|
Decision 015/2013 Ms D and the Chief Constable of Tayside Police
Whether named individual a serving police officer
Reference No: 201202101
Decision Date: 14 February 2013 |
Summary
Ms D asked the Chief Constable of Tayside Police (Tayside Police) whether a named individual was a serving police officer.Tayside Police advised Ms D that they were withholding the information as it was the individual's personal data and its disclosure would be unlawful.After investigation, the Commissioner found that Tayside Police was entitled to withhold the information on this basis.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "the data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles, Part I: the principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (conditions 1 and 6)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision.The Appendix forms part of this decision.
Background
1.On 8 June 2012, Ms D wrote to Tayside Police, asking whether a named person, of a specified address, was still employed as a serving police officer.Ms D explained that she had registered a complaint with Tayside Police about that named officer in 2010.
2.Tayside Police responded on 14 June 2012 and issued a refusal notice.They stated that the information related to the personal circumstances of an individual and disclosure would breach one or more of the data protection principles in the DPA.Consequently, the information was exempt in terms of section 38(1)(b) of FOISA.
3.On 23 June 2012, Ms D wrote to Tayside Police requesting a review of their decision, stating that she needed the information because she intended to progress a civil case against the named person.
4.Tayside Police notified Ms D of the outcome of their review on 20 July 2012. They confirmed that the information requested was the individual's personal data.They acknowledged that Ms D had a legitimate interest in obtaining the data, as pursuing legal proceedings against the named person would amount to such an interest.Nonetheless, Tayside Police were of the opinion that disclosure of the information was not necessary to achieve that interest.They explained why they did not consider the information to be fundamental to the progression of a case, going on to submit that, even were disclosure necessary, they would refuse to provide the information on the basis of the unwarranted prejudice that disclosure would cause to the rights and freedoms or legitimate interests of the named person.Tayside Police therefore upheld their decision to withhold the information under section 38(1)(b) of FOISA.
5.On 15 October 2012, Ms D wrote to the Commissioner stating that she was dissatisfied with the outcome of Tayside Police's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
6.The application was validated by establishing that Ms D made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
7.On 8 November 2012, Tayside Police were notified in writing that an application had been received from Ms D and were asked to provide the Commissioner with the information Ms D had asked for.Tayside Police did so, and the case was allocated to an investigating officer.
8.The investigating officer subsequently contacted Tayside Police, giving them an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking them to respond to specific questions. In particular, Tayside Police were asked to justify their reliance on section 38(1)(b) of FOISA.
9.The relevant submissions received from both Tayside Police and Ms D will be considered fully in the Commissioner's analysis and findings below.
Commissioner's analysis and findings
10.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to her by both Ms D and Tayside Police and is satisfied that no matter of relevance has been overlooked.
Consideration of section 38(1)(b)
11.Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (2)(b) (as appropriate), exempts personal data where their disclosure to a member of the public, otherwise than under FOISA, would contravene any of the data protection principles.
12.Tayside Police withheld information in terms of section 38(1)(b), on the basis that it was the personal data of an individual ("the data subject"), disclosure of which would breach the first data protection principle.In considering the application of this exemption, the Commissioner will consider firstly whether the information in question is personal data as defined in section 1(1) of the DPA and then, if it is, whether its disclosure would breach the first data protection principle.
Is the information under consideration personal data?
13.The definition of "personal data" is set out in the Appendix.
14.The information in question is confirmation of whether the data subject (a named individual) was, at the date of Ms D's request, a serving police officer with Tayside Police. The information is therefore the data held on Tayside Police's personnel system indicating whether, at the time it dealt with Ms D's request, the person was still a serving officer.Tayside Police confirmed that the information would be (and was) recorded there.
15.The Commissioner is satisfied that this information falls within the definition of personal data, as a living individual can be identified from the information, which is biographical in relation to that individual and focuses on them.The Commissioner is therefore satisfied that the information relates to the individual in question.
The first data protection principle
16.The first data protection principle states that personal data shall be processed fairly and lawfully.It also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 of the DPA is also met.
17.Tayside Police took the view that the information was not sensitive personal data as defined by section 2 of the DPA.The Commissioner agrees, and therefore has not found it necessary to consider whether any of the conditions in Schedule 3 could be met.
18.When considering the conditions in Schedule 2, the Commissioner has noted Lord Hope's comment in the case of Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[1]that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject.
19.Condition 1 applies when the data subject (i.e. the individual to whom the data relate) has consented to the release of the information.The Commissioner accepts that consent has not been given in this case and that condition 1 in Schedule 2 cannot be met here.
20.The Commissioner considers that only condition 6 in Schedule 2 to the DPA might be considered to apply in this case.Condition 6 allows personal data to be processed (in this case, disclosed into the public domain in response to Ms D's information request) if that processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
21.There are a number of tests which must be met before condition 6(1) can apply. These are:
Does Ms D have a legitimate interest in obtaining the personal data?
