|
Decision 034/2011 Mr W Hunter Watson and Grampian Health Board
Staff who signed for the prescription and administration of two injections
Reference No: 201000711
Decision Date: 23 February 2011
|
Summary
Mr Watson asked Grampian NHS Board (NHS Grampian) for information about staff involved in prescribing and administering two injections to a named patient.
NHS Grampian withheld the information requested under section 38(1)(b) of the Freedom of Information (Scotland) Act 2002 (FOISA), believing that disclosure would breach the first data protection principle.NHS Grampian confirmed this decision after review and Mr Watson subsequently applied to the Scottish Information Commissioner (the Commissioner) for a decision.
The Commissioner found that NHS Grampian had correctly withheld the requested information under section 38(1)(b) of FOISA (being satisfied that it was personal data and that its disclosure would breach the first data protection principle).He therefore found that NHS Grampian had complied with Part 1 of FOISA in dealing with Mr Watson's request.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions) and 38(1)(b), (2)(a)(i) and (b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedule 1 (The data protection principles, Part I: The principles) (the first data protection principle) and Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision.The Appendix forms part of this decision.
Background
1.On 15 February 2010, Mr Watson requested the following information from NHS Grampian:
a)the full name of the doctor who signed a prescription for the intramuscular haloperidol injections administered to a named individual on a certain date in Aberdeen Royal Infirmary
b)whether the person who signed for the administration of these injections was a doctor or a nurse
c)the full name of the person who signed for the administration of these injections
2.NHS Grampian responded on 12 March 2010, and advised that the information requested was exempt from disclosure under section 38(1)(b) of FOISA.NHS Grampian provided an application form to request access to the patient's medical record under the DPA. (Mr Watson has been authorised to act as the representative of the patient in relation to a complaint about the administration of the injections.)
3.On 14 April 2010, Mr Watson wrote to NHS Grampian to request a review of its response, arguing that a patient should be entitled to information about the identities of those who prescribed and administered medication.
4.On 18 May 2010, NHS Grampian wrote to Mr Watson, upholding the decision to withhold the information under section 38(1)(b) of FOISA, on the grounds that disclosure would contravene one or more of the data protection principles in the DPA.Again, NHS Grampian suggested that access to the patient's medical records should be sought under the DPA (as opposed to under FOISA).
5.Mr Watson remained dissatisfied with NHS Grampian's response, and applied for a decision from the Commissioner on 7 June 2010.He stated that the information sought in parts b) and c) of his request was not available from the patient's medical record, and questioned whether the information in part a) would be found there either.
6.The application was initially believed to be invalid, on the grounds that Mr Watson had made his request on behalf of another, unnamed person, and was not the "true applicant" (see the Commissioner's guidance on validity[1]).However, after further consideration (including correspondence which had not been available to the Commissioner during his initial consideration of the application), it was accepted that, on the balance of evidence available in this case, Mr Watson should be accepted as the true applicant and that his application for a decision was valid, as he had made a request for information to a Scottish public authority and had applied for a decision from the Commissioner, in terms of section 47(1) of FOISA, only after asking the authority to review its response to that request.The case was then allocated to an investigating officer.
Investigation
7.On 21 December 2010, NHS Grampian was notified in writing that an application had been received from Mr Watson and was asked to provide any comments it wished to make on Mr Watson's application (as required by section 49(3)(a) of FOISA).NHS Grampian was also asked to confirm that it held the information requested by Mr Watson, and to advise which of the data protection principles would be breached by its disclosure.Given that, in correspondence with the Commissioner, Mr Watson had referred to the fact that he wanted the information in order to make a complaint to the General Medical Council (the GMC) or the Nursing and Midwifery Council (as appropriate), enquiries were also made about the possibility of taking a complaint forward to these bodies where the name of the doctor or nurse involved was not known.
8.NHS Grampian replied on 28 January 2011.It described the searches carried out to establish whether it held the information requested.It confirmed that the information was held, but did not appear in the medical records of the patient.NHS Grampian explained why the information was considered to be exempt from disclosure under section 38(1)(b) of FOISA; its reasons are outlined and discussed in the next part of this decision.
9.NHS Grampian confirmed that the patient's medical records had already been provided to the patient (and evidently viewed by Mr Watson), but advised that this fact was not known to the staff responsible for answering Mr Watson's request and request for review. It provided information about previous attempts to address the patient's complaint, and about the powers of the relevant regulatory body to investigate, should that be required.
