Decision 022/2018: Mr X and the Chief Constable of the Police Service of Scotland Source of a statement about a conviction Reference No: 201701553 Decision Date: 23 February 2018 Summary Police Scotland were asked for the names of officers who had allegedly lied about someone having a criminal conviction. Police Scotland refused to confirm or deny whether the information existed or was held by them. The Commissioner accepted that it would not be in the public interest for Police Scotland to reveal whether the information existed or was held, and that section 18 of FOISA was correctly applied by Police Scotland.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (4) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 16(1) (Refusal of request); 18(1) (Further provision as respects responses to requests); 38(1)(b), (2)(a)(i) and (2)(b) and (5) (Definitions of "the data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedule 1 (The data protection principles, Part 1 - the principles) (the first data protection principle); Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 16 June 2017, Mr X made a request for information to the Chief Constable of the Police Service of Scotland (Police Scotland). The information he requested was (in his words):

"Police Scotland know the names of the officers who fabricated the lie there exists a conviction in my name. Please provide these names to me."

2. Mr X had prefaced his request with the following:

"In her letter dated [date] [named officer] advised the police assertion there exists a conviction in my name is a fabrication designed by police officers.

At [date], I requested [the named officer] provide me with the names of the persons who fabricated this lie. [The named officer] refused to provide this information.

I lodged a complaint against [the named officer's] refusal to address [the named officer's] duty and provide me with this information. Despite this complaint and subsequent requests and complaints neither the names of the officers who fabricated this conviction lie nor my complaints have been responded to by Police Scotland."

3. Police Scotland responded on 4 July 2017 that, in terms of section 18 of FOISA, they could neither confirm nor deny that they held the information Mr X had requested, but if they held the information, it would be exempt from disclosure in terms of section 38 of FOISA.

4. Police Scotland (correctly) stated that disclosure of information under FOISA is not simply a disclosure to the person that requests it: rather, it is a public disclosure and, as such, in order to protect individuals who may be or have been the subject of criminal investigations or prosecution, Police Scotland cannot, in the vast majority of circumstances, release information directly relating to investigations under FOISA. They stressed that Mr X should not take this reply as conclusive evidence that the information he requested exists or does not exist.

5. On 7 July 2017, Mr X wrote to Police Scotland requesting a review of their decision. He argued that there was no public interest in "covering up police personnel's misconduct", while "[t]he public interest and the interests of justice are served by revealing the names of the officers who fabricated this pro-criminal lie".

6. Police Scotland notified Mr X of the outcome of their review on 4 August 2017. They upheld their initial response and confirmed that, under section 18 of FOISA, they would neither confirm nor deny whether they held the information he had requested.

7. On 24 August 2017, Mr X applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr X was dissatisfied with the outcome of Police Scotland's review because he believed it was in the public interest for the information to be disclosed. He also stated that the information should be made available to him so he could decide how to respond to the activities of the police involved.

Investigation

8. The application was accepted as valid. The Commissioner confirmed that Mr X made request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

9. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. Police Scotland were invited to comment on this application and answer specific questions including justifying their reliance on any provisions of FOISA they considered applicable to the information requested. Police Scotland provided submissions.

10. Mr X also provided comments to the Commissioner.

Commissioner's analysis and findings

11. In coming to a decision on this matter, the Commissioner considered all the relevant submissions, or parts of submissions, made to him by both Mr X and Police Scotland. He is satisfied that no matter of relevance has been overlooked.

Section 18(1) of FOISA - "neither confirm nor deny"

12. Police Scotland refused to confirm or deny whether they held any information falling within the scope of Mr X's request.

13. Section 18(1) of FOISA allows public authorities to refuse to confirm or deny whether they hold information in the following limited circumstances:

(i) a request has been made to the authority for information which may or may not be held by it;

(ii) if the information existed and was held by the authority (and it need not be), it could give a refusal notice under section 16(1) of FOISA, on the basis that the information was exempt information by virtue of any of the exemptions in sections 28 to 35, 38, 39(1) or 41 of FOISA; and

(iii) the authority considers that to reveal whether the information exists or is held by it would be contrary to the public interest.

