Decision 031/2010 Mr Arthur McFarlane and the Scottish Public Services Ombudsman
Unredacted letters to complainants
Reference No: 200901754
Decision Date: 24 February 2010
Summary
Mr McFarlane requested from the Scottish Public Services Ombudsman (the SPSO) unredacted versions of letters written by the SPSO to complainants who were dissatisfied with the outcomes of the SPSO's investigations.These letters had been published in redacted form on the SPSO website.The SPSO responded by stating the redactions had been made under sections 26(a) and 38(1)(b) of FOISA.Following a review, Mr McFarlane remained dissatisfied and applied to the Commissioner for a decision.
Following an investigation, the Commissioner found that the SPSO had dealt with Mr McFarlane's request for information in accordance with Part 1 of FOISA.He found that the information was properly withheld under sections 26(a) (on the basis that other legislation prohibited disclosure) and 38(1)(b) (on the basis that the information was personal data the disclosure of which would breach the data protection principles).
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA): sections 1(1) and (6) (General entitlement); 2 (Effect of exemptions); 26(a) (Prohibitions on disclosure); 38(1)(b), 38(2)(a)(i) and (b), (5) (Personal information).
Scottish Public Services Ombudsman Act 2002 (the SPSOA): sections 2(1) and (2) (Power to investigate); 19 (Confidentiality of Information).
Data Protection Act 1998 (the DPA): section 1(1) (Basic interpretative provisions) (definition of personal data); Schedule 1 (The data protection principles) (the first data protection principle).
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision.The Appendix forms part of this decision.
Background
1.Mr McFarlane had been in correspondence with the SPSO regarding the release of letters written by the SPSO to individuals who had made complaints in relation to the outcomes of the SPSO's investigations.In the course of this correspondence the SPSO published such letters, redacted under the terms of sections 26(a) and 38(1)(b) of FOISA, on its website.
2.On 8 August 2009, Mr McFarlane wrote to the SPSO requesting the following information:
I hereby request that the Scottish Public Services Ombudsman releases in un-redacted form all the "Comeback Complaints" letters, written by the SPSO to complainants, which have been released in redacted form on the SPSO website.
3.The SPSO responded on 7 September 2009 informing Mr McFarlane that the reason for withholding the redacted data had previously been explained.
4.On 11 September 2009, Mr McFarlane wrote to the SPSO requesting a review of its decision. In particular, Mr McFarlane drew the SPSO's attention to his view that the letters were so heavily redacted it rendered their publication useless.
5.The SPSO notified Mr McFarlane of the outcome of its review on 22 September 2009, drawing his attention to previous letters of 2 April and 26 May 2009 which explained the redacted information was being withheld under section 26(a) (prohibition on disclosure) and 38(1)(b) (personal information) of FOISA.
6.On 6 October 2009 Mr McFarlane wrote to the Commissioner, stating that he was dissatisfied with the outcome of the SPSO's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
7.The application was validated by establishing that Mr McFarlane had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
8.On 28 October 2009, the SPSO was notified in writing that an application had been received from Mr McFarlane and asked to provide the Commissioner with any information withheld from him. The SPSO responded with the information requested and the case was then allocated to an investigating officer.
9.The investigating officer subsequently contacted the SPSO, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions.In particular, the SPSO was asked to justify its reliance on any provisions of FOISA it considered applicable to the information requested, with particular reference to section 26(a) and 38(1)(b).
10.The SPSO responded by confirming that the information had been redacted from the published letters in terms of section 26(a) and 38(1)(b) of FOISA, referring to the Commissioner's Decision 080/2008 Mr Frank French and Scottish Public Services Ombudsman in support of its reliance on these exemptions.
11.Mr McFarlane was invited to comment on why he considered himself to have a legitimate interest in obtaining any personal data which had been withheld in terms of section 38(1)(b) of FOISA.His submissions and those of the SPSO will be considered fully (insofar as relevant) in the Commissioner's analysis and findings below.