Commissioner's analysis and findings
10.In coming to a decision on this matter, the Commissioner has considered the information withheld and all submissions presented to him and is satisfied that no matter of relevance has been overlooked.
Section 38(1)(b) ? personal data
11.NHS Grampian withheld the information covered by all three parts of Mr Watson's request under the exemption in section 38(1)(b) of FOISA.Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (as appropriate) section 38(2)(b), exempts information if it is personal data and if its disclosure to a member of the public otherwise than under FOISA would contravene any of the data protection principles laid down in Schedule 1 to the DPA. NHS Grampian has argued that disclosure of the information requested by Mr Watson would breach the first data protection principle.
12.The exemption in section 38(1)(b) is an absolute exemption, so is not subject to the public interest test laid down by section 2(1)(b) of FOISA.
13.NHS Grampian also suggested that the information was exempt from disclosure under section 38(1)(b) as read with section 38(2)(a)(ii) of FOISA.This exempts personal data from disclosure where disclosure would contravene section 10 of the DPA (right to prevent processing likely to cause damage or distress).However, it does not appear (and NHS Grampian did not provide the Commissioner with any evidence to show) that any notice under section 10 of the DPA had been given to it and the Commissioner has not, therefore, considered section 38(2)(a)(ii) in this decision.
Is the information personal data?
14.Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).
15.The Commissioner is satisfied that the withheld information relates to a living individual who can be identified from that information and other information in the possession of NHS Grampian, and that it is therefore personal data as defined in section 1(1) of the DPA.
16.To avoid confusion, it should be made clear that, after investigation, the Commissioner is satisfied that the individual who signed the prescription (as referred to in part a) of the request) is the same individual who signed for the administration of the injections (parts b) and c) of the request).In this decision, the Commissioner is therefore considering disclosure of personal data relating to one individual.
Would disclosure breach the first data protection principle?
17.NHS Grampian has argued that the release of the information would breach the first data protection principle, which requires that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met.The processing under consideration in this case is disclosure of personal data into the public domain in response to Mr Watson's information request.
18.The Commissioner has considered the definition of sensitive personal data set out in section 2 of the DPA and, in particular, the definition in section 2(g): personal data consisting of information as to the commission or alleged commission by the data subject of any offence.The Commissioner understands that Grampian Police may be investigating a related complaint, although it is not known whether the allegations of criminal behaviour relate to the individual whose personal data is under consideration in this decision.In any event, the Commissioner understands that the complaint was made after NHS Grampian carried out a review of the way in which it had dealt with Mr Watson's information request.As such, and in the circumstances of this case, the Commissioner has not found it necessary to go on to consider whether the information is sensitive personal data for the purposes of section 2 of the DPA.He is not, therefore, required to consider whether disclosure of the information would be permitted by any of the conditions in Schedule 3 to the DPA.
19.There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules.However, these three aspects are interlinked.For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.
20.The Commissioner will now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed.If any of these conditions can be met, he must then consider whether the disclosure of this personal data would be fair and lawful.
Can any of the conditions in Schedule 2 to the DPA be met?
21.When considering the conditions in Schedule 2, the Commissioner notes Lord Hope's comment in Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[2] that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights and freedoms or legitimate interests of the data subject.
22.The Commissioner considers that condition 6 of Schedule 2 of the DPA would appear to be the only condition which might permit disclosure of the personal data requested by Mr Watson. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
23.There are a number of different tests which must therefore be satisfied before condition 6 can be met.These are:
Does Mr Watson have a legitimate interest in obtaining the personal data?
If yes, is the disclosure necessary to achieve these legitimate aims?In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subject?
Even if the processing is necessary for Mr Watson's legitimate purposes, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject (i.e. the member of staff to whom the data relates)?There is no presumption in favour of the release of personal data under the general obligation laid down by FOISA.Accordingly, the legitimate interests of Mr Watson must outweigh the rights and freedoms or legitimate interests of the data subject before condition 6 will permit the personal data to be disclosed.If the two are evenly balanced, the Commissioner must find that NHS Grampian was correct to refuse to disclose the personal data to Mr Watson.
Does Mr Watson have a legitimate interest?
24.There is no definition within the DPA of what constitutes a "legitimate interest", but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive.In his published guidance on section 38 of FOISA[3], the Commissioner states:
"In some cases, the legitimate interest might be personal to the applicant? e.g. he or she might want the information in order to bring legal proceedings.With most requests, however, there are likely to be wider legitimate interests, such as scrutiny of the actions of public bodies or public safety."
