within the Highland Council area where domestic properties have been charged wastewater as part of domestic council tax in the current financial year as well as the total number of properties being charged in each postcode sector.

Please see tab 2 of the attached spreadsheet.

3. The standard operational procedure the Highland Council uses for adding wastewater charges to newly added domestic premises or new builds to conform with the Council’s obligations in 6(3) of The Water Services Charges (Billing and Collection) (Scotland) Order 2006 and copies of any related internal policy.

Highland Council does not hold a separate “standard operational procedure” document or internal policy specifically dedicated to the process of adding water and wastewater charges for new domestic properties.

However, for operational purposes, when a new domestic property or new build is added to the Council Tax system, water and wastewater charges are initially applied to the account. This ensures that the Council meets its statutory obligations as the billing authority for Scottish Water.

When the customer receives their Council Tax bill customers are advised to contact the Council if they do not believe it is correct.  Where this relates to wastewater charges the Council will verify the charges with Scottish Water and adjust the account accordingly.  to provide evidence—such as confirmation of a private water supply or private septic tank—so that the account can be amended accordingly.

4. The total number of domestic accounts that have successfully had a wastewater charge removed or refunded in the last 5 financial years and the total amount of refunds per year.

The information you have requested is not held centrally by the Council and in order to collate this information would require the manual check of Council tax accounts to check the system for the date of removal. As at May 2026 there are 29,325 accounts without a wastewater charge. Therefore, the costs to collate the required information would be more than the £600 threshold set by the Fees regulations under Section 12 of the Freedom of Information (Scotland) Act 2002. Where the costs of complying with a request exceeds this threshold, the Council is not obliged to comply with a request.

Under Section 20 of Freedom of Information (Scotland) Act 2002, you have the right to request that the Highland Council reviews any aspect of how it has dealt with your request. This requirement for review should be requested to the Freedom of Information Officer, Highland Council, Glenurquhart Road, Inverness IV3 5NX, or foireview@highland.gov.uk, within 40 working days of receipt of this response. The request should include details of the information requested and the aspects of the Highland Councils response which you are not satisfied with.

If you are subsequently dissatisfied with the outcome of the Councils review, you have the right to appeal to the Scottish Information Commissioner under Section 47 of the Freedom of Information (Scotland) Act 2002, within six months of receiving the Councils review response.

Yours sincerely

Customer Resolution and Improvement Team

14 May 2026

Please provide the following information:

1. A breakdown by year of the last 5 financial years of the following:

(a) the gross amount of wastewater charges billed to domestic council tax accounts

(b) the total amount collected

(c) the total amount transferred/paid over to Scottish Water from Highland Council including receipts.

(d) the amount retained by or paid to The Highland Council as an administrative fee or commission for collecting and handling those charges for Scottish Water including any receipts or invoices.

2. A list of all postcode sectors (IV1 1, KW1 4 etc) within the Highland Council area where domestic properties have been charged wastewater as part of domestic council tax in the current financial year as well as the total number of properties being charged in each postcode sector.

3. The standard operational procedure the Highland Council uses for adding wastewater charges to newly added domestic premises or new builds to conform with the Council’s obligations in 6(3) of The Water Services Charges (Billing and Collection) (Scotland) Order 2006 and copies of any related internal policy.

4. The total number of domestic accounts that have successfully had a wastewater charge removed or refunded in the last 5 financial years and the total amount of refunds per year.

Thank you for your time & attention.

Kind regards.