Decision 038/2015 | Scottish Information Commissioner

Home Decisions

Decision 038/2015

Decision 038/2015: Mr I and the Scottish Prison Service

Complaints and disciplinary issues

Reference No: 201402459

Decision Date: 26 March 2015

Summary

On 8 August 2014, Mr I asked the Scottish Prison Service (the SPS) for information relating to specific disciplinary and complaint-related matters. The SPS provided Mr I with some information, informing him that other information was his own personal data or otherwise accessible, or that the cost of complying would exceed the ?600 limit.

Following an investigation the Commissioner found that the SPS was entitled to withhold information as personal data and that some information was otherwise accessible. She also found that the SPS had wrongly stated that other information had been provided previously, and was wrong to apply the cost limit.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (4) and (6) (General entitlement); 12(1) (Excessive cost of compliance); 17(1) (Notice that information is not held); 25(1) (Information otherwise accessible); 38(1)(a), (1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles, Part I - the principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 8 August 2014, within written submissions made in connection with an Internal Complaints Committee (ICC) hearing, held under The Prisons and Young Offenders Institutions (Scotland) Rules 2011 (the Prison Rules), Mr I requested information which included the following:

a) the notes taken by the SPS note taker and any other SPS employees in the course of the ICC meeting concerned;

b) all and any information held by the Governor and SPS senior management at the prison in relation to the investigations carried out in relation to the complaints detailed in the SPSO's decision letter of 28 July 2014;

d) all and any information contained within the current SPS Adjudication Manual;

e) all and any information held by the Governor relative to any disciplinary charge contrary to para 10 of Schedule 1 to the Prison Rules 2011 such as may have been laid at HMP Edinburgh between 1 January and 31 July 2014;

f) all and any information in the possession of the Governor supporting the assertion within the Charging Officer's 'Statement' to the effect that I have "?been warned not to continue to challenge (Named staff member) presence at the ICC."

2. On 2 September 2014, the SPS provided Mr I with a response. It informed him that the information requested at parts a) and b) was his own personal data and exempt in terms of section 38(1)(a) of FOISA. Mr I was advised that he may wish to submit a subject access request under the DPA.

3. In relation to part d) of his request, the SPS informed Mr I that the information was readily available in the prison library. He was advised to speak to the Librarian on his next visit. As it was otherwise accessible, the SPS considered the information to be exempt in terms of section 25(1) of FOISA.

4. In relation to part e) of his request, the SPS provided a report showing the number placed on report for breaching prison discipline, broken down by specific charge.

5. In relation to part f) of his request, the SPS informed Mr I that the information he requested was contained in a letter sent to him on 15 May 2014, and so was exempt in terms of section 25(1).

6. On 23 August 2014, Mr I wrote to the SPS requiring a review. He did not accept the application of section 38(1)(a) of FOISA to parts a) and b) of his request, submitting that it could not all be his personal data.

7. He also disputed the application of section 25(1) of FOISA to parts d) and f) of the request. Regarding the Adjudication Manual, he stated that he had limited access to the library, which had been closed the previous week. He did not believe the letter referred to by the SPS to contain the information that he had requested at part f).

8. Finally, Mr I did not accept that the information provided in response to part e) of his request was all of the information held by the SPS and falling within the scope of that part.

9. The SPS notified Mr I of the outcome of its review on 26 September 2014. It upheld its application of section 38(1)(a) FOISA.

10. While accepting that the library had been closed at the time mentioned by Mr I, the SPS maintained that he still had reasonable access to the library and so section 25(1) of FOISA applied to part d) of his request. In relation to part f) of the request, it also upheld its original response.

11. In relation to part e) of the request, the SPS acknowledged that it did hold further information. However, the cost of locating, retrieving and providing this additional information would, in the SPS's view, exceed the prescribed limit set for the purposes of section 12(1) of FOISA (and so it was not obliged to comply).

12. On 16 October 2014, Mr I wrote to the Commissioner. He applied to the Commissioner for a decision in terms of section 47(1) of FOISA. In summary, he stated that he did not agree with the application of the provisions claimed by the SPS. He provided reasons for his views.

Investigation

13. The application was accepted as valid. The Commissioner confirmed that Mr I made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision. The case was then allocated to an investigating officer.

14. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. On 1 December 2014, the investigating officer notified the SPS in writing that Mr I had made a valid application and invited it to comment on this application. It was asked to justify its reliance on any provisions of FOISA it considered applicable, with specific reference to those applied in correspondence with Mr I.

15. The SPS responded, adhering to its position that information covered by parts a) and b) of Mr I's request was exempt in terms of section 38(1)(a) of FOISA. It now took the same position in relation to request f) as well, acknowledging that this information was not to be found in the letter of 15 May 2014.

