The Scottish Environment Protection Agency (Sepa) has been accused of breaking the law by failing to maintain a public register of over 175,000 pollution permits for sites across Scotland.
Following a formal complaint, the issue is now being reviewed by the Scottish Government’s new post-Brexit watchdog, Environmental Standards Scotland to “assess what action is required”.
Campaigners warned that companies had been given “free rein” to pollute the environment. The public had been “left in the dark” about Scotland’s most polluting industrial facilities, they said.
Sepa said the public register had gone offline after the cyber attack in December 2020. It promised to “build back better” in a “multi-year project” to develop a new and accessible register.
The Ferret is investigating the role of Sepa as the Scottish Government’s major environmental watchdog, following growing concern from readers. We are publishing a series of stories exposing its record on tackling pollution, transparency, and funding.
One of Sepa’s statutory duties is to maintain a public register of permits to pollute air or water requested by companies. The register is meant to contain “all particulars” of any application, including information on pollution monitoring.
Glossary
Sepa
Sepa is the Scottish Government’s environmental regulator. It’s responsible for the health of Scotland’s natural environment and for ensuring businesses don’t break rules on pollution.
Environmental Standards Scotland (ESS)
Environmental Standards Scotland monitors how well environmental law in Scotland works, and ensures other public sector bodies comply with it. It was set up by the Scottish Government in 2021 to replace European Union scrutiny of environmental law in Scotland.
Environmental Rights Centre for Scotland (ERCS)
ERCS is a campaign group which aims to use the law to improve protection of Scotland’s environment.
Pollution permits
Industrial or other installations which pollute the environment must hold a permit to do so from Sepa.
The permit sets conditions which owners of the installations must follow. The conditions are aimed at protecting the environment.
According to Sepa, there were “around 175,200” active permits in 2023, up from 106,800 at the end of 2019. These cover many kinds of sites, including major fossil fuel complexes such as Grangemouth and Mossmorran, waste incinerators, landfill sites, sewage works, chemical plants and intensive farms.
As The Ferret reported, the cyber attack on Christmas Eve 2020 resulted in most of Sepa’s data being encrypted, stolen or lost. “Access to the public register is not currently available,” advised the agency’s website.
In May 2023 the Environmental Rights Centre for Scotland (ERCS), which campaigns for environmental justice, lodged a complaint with Sepa. It alleged that by failing to maintain a public register of pollution permits, Sepa was in breach of the 2012 Pollution Prevention and Control (Scotland) Regulations.
ERCS asked Sepa to reinstate the public register within a month. Sepa upheld the complaint, saying “regretfully it is not possible for Sepa to make a commitment to reinstating the public register in full within one month”.
ERCS then filed a formal complaint to Environmental Standards Scotland (ESS), asking it to investigate. ESS was set up by the Scottish Government in 2021 to regulate environmental standards in the wake of the UK’s departure from the European Union.
ESS is currently considering the complaint. “We have made enquiries of Sepa which we are awaiting a response to, including how many public registers Sepa is required to maintain,” an ESS spokesperson told The Ferret.
“Once we have received a response, we will assess at that time what action is required. The details of our consideration will be published on our website upon conclusion.”
ESS subsequently told ERCS it had “initial discussions” with Sepa and decided to seek an “informal resolution”. ESS is writing to Sepa to “determine next steps in this process”.
ERCS called on Sepa to change its approach and commit to meeting minimum legal standards on transparency. “We have established that Sepa is not maintaining a public register of various information and documents relating to large industrial facilities,” said the centre’s solicitor, Ben Christman.
“Access to the public register is vital so that people can find permits and what information exists about whether those permits are being complied with. Without maintaining the register, we are left in the dark about what happens in Scotland’s most polluting industrial facilities.”
Christman pointed out that Sepa had failed to give any timescales for restoring the register. “ERCS is sympathetic to how badly the 2020 cyber attack affected Sepa, but that does not justify breaking the law,” he argued.
According to Friends of the Earth Scotland, Sepa should have prioritised the restoration of the public register. “Three years on, the excuse that Sepa is still recovering from a cyber attack is wearing thin,” said the environmental group’s circular economy campaigner, Kim Pratt.
“There has been ample time to recover and replace systems. The longer the delay continues, the greater the risk that companies are polluting Scotland’s communities and environment beyond sustainable levels.”
Pratt added: “Sepa’s continued failure to meet its legal responsibilities to maintain a public register means that companies have been given free rein to pollute Scotland’s environment. The possible impacts on communities and the environment throughout Scotland are going unchecked.”
Professor Andrew Watterson, an environmental regulation expert from the University of Stirling, warned the public register may be offline for a considerable time. “This is and will continue to be a great handicap to ensuring the agency is transparent and accountable,” he said.
“It’s a source of critical information for communities and those concerned about Scotland’s environment now so clearly under greater and greater threats.”
In its initial response to the ERCS complaint, Sepa pointed out the public register was not “fully online” before the cyber attack “and there is no legal obligation for it to be”. It stressed it was “working to make more information available, either by request or online”.
Sepa told The Ferret it was supporting ESS’s review of its public register duties. Anyone wanting access to public register information was advised to email its freedom of information team at foi@sepa.org.uk.
“Responding to a significant cyber attack by international serious and organised criminals, Sepa has prioritised its recovery to maximise environmental benefit,” said the agency’s legal chief, Alison York.
“As Scotland’s environment watchdog, we understand and recognise the importance of access to public information and are committed to building back better, making more of our information publicly available.
“We continue to provide a service in response to requests for public register information and have begun a multi-year project to develop a modern, accessible digital public register service.”
The Ferret’s investigation into the Scottish Environment Protection Agency has been supported by members of the Environmental Funders Network, a UK-based network of foundations and donors supporting environmental causes. The Ferret maintains complete editorial control.
If you want to find out more about how we fund our investigations, check out our transparency page.
Cover image: iStock/piotr_ku
It looks like SEPA has been compromised by corporate businesses in some way. That’s the only rational logic to explain their woeful performance in keeping these polluters in check. Its also not too much of a reach to think that the cyber attack on SEPA that caused them problems, for 3 years now(!?), is not linked to these polluters either. The polluters are benefitting from all this chaos – what a surprise…