Decision 037/2025: Information on Police Scotland’s handling of an incident
Authority: Chief Constable of the Police Service of Scotland
Case Ref: 202201401
Summary
The Authority was asked for information regarding an incident at a specified address. The Authority refused to confirm or deny whether the information existed or was held by it. The Commissioner accepted that it was in the public interest for the Authority not to reveal whether the information existed or was held.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6)) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 18(1) (Further provision as respects responses to request); 38(1)(b), (2A)(a), (5) (definitions of "the data protection principles", "data subject", "personal data", "processing" and "the UK GDPR") and (5A) (Personal information)
United Kingdom General Data Protection Regulation (the UK GDPR) articles 5(1)(a) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness of processing)
Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data)
Background
1. On 12 October 2022, the Applicant made a request for information. The request comprised seven questions, presented under four statements. These are summarised below.
2. Statement one related to an allegation that police officers had lied in court proceedings about their stated intentions for entering a specified residence.
a) Why has a police officer that allegedly committed perjury not been prosecuted?
b) As all the police officers who entered the property stated in their statements they entered out of concern for the mental welfare of the occupant, exactly what action did any of the police officers take to substantiate this reason for entering the property?
3. Statement two concerned an allegation that a police officer who made an arrest at the specified residence, had been aware of the warrant for entry before entering the residence, as opposed to only becoming aware after entry.
c) How could the police officer arrest the occupant for reasons immediately after entering the property when according to his statement he only became aware of a warrant for arrest after being in the property for approximately two minutes?
4. Statement three alleged discrepancies between the accounts of police officers relating to an alleged offence at a specified residence.
d) Why if the police could not access the specified residence and allegedly permitted an offence to proceed, why did they not force entry and arrest an alleged offender?
e) Why were certain statements by police officers not investigated adequately, towards criminal prosecution?
f) Why was the occupant of the specified residence not prosecuted for breach of the peace?
5. Statement four concerned the Applicant’s dissatisfaction on why the police investigating his complaint on the incident at the specified residence, had not upheld it.
g) Why did the police who investigated my complaint not deal with the [alleged] discrepancies that the Applicant detailed in his complaint and report the officers for prosecution?
6. The Authority responded on 2 November 2022. The Authority refused to confirm or deny whether it held the requested information, relying on section 18 of FOISA, in conjunction with sections 38(1)(a) and (b), 34(1), and 35(1)(a) and (b) of FOISA.
7. On the 24 November 2022, the Applicant requested a review of the Authority’s decision not to disclose the information requested that it may or may not hold. The Applicant was dissatisfied with the Authority’s response, because it had refused to answer the questions he had asked.
8. The Authority notified the Applicant of the outcome of its review on 2 December 2022, upholding its initial response that section 18 of FOISA had been correctly applied.
9. On 5 December 2022, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Applicant stated that he was dissatisfied with the outcome of the Authority’s review because it had refused to give him access to the information he had requested.
Investigation
10. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
11. On 14 December 2022, the Authority was notified in writing that the Applicant had made a valid application.
12. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Authority was invited to comment on the application and the case was allocated to an investigating officer.
13. The Authority provided its comments, and further submissions were also sought and obtained from the Applicant.
Commissioner’s analysis and findings
14. In coming to a decision on this matter, the Commissioner considered all the relevant submissions made to him by both the Applicant and the Authority. He is satisfied that no matter of relevance has been overlooked.
15. As mentioned above, the Authority are relying on section 18 of FOISA, read in conjunction with other exemptions, including section 38(1)(b) of FOISA.
Scope of the investigation
16. As noted above, the Applicant made seven separate information requests. However, the Commissioner determined that only two of those requests were valid requests for recorded information. In light of this, this decision will only consider the Authority’s handling of requests b) and f).
Section 18(1) – Neither confirm nor deny
17. Section 18(1) of FOISA allows public authorities to refuse to confirm or deny whether they hold information in the following limited circumstances:
(i) a request has been made to the authority for information, which may or may not be held by it;
(ii) if the information existed and were held by the authority (and it need not be), it could give a refusal notice under section 16(1) of FOISA, on the basis that the information was exempt information by virtue of any of the exemptions in sections 28 to 35, 38, 39(1) or 41 of FOISA; and
(iii) the authority considers that to reveal whether the information exists or is held by it would be contrary to the public interest.
18. In any case where section 18(1) is under consideration, the Commissioner must ensure that his decision does not confirm one way or the other whether the information requested exists or is held by the authority. This means he is unable to comment in any detail, in this case, on the Authority’s reliance on any of the exemptions referred to, or on other matters that could have the effect of indicating whether the information existed or was held by the Authority.