16. The SPS also maintained its reliance on section 25(1) of FOISA in relation to part d) of the request.

17. In relation to part e) of Mr I's request, the SPS acknowledged that its interpretation had been inaccurate, with the result that it had been incorrect to apply section 12(1) of FOISA. It now took the view that the information was the personal data of the prisoners involved and so exempt under section 38(1)(b) of FOISA. During the investigation, it provided Mr I with notice of its new position, with some information on the number of charges, the number found guilty and the punishments imposed.

18. Mr I was informed of the SPS's submissions and given the opportunity to comment. His comments are considered further below.

Commissioner's analysis and findings

19. In coming to a decision on this matter, the Commissioner considered all the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr I and the SPS. She is satisfied that no matter of relevance has been overlooked.

20. Before considering whether the SPS are entitled to withhold information, the Commissioner will consider aspects of the handling of Mr I's request.

Handling - Information held by the SPS (part f) of request)

21. Section 1(1) of FOISA provides that a person who requests information from a Scottish public authority which holds it is entitled to be given that information by the authority, subject to qualifications which, by virtue of section 1(6) of FOISA, allow Scottish public authorities to withhold information or charge a fee for it.

22. The information to be given is that held by the authority at the time the request is received, subject to any amendment or deletion which would have been made, regardless of the receipt of the request, between the time the request is received and the time the information is given (section 1(4)). If no such information is held by the authority, section 17(1) of FOISA requires it to give the applicant notice in writing to that effect.

23. In relation to part f) of Mr I's request, the SPS initially informed him that the information that it held was contained in a letter of 15 May 2014. It had previously given this letter to

Mr I, and so the information he requested was exempt in terms of section 25(1) of FOISA.

24. In his requirement for review and his application to the Commissioner, Mr I submitted that the previous letter did not contain the information requested.

25. In its submissions to the Commissioner, the SPS accepted that the letter of 15 May 2014 did not contain the information requested by Mr I. On further consideration, it took the view that information falling within the scope of part f) of the request was contained within the information it held and which fell within the scope of part a).

26. Mr I disputed that any information falling within the scope of part a) of his request (notes taken by the person complained of) could be considered supportive of the assertion referred to in part f). Therefore, he believed the SPS should have provided him with a response in terms of section 17(1) of FOISA.

27. Having considered the withheld information, the Commissioner is satisfied that information which would fall within the scope of part f) of Mr I's request is contained within the information withheld under part a) of his request. This information is reflected in the official record of the meeting in question, so the Commissioner does not consider it reasonable to accept Mr I's interpretation of its status. Given this conclusion, a response in terms of section 17(1) of FOISA, as suggested by Mr I, would be inappropriate. The withholding of this information will be considered when considering the application of section 38(1)(a) of FOISA.

28. Given that the information requested by Mr I in part f) of his request was not contained in the earlier letter of 15 May 2014, the Commissioner finds that the SPS failed to identify correctly the information falling within the scope of this request and so failed to comply with section 1(1) of FOISA.

Section 12(1) - Excessive cost of compliance (part e) of request)

29. In the review outcome, the SPS informed Mr I that it was not required to respond to part e) of his request, as the cost of complying would exceed the cost limit set under section 12(1) of FOISA.

30. Under section 12(1) of FOISA, a Scottish public authority is not obliged to comply with a request for information where the estimated cost of doing so would exceed the amount prescribed for that purpose in the Freedom of Information (Fees for Required Disclosure) (Scotland) Regulations 2004. This amount is currently ?600 (regulation 5). Consequently, the Commissioner has no power to order a public authority to disclose information should she accept that the cost of responding to a request for that information exceeds this sum.

31. The SPS informed Mr I on review that it wished to apply section 12(1). During the investigation, it withdrew its reliance on this section. It provided Mr I with some of the information, withholding the remainder under section 38(1)(b) of FOISA.

32. Given the SPS's withdrawal of its reliance on section 12(1) of FOISA, the Commissioner can only conclude that it was wrong to apply this provision to part e) of Mr I's request.

Section 25(1) - information otherwise accessible (part d) of request)

33. In its response to Mr I and in the review outcome, the SPS informed Mr I that it was applying section 25(1) of FOISA to part d) of his request. It believed the information in the Adjudication Manual was readily accessible by him within the Prison Library. It suggested to Mr I that he discuss access with the librarian on his next visit.

34. Under section 25(1) of FOISA, information which an applicant can reasonably obtain other than by requesting it under section 1(1) of FOISA is exempt information. The exemption in section 25(1) is absolute, in that it is not subject to the public interest test in section 2(1)(b) of FOISA.

