Decision 013/2019: Police investigation - neither confirm nor deny
Public authority: Chief Constable of the Police Service of Scotland
Case Ref: 201801697
Summary
Police Scotland were asked about investigations or inquiries into the possible involvement of a named individual in specific deaths. Police Scotland refused to confirm or deny whether the information existed or was held by them.
The Commissioner found that Police Scotland's response complied with FOISA.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 18(1) (Further provision as respects responses to request); 38(1)(b), (2A), (5) (definitions of "the data protection principles", "data subject", the GDPR, "personal data" and "processing") and (5A) (Personal information)
Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), and (5) (Terms relating to the processing of personal data)
General Data Protection Regulation (the GDPR) Articles 5(1)(a) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness of processing)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 22 June 2018, Mr D made a request for information to the Chief Constable of the Police Service of Scotland (Police Scotland). He asked for information held by Police Scotland concerning investigations or inquiries made into the possible involvement of a named individual in specific deaths.
2. Mr D explained the context of his request, including reference to a media article about the named person, and why he wished this information.
3. Having received no response, Mr D wrote to Police Scotland on 27 July 2018, requesting a review on the basis that they had not responded.
4. Police Scotland notified Mr D of the outcome of their review on 30 July 2018. Police Scotland refused to confirm or deny whether they held the information or whether it existed, relying on section 18(1) of FOISA with section 38(1)(b) (Personal information). They advised Mr D to seek a further review if he was unhappy with the response (see "Handling of request" at the end of the decision).
5. On 15 August 2018, Mr D wrote to Police Scotland and requested a further review of their decision. Again, Mr D highlighted that Police Scotland had not responded on time. He also stated that he had a legitimate interest for processing the personal data of the named individual, whom he described as a potential suspect in the case in question. He said that Police Scotland's refusal notice had asserted considerations of a general nature and had not addressed the particular circumstances. He stated that it was common for police forces to publicise suspected links between individuals and serious crime to encourage members of the public to come forward with information.
6. Mr D also argued that there was a public interest in justice being done. He argued that Police Scotland had made no attempt to assess the public interest and evaluate the legitimacy of the processing of the personal data to pursue due legal process. He believed that the named individual had forfeited any right to privacy by their criminal conduct.
7. On 20 September 2018, Police Scotland upheld their use of section 18, with section 38(1)(b) of FOISA. They claimed it was not in the public interest to confirm whether or not they held information as there was a "very strong public interest" in safeguarding the integrity of police operations.
8. Police Scotland also apologised for the delay in responding to Mr D' request.
9. On 9 October 2018, Mr D applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr D was dissatisfied with the outcome of Police Scotland's review. He commented that he was seeking information that would serve the public interest of ensuring that those involved in crime were convicted. Mr D repeated many of the points he had made in his requirement for review of 15 August 2018.
Investigation
10. The application was accepted as valid. The Commissioner confirmed that Mr D made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.
11. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. Police Scotland were invited to comment on this application and to answer specific questions.
Commissioner's analysis and findings
12. In coming to a decision on this matter, the Commissioner considered all the relevant submissions, or parts of submissions, made to him by both Mr D and Police Scotland. The Commissioner is satisfied that no matter of relevance has been overlooked.
Section 18(1) of FOISA - "neither confirm nor deny"
13. Section 18(1) of FOISA allows public authorities to refuse to confirm or deny whether they hold information in the following limited circumstances:
(a) a request has been made to the authority for information which may or may not be held by it;
(b) if the information existed and was held by the authority (and it need not be), it could give a refusal notice under section 16(1) of FOISA, on the basis that the information was exempt information by virtue of any of the exemptions in sections 28 to 35, 38, 39(1) or 41 of FOISA; and
(c) the authority considers that to reveal whether the information exists or is held by it would be contrary to the public interest.
14. Where a public authority has chosen to rely on section 18(1), the Commissioner must therefore establish whether the authority is justified in stating that to reveal whether the information exists or is held would be contrary to the public interest. He must also establish whether, if the information existed and was held by the public authority, the authority would be justified in refusing to disclose the information by virtue of any of the exemptions listed in section 18(1) and cited by the authority.