Commissioner's analysis and findings
12.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Mr McFarlane and the SPSO and is satisfied that no matter of relevance has been overlooked.
13.In this case, the SPSO indicated that the redactions to the published letters had been made under either section 26(a) or section 38(1)(b) of FOISA.
Section 26(a) of FOISA (Prohibitions on disclosure)
14.Section 26(a) of FOISA exempts information from disclosure under FOISA where disclosure of the information (otherwise than under FOISA) is prohibited by or under any enactment. This is an absolute exemption in that it is not subject to the public interest test set down in section 2(1)(b) of FOISA.
15.The SPSO has argued that the disclosure of certain of the information requested by Mr McFarlane is prohibited by section 19(1) of the SPSOA and therefore is exempt in terms of section 26(a) of FOISA.
16.Section 19(1) of the SPSOA states that information obtained by the Ombudsman or any of the Ombudsman's advisers in connection with any matter in respect of which a complaint or a request has been made (to the Ombudsman) must not be disclosed except for any of the purposes specified in subsection (2) (of section 19) or as permitted by subsection (3).The full text of section 19 is set out in the Appendix to this decision.
17.Section 19(2) and (3), therefore, set out specific conditions under which information obtained by the SPSO can be disclosed.The SPSO has asserted that, as the information in this case is not being requested for any of the purposes specified or permitted in these subsections, most of the information sought by Mr McFarlane is exempt from disclosure in terms of section 26(a) of FOISA.
18.The exemption under section 26(a) of FOISA (read in conjunction with section 19 of the SPSOA) was previously considered in Decision 080/2008 Mr Frank French and the Scottish Public Services Ombudsman, where the Commissioner drew a distinction between the types of matters which the SPSO is entitled to investigate (under section 2 of the SPSOA) and service complaints made to the SPSO about matters such as the way in which it carried out those investigations.
19.In Decision 080/2008, the Commissioner concluded that whilst section 19(1) of the SPSOA prohibited the disclosure of information obtained by the SPSO when carrying out the Ombudsman's investigative functions under the SPSOA, it did not prohibit the disclosure of information obtained or held in relation to complaints made to the SPSO about the service provided in carrying out these functions.That said, he accepted that where responses to subsequent complaints about that service contained information obtained by the SPSO when carrying out those investigative functions, then section 19 of the SPSO still prohibited disclosure.
20.The SPSO submitted that in relation to the published response letters, it had redacted information such as the name and sector of the public authority, the subject of the complaint and information obtained directly from the original complainant (including their direct opinions and quotes) and other third parties, as these had been obtained during the initial investigations under section 2 of the SPSOA and consequently release was prohibited by section 19(1).The published information related to complaints made to the SPSO about the service provided.
21.The SPSO further contended that even where the complainant had given permission for any details to be released, as indicated by Mr McFarlane, the information was still exempt from disclosure under section 26(a) of FOISA.In this regard, the Commissioner notes that section 19(1) of FOISA is explicit in stating that information must not be disclosed except for any of the purposes specified in subsection (2) or as permitted by subsection (3) of that section.
22.The Commissioner also acknowledges that disclosure of the information as a result of a request under section 1(1) of FOISA is not a purpose specified in subsection (2) or permitted under subsection (3) of section 19 of the SPSOA.
23.Having considered the redactions to the response letters in question, the Commissioner is satisfied that the SPSO has been consistent in redacting only information which was obtained during the original investigation.The only redactions which do not fall within this category are of details of SPSO staff, which were redacted as personal data in terms of section 38(1)(b) of FOISA.These will be considered later.