14. Where a public authority has chosen to rely on section 18(1), the Commissioner must establish whether the authority is justified in stating that to reveal whether the information exists or is held would be contrary to the public interest. He must also establish whether, if the information existed and was held by the public authority, the authority would be justified in refusing to disclose the information by virtue of any of the exemptions listed in section 18(1) and cited by the authority.

15. It is not sufficient to claim that one or more of the relevant exemptions applies. Section 18(1) makes it clear that the authority must be able to give a refusal notice under section 16(1), on the basis that any relevant information, if it exists and is held, would be exempt information under one or more of the listed exemptions. Where the exemption(s) is/are subject to the public interest test in section 2(1)(b) of FOISA, the authority must also be able to satisfy the Commissioner that the public interest in maintaining the exemption(s) outweighs any public interest there would be in releasing any relevant information, if it exists and is held.

16. In this case, Police Scotland submitted that, if they held any information falling within the scope of Mr X's request, it would be exempt from disclosure under section 38(1)(b) of FOISA. The Commissioner must therefore consider whether Police Scotland could have given a refusal notice under section 16(1) of FOISA in relation to the information in question, if it existed and Police Scotland held it; in other words, whether Police Scotland could have refused to provide the information on the grounds that it was exempt from disclosure under section 38(1)(b), if it existed and was held by Police Scotland.

17. In any case where section 18(1) is under consideration, the Commissioner must ensure that his decision notice does not confirm one way or the other whether the information requested actually exists or is held by the authority. This means that he is unable to comment in any detail on the reliance by the public authority on any of the exemptions listed in relation to section 18(1), or on other matters which could have the effect of indicating whether the information existed or was held by the authority.

Section 38(1)(b) - Personal information

18. Police Scotland stated that, if they held the requested information, they would (and could) apply the exemption in section 38(1)(b) of FOISA to that information. Section 38(1)(b), read in conjunction with section 38(2)(a)(i) or, as appropriate, section 38(2)(b), exempts information from disclosure if it is "personal data", as defined in section 1(1) of the DPA, and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.

19. In order to rely on this exemption, Police Scotland must show that any such information would be personal data for the purposes of the DPA, and that disclosure of that information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Schedule 1. In this case, Police Scotland submitted that, if the information existed or were held, disclosure would breach the first data protection principle.

20. The Commissioner is aware that Mr X and Police Scotland have differing views in respect of the incident complained of: Mr X believes there have been actions by police staff which he views as fabrication and misconduct, while Police Scotland do not accept there has been any fabrication or misconduct. The Commissioner makes no comment on which view is correct or justified, but simply notes that Mr X considers there to have been fabrication and his information request is worded accordingly.

Is the information personal data?

21. "Personal data" are defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in Appendix 1).

22. Police Scotland stated that (were it held) the information requested would be the personal data of any police employee involved: that is, any person covered by the description (using Mr X's words) "the officers who fabricated the lie there exists a conviction in my name".

23. In his application to the Commissioner, Mr X suggested that the information he had requested would not be personal data. He argued that, as it would relate to the actions of police personnel whilst on duty, it would be "public information".

24. However, the Commissioner is satisfied that, if held, the information covered by Mr X's request would be personal data, as defined by section 1(1) of the DPA. Mr X is seeking a name or names which would identify an individual or individuals employed by Police Scotland within a certain time period and who is/are alleged to have fabricated information. The nature of the information means that, if held, it must relate to that person or those persons.

Would disclosure contravene the first data protection principle?

25. The first data protection principle states that personal data shall be processed fairly and lawfully. The processing in this case would be disclosure of the information into the public domain in response to Mr X's request. The first principle also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. In the case of sensitive personal data, as defined in section 2 of the DPA, at least one of the conditions in schedule 3 to the DPA must also be met.

26. In their submissions, Police Scotland argued that disclosure of the information, if it existed and was held, would contravene the first data protection principle. They did not consider that any of the conditions of Schedule 2 of the DPA could be satisfied in relation to disclosure of the information and submitted that disclosure would, therefore, be unlawful and in breach of the first principle.

27. The Commissioner will now consider whether there are any conditions in Schedule 2 that would permit the requested information to be disclosed, if it exists and is held. If any of these conditions could be met, he must then consider whether such disclosure would be fair and lawful.

