|
Decision 020/2015: Mr Carbiner and Lothian Health Board
Information regarding an investigation
Reference No: 201402074
Decision Date: 11 February 2015
Summary
On 2 December 2013, Mr Carbiner, through his solicitors, asked Lothian Health Board (NHS Lothian) for information relating to any investigation into infection control at a dental practice in North Berwick.
NHS Lothian provided Mr Carbiner with some information, whilst withholding other information.
Following an investigation, during which information further information was disclosed, the Commissioner found that NHS Lothian was entitled to withhold the remaining information as personal data, disclosure of which would breach the data protection principles.
|
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) section 1(1) (definition of "personal data") (Basic interpretative provisions); Schedule 1 (The data protection principles, Part I: the principles) (the first data protection principle) and Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6(1))
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 2 December 2013, Mr Carbiner made a request for information to NHS Lothian. The information requested was that contained in:
? all documents (whether held electronically or in hard copy) relating to any investigation into infection control at Law Road Dental Practice, 19 Law Road, North Berwick from 1 January 2008 to date.
2. Mr Carbiner explained that the information should include documents showing NHS Lothian's reasons for (i) commencing the investigation, (ii) carrying out a "look-back" exercise and (iii) writing a patient notification letter. He asked for any information gathered as part of the investigations, and transcripts of any interviews with past and present staff at the practice.
3. Mr Carbiner explained that the request followed on from an earlier information request.
4. NHS Lothian responded on 6 January 2014. NHS Lothian stated that information had already been provided in response to the previous request for information, with an explanation of why it considered this to be the case. It did not consider it held the information he sought.
5. On 9 January 2014, Mr Carbiner wrote to NHS Lothian, requesting a review of its decision. He disagreed with its conclusion that no relevant information was held.
6. NHS Lothian notified Mr Carbiner of the outcome of its review on 21 February 2014. NHS Lothian provided information, with some further explanation of the context of the investigation. It withheld other information under sections 34 (which relates to criminal investigations) and 38 (which relates to personal data) of FOISA.
7. On 21 August 2014, Mr Carbiner wrote to the Commissioner. He applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr Carbiner did not believe NHS Lothian had been justified in withholding information, or that it had identified all the information he sought.
Investigation
8. The application was accepted as valid. The Commissioner confirmed that Mr Carbiner made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.
9. On 26 August 2014, NHS Lothian was notified in writing that Mr Carbiner had made a valid application. NHS Lothian was asked to send the Commissioner the information withheld from him. NHS Lothian provided the information and the case was allocated to an investigating officer.
10. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. NHS Lothian was invited to comment on this application and answer specific questions, in relation to the searches it carried out for information and the exemptions applied to the information it withheld.
11. During the investigation, NHS Lothian provided further explanation as to the information it held. It also provided Mr Carbiner with further information, subject to redaction in terms of section 38(1)(b) of FOISA. However, it maintained that other information was exempt in terms of section 38(1)(b) and 34(1)(b) of FOISA.
12. Mr Carbiner acknowledged receipt of the further disclosure. He accepted the majority of the redactions to the information that had been provided, but believed that further information should be disclosed, not accepting that NHS Lothian had provided all the information it should have done.
Commissioner's analysis and findings
13. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr Carbiner and NHS Lothian. She is satisfied that no matter of relevance has been overlooked.
14. Following the disclosure during the investigation, the Commissioner is asked to consider the remaining information withheld from Mr Carbiner, not including that redacted from the documents disclosed. She will also consider whether any further relevant information is held by NHS Lothian.
Information held
15. NHS Lothian provided submissions on the searches it had carried out. All of the professionals identified as leading workstreams in the investigation were, it explained, asked to search their systems and forward any documents located. These were catalogued in a "file of files", which was provided to the investigating officer. It also provided information on the roles of the staff involved. Given the focus of the investigation and information provided for the investigation, the Commissioner is satisfied that NHS Lothian has taken adequate, proportionate steps to identify and locate all information it holds and which falls within the scope of Mr Carbiner's request. As a result, she is satisfied that NHS Lothian has produced all the relevant information it holds.
16. The Commissioner will now consider the information NHS Lothian continues to withhold. First, she will consider the application of section 38(1)(b) of FOISA.
Section 38(1)(b) - Personal Information
17. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (2)(b) (as appropriate) exempts personal data if its disclosure to a member of the public, otherwise than under FOISA, would contravene any of the data protection principles.
18. NHS Lothian submitted that the withheld information was personal data for the purposes of the DPA and that its disclosure would contravene the first data protection principle. Therefore, it argued that the information was exempt under section 38(1)(b) of FOISA.
19. In considering the application of this exemption, the Commissioner will first consider whether the information in question is personal data as defined in section 1(1) of the DPA. If it is, she will go on to consider whether disclosure of the information would breach the first data protection principle as claimed.
20. This is an absolute exemption, which means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
Is the information under consideration personal data?
21. "Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller" (the full definition is set out in the Appendix).