24.In this case, the redactions have been made to responses by the SPSO in relation to complaints about its previous findings in investigations.The SPSO did this on the basis that the information (including complainants' details) had been obtained as a result of the original investigation and therefore fell within the scope of section 19(1) of the SPSOA.In Decision 080/2008, the Commissioner accepted that section 19(1) prohibited the disclosure of information which was originally obtained by it in respect of a complaint or request made to it under section 2 of the SPSOA.While he will consider each application to him on its own merits, he has concluded that he must reach the same conclusion in this case.Any information so obtained and repeated within the response letters in relation to service complaints is still information obtained during the original investigation under section 2 of the SPSOA and therefore the Commissioner is satisfied that disclosure of that information is prohibited by section 19(1) and consequently that the information is exempt from disclosure under section 26(a) of FOISA.As indicated above, this prohibition is absolute and cannot be affected by the consent of any individual to whom the information relates.As also indicated above, the section 26(a) exemption is absolute and therefore the Commissioner is not required to consider the public interest test.
25.Given that the Commissioner has concluded that personal information relating to the complainants is information obtained during an investigation under section 2 of the SPSOA and therefore exempt in terms of section 26(a) of FOISA, he is not required (and does not intend) to consider the exemption in section 38(1)(b) in relation to that information.He is, however, required to consider section 38(1)(b) in relation to the remaining withheld information, which comprises SPSO staff members' details.
Section 38(1)(b) ? Personal Information
26.Under section 38(1)(b) of FOISA (read in conjunction with section 38(2)(a)(i) or, as appropriate, 38(2)(b)), information is exempt information if it constitutes personal data and the disclosure of that information to a member of the public otherwise than under FOISA would contravene any of the data protection principles contained in schedule 1 to the DPA.
27.In relation to the redaction of SPSO staff details the SPSO again drew attention to Decision 080/2008, in which the Commissioner considered the relevant tests in section 1(1) of the DPA and concluded that the names of staff of the SPSO constituted personal data as defined by section 1(1) the DPA.The details of SPSO staff withheld in this case are of the same character and the Commissioner is satisfied, bearing in mind the conclusions reached in that earlier decision, that the information in question identifies the individuals concerned and relates to them.He is satisfied, therefore, that it is their personal data.
28.The Commissioner dealt with this issue in full within Decision 080/2008 and does not intend to repeat the arguments here.There, having concluded that staff member details did constitute personal data, the Commissioner stated in relation to the disclosure of those data (at paragraph 47): "? it will normally be the case that the higher the position and the greater the authority of an individual, the greater is the argument for openness, transparency and accountability and the more likely it is that disclosure of their names, etc. would be fair.In this case, the correspondence makes reference to more junior SPSO staff (such as investigative officers and personal assistants), senior SPSO staff (such as the Service Quality Manager) and officeholders including the Ombudsman herself and the (then) Deputy Ombudsmen."He went on to conclude that disclosure of the personal data of the more junior staff would be unfair and therefore in breach of the first data protection principle.
29.In this case, the Commissioner notes that the names of the Ombudsman, Deputy Ombudsman and other senior members of staff have been released within the redacted documents and that only the names of the more junior staff have been redacted, in line with the Commissioner's decision in the above case.
30.As indicated above, the Commissioner will consider each case on its own merits.Here, however, he is satisfied in the circumstances that there is no reason for him taking a different approach to the withheld personal data of the more junior SPSO staff (such as investigative officers, personal assistants or complaints managers) from that taken in Decision 080/2008.Consequently, he has concluded that it would be unfair in this case to disclose the withheld details of those junior members of SPSO staff, as they would have no expectation that they would be identified in relation to the type of correspondence in question.Therefore, he considers that disclosure of the personal data pertaining to those junior staff members would breach the first data protection principle.
31.Accordingly, the Commissioner concludes that the personal data of SPSO staff redacted from the information published is exempt in terms of section 38(1)(b) of FOISA.This is an absolute exemption and therefore is not subject to the public interest test set down in section 2(1)(b) of FOISA.
DECISION
The Commissioner finds that the Scottish Public Services Ombudsman complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr McFarlane.
Appeal
Should either Mr McFarlane or the Scottish Public Services Ombudsman wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Kevin Dunion
Scottish Information Commissioner
24 February 2010
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1General entitlement
(1)A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2Effect of exemptions
(1)To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a)the provision does not confer absolute exemption; and
(b)in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
(2)For the purposes of paragraph (a) of subsection (1), the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(b)section 26
?
