Decision 009/2007 - Ms Sandra Uttley and the Chief Constable of Central Scotland Police
Request for copies of correspondence written by three individuals to Central Scotland Police – information withheld – decision upheld by the Commissioner.
Request for copies of correspondence written by three individuals to Central Scotland Police
Applicant: Ms Sandra Uttley
Authority: Chief Constable of Central Scotland Police
Case No: 200601321
Decision Date: 19 January 2007
Kevin Dunion
Scottish Information Commissioner
Relevant Statutory Provisions and other Sources
Freedom of Information (Scotland) Act 2002 sections 1(1) (General entitlement); 2 (Effect of exemptions); and 38(1)(b) (Personal information).
Data Protection Act 1998 sections 1(1) (Basic interpretative provisions) and 2 (Sensitive personal data); Schedules 1 (The data protection principles) and 2 (Conditions relevant for the purposes of the first principle: processing of any personal data).
The full text of each of these provisions is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Facts
Ms Uttley requested copies of correspondence written by three individuals to Central Scotland Police. The Chief Constable of Central Scotland Police (Central Scotland Police) refused to release this information, claiming it to be exempt under section 38(1)(b) of the Freedom of Information (Scotland) Act 2002 (FOISA). Ms Uttley emailed the Central Scotland Police, expressing her dissatisfaction with its response and asked it to review its decision. Upon review, Central Scotland Police upheld its original decision.
Ms Uttley was dissatisfied with the response she received from Central Scotland Police and applied to the Commissioner for a decision on the matter.
Following an investigation, the Commissioner found that Central Scotland Police had dealt with Ms Uttley’s request for information in accordance with Part 1 of FOISA.
Background
1. Ms Uttley emailed Central Scotland Police on 25 July 2006, referring to earlier correspondence from one of its officers to my Office which purported to identify instances where her contact with certain individuals had caused those individuals concern. She requested Central Scotland Police to supply her with “the relevant information pertaining to your allegations above, about the people I have written to, causing them ‘concern’”.
2. On 27 July 2006 Central Scotland Police emailed Ms Uttley, confirming that it had been contacted by three individuals who had been written to by her about the Dunblane Incident (i.e. the incident at Dunblane Primary School on 13 March 1996, in which 16 pupils and a teacher were killed). It advised Ms Uttley that the communications from the three individuals to Central Scotland Police were being withheld under section 38(1)(b) of FOISA.
3. On 27 July 2006 Ms Uttley emailed Central Scotland Police stating she was dissatisfied with its refusal to provide the information. She was also unhappy with the fact that this information had been passed to my Office but would not be released to her.
4. Central Scotland Police responded to Ms Uttley’s request for review on 7 August 2006. Central Scotland Police reduced Ms Uttley’s request to a request for names and confirmed its decision to withhold this information under section 38(1)(b) of FOISA.
5. Ms Uttley emailed my Office on 8 August 2006, stating that she was dissatisfied with the outcome of Central Scotland Police’s review and applying to me for a decision in relation to the withholding of the information requested.
6. The case was validated by establishing that Ms Uttley had made a request for information to a Scottish public authority and had applied to me for a decision only after asking the authority to review its response to her request.
7. My Validation Officer wrote to Central Scotland Police on 14 September 2006, giving notice that an appeal had been received and that an investigation into the matter had begun and inviting comments from Central Scotland Police as required under section 49(3) of the Freedom of Information (Scotland) Act 2002 (FOISA). Central Scotland Police was asked to supply my Office with copies of the information withheld from Ms Uttley and a full analysis of the exemptions applied to that information.
8. Central Scotland Police wrote to the Validation Officer on 22 September 2006, providing copies of the correspondence from two of the individuals: the third individual had made a statement to another police force, which could be provided upon request. Central Scotland Police clarified its understanding of Ms Uttley’s request as being for the names of the individuals who contacted Central Scotland Police following her contact with them, and for copies of any letters or emails sent to Central Scotland Police bringing Ms Uttley’s behaviour to its attention.
9. The case was then allocated to an investigating officer.
The Investigation
10. The investigating officer wrote to Central Scotland Police on 5 October 2006, seeking clarification of certain points and asking it to provide copies of the statement from the third individual and any other correspondence from the other individuals who had written to Central Scotland Police regarding Ms Uttley’s communication with them.
11. The investigating officer also wrote to Ms Uttley on 5 October confirming my understanding that the scope of her application was for the names of the three individuals and copies of their correspondence with Central Scotland Police.
12. Central Scotland Police responded in writing on 18 October 2006, providing copies of the requested additional documents.
Submissions from the Central Scotland Police
13. In its letter of 22 September 2006, Central Scotland Police stated that Ms Uttley’s request was for personal information relating to the three individuals. The names and withheld communications were considered by Central Scotland Police to have been provided on the wholly reasonable expectation that they would be regarded as confidential and therefore not disclosed to a third party without the prior consent of the individuals concerned. Central Scotland Police was of the view that disclosure of the information would breach the first principle of the Data Protection Act 1998 (the DPA) and therefore that the information was exempt under section 38(1)(b) of FOISA.