19. In this case, the Authority submitted that, if it held any information falling within the scope of requests b) and f), it would be exempt from disclosure under section 38(1)(b) of FOISA.
The Authority maintained that section 38(1)(a), 34(1) and 35(1)(a) and (b) of FOISA also applied to the requested information.
20. The Commissioner must first, therefore, consider whether the Authority could have given a refusal notice under section 16(1) of FOISA in relation to the information in question, if it existed and were held.
Section 38(1)(b) - Personal information
21. Section 38(1)(b), read in conjunction with section 38(2A) (a) or (b), exempts information from disclosure if it is "personal data", as defined in section 3(2) of the Data Protection Act 2018 (the DPA) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR.
Would the information be personal data?
22. "Personal data" is defined in section 3(2) of the DPA as "any information relating to an identified or identifiable living individual". Section 3(3) of the DPA 2018 defines "identifiable living individual" as "a living individual who can be identified, directly or indirectly, in particular with reference to -
(i) an identifier such as a name, an identification number, location data or an online identifier, or
(ii) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual."
23. In this case, requests b) and f) relate to a specific incident at a specified address which involved an unnamed individual. However, when making his request for information, the Applicant also provided the Authority with a copy of a complaint he had made to the Procurator Fiscal, which identified the individual involved in the incident.
24. The Authority submitted that if the information existed and was held, it would be "personal data" given that the data subject had been identified and the information requested would relate to that individual.
25. The Commissioner notes the Applicant's information request relates solely to an incident at a specified address. Furthermore, this request contains information that names an individual as resident at that address and in relation to the incident. The information sought is only about this incident on a particular day at the specified address. The Commissioner is satisfied if this information did exist and were held by the Authority, it would relate to an identified or identifiable living individual. The Commissioner accepts if it existed and were held, the information would be personal data as defined in section 3(2) of the DPA 2018.
Would disclosure contravene one of the data protection principles?
26. The Authority argued that disclosing the personal data, if it existed and were held, would breach the first data protection principle. This requires personal data to be processed "lawfully, fairly and in a transparent manner in relation to the data subject" (Article 5(1)(a) of the UK GDPR).
27. The definition of "processing" is wide and includes (section 3(4)(d) of the DPA) "disclosure by transmission, dissemination or otherwise making available". For the purposes of FOISA, personal data are processed when disclosed in response to a request. This means that personal data could only be disclosed if disclosure would be both lawful (i.e. it would meet one of the conditions of lawful processing listed in Article 6(1) of the UK GDPR) and fair.
Lawful processing: Articles 6(1)(f) of the UK GDPR
28. In considering lawfulness, the Commissioner must consider whether any of the conditions in Article 6(1) of the UK GDPR would allow the personal data to be disclosed.
29. The Authority has commented that, if the information existed and was held, condition (f) is the only condition which could potentially apply. This states that processing shall be lawful if it is "necessary for the purposes of the legitimate interest pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data...”
30. Although Article 6(1) states that this condition cannot apply to processing by a public authority in performance of its tasks, section 38(5A) of FOISA makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
31. The tests which must be met before Article 6(1)(f) can be met are as follows:
(i) Would the Applicant have a legitimate interest in obtaining personal data, if held?
(ii) If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?
(iii) Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subject?
Would the Applicant have a legitimate interest in obtaining the personal data, if held?
32. The Authority acknowledged that if the information existed and were held, the Applicant would have a legitimate interest in obtaining the personal data.
Would disclosure be necessary?
33. Having accepted that the Applicant has a legitimate interest in the personal data (if it existed and were held), the Commissioner must consider whether disclosure of the personal data is necessary for the Applicant's legitimate interests. In doing so, he must consider whether those interests might reasonably be met by any alternative means.
34. "Necessary" means "reasonably" rather than "absolutely" or "strictly" necessary. When considering whether disclosure would be necessary, public authorities should consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the Applicant's legitimate interests could reasonably be met by means which interfered less with the privacy of the data subject.
35. The Authority acknowledged that the Applicant was entitled to make a complaint about his concerns regarding its handling of an incident, but it stated that it was not necessary for him to be provided with information to conduct his own investigation into the incident, or to obtain records relating to the incident, if such information existed and were held. The Authority argued that disclosure of the information, if it existed and were held, would breach the individual’s right to privacy, particularly where the information would be disclosed into the public domain, as would be the case with disclosure under FOISA.