(e)in subsection (1) of section 38 ?
?
(ii)paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
26Prohibitions on disclosure
Information is exempt information if its disclosure by a Scottish public authority (otherwise than under this Act) -
(a) is prohibited by or under an enactment;
?
38Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Scottish Public Services Ombudsman Act 2002
2 Power of investigation
(1) The Ombudsman may investigate any matter, whenever arising, if ?
(a) the matter consists of action taken by or on behalf of a person liable to investigation under this Act;
(b)the matter is one which the Ombudsman is entitled to investigate, and
c) a complaint in respect of the matter has been duly made to the Ombudsman.
(2) The Ombudsman may investigate any matter, whenever arising, if ?
(a) paragraphs (a) and (b) of subsection (1) are satisfied, and
(b) the person liable to investigation has requested the Ombudsman to investigate the matter.
19 Confidentiality of information
(1) Information obtained by the Ombudsman or any of the Ombudsman's advisers in connection with any matter in respect of which a complaint or a request has been made must not be disclosed except for any of the purposes specified in subsection (2) or as permitted by subsection (3).
(2) Those purposes are?
(a) the purposes of?
(i) any consideration of the complaint or request (including any statement under section 11),
(ii) any investigation of the matter (including any report of such an investigation),
(b) the purposes of any proceedings for?
(i) an offence under the Official Secrets Acts 1911 to 1989 alleged to have been committed in respect of information obtained by the Ombudsman,
(ii) an offence of perjury alleged to have been committed in the course of any investigation of the matter,
(c) the purposes of an inquiry with a view to the taking of any of the proceedings mentioned in paragraph (b),
(d) the purposes of any proceedings under section 14.
(3) Where information referred to in subsection (1) is to the effect that any person is likely to constitute a threat to the health or safety of patients, the Ombudsman may disclose the information to any person to whom the Ombudsman thinks it should be disclosed in the interests of the health and safety of patients.
(4) In relation to information disclosed under subsection (3), the Ombudsman must?
(a) where the Ombudsman knows the identity of the person to whom the information relates, inform that person of the disclosure of the information and of the identity of the person to whom it has been disclosed, and
(b) inform the person from whom the information was obtained of the disclosure.
(5)It is not competent to call upon the Ombudsman or the Ombudsman's advisers to give evidence in any proceedings (other than proceedings referred to in subsection (2)) of matters coming to the knowledge of the Ombudsman or advisers in connection with any matter in respect of which a complaint or request has been made.
(6) A member of the Scottish Executive may give notice in writing to the Ombudsman with respect to?
(a) any document or information specified in the notice, or
(b) any class of document or information so specified,
that, in the opinion of the member of the Scottish Executive, the disclosure of the document or information, or of documents or information of that class, would be contrary to the public interest.
(7) Where such a notice is given nothing in this Act is to be construed as authorising or requiring the Ombudsman or any of the Ombudsman's advisers to communicate to any person or for any purpose any document or information specified in the notice, or any document or information of a class so specified.
(8) Information obtained from-
(a)the Information Commissioner by virtue of section 76 of the Freedom of Information Act 2000 (c. 36), or
(b)the Scottish Information Commissioner by virtue of section 63 of the Freedom of Information (Scotland) Act 2002 (asp 13),
is to be treated for the purposes of subsection (1) as obtained in connection with any matter in respect of which a complaint or request has been made.
(9)In relation to such information, subsection (2)(a) has effect as if?
(a) the reference in sub-paragraph (i) to the complaint or request were a reference to any complaint or request, and
(b) the reference in sub-paragraph (ii) to the matter were a reference to any matter.
(10) In this section and section 20 references to the Ombudsman's advisers are to persons from whom the Ombudsman obtains advice under paragraph 10 of schedule 1.
Data Protection Act 1998
1 Basic interpretative provisions
In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 ? The data protection principles
Part I ? The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
