Decision 005/2009 Mr David Ewen of the Evening Express and Aberdeenshire Council
Weapons seized in schools
Reference No: 200700892
Decision Date: 15 January 2009
Summary
Mr Ewen requested information from Aberdeenshire Council (the Council) about weapons seized from pupils attending schools in its area.
The Council provided Mr Ewen with some of the information he had asked for, but relied on the exemption in section 38(1)(b) of the Freedom of Information (Scotland) Act 2002 (FOISA) to withhold the names of the schools where weapons had been seized, on the basis that disclosure of this information could lead, unfairly, to the identification of the pupils involved, given the other information being disclosed to Mr Ewen.
Following an investigation, the Commissioner agreed that the disclosure of the names of the schools could identify the pupils involved and that the disclosure of the information would be unfair and would breach the first data protection principle.As a result, he found that the Council was correct to withhold the information from Mr Ewen under section 38(1)(b) of FOISA.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions); 15(1) (Duty to provide advice and assistance) and 38(1)(b) and (2)(a)(i) (Personal information)
Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data") and 2(g) (Sensitive personal data); Schedule 1 (The data protection principles) (the first principle)
Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data: recital 26
Criminal Procedure (Scotland) Act 1995 section 47(1) (Restriction on report of proceedings involving children)
Criminal Law (Consolidation) (Scotland) Act 1995 sections 47(4) (Prohibition of the carrying of offensive weapons) (definition of offensive weapon); 49 (2) (Offence of having in public place article with blade or point) and 49A(1) and (2) (Offence of having article with blade or point (or offensive weapon) on school premises
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Background
1.On 4 April 2007, Mr Ewen wrote to the Council requesting the following information:
What weapons (or items suspected of being carried as a weapon) have been seized at Aberdeenshire schools since 2004, e.g. knife, catapult, baseball bat?
Which school were they seized from and when?
What was the age and sex of the pupils involved?
What sanction did they receive?
In which cases were the police called?
2.In response, the Council provided Mr Ewen with a list of all incidents in Aberdeenshire schools over the previous three year period.However, the Council withheld the actual names of the schools where the weapons had been seized, and instead simply specified whether the school involved was a primary school or a secondary school.The Council advised Mr Ewen that it was relying on the exemption in section 38(1)(b) of FOISA to withhold the names of the schools.
3.On 15 May 2007, Mr Ewen wrote to the Council requesting a review of its decision. Mr Ewen disagreed that it would be possible to identify the pupils involved if the names of the schools were disclosed to him.He commented that if the Council had been concerned about identifying the pupils, it could have withheld their age or sex rather than withholding the identity of the school.(This point is addressed later in the decision.)
4.The Council subsequently carried out a review and, on 12 June 2007, notified Mr Ewen that it had upheld its original decision.
5.On 19 June 2007, Mr Ewen wrote to the Commissioner, stating that he was dissatisfied with the outcome of the Council's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
6.The application was validated by establishing that Mr Ewen had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
7.On 2 July 2007, the Council was notified in writing that an application had been received from Mr Ewen and was asked to provide the Commissioner with specified items of information required for the purposes of the investigation. The Council responded with the information requested and the case was then allocated to an investigating officer.
8.The investigating officer subsequently contacted the Council on 17 July 2007, providing the Council with an opportunity to provide comments on the application and to respond to specific questions on it (particularly in relation to its reliance on the exemption in section 38(1)(b) of FOISA).Further questions were also put to, and additional information sought from, the Council during the investigation.
Submissions from the Council
9.In its submissions, the Council confirmed that it wished to rely on the exemption in section 38(1)(b) as read with section 38(2)(a)(i) of FOISA for withholding the names of the schools attended by the pupils from whom the weapons were seized.
10.The Council has argued that release of this information would, together with the information which has already been disclosed to Mr Ewen, allow individual pupils to be identified, and that such a release would be contrary to the data protection principles.
Submissions from Mr Ewen
11.In his application to the Commissioner, Mr Ewen argued that disclosing the names of the schools where the weapons were seized would not identify the pupils involved.
12.Mr Ewen also made it clear that he did not request the names of the pupils involved, as his intention was always to protect their identity.
Commissioner's analysis and findings
13.In coming to a decision on this matter, the Commissioner has considered all of the information and submissions presented to him by both Mr Ewen and the Council and is satisfied that no matter of relevance has been overlooked.
14.As indicated above, Mr Ewen requested various pieces of information relating to the seizure of weapons from pupils attending schools in the Aberdeenshire Council area from 2004 onwards.
15.In response, the Council provided him with information describing the weapon seized, the type of school which the pupil attended (primary or secondary), the age and gender of the pupil from whom the weapon was seized, the year in which the incident occurred, the sanction imposed on the pupil and whether the police were involved.