35. The SPS submitted that Mr I had access to the library twice a week: on Mondays and Wednesdays. While it acknowledged that the library was closed on the week commencing 4 August 2014, it did not believe this rendered the document inaccessible for the purposes of this request. The library was accessible from 11 August 2014 onwards (three days after

Mr I's initial request). It further explained that records showed Mr I had attended the library on Wednesday 20 August 2014. He had not sought to borrow a copy of the document, or asked to have any of the information in it photocopied. The SPS confirmed that a loan copy was available.

36. Mr I outlined various reasons why he did not believe he had reasonable access to the library. He highlighted periods of closure, and the lack of information as to when the library would be available to him. He submitted that, to the extent that the library might be open from time to time, the information within the Manual in question was not reasonably accessible, given the volume of information concerned and the available time (which he stated was less than 15 minutes once or twice per week). He later submitted that he only had access once a week, at most.

37. Mr I also argued that, as a matter of law, making information available for inspection did not make it reasonably accessible for the purposes of section 25(1). He argued that his access to the library was a privilege rather than a right under the Prison Rules, which meant that access by this route could not be considered an entitlement. He drew the Commissioner's attention to the Information Rights Tribunal's decision in EA/2011/0291 Northamptonshire County Council[1], stating that in that case the Tribunal found the (UK) Information Commissioner had erred by concluding that information available for inspection only at a Council office was reasonably accessible for the purposes of section 21 of the Freedom of Information Act 2000 (FOIA), which is the equivalent to section 25(1) of FOISA.

38. During the investigation, Mr I was able to borrow the Adjudication Manual on a 48-hour loan. He submitted that this facility was not available to him at any time during the currency of his request. He also submitted that the SPS had made no attempts to ensure the facility was available or inform him of the means by which he might access the information.

39. The Commissioner has considered the arguments put forward by Mr I in relation to the Tribunal decision. She acknowledges that, in the circumstances of that particular case, the (UK) Information Commissioner was found to have erred in concluding that the equivalent provision of FOIA applied. In particular, the (UK) Information Commissioner was found to have reached his conclusions based on an inadequate understanding of the applicant's personal circumstances. In this case, the Commissioner is satisfied that she has all the relevant information she needs in relation to Mr I's personal circumstances. She will take full account of that information in considering the application of section 25(1) here.

40. The Tribunal decision referred to above also considered the application of section 11 of FOIA, which has its equivalent in section 11 of FOISA. It is open to an applicant to express a preference for receiving information by one or more of three specified means, in which case the authority must give effect to that preference, to the extent that it is reasonably practicable to do so. The Tribunal found that Northamptonshire County Council had failed to have regard to the applicant's expressed preference.

41. In this case, no such preference was expressed by Mr I. The Commissioner would simply note that the means of provision listed in section 11(2) include giving the applicant a reasonable opportunity to inspect a record containing the information. This would suggest that it would be acceptable, in appropriate circumstances, to respond to a request for information by giving such an opportunity. The Tribunal did not suggest otherwise in Decision EA/2011/0291.

42. In Decision 162/2014, the Commissioner considered another request for information held in the prison library. While noting that access to the library was a privilege rather than an enforceable right, she considered the access available to the applicant, as a matter of fact, at the relevant time. She considers that to be the right approach to take in this case.

43. It does not appear to be disputed that the information sought by Mr I was to be found in the Prison Library. Even accepting that the library was not accessible every day of every week, it is evident that there were periods when the library was in fact available to Mr I and it appears clear that there were occasions on which he could visit the library in the weeks before and after he made his request. It does not appear to be disputed that he did so.

44. In all the circumstances, the Commissioner is satisfied that the SPS was entitled to conclude that Mr I was capable of availing himself of access to the information in question, in the library, without further advice or guidance. In case there was any doubt on this point, SPS had suggested that he discuss access with the librarian on his next visit.

45. It is clear that a copy of the document specified in this part of the request is available for loan. More recently, Mr I has availed himself of such an opportunity. The Commissioner has identified no reason why the existence of such an opportunity, at the time the SPS dealt with this request, should not have been found to meet part d) of the request in full. Mr I has reasonable access to the library. The document is relatively large and permitted time in the library may be relatively short, but a loan of 48 hours should have allowed an adequate opportunity to digest it and take any necessary notes.

46. From all the communications she has received from Mr I, the Commissioner considers it reasonable to conclude that he did not discuss access to this document with the librarian until some time during the investigation. This is unfortunate. She considers it was reasonable for the SPS to believe he was capable of taking up its suggestion that he approach the librarian. In the absence of such discussion, there would appear to have been no reasonable basis for concluding that the document was only available for inspection in the library. On the balance of probabilities, the Commissioner accepts the SPS's claim that it was available for loan at the relevant time, on the same basis as Mr I eventually enjoyed.