28. There are three separate aspects to the first data protection principle:

(i) fairness

(ii) lawfulness and

(iii) the conditions in the schedules.

29. These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits disclosure, it is likely that disclosure will also be fair and lawful.

Can any of the conditions in Schedule 2 be met?

30. In the circumstances, it appears to the Commissioner that condition 6 of Schedule 2 is the only one which might permit disclosure of the information, if held. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individual(s) to whom the data relate).

31. There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:

(i) Is Mr X pursuing a legitimate interest or interests?

(ii) If yes, is the processing involved necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subject(s)?

(iii) Even if the processing is necessary for Mr X's legitimate interests, is that processing nevertheless unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject(s)?

32. There is no presumption in favour of the disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. Accordingly, the legitimate interests of Mr X must outweigh the rights and freedoms or legitimate interests of the data subject(s) before condition 6 would permit disclosure. If the two are evenly balanced, the Commissioner must find that Police Scotland would be able to refuse to disclose the requested information (if held) to Mr X.

Is Mr X pursuing a legitimate interest or interests?

33. In his requirement for review of 7 July 2017, Mr X said that the "public interest and the interests of justice are served by revealing the names of the officers…" and also that he, "as the victim", had a right to know the names and thereafter the right to decide how he "will proceed with this knowledge". His application to the Commissioner also expressed dissatisfaction as follows:

"Police Scotland appears to be suggesting the officers who fabricated this lie have been the subjects of, "criminal investigations or prosecutions". It offers no clarity on this point."

34. Police Scotland commented in its submission that if Mr X was unhappy with the service he had received from the police he could make a Complaint about the Police (CAP) or refer the matter to the Police Investigations and Review Commissioner (PIRC) who would fully investigate any complaints he may have. Police Scotland said Mr X was advised of this route in their response of 4 July 2017.

35. Mr X has a legitimate interest in pursuing any grievances he might have as a result of any actions of Police Scotland. Police Scotland recognised this in their advice to him. The Commissioner must consider whether this means that Mr X has a legitimate interest in the information covered by his request, if it exists and is held by Police Scotland.

36. Although Mr X may believe that he needs to identify any police personnel concerned to allow him "to proceed" or to "decide how to respond to the activities of my abusers", the Commissioner takes the view that it should be quite possible to make a complaint or pursue any legitimate remedy Mr X might have in relation to his concerns without him knowing the identity of any individual. Insofar as an individual would need to be identified for the purposes of pursuing such remedies, that could be done without their name and position being disclosed to the world under FOISA.

37. However, the information requested does have a personal significance to Mr X and also (as he has stated) a more general significance in terms of scrutiny of the actions of a public authority. Having considered all relevant submissions he has received on this point, the Commissioner therefore accepts that Mr X would have a legitimate interest in the information, if it existed or was held by Police Scotland.

Would disclosure of the information be necessary to achieve those legitimate interests?

38. Having concluded that Mr X would have a legitimate interest in obtaining the personal data under consideration (if it exists and is held), the Commissioner must now consider whether disclosure of the personal data would be necessary in order to satisfy his legitimate interest. In doing so, he must consider whether his legitimate interest might be reasonably met by any alternative means.

39. "Necessary" in condition 6(1) of Schedule 2 implies the existence of a pressing social need. Whilst it does not mean indispensable, neither does it mean "useful", "reasonable" or "desirable."

40. As noted above, Police Scotland commented in its submission that if Mr X remains unhappy with the service he has received, he could make a CAP or refer the matter to the PIRC who would fully investigate any complaints he may have. Police Scotland advised Mr X of this route in their response of 4 July 2017.

41. The Commissioner does not doubt that Mr X wants the information for the reasons he stated, i.e. increased transparency and his personal concerns. However, there are other ways for Mr X to obtain this outcome. If Mr X intends to pursue some form of action then, as Police Scotland have said, there are various ways of making a complaint. It is unlikely that Mr X would need the name(s) of any personnel to instigate a complaint about their actions or to seek redress under the legal system. The name(s) (if held) could be established by the persons responsible for investigating the complaint.

42. On these grounds, the Commissioner does not accept that it would be necessary for the personal data (if held) to be disclosed to Mr X in order to achieve his legitimate interests. There are other viable means of meeting Mr X's interests which would interfere less with the privacy of the data subject(s) than providing the withheld personal data (if it exists and is held). For this reason, the Commissioner is not satisfied that disclosure of the information would be necessary for the purposes of Mr X's legitimate interests.