Submission from Ms Uttley
14. In her email to my Office of 13 September 2006, Ms Uttley stated that she (“the accused”) had a right to know the details of her accusers and the basis of their allegations.
Documents Withheld from Ms Uttley
15. In this case, the information requested from and withheld by Central Scotland Police comprised 7 documents; 3 emails, 3 letters and a statement given to another police force.
The Commissioner’s Analysis and Findings
16. I have considered whether the information requested is exempt under section 38(1)(b) of FOISA. In coming to a decision on this matter, I have considered all of the information and the submissions that have been presented to me by both Ms Uttley and Central Scotland Police and I am satisfied that no matter of relevance has been overlooked. I should clarify at the outset that, contrary to what Ms Uttley may believe, the information she has requested in this case has not been seen by my Office prior to it being provided by Central Scotland Police for the purposes of this investigation.
The application of section 38 (1)(b) – personal information
17. In its response to Ms Uttley’s original request and request for review, Central Scotland Police relied on section 38(1)(b) (read in conjunction with section 38(2)(a)(i)) of FOISA to withhold the documents from her.
18. In order to rely on this exemption, Central Scotland Police would have to show that the information which had been requested was personal data for the purposes of the DPA, and that disclosure of the information to a member of the public would contravene one or more of the data protection principles contained in Schedule 1 of the DPA.
19. In considering the application of the exemption, I first have to establish whether the information which has been withheld by Central Scotland Police is personal data as defined in section 1(1) of the DPA. Section 1(1) is reproduced in the Appendix to this decision.
20. I have to bear in mind the effect that the Court of Appeal case of Durant v Financial Services Authority [2003] EWCA 1746 had on the interpretation of the definition of personal data under section 1(1) of the DPA. This case highlighted that for information to be personal data it must relate to an individual, be biographical in respect of the individual concerned to a significant extent and must have that individual at its focus – in short it must affect the individual’s privacy.
21. In considering the information (detailed in paragraph 15) that has been withheld from Ms Uttley, I am satisfied that the information which is contained within the documents would constitute the personal data of those individuals. The withheld documents do contain information which is biographical in nature and would lead to the identification of the individuals concerned. I am also satisfied that the individuals are the focus of the information and therefore that this information comes fully within the definition laid down in section 1(1) of the DPA.
22. As I am satisfied that the information contained in the documents is personal data, I now have to go on to consider whether release of this information would breach any of the data protection principles.
23. In this case, Central Scotland Police argued that release of the information contained in the documents would breach the first data protection principle. Central Scotland Police argued that the processing of the information would be unfair. The first data protection principle requires that personal data shall be processed fairly and lawfully and, in particular, that it shall not be processed unless at least one of the conditions in Schedule 2 is met.
24. It should be noted that the first data protection principle also states that, in the case of sensitive personal data, at least one of the conditions in Schedule 3 of the DPA must also be met before processing can be fair and lawful. Having considered the definition of sensitive personal data in section 2 of the DPA, I am satisfied that the personal data in question is not sensitive personal data. Therefore I am not required to consider whether any of the conditions in Schedule 3 can be met.
25. As mentioned above, section 38(1)(b), read in conjunction with section 38(2)(a)(i), exempts from release personal information unless at least one of the conditions in Schedule 2 of the DPA can be met. Condition 6 of Schedule 2 to the DPA allows information to be processed (in this case, disclosed) where:
“The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.”
26. I can accept that Ms Uttley feels she has a legitimate interest in gaining access to information relating to expressions of concern about her conduct made to a third party, with a view to clarifying the nature of those concerns and (where appropriate) taking reasonable steps to set the record straight. Given that Ms Uttley has no information about the nature or source of any of these concerns at present and has no other reasonable means of obtaining such information, I also accept that disclosure of the information held by Central Scotland Police might be considered necessary for the purposes of that legitimate interest.
27. On the other hand, the persons to whom the information held by Central Scotland Police relates have legitimate interests in being able to make enquiries of or register their concerns with an authority and to expect to be able to do so without their personal information being then provided to the individual to which these enquiries or concerns relate. Nor would they expect this information to be made publicly available. I am satisfied that the information withheld was provided to Central Scotland Police in the expectation (which I accept as reasonable in the circumstances) that it would be regarded as confidential and would not be disclosed. Therefore, I am satisfied that those persons have a strong legitimate interest in the information not being disclosed.
28. In all the circumstances of this case, having weighed the competing interests in disclosure and in the privacy of the individuals concerned, I am satisfied on balance that disclosure is unwarranted by virtue of the rights, freedoms and legitimate interests of the individuals to whom the information relates and therefore that condition 6 cannot be met. Noting in particular that the individuals to whom the information relates have not consented to disclosure of the information, I can identify no other condition in Schedule 2 which might be relevant to the processing of the information withheld. I am satisfied therefore, that release of this information would amount to unfair processing and therefore that the exemption under section 38(1)(b) of FOISA applies to the information.
Decision
I find that the Chief Constable of Central Scotland Police dealt with Ms Sandra Uttley’s request for information in accordance with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA), in applying the exemption under section 38(1)(b) of FOISA to the information withheld.