15. Police Scotland relied on section 18 with section 38(1)(b) of FOISA; i.e. they claimed that if information were held it would be personal data of a third party and it would be contrary to the public interest to reveal whether the personal data existed or was held.
16. In any case where section 18(1) is under consideration, the Commissioner must ensure that his decision notice does not confirm one way or the other whether the information requested actually exists or is held by the authority. This means that he is unable to comment in any detail on the reliance by Police Scotland on section 38(1)(b) or on other matters which could have the effect of indicating whether the information existed or was held by the authority.
Section 38(1)(b) - Personal information
17. Police Scotland stated that, if they held the requested information, they would (and could) apply the exemption in section 38(1)(b) of FOISA to that information. Section 38(1)(b), read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is "personal data", as defined in section 3(2) of the DPA 2018 and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the GDPR.
18. In this case, Police Scotland submitted that, if the information existed or was held, disclosure would breach the first data protection principle, which requires the processing of personal data to be lawful and fair (Article 5(1)(a) of the GDPR).
Is the information personal data?
19. "Personal data" is defined in section 3(2) of the DPA 2018 as "any information relating to an identified or identifiable living individual".
20. Section 3(3) of the DPA 2018 defines "identifiable living individual" as "a living individual who can be identified, directly or indirectly, in particular by reference to -
(a) an identifier such as a name, an identification number, location data or an online identifier, or
(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual."
21. Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.
22. Mr D has identified the individual in his request. Given the subject matter of the request, the information, if held and if it existed, would clearly relate to that individual. The Commissioner therefore accepts that, if held, the information would be personal data.
Would disclosure contravene one of the data protection principles?
23. Police Scotland argued that disclosing the personal data, if held, would contravene Article 5(1)(a) of the GDPR. This requires personal data to be processed "lawfully, fairly and in a transparent manner in relation to the data subject."
24. The definition of "processing" is wide and includes (section 3(4)(d) of the DPA 2018), "disclosure by transmission, dissemination or otherwise making available".
25. In the case of FOISA, personal data is processed when it is disclosed in response to a request. This means that the personal data could only be disclosed if disclosure would be both lawful (i.e. if it would meet one of the conditions of lawful processing listed in Article 6(1) of the GDPR) and fair.
Lawful processing: Article 6(1)(f) of the GDPR
26. In the Commissioner's view, if the personal data existed, the only condition in Article 6(1) which could potentially apply is condition (f). This states that processing shall be lawful if it is "necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.)"
27. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA (see Appendix 1) makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
28. The tests which must be met before Article 6(1)(f) can be met are as follows:
(a) Would Mr D have a legitimate interest in obtaining the personal data if held?
(b) If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?
(c) Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental right and freedoms of the data subject?
29. Police Scotland considered that Mr D could have a legitimate interest with regard to the disclosure of such information (if held) and that disclosure might well be necessary to meet that legitimate interest. Nonetheless, they were of the view that this interest was outweighed by the interests or fundamental rights and freedoms of the data subject.
30. The Commissioner agrees that Mr D has a legitimate interest in the disclosure of the information, for reasons set out in his application and for reasons known to Police Scotland.
31. However, he does not agree that disclosure under FOISA (which would be disclosure into the public domain) is necessary to achieve that legitimate interest. "Necessary" means "reasonably" rather than "absolutely" or "strictly necessary". When considering whether disclosure would be necessary, public authorities should consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the requester's legitimate interests can be met by means which interfere less with the privacy of the data subject.
32. Police Scotland advised the Commissioner that Mr D has been told previously of other mechanisms which would allow information to be disclosed, but which would not involve the personal data being disclosed into the public domain.
33. Even if this option were not practical or available to Mr D, the Commissioner agrees with Police Scotland that, if the information were held, Mr D' legitimate interest would be overridden by the interests or fundamental rights and freedoms of the data subject. Disclosing the data, if held, would understandably cause harm or distress to the data subject as it would link the data subject to the deaths of individuals.
34. The Commissioner is aware that the data subject has been convicted of a number of offences. Mr D has argued that this means that the data subject has forfeited any right to privacy, but that is clearly not the aim of the DPA 2018 or, indeed, the GDPR.