43. Given this conclusion, the Commissioner finds that there is no condition in Schedule 2 which would permit disclosure of the requested information, if it existed and was held by Police Scotland. In the absence of a condition permitting disclosure, that disclosure would be unlawful. Consequently, the Commissioner finds that disclosure of the information, if it existed and was held, would breach the first data protection principle. The information would therefore be exempt from disclosure (and properly withheld) under section 38(1)(b) of FOISA.

Conclusion on section 16(1)

44. Having accepted that Police Scotland could have given a refusal notice under section 16(1) of FOISA on the basis that any relevant information, if held, would be exempt information by virtue of section 38(1)(b) of FOISA, the Commissioner is required by section 18(1) to go on to consider whether Police Scotland were entitled to conclude that it would be contrary to the public interest to reveal whether the information existed or was held.

Section 18(1) - The public interest

45. In his application to the Commissioner, Mr X provided reasons why he believed the information he was seeking, if held, should be disclosed. These related to his belief that personnel in Police Scotland had fabricated information that a conviction existed in his name. He therefore wished to obtain the names of the officer or officers involved to allow him to consider his rights and remedies. He also believed there was a strong public interest in such information being made public because it would allow the identification of any police personnel who had acted "to defeat the ends of justice" and their actions would then be subjected to impartial and independent scrutiny.

46. Police Scotland submitted that, because disclosure under FOISA is in effect a disclosure to the world, there will very rarely be any discernible public interest in confirming or otherwise the investigation by the police of any named individual, or even that a particular incident took place. Police Scotland commented that they would never publicly confirm that a person had been the subject of a police investigation which resulted in a report to the Crown Office and Procurator Fiscal Service. They argued that there is a strong public interest in protecting individuals' privacy.

47. Mr X argued that disclosure would permit scrutiny of the actions of police personnel: however, the Commissioner takes the view that such scrutiny should be possible by other means (for example, by raising a complaint) rather than by disclosing information into the public domain. It is not clear to the Commissioner how such scrutiny would be made possible by public confirmation that the information which Mr X asked for exists and is held, or how this scrutiny would be impossible if confirmation is refused.

48. The Commissioner accepts Police Scotland's arguments that there is a strong public interest in protecting the privacy of individuals in relation to their dealings with the police. He also accepts that there is a strong public interest in ensuring that Police Scotland do not breach the Data Protection Act 1998.

49. Having considered the arguments submitted by both parties, the Commissioner is satisfied, in all the circumstances of this case, that it would be contrary to the public interest for Police Scotland to disclose whether the information requested by Mr X existed or was held by them.

50. As a result, the Commissioner is satisfied that Police Scotland were entitled to refuse to confirm or deny, in accordance with section 18(1) of FOISA, whether they held the information requested by Mr X, or whether such information existed.

Decision The Commissioner finds that the Chief Constable of the Police Service of Scotland complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr X.

Appeal

Should either Mr X or Police Scotland wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement

23 February 2018

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

 

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

...

(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

…

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

…

(e) in subsection (1) of section 38 -

…

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

16 Refusal of Request

(1)Subject to section 18, a Scottish public authority which, in relation to a request for information which it holds, to any extent claims that, by virtue of any provision of Part 2, the information is exempt information must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant a notice in writing (in this Act referred to as a "refusal notice") which -

(a) discloses that it holds the information;

(b) states that it so claims;

(c) specifies the exemption in question; and

(d) states (if not otherwise apparent) why the exemption applies…

18 Further provision as respects responses to request

(1) Where, if information existed and was held by a Scottish public authority, the authority could give a refusal notice under section 16(1) on the basis that the information was exempt information by virtue of any of sections 28 to 35, 38, 39(1) or 41 but the authority considers that to reveal whether the information exists or is so held would be contrary to the public interest, it may (whether or not the information does exist and is held by it) give the applicant a refusal notice by virtue of this section.

…

38 Personal information

(1) Information is exempt information if it constitutes-

…

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

…

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

…

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

…

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

…

 

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

…

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

…

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

…

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.