16.However, the Council did not provide Mr Ewen with the actual name of the schools attended by the pupils involved in the incidents. As mentioned above, the Council relied on the exemption in section 38(1)(b) (read in conjunction with section 38(2)(a)(i)) for withholding this information from Mr Ewen.
Section 38(1)(b) ? Personal information
17.The exemption in section 38(1)(b) (read with section 38(2)(a)(i)) of FOISA exempts personal data from disclosure, if the disclosure would contravene any of the data protection principles contained in the Data Protection Act 1998 (the DPA). This particular exemption is an absolute exemption in that it is not subject to the public interest test set down in section 2(1)(b) of FOISA.(As a result, the Commissioner has been unable to take account of any public interest arguments made in coming to his decision.)
18.In order to rely on this exemption, the Council must show firstly that the information being withheld is personal data for the purposes of the DPA, and secondly that disclosure of the information into the public domain (which is the effect of a disclosure under FOISA) would contravene one or more of the data protection principles to be found in Schedule 1 to the DPA.
19.In considering the application of the exemption, the Commissioner will therefore first consider whether the information sought by Mr Ewen is personal data as defined in section 1(1) of the DPA.
Is the information personal data?
20.Section 1(1) of the DPA defines personal data as data which relate to a living individual who can be identified (a) from those data or (b) from those data and other information which is in the possession of, or likely to come into the possession of, the data controller or any other person in respect of the individual (the full definition is set out in the Appendix).
21.Looking at definition (b) of the definition of personal data, it is clear that the Council already has in its possession the information from which, along with the names of the schools, living individuals (i.e. the pupils from whom weapons were seized) can be identified.The Commissioner is therefore satisfied that this information as a whole is personal data as defined by section 1(1) of the DPA; the information clearly relates to the pupils and they can be identified from it.
22.However, that is not the end of the matter.Mr Ewen did not ask for all of the information held by the Council.Instead, he asked for various details about weapons seized in schools.He has made it clear that he does not want to know the identity of the pupils involved and, indeed, has stated that it was always his intention to protect their identity.
23.In the case of the Common Services Agency v Scottish Information Commissioner[1], the House of Lords considered a request for information relating to childhood leukaemia statistics in the Dumfries and Galloway postal area.In that case, the Lords concluded that the definition of "personal data" in the DPA had to be taken to permit the disclosure of information which had been rendered fully anonymous in such a way that individuals were no longer identifiable from it, without having to apply the data protection principles.Therefore, if individuals cannot be indentified from the actual information requested, then the information is not personal data and cannot, therefore, be exempt under section 38(1)(b) of FOISA.
24.The Commissioner considers that the Council was correct to come to the conclusion that the disclosure of all of the information requested by Mr Ewen could lead to the identification of the children (and, indeed, that in some cases, identification would be very likely)..
25.However, rather than withholding all of the information, the Council then sought to establish what information it could release which would meet some of the elements of Mr Ewen's request, whilst at the same time rendering the information fully anonymous. The Council chose to release the information detailed in paragraph 15 above, concluding that by withholding the names of the schools, pupils cannot be identified. (The choice of which information to release is addressed later in this decision.)
26.Given that much of the information has been disclosed, the key issue is whether pupils can be identified if the names of the schools were now to be disclosed as a result of Mr Ewen's application..
27.The Council has commented that a number of Aberdeenshire schools, particularly primary schools, have pupil roll numbers of less than one hundred, which increases the likelihood of the children being identified.
28.However, Mr Ewen does not believe that such identification is possible and, in his application to the Commissioner, he stated that a secondary school typically has hundreds of pupils in any one year, a primary dozens.He believes that even if the age and sex of the pupil involved is known, there will be a sufficient number of pupils fitting this broad description to make identification impossible.
29.Mr Ewen also referred to the fact that he had made the same request to another local authority, which had provided him with all of the information which he had requested.He also advised the Commissioner that the other local authority had not had any complaints about the disclosure of that information leading to the identification of pupils.While the Commissioner has noted that this has happened, he is unable to give much weight to the outcome of the other request, given that he is not aware of the actual circumstances of the request and the decision to disclose.
30.During the investigation, the Council provided the Commissioner with a copy of the information which had been provided to Mr Ewen, but which, in addition, listed the name of the school where each incident had occurred.The Council also provided the Commissioner with details of the school rolls broken down by year and by gender and with figures relating to the total number of pupils excluded (i.e. not just as a result of bringing weapons into school), again broken down by gender.
31.Looking first of all at the size of the school rolls, the Commissioner notes that the position in primary schools is, as is to be expected, different from that in secondary schools, given their smaller rolls.He also notes that, although Mr Ewen refers to the number of pupils in primary schools who would fit within the broad description (male child, etc.) as being within the dozens, given the fact that the age of the pupil when the incident happened and the sex of the pupil is already in the public domain, the number of possible pupils who could fall within the description tends to be much lower than this.Similarly, according to the Commissioner's calculations, the number of possible pupils who could fall within the broad description in secondary schools is much lower than the "hundreds" envisaged by Mr Ewen.