35. In the circumstances, the Commissioner is not satisfied that condition 6(1)(f) can be met.
Fairness
36. Given that the Commissioner has concluded that the processing of the personal data, if held, would be unlawful, he is not required to go on to consider separately whether disclosure of such personal data would otherwise be fair and transparent in relation to the data subject.
Conclusion on the data protection principles
37. For the reasons set out above, the Commissioner is satisfied that disclosure of the personal data, if held, would breach the data protection principle in Article 5(1)(a) of the GDPR. Consequently, he is satisfied that the personal data, if held, would be exempt from disclosure under section 38(1)(b) of FOISA and that Police Scotland could have given a refusal notice under section 16(1) of FOISA on the basis that any relevant information, if it existed and was held, would be exempt information by virtue of section 38(1)(b) of FOISA.
Section 18(1) - The public interest
38. The Commissioner must now consider whether Police Scotland were entitled to conclude that it would be contrary to the public interest to reveal whether the information exists or is held.
39. Police Scotland's initial response identified the "strong public interest in protecting individuals' privacy". They also submitted that release of such information into the public domain, through FOISA, would be unfair, unlawful and otherwise breach the DPA 2018. Police Scotland therefore believe that any legitimate interest Mr D would have in the personal data (if held) would be outweighed by the public interest in ensuring that personal data is processed in accordance with the data protection law.
40. Police Scotland also argued that it was not in the public interest to confirm or deny whether they held information which would jeopardise either the impartial integrity of the police report to the Crown Office and Procurator Fiscal Service (COPFS) or the force's ongoing efforts against criminality.
41. Police Scotland acknowledged that there was considerable media interest in the police investigation of the deaths in question, but, in their view, this did not outweigh the public interest arguments they had set out, in relation to confirming or denying whether they held the requested information.
42. Police Scotland submitted that a criminal investigation is, by necessity, a confidential process and those affected are entitled to have their information protected. They stated that witnesses and other sources provide information on the understanding that it will remain confidential unless they are required to give evidence in court. Police Scotland found no public interest in the disclosure of information into the public domain that could compromise the future flow of information to the police and, in turn, compromise the ability of the force to effectively fulfil its statutory obligations.
43. Mr D made a number of points to Police Scotland and the Commissioner which are relevant to the balancing of the public interest. Mr D argued that:
(a) Police Scotland's refusal notice had asserted considerations of a general nature and had not addressed the particular circumstances.
(b) it was common for police forces to publicise suspected links between individuals and serious crime to encourage members of the public to come forward with information.
(c) there was a public interest in justice being done, and in ensuring that police and public prosecution authorities are discharging their duties and are held to account.
(d) Police Scotland had made no attempt to assess the public interest and evaluate the legitimacy of his processing of the personal data to pursue due legal process. Mr D suggested that he had advanced a legitimate purpose for processing third party personal data.
(e) the named individual had forfeited any right to privacy by their criminal conduct.
44. The Commissioner accepts that there is a strong public interest in protecting the privacy of individuals in relation to their dealings with Police Scotland. While he is aware of Mr D' particular interest in this case, the public interest is something of serious concern and benefit to the public at large, not merely something of individual interest. Disclosure under FOISA is not simply disclosure to the person requesting the information, but rather is a public disclosure. This must always be borne in mind when considering the effects of disclosure; a disclosure of this kind to one individual cannot, therefore, be considered in isolation.
45. The Commissioner also accepts that there is a strong public interest in Police Scotland not breaching data protection legislation. It is not the case that a person who has been convicted of criminal conduct forfeits any rights to privacy.
46. However, Mr D is correct to highlight the public interest in justice being done and in ensuring that the police and public prosecution authorities discharge their duties and are held to account. There is a public interest in transparency in relation to the actions and decision-making processes of public bodies, including Police Scotland; this may include disclosure of information (if held) which could shed some light on those actions and processes.