Appeal
Should either Central Scotland Police or Ms Uttley wish to appeal against this decision, there is a right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days of receipt of this notice.
Kevin Dunion
Scottish Information Commissioner
19 January 2007
APPENDIX
Relevant Statutory Provisions
1 General entitlement
(1) A person who request information from a Scottish public authority which holds is it entitled to be given it by the authority.
2. Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that –
(a) the provision does not confer absolute exemption; and
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption –
(a) section 25;
(b) section 26;
(c) section 36(2);
(d) section 37; and
(e) in subsection (1) of section 38 –
(i) paragraphs (a), (c) and (d); and
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
(a) ………
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
(c) ……………
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
(ii) section 10 of that Act (right to prevent processing likely to cause damage or distress); and
(3) ……………
(4) ……….
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
"health record" has the meaning assigned to that term by section 1(1) of the Access to Health Records Act 1990 (c.23); and
"personal census information" means any census information-
(a) as defined in section 8(7) of the Census Act 1920 (c.41); or
(b) acquired or derived by virtue of sections 1 to 9 of the Census (Great Britain) Act 1910 (c.27),
which relates to an identifiable person or household.
(6) ………………….
Data Protection Act 1998
Basic interpretative provisions
1. (1) In this Act, unless the context otherwise requires-
"data" means information which-
(a) is being processed by means of equipment operating automatically in response to instructions given for that purpose,
(b) is recorded with the intention that it should be processed by means of such equipment,
(c) is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system, or
(d) does not fall within paragraph (a), (b) or (c) but forms part of an accessible record as defined by section 68;
"data controller" means, subject to subsection (4), a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be, processed;
"data processor", in relation to personal data, means any person (other than an employee of the data controller) who processes the data on behalf of the data controller;
"data subject" means an individual who is the subject of personal data;
"personal data" means data which relate to a living individual who can be identified-
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
"processing", in relation to information or data, means obtaining, recording or holding the information or data or carrying out any operation or set of operations on the information or data, including-
(a) organisation, adaptation or alteration of the information or data,
(b) retrieval, consultation or use of the information or data,
(c) disclosure of the information or data by transmission, dissemination or otherwise making available, or
(d) alignment, combination, blocking, erasure or destruction of the information or data;
"relevant filing system" means any set of information relating to individuals to the extent that, although the information is not processed by means of equipment operating automatically in response to instructions given for that purpose, the set is structured, either by reference to individuals or by reference to criteria relating to individuals, in such a way that specific information relating to a particular individual is readily accessible.
(2) In this Act, unless the context otherwise requires-
(a) "obtaining" or "recording", in relation to personal data, includes obtaining or recording the information to be contained in the data, and
(b) "using" or "disclosing", in relation to personal data, includes using or disclosing the information contained in the data.
(3) In determining for the purposes of this Act whether any information is recorded with the intention-
(a) that it should be processed by means of equipment operating automatically in response to instructions given for that purpose, or
(b) that it should form part of a relevant filing system,
it is immaterial that it is intended to be so processed or to form part of such a system only after being transferred to a country or territory outside the European Economic Area.
(4) Where personal data are processed only for purposes for which they are required by or under any enactment to be processed, the person on whom the obligation to process the data is imposed by or under that enactment is for the purposes of this Act the data controller.
Sensitive personal data
2. In this Act "sensitive personal data" means personal data consisting of information as to-
(a) the racial or ethnic origin of the data subject,
(b) his political opinions,
(c) his religious beliefs or other beliefs of a similar nature,
(d) whether he is a member of a trade union (within the meaning of the Trade Union and Labour Relations (Consolidation) Act 1992),
(e) his physical or mental health or condition,
(f) his sexual life,
(g) the commission or alleged commission by him of any offence, or
(h) any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings.
SCHEDULE 1
THE DATA PROTECTION PRINCIPLES
PART I
THE PRINCIPLES
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless-
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
2. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.
3. Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.
4. Personal data shall be accurate and, where necessary, kept up to date.
5. Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.
6. Personal data shall be processed in accordance with the rights of data subjects under this Act.
7. Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.
8. Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.
SCHEDULE 2
CONDITIONS RELEVANT FOR PURPOSES OF THE FIRST PRINCIPLE
PROCESSING OF ANY PERSONAL DATA
1. The data subject has given his consent to the processing.
2. The processing is necessary-
(a) for the performance of a contract to which the data subject is a party, or
(b) for the taking of steps at the request of the data subject with a view to entering into a contract.
3. The processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract.
4. The processing is necessary in order to protect the vital interests of the data subject.
5. The processing is necessary-
(a) for the administration of justice,
(b) for the exercise of any functions conferred on any person by or under any enactment,
(c) for the exercise of any functions of the Crown, a Minister of the Crown or a government department, or
(d) for the exercise of any other functions of a public nature exercised in the public interest by any person.
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
(2) The Secretary of State may by order specify particular circumstances in which this condition is, or is not, to be taken to be satisfied.
Link to PDF file of decision 009/2007 (68.9 kb)