25.Mr Watson has explained to the Commissioner that the withheld information would enable a complaint to be made about to the appropriate regulatory body, such as the GMC or the Nursing and Midwifery Council.He also referred to a parliamentary question raised by Nicol Stephen MSP (ref S3W-33552), who asked whether a patient in an NHS hospital should have the right to find out the identities of those who have prescribed and administered medication to him or her.The parliamentary answer stated:
"There would be no reason on the grounds of privacy and confidentiality why an individual should not be informed of the names of those who prescribe and administer their medication. This is an integral part of the medical record and it is fundamental that the patient knows the name of the person who treated them. The prescriber actively treats the patient. It is not a passive relationship."[4]
26.As noted above, the patient concerned in this matter has authorised Mr Watson to act on their behalf in relation to a complaint about the administration of the injections.The Commissioner therefore accepts that Mr Watson has demonstrated a legitimate interest in the personal data withheld.
Is disclosure of the information necessary for Mr Watson's legitimate interests?
27.The Commissioner then considered whether disclosure of the personal data was necessary to achieve Mr Watson's aims, or whether those aims could be achieved by means which interfere less with the privacy of the data subject.
28.NHS Grampian submitted that the legitimate interests of Mr Watson were equally served by information already in his possession, that is, the name of the senior clinician responsible for the patient's care.NHS Grampian explained that the administration of the injections would have been at the direction and instruction of the senior clinician.NHS Grampian also explained that, should Mr Watson wish to do so, he could bring a complaint to the GMC citing the senior clinician as the person responsible for the patient's care; the GMC has the authority to access all medical and staff records when investigating a complaint.(As noted above, given that it will now be clear to Mr Watson that the individual who is the subject of question c) is in fact the same individual as the person who is the subject of question a), Mr Watson will be aware that the person is a doctor and that the relevant regulatory body is the GMC.)
29.The Commissioner has separately received confirmation from the GMC that it is desirable but not always essential to provide the name of a doctor when making a complaint about them, if other information about the incident in which they were involved can be provided.It is clear to the Commissioner that Mr Watson already has in his possession other information about the incident which can be provided to the GMC.
30.The Commissioner has therefore concluded that, on balance, it is not necessary for the information to be disclosed under FOISA (and accordingly disclosed into the public domain) in order to further Mr Watson's legitimate interests in relation to bringing a complaint to a regulatory body.
31.In relation to the parliamentary answer to which Mr Watson referred, the Commissioner does not accept that this is relevant in relation to the disclosure of information under FOISA.The parliamentary answer was clearly framed in terms of confidential disclosure of information to the patient alone, unlike information which is disclosed under FOISA, which once disclosed, is considered to be in the public domain and ceases to be protected by any confidentiality it had prior to disclosure[5].
32.As the Commissioner has concluded that disclosure of the information is not necessary for Mr Watson's legitimate interests, he finds that none of the conditions in Schedule 2 of the DPA can be met.As a result, disclosure of the personal data in question would contravene the first data protection principle.Consequently, disclosure would be unlawful and, for the reasons stated above, unfair.Accordingly, the Commissioner finds that the information was correctly withheld under section 38(1)(b) of FOISA.
DECISION
The Commissioner finds that Grampian NHS Board (NHS Grampian) complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Watson.
Appeal
Should either Mr Watson or NHS Grampian wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision.
Kevin Dunion
Scottish Information Commissioner
23 February 2011
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1General entitlement
(1)A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6)This section is subject to sections 2, 9, 12 and 14.
2Effect of exemptions
(1)To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a)the provision does not confer absolute exemption; and
?
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(e) in subsection (1) of section 38 ?
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 ? The data protection principles
Part I ? The principles
1.Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data
...
6(1)The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
[1] http://www.itspublicknowledge.info/uploadedfiles/CourtofSessionGuidanceonValidity.pdf
[2] http://www.publications.parliament.uk/pa/ld200708/ldjudgmt/jd080709/comm-1.htm
[3] http://www.itspublicknowledge.info/nmsruntime/saveasdialog.aspx?lID=3085&sID=133
[4] http://www.scottish.parliament.uk/business/pqa/wa-10/wa0521.htm
[5] Craigdale Housing Association and others v Scottish Information Commissioner [2010] CSIH 43, paragraph 17