32.However, while looking at the numbers in the school rolls does give some assistance in deciding whether pupils can be identified from the information, this is not the only matter which the Commissioner must take into account.He must also consider what other information is already in the public domain which would lead to the identification of the pupils and must also take account of recital 26 to EU Directive 95/46/EC on the protection of individuals with regard to the processing of personal data.As a result of recital 26, the Commissioner must, when considering whether a person can be identified from the information, look beyond the simple numbers.This will be particularly important when relatively small numbers are involved, as is the case here.
33.According to guidance entitled "Determining what is personal data" which has been issued by the (UK) Information Commissioner (who is responsible for enforcing the DPA throughout the UK), in considering whether a person can be identified, it should be assumed that it is not just the means reasonably likely to be used by the ordinary man in the street to identify a person, but also the means which are likely to be used by a determined person with a particular reason to want to identify the individual.
34.So, while the Commissioner has considered the numbers of pupils who would fall into the broad descriptions, he has also taken account of other matters, such as the fact that five out of the six pieces of information requested by Mr Ewen (type of weapon; age of pupil; sex of pupil; the year the incident occurred; the sanction received and whether the police were called) are now in the public domain as a result of being disclosed under FOISA.Clearly, with the disclosure of each additional piece of information, the possibility of identification increases although, as noted above, the Commissioner agrees with the Council that the information disclosed so far would not lead to the children being identified.
35.One of the other factors which the Commissioner considers it is relevant to take into account in determining whether a pupil can be identified from the disclosure of the names of the schools is the total numbers of exclusions which occurred in the schools: given that the fact that a child has been excluded from school is likely to be known by a wide number of people, including his or her peers and their parents.As a result, in each case where a child had been excluded for carrying a weapon, the Commissioner asked the Council to provide him with the total number of children excluded from that pupil's school and in that pupil's year, broken down by sex, for the year in which that pupil had been excluded.From this additional information provided by the Council it is clear that the total number of exclusions (for all reasons) in any year group are small. In the Commissioner's view what has to be taken into account when considering whether identification is possible or likely, is not just the size of the school roll for any year group but the number of exclusions . Even where the year roll exceeds one hundred, if the total exclusions for that year are, for example, less than ten then there is a higher likelihood of identification of the individual(s) excluded specifically for having been found to carry weapons.
36.The possibility for disclosure emerges from the interplay of the variables involved.For example, a parent may know that a certain boy was excluded from her son's class. That may be the only exclusion in that year. Information to the effect that a boy of the relevant age was excluded for carrying an offensive weapon in that school would effectively tell the parent why the boy was excluded and whether the police were involved. In some cases, the school rolls themselves are so small that simply knowing that a boy of a certain age was found to be carrying weapons would narrow the number to a few individuals who could be capable of the offence and, as well as bringing innocent parties under suspicion, would make it highly likely that the specific individual responsible would in due course be identified.
37.Having taken all of these matters into account, the Commissioner is satisfied that pupils could be identified by the disclosure of the names of the schools.Given that he has already found that the information clearly relates to the pupils involved, the Commissioner finds that the information constitutes personal data for the purposes of section 1(1) of the DPA.
38.The fact that information is personal data is not enough, however, to make it exempt from disclosure under FOISA.For the exemption in section 38(1)(b) (as read with section 38(2)(a)(i)) to apply, the Commissioner must be satisfied that disclosure would breach one or more of the data protection principles contained in the DPA.As noted above, the Council has argued that disclosure would breach the first data protection principle.
Would disclosure of the information breach the first data protection principle?
39.The first data protection principle requires personal data to be processed fairly and lawfully.It also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 (of the DPA) is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 (again, of the DPA) is also met.
40.The conditions in Schedule 3 are very restrictive and it therefore makes sense, before going on to consider whether the conditions in Schedule 2 of the DPA would permit the information to be disclosed, to look at whether the information falls into the definition of sensitive personal data.
41.Although the question of whether the information was sensitive personal data was not addressed by the Council, the Commissioner considers that he is duty bound to take this point into consideration, given the restrictions which are put on the disclosure of such information, not only by the conditions in schedule 3 (such as the restrictions put on the reporting of criminal offences by children ? section 47 of the Criminal Procedure (Scotland) Act 1995 forbids newspapers disclosing a child's name, address or school, or any information calculated to lead to the identification of any person under 16 years) in court reports.
42."Sensitive personal data" is defined in section 2 of the DPA.The definition includes, in section 2(g), personal data consisting of information as to the commission or alleged commission by the data subject (in this case, the data subjects are the pupils from whom the weapons were seized).