47. Police Scotland are, however, justified in highlighting that there are other ways (i.e. other than public disclosure of information under FOISA) to ensure justice is done and that authorities are held to account in the criminal justice sphere (for example, the rights that Mr D has in terms of the criminal justice process). There exist other ways, as Police Scotland have submitted, for a person in Mr D' position to obtain information that may be relevant for the purpose of establishing his innocence: for example, any statutory mechanism for disclosure in relation to criminal cases through COPFS.
48. Whilst Police Scotland may choose, as Mr D notes, to publicise suspected links between individuals and serious crime to encourage members of the public to come forward with information, this is a course of action decided on the particular circumstances of each case.
49. The Commissioner agrees with Mr D that, to an extent, Police Scotland's refusal notice and review response focus on considerations of a general nature. The review of 20 September 2018, although upholding section 38(1)(b) with section 18, refers to the public interest in safeguarding the integrity of police operations and the effective operational law enforcement and the prevention and detection of crime and the apprehension or prosecution of offenders. These arguments appear more relevant to sections 34 and 35 of FOISA than to section 38(1)(b). However, the Commissioner cannot accept that Police Scotland failed to address the particular points raised by Mr D, albeit that their response used general considerations. The Commissioner recognises that there are limits on the level of detailed reasoning which can be provided when relying on section 18 of FOISA.
50. The Commissioner also takes the view that a consideration of a general nature may well be relevant: for example, when balancing the public interest, it may be appropriate for a public authority to have regard to both the general and the specific circumstances of a case.
51. On balance, the Commissioner accepts that for Police Scotland to reveal whether they held the requested information, or whether it existed, would be contrary to the public interest. Consequently, the Commissioner is satisfied that Police Scotland were entitled to refuse to confirm or deny, in accordance with section 18(1) of FOISA, whether the information requested by Mr D exists or is held.
Handling of request
52. When responding to Mr D' request for review, Police Scotland told Mr D that he needed to ask them to carry out a further review before applying to the Commissioner for a decision. That was not the case. Given that they had not responded to his initial request, the only option Police Scotland had under section 21(4) of FOISA (Review by Scottish public authority) was to reach a decision, where the complaint is that no decision had been reached (section 21(4)(c)).
53. The notice advising Mr D of the outcome of the review should have told Mr D that, if he was dissatisfied with the response, his next step was to make an application to the Commissioner (section 21(10)).
Decision
The Commissioner finds that the Chief Constable of the Police Service of Scotland complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr D.
Appeal
Should either Mr D or Police Scotland wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
5 February 2019
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
…
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
…
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
…
(e) in subsection (1) of section 38 -
…
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied.
18 Further provision as respects responses to request
(1) Where, if information existed and was held by a Scottish public authority, the authority could give a refusal notice under section 16(1) on the basis that the information was exempt information by virtue of any of sections 28 to 35, 38, 39(1) or 41 but the authority considers that to reveal whether the information exists or is so held would be contrary to the public interest, it may (whether or not the information does exist and is held by it) give the applicant a refusal notice by virtue of this section.
…
38 Personal information
(1) Information is exempt information if it constitutes-
…
(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A));
…
(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act -
(a) would contravene any of the data protection principles, or
(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.
…
(5) In this section-
"the data protection principles" means the principles set out in -
(a) Article 5(1) of the GDPR, and
(b) section 34(1) of the Data Protection Act 2018;
"data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
"the GDPR", "personal data", "processing" and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4), (10), (11) and 14 of that Act);
…
(5A) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.
…
Data Protection Act 2018
3 Terms relating to the processing of personal data
…
(2) "Personal data" means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).
(3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to-
(a) an identifier such as a name, an identification number, location data or an online identifier, or
(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
(4) "Processing", in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as
…
(d) disclosure by transmission, dissemination or otherwise making available,
…
(5) "Data subject" means the identified or identifiable living individual to whom personal data relates.
General Data Protection Regulation
Article 5 Principles relating to processing of personal data
1 Personal data shall be:
a. processed lawfully, fairly and in a transparent manner in relation to the data subject ("lawfulness, fairness and transparency")
…
Article 6 Lawfulness of processing
1 Processing shall be lawful only if and to the extent that at least one of the following applies:
…
f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.
Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.