If so, is the disclosure necessary to achieve those legitimate aims?In other words, is disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subject?
Even if disclosure is necessary for the legitimate purposes of the applicant, would disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject?
22.As noted by Lord Hope, there is no presumption in favour of the release of personal data under the general obligation laid down in FOISA.Accordingly, the legitimate interests of Ms D must outweigh the rights and freedoms or legitimate interests of the data subject before condition 6 will permit the personal data to be disclosed.If the two are evenly balanced, the Commissioner must find that Tayside Police were correct to refuse to disclose the personal data to Ms D.
Does Ms D have a legitimate interest?
23.There is no definition within the DPA of what constitutes a "legitimate interest", but the Commissioner takes the view that the term indicates that matters in which an individual properly has a legitimate interest should be distinguished from matters about which he or she is simply inquisitive.In published guidance[2] on section 38 of FOISA, the Commissioner states:
In some cases, the legitimate interest might be personal to the applicant ? e.g. he or she might want the information in order to bring legal proceedings.With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety.
24.Tayside Police noted that it remained unsure as to exactly why Ms D required the information, but taking into account all of her correspondence they were of the view that the information was important to her as she believed she had ongoing issues with both the data subject and the agencies involved in her complaint.While Tayside Police considered the matter closed, they accepted that Ms D had a legitimate interest on the basis of these ongoing concerns.
25.Ms D's request refers to her complaint about the data subject.Her requirement for review to Tayside Police (and her application to the Commissioner) referred to her intention to raise a civil action against the data subject.Ms D's application also referred to an intention to take the matter further with Tayside Police.
26.Having considered all relevant submissions, the Commissioner accepts that Ms D, as an individual, has a legitimate interest in the withheld personal data.
Is disclosure of the information necessary to achieve these legitimate interests?
27.The Commissioner must now consider whether disclosure of the withheld personal data is necessary for the legitimate interests identified above, and in doing so she must consider whether these interests might reasonably be met by any alternative means.
28.Tayside Police commented that it believed, from the various pieces of correspondence received, that Ms D's intention in obtaining the information could be one of three things:
The resolution of her complaint
The pursuit of legal action; or
Making a further complaint to Tayside Police.
29.Tayside Police did not understand how disclosure of the information could further the resolution of her complaint, which was now with another agency.They also believed confirmation of the individual's status would be irrelevant to the pursuit of a civil action, which, in the circumstances, would be raised against the individual in a personal capacity.Finally, they confirmed that there was no obligation on members of the public wishing to complain about someone believed to be a police officer to ascertain whether or not that individual was definitely a serving officer.Ms D was free to submit a fresh complaint about the individual at any time.
30.In all the circumstances, therefore, Tayside Police did not consider it necessary for Ms D to be advised of whether or not the data subject was still employed by them.
31.Having considered all relevant submissions, the Commissioner does not accept that disclosure of the personal data she has requested is necessary to meet Ms D's legitimate interests.Ms D has not explained why the information should be required for those purposes, and broadly the Commissioner accepts Tayside Police's submissions to the effect that her legitimate interests could be pursued just as effectively without that information: it is not clear why the information should be relevant a personal action against the individual and the relevant agencies are in a position to ascertain the data subject's current status quite readily without the information being made available to Ms D.
32.Having decided that disclosure of the information requested by Ms D is not necessary to achieve her legitimate interests, the Commissioner does not consider it necessary to (and will not) go on to decide whether disclosure would cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject.As disclosure is not necessary in the circumstances, she must conclude that condition 6 cannot be met and, for the same reasons, that disclosure would not be fair.In the absence of a condition permitting disclosure, it would also be unlawful.
33.In all the circumstances, therefore, the Commissioner's conclusion is that the first data protection principle would be breached by disclosure of whether the data subject remained a serving police officer.Consequently, she is satisfied that this information was properly withheld by Tayside Police under section 38(1)(b) of FOISA.
DECISION
The Commissioner finds that the Chief Constable of Tayside Police complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Ms D.
Appeal
Should either Ms D or the Chief Constable of Tayside Police wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Margaret Keyse
Head of Enforcement
14 February 2013
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a) the provision does not confer absolute exemption; and
?
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(e) in subsection (1) of section 38 ?
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1)In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 ? The data protection principles
Part I ? The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data
1.The data subject has given his consent to the processing.
...
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
[1] http://www.publications.parliament.uk/pa/ld200708/ldjudgmt/jd080709/comm-1.htm
[2] http://www.itspublicknowledge.info/Law/FOISA-EIRsGuidance/section38/Section38.aspx