43.The Commissioner notes that, in terms of section 49A of the Criminal Law (Consolidation) (Scotland) Act 1995, it is a criminal offence for any person to have an offensive weapon or a blade or pointed article on school premises.He is therefore satisfied that the information which has been withheld from Mr Ewen falls within the definition of sensitive personal data in section 2(g) of the DPA.While the names of the schools are not in themselves sensitive personal data, the Commissioner cannot consider the names of the schools on their own.
44.As noted above, sensitive personal data can only be processed without breaching the first data protection principle if there is a condition in Schedule 3 to the DPA which would permit it to be processed.While the processing of sensitive personal data is permitted in certain very limited circumstances, e.g. where the processing is necessary in order to protect the vital interests of the data subjects or another person, or where the processing is necessary for the administration of justice, the Commissioner does not consider that any of the conditions in schedule 3 would permit the disclosure of the information into the public domain (which would be the effect of the disclosure if the information were to be disclosed to Mr Ewen under FOISA) in this case.
45.In the absence of a Schedule 3 condition to permit the disclosure of the information, the sensitive personal data cannot be disclosed without breaching the first data protection principle.The Commissioner will not, therefore, go on to consider whether the disclosure of the information is otherwise fair and lawful or whether one of the conditions in schedule 2 to the DPA could be met.
46.Given that the Commissioner is satisfied that the disclosure of the sensitive personal data would breach the first data protection principle, he is satisfied that the information is exempt under section 38(1)(b) (in conjunction with section 38(2)(a)(i)) of FOISA.
Additional comments
47.It would appear that, in this case, the Council tried to provide Mr Ewen with as much information in response to his information request as it considered possible, while protecting the identity of the pupils involved.However, from later correspondence between Mr Ewen and the Council, it is also clear that Mr Ewen would have preferred to have been told the name of the school rather than the age or sex of the child.(As noted above, in his request for review, Mr Ewen states that if the Council was concerned about identifying a pupil, it could have withheld their age or sex rather than withholding the identity of the school.)
48.Under section 15 of FOISA, a public authority must, so far as it is reasonable to expect it to do so, provide advice and assistance to a person who proposes to make, or has made, a request for information to it.
49.While the Commissioner has not found there to be a breach of section 15 in this particular case, he considers that it would be good practice for public authorities, which find that different permutations of information in response to a list of related requests could be released, even if not all could, to find out what information the applicant is most interested in.It is likely, for example, that the names of the schools might have been capable of being disclosed to Mr Ewen if other details (such as age/gender and sanctions) had been withheld instead.
DECISION
The Commissioner finds that Aberdeenshire Council acted in accordance with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request from Mr Ewen.
Appeal
Should either Mr Ewen or Aberdeenshire Council wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Kevin Dunion
Scottish Information Commissioner
15 January 2009
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a) the provision does not confer absolute exemption; and
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(e) in subsection (1) of section 38 ?
(?)
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
15 Duty to provide advice and assistance
(1) A Scottish public authority must, so far as it is reasonable to expect it do so, provide advice and assistance to a person who proposes to make, or has made, a request for information to it.
38 Personal information
(1) Information is exempt information if it constitutes-
(a) ?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
(?)
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
2 Sensitive personal data
In this Act "sensitive personal data" means personal data consisting of information as to-
?
(g) the commission or alleged commission by him of any offence, or
?
Schedule 1 ? The data protection principles
Part I ? The principles
1.Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
(?)
Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data
Recital 26
Whereas the principles of protection must apply to any information concerning an identified or identifiable person; whereas to determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person; whereas the principles of protection shall not apply to data rendered anonymous in such a way that the data subject is no longer identifiable ?
Criminal Procedure (Scotland) Act 1995
47 Restriction on report of proceedings involving children
(1) Subject to subsection (3) below, no newspaper report of any proceedings in a court shall reveal the name, address or school, or include any particulars calculated to lead to the identification, of any person under the age of 16 years concerned in the proceedings, either ?
(a) as being a person against or in respect of whom the proceedings are taken; or
(b) as being a witness in the proceedings.
Criminal Law (Consolidation) (Scotland) Act 1995
47 Prohibition of the carrying of offensive weapons
?
(4) In this section ? "offensive weapon" means any article made or adapted for use for causing injury to the person, or intended by the person having it with him for such use by him or by some other person.
49 Offence of having in public place article with blade or point
?
(2) Subject to subsection (3) below, this section applies to any article which has a blade or is sharply pointed.
?
49A Offence of having article with blade or point (or offensive weapon) on school premises
(1) Any person who has an article to which section 49 of this Act applies with him on school premises shall be guilty of an offence.
(2) Any person who has an offensive weapon within the meaning of section 47 of this Act with him on school premises shall be guilty of an offence.