22. The Commissioner has considered the submissions received from NHS Lothian on this point, along with the withheld information. The withheld information comprises the statements of named individuals, taken during an investigation into the dental practice in question, with associated summaries. The Commissioner is satisfied that living individuals can be identified from the information, either by itself or with other information reasonably likely to be accessible to Mr Carbiner (and others). Given the nature of the information, the Commissioner finds that it relates to the individuals concerned. Consequently, the Commissioner accepts that the information is those individuals' personal data, as defined by section 1(1) of the DPA.
23. The Commissioner notes that Mr Carbiner believes personal data could be redacted from the information, allowing disclosure of the remainder. This would require the removal of any information which would be likely to identify a living individual. As explained above, NHS Lothian has done this (where practicable) during the investigation, allowing the disclosure of some information. The Commissioner has considered what remains and is satisfied that this could not be redacted to allow disclosure: at any level of redaction which retained anything of substance, the risk of identification would remain.
24. The Commissioner has gone on to consider whether the withheld information could be disclosed without breaching any of the data protection principles.
The first data protection principle
25. The first data protection principle states that personal data shall be processed fairly and lawfully. The processing in this case would be disclosure of the information into the public domain, in response to Mr Carbiner's request. The first principle also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. In the case of sensitive personal data, as defined in section 2 of the DPA, at least one of the conditions in Schedule 3 to the DPA must also be met. The Commissioner is satisfied that none of the information which remains withheld is sensitive personal data.
26. The Commissioner will now consider whether there are any conditions in Schedule 2 which would permit the withheld personal data to be disclosed. If any of these conditions can be met, she must then consider whether the disclosure of the personal data would be fair and lawful.
27. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.
Can any of the conditions in Schedule 2 be met?
28. In the circumstances, it appears to the Commissioner that condition 6 in Schedule 2 is the only one which might permit disclosure to Mr Carbiner. In any event, neither Mr Carbiner nor NHS Lothian has argued that any other condition would be relevant. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individual(s) to whom the data relate).
29. There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:
a. Is Mr Carbiner pursuing a legitimate interest or interests?
b. If yes, is the processing involved necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subject?
c. Even if the processing is necessary for Mr Carbiner's legitimate interests, is that processing nevertheless unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?
30. There is no presumption in favour of the disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. Accordingly, the legitimate interests of Mr Carbiner must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the NHS Lothian was correct to refuse to disclose the personal data to Mr Carbiner.
Is the applicant pursuing a legitimate interest or interests?
31. NHS Lothian accepted that Mr Carbiner was pursuing a legitimate interest in the withheld information, given his direct involvement in the subject matter. In the circumstances, the Commissioner accepts this.
Is disclosure necessary for the purposes of these interests?
32. The Commissioner must now consider whether disclosure of the requested information is necessary for achieving the legitimate interests she has identified, and in doing so she must consider whether these interests might reasonably be met by any alternative means.
33. NHS Lothian submitted that Mr Carbiner had been provided with a summary of the matters raised, but not information that would enable him to attribute specific statements to individuals. It submitted that disclosure was not necessary to meet Mr Carbiner's legitimate interests, as he could have access to the information, at the appropriate point, through General Dental Council processes.
34. Mr Carbiner submitted that there was a clear public interest in ascertaining why NHS Lothian took the actions that it did and therefore it was necessary for the information to be disclosed.
35. The Commissioner has considered the information that has already been disclosed to Mr Carbiner and also NHS Lothian's review outcome. Mr Carbiner has been informed as to what issues were raised and when. He has also been informed that under General Dental Council procedures, there is a process for defendants to obtain evidence of allegations against them via their solicitors, and not under FOISA.
36. The Commissioner is satisfied that the information already disclosed to Mr Carbiner, in summary form and without identifying individuals, goes some way to addressing Mr Carbiner's legitimate interest. The withheld personal data might provide some additional evidential background to the investigation and its outcomes, but the Commissioner does not believe they would add materially to understanding of the actions taken by NHS Lothian in investigating the matters raised.
37. In all the circumstances, the Commissioner concludes that disclosure of the withheld personal data would not be necessary to meet the legitimate interests identified above. The Commissioner must therefore conclude that condition 6 cannot be met in this case and, in the absence of a condition permitting disclosure, she must also conclude that disclosure would be unlawful.
38. The Commissioner therefore finds that the first data protection principle would be breached by disclosure, and so the remaining information under consideration was properly withheld by NHS Lothian under section 38(1)(b) of FOISA. Consequently, she is not required, and will not, go on to consider whether the exemption in section 34(1)(b) also applies.
|
Decision
The Commissioner finds that, in respect of the information remaining withheld at the close of the investigation, Lothian Health Board complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr Carbiner.
|
Appeal
Should either Mr Carbiner or Lothian Health Board wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
11 February 2015
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
?
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
?
(e) in subsection (1) of section 38 -
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
?
"personal data" means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 - The data protection principles
Part I - The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data
...
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