36. The Authority commented that there were existing processes in place outside of FOISA for people to exercise their right of access to their own information. It added that even “yes” or “no” as to whether information is held by it would be a substantial breach of privacy and unlawful in terms of the DPA.
The Authority recognised that there was a public interest in individuals being able to access their own information and, in limited circumstances, that of other people. However, it considered that there was no public interest in such information being made publicly available, if it existed and were held. Disclosure would severely breach the individual’s right to privacy and their expectation that the Authority treat personal information appropriately.
37. In the circumstances, the Commissioner does not accept that disclosure through FOISA of the personal data sought in this case (if it existed and was held) would be necessary to fulfil the Applicant's legitimate interest. He considers that the Applicant has the option of making a complaint to the Authority, and he notes that this option was suggested by the Authority to the Applicant.
38. In all the circumstances of this case, the Commissioner concludes that condition (f) in Article 6(1) of the UK GDPR could not be met in relation to the personal data sought by the Applicant (assuming it existed and were held).
Conclusion on the data protection principles
39. For the reasons set out above, the Commissioner is satisfied that disclosure of any relevant personal data, if it existed and were held, would breach the data protection principle in Article 5(1)(a) of the UK GDPR. Having reached this conclusion, he need not consider the status of such personal data as data relating to criminal matters, if it existed and were held.
40. In all the circumstances, the Commissioner is satisfied that such personal data would be exempt from disclosure under section 38(1)(b) of FOISA and that the Authority could give a refusal notice under section 16(1) of FOISA, on the basis that the information would be so exempt.
41. As the Commissioner has concluded that the information, if it existed and were held, could be withheld under section 38(1)(b) of FOISA, he does not need to consider the other exemptions cited by the Authority.
42. Having accepted that the Authority could give a refusal notice under section 16(1) of FOISA on the basis that any relevant information would be exempt information by virtue of section 38(1)(b) of FOISA, the Commissioner is required by section 18(1) to go on to consider whether the Authority was entitled to conclude that it would be contrary to the public interest to reveal whether the information existed or was held.
Section 18(1) - The public interest
43. The Applicant was invited to provide specific public interest arguments. The Applicant stated that the Authority had acted in bad faith throughout the incident and were involved in a conspiracy to pervert the course of justice. He argued that disclosure of the information was in the public interest as it was evident that certain police officers had acted with criminal intent during the incident, and in breach of their “oath of office”.
44. The Authority submitted that the public interest lay overwhelmingly in protecting an individual’s right to privacy. It stressed that disclosure under FOISA meant disclosure into the public domain, and any definitive position on whether information existed and was held would constitute a significant breach of privacy. The Authority stated it would be unlawful under data protection legislation.
45. The Authority recognised the public interest in individuals being able to access their own information and, in limited circumstances, that of other people.
However, it argued that there was no public interest in such information being made publicly available to anyone who asks. It concluded that there was no public interest in confirming whether an individual has been involved with the Authority in any capacity.
46. The Authority argued that any response other than section 18, in response to such a request, would be unlawful in most cases and therefore not in the public interest.
The Commissioner’s conclusions
47. The test the Commissioner must consider is whether (having already concluded that the information, if it existed and was held, would be exempt from disclosure) it would have been contrary to the public interest to reveal whether the information existed or was held.
48. The Commissioner has considered the submissions from the Applicant, and he acknowledges the length of time the Applicant has been pursuing matters, and his stated need for the information.
49. However, the Commissioner is aware that, in this case, the action of confirming or denying whether the information existed or was held would have had the effect of revealing, through public disclosure whether the individual concerned had been the subject of police actions.
50. Having considered the arguments submitted by both parties, the Commissioner is satisfied, in all the circumstances of this case, that it would have been contrary to the public interest for the Authority to disclose whether the information requested by the Applicant existed or was held, given that it would constitute a third party’s personal data and disclosure would breach that individual’s rights under the DPA 2018. (The Commissioner cannot accept, however, that it is possible to lay down rules of wholly general application as to whether it can ever be confirmed that an individual has been involved with this, or any other, Authority: it is of the essence of section 18(1) – and, for that matter, section 38(1)(b), assuming information did exist and were held – that each case must be considered on its own merits.)
51. As a result, the Commissioner is satisfied that the Authority was entitled to refuse to confirm or deny, in accordance with section 18(1) of FOISA, whether it held the information requested by the Applicant or whether such information existed.
Decision
The Commissioner finds that the Authority complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.
Appeal
Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Euan McCulloch
Head of Enforcement
14 February 2025
