FOI release

RFI 107: legal advice

Updated 11 August 2025

RE: Freedom of information request - legal advice

Thank you for your freedom of information request of 16 July 2025, allocated reference number RFI 107.

You asked for the following information:

鈥淧lease provide an electronic copy of the request made to the Nottingham University Industrial and Commercial Enterprise Ltd for legal advice referred to in the SSRO transparency report for April 2025.

Please also provide 鈥

a. Date of the request,

b. The legal question and answers sought,

c. The individual to whom the question was put, and who replied,

d. The response made to the request and the legal arguments supporting the response,

e. The cost of the advice sought.鈥

We have considered your request under the Freedom of Information Act 2000 (鈥榯he FOI Act鈥). Under the FOI Act, you have the right to:

  • know whether the Single Source Regulations Office (鈥楽SRO鈥) holds the information you require
  • be provided with that information (subject to any exemptions under the FOI Act which may apply).

I confirm that we hold the information requested under a., b., c., d. and e. of your request.

a. Date of the request

In respect of information requested under a., I confirm the date of the request was 14 January 2025.

b. The legal question and answers sought

d. The response made to the request and the legal arguments supporting the response

In respect of information requested under b. and d., information is exempt from disclosure under section 42(1) of the FOI Act where it is subject to legal professional privilege. In this particular context, legal advice privilege whereby the SSRO, as the client, sought legal advice from a consultant in their capacity as a legal professional who provides their services through Nottingham University Industrial and Commercial Enterprise Ltd (鈥楴UICE Ltd鈥). Legal advice privilege is not confined to the legal advice provided. It includes communications sent by the client to the legal professional for, and with the purpose of, obtaining the legal advice, that themselves would reveal or evidence the substance of legal advice (USP Strategies v London General Holdings Ltd [2004] EWHC 373 (Ch)). In Three Rivers District Council & Others v Governor and Company of the Bank of England (No. 6) [2005] 1 AC 610, the House of Lords held that as long as the seeking and giving of advice is undertaken within a 鈥榣egal context鈥 and not in respect of non-legal business matters, legal advice privilege should attach to that advice. Furthermore, the SSRO entered into a particular agreement with NUICE Ltd for the purposes of seeking and obtaining this legal advice, and the seeking and obtaining of this legal advice fell squarely within, and as a result of, this particular agreement. The agreement meant that both the SSRO and NUICE Ltd would have understood information referred to under b. and d. would be disclosed between themselves on a confidential basis. The information referred to in b and d. has not been disclosed to the world at large and legal advice privilege applies to it.

The exemption relied on in respect of information to which b. and d. relates, is a qualified exemption and is subject to the public interest test. We have balanced the public interest in disclosing the information against the public interest in maintaining the exemption. We accept there is a public interest in having access to information held by public authorities, including that it aids transparency, informs public debate and holds them to account on how they spend public funds. Weighed against this is the integral nature and purpose of legal professional privilege. 鈥淚t is a necessary corollary of the right of any person to obtain skilled advice about the law. Such advice cannot be effectively obtained unless the client is able to put all the facts before the advisor without fear that they may afterwards be disclosed and used to his prejudice鈥 (per Lord Hoffmann, R (Morgan Grenfell & Co ltd v Special Commissioner of Income Tax [2003] 1 AC 563). Legal professional advice is fundamental to the administration of justice; unless the public interest in disclosing information subject to legal professional privilege is clear and compelling, it should not be disclosed. The SSRO does not consider there is a clear and compelling case for disclosing the information to which b. or d. relates.

c. The individual to whom the request was put, and who replied

In respect of information requested under c., this concerns personal data of at least one third party. Section 40(5B) states that the duty on a public authority to confirm or deny whether it holds personal data of a third party does not arise if disclosing to a member of the public that the personal data is or is not held by that public authority would (apart from the FOI Act) contravene any one of three conditions. The SSRO is satisfied that merely confirming in this instance that it holds the personal data of the third party or third parties concerned: first, does not contravene an Article 5 UK GDPR data protection principle, secondly does not contravene the right to object under Article 21 of the UK GDPR, and thirdly is exempt from the right of access under data protection legislation. To go beyond merely confirming it holds the information requested under c. to one of disclosing that information requested also requires considering whether any one of the same three conditions would be contravened. One of the conditions, under section 40(3A)(a), is that disclosure of the personal data (otherwise than under the FOI Act) to a member of the public would breach an Article 5 UK GDPR data protection principle. Article 5(1)(a) of the UK GDPR requires that personal data shall be processed lawfully, fairly and transparently. One way it would be lawful for the SSRO to disclose the personal data of a third party is where the SSRO has the consent of the third party or third parties to the SSRO making this disclosure (Article 6(1)(a)). The SSRO does not have this consent. Alternatively, an alternative mechanism by which it would be lawful for the SSRO to disclose personal data of a third party would be where the SSRO identifies a legitimate interest that justifies making this disclosure (Article 6(1)(f)). The SSRO considers that, on the face of the request, there is no legitimate public or private interest in disclosing this information, because the wider interests of transparency and accountability of public authorities, including in how the SSRO spends its funds, do not outweigh any unwarranted interference with the third party鈥檚 or third parties鈥 rights that disclosure may cause, as well as the possible implications disclosure may have on future relationships between the SSRO and the third party or third parties concerned. The SSRO is mindful that disclosure of third party personal data would be to the world at large, and where there is an expectation of confidentiality in respect of this information under the agreement entered into between the SSRO and NUICE Ltd. The SSRO considers disclosure of the information requested under c. would contravene Article 5(1)(a) and, as such, that the application of the section 40(2) exemption is absolute. No public interest test is therefore triggered in determining whether the section 40(2) exemption applies.

e. The cost of advice sought

Information requested under e. is covered by section 21 in that the cost of the advice sought is already in the public domain. For ease of reference, the information is contained in this publicly available link: /government/publications/ssro-transparency-reports-2025/ssro-transparency-report-april-2025. The SSRO confirms that the cost of the advice was 拢30,000.00.

If you are dissatisfied with the handling of your request, you have the right to ask for an internal review. Internal review requests should be submitted within two months of the date of receipt of our response to your request and should be addressed to: enquiries@ssro.gov.uk. In particular, for the purposes of seeking an internal review of the information requested under c. you may wish to consider providing details to the SSRO of any legitimate interest you have in seeking disclosure of this third party personal data. If you are not content with the outcome of the internal review, you have the right to apply directly to the Information Commissioner for a decision. The Information Commissioner can be contacted at: Information Commissioner鈥檚 Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Please remember to quote the reference number above in any future communications in respect of your request.

Yours sincerely

Enquiries