47. Having considered all relevant submissions in relation to part d) of his request, the Commissioner is satisfied that the information sought by Mr I was reasonably obtainable by him, other than by making a request for it under section 1(1) of FOISA. Therefore, the SPS was entitled to apply section 25(1) of FOISA to part d) of the request.

Section 38(1)(a) of FOISA (parts a), b) and f) of request)

48. In its submissions to the Commissioner, the SPS submitted that any information falling within the scope of parts a), b) and f) of Mr I's request was exempt in terms of section 38(1)(a) of FOISA.

49. Section 38(1)(a) of FOISA contains an absolute exemption in relation to personal data of which the applicant is the data subject. The fact that it is absolute means that it is not subject to the public interest test in section 2(1)(b) of FOISA.

50. This exemption exists under FOISA because individuals have a separate right to make a request for their own personal data (commonly known as a "subject access request") under section 7 of the DPA. The DPA will therefore usually determine whether a person has a right to their own personal data, and govern the exercise of that right. Section 38(1)(a) of FOISA does not deny individuals a right to access to information about themselves, but ensures that the right is exercised under the DPA and not under FOISA.

51. Personal data are defined in section 1(1) of the DPA as data which relate to a living individual who can be identified:

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in Appendix 1).

52. The SPS submitted that the information requested at part a) of the request (which also includes part f) information) was Mr I's own personal data, as a record of the discussion between Mr I and the chairperson of the hearing, where Mr I had exercised his right to refer his complaint to an ICC. It related entirely to discussion of Mr I's complaints.

53. Similarly, the SPS submitted that information falling within the scope part b) of the request was also Mr I's personal data. Again, this was information about a complaint made by Mr I. Given the nature of the complaint in each case, the information was considered to be information about him. The SPS considered all of the information withheld in response to these requests to fall into this category, even where it also related to others and so was their personal data in addition.

54. In relation to this, the SPS submitted that it wished to rely upon the submissions it had provided in relation to earlier decisions by the Commissioner (Decisions 233/2014[2] and 002/2015[3]), where the Commissioner accepted that notes taken during ICC meetings were correctly withheld in terms of section 38(1)(a).

55. Mr I drew the Commissioner's attention to his requirement for review, in which he submitted (in relation to part a) of the request) that the information contained within the notes could not all be his own personal data. He referred to information concerning a staff member's understanding of their responsibilities, and a series of questions asked of that staff member. He also referred to a complaint against an SPS employee, covered by part b) of the request and potentially by part a). He stated that whilst this information might, to some extent, be the personal data of the employees concerned, it could not be said to be "biographical" in any meaningful sense in relation to him. He referred to tests applied by the Court of Appeal in the case of Durant v Financial Services Authority [2003] EWCA Civ 1746, and highlighted what he considered to be the "problem-centered" role of the ICC.

56. The Commissioner has considered the information withheld under section 38(1)(a) carefully. As in the earlier cases cited by the SPS, she has approached this on the basis that she must focus on this particular set of information and not ICC notes as a class. As she said in Decision 002/2015, the context (including the role of the ICC hearing) is relevant to this determination, but not to the exclusion of the content of the withheld information. As in Decision 002/2015, she has taken into account the notions of biographical significance and focus on the individual, highlighted in the Durant decision, with the relevant submissions provided by Mr I.

57. In all the circumstances, the Commissioner is satisfied that the information covered by part a) (and therefore also part f)) of the request is about Mr I. Applying the Durant criteria, it is significantly biographical in relation to him, and has him as its focus. It relates to concerns specific to him, even if it includes the personal data of others. In the Commissioner's view, it is information which relates to Mr I and from which he can be identified. She does not believe it would be practicable to render it anonymous.

58. While there may be more about other individuals in the information covered by part b) of the request, the Commissioner is satisfied that the primary focus of this information is still Mr I and his specific concerns. It is information from which he can be identified, and the Commissioner does not believe it would be practicable to render it anonymous. In the Commissioner's view, this information also relates to Mr I.

59. Taking all relevant circumstances into account, therefore, the Commissioner is satisfied that the SPS was correct in concluding that the information it held and which fell within the scope of parts a), b) and f) of the request was Mr I's personal data. Consequently, she finds that the SPS was entitled to withhold this information under section 38(1)(a) of FOISA.

Section 38(1)(b) - Personal Information (part e) of request)

60. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (2)(b) (as appropriate) exempts personal data if its disclosure to a member of the public, otherwise than under FOISA, would contravene any of the data protection principles.

61. The SPS submitted that the information that it continued to withhold falling within the scope of part e) of Mr I's request was personal data for the purposes of the DPA, and that its disclosure would contravene the first data protection principle. Therefore, it argued that the information was exempt under section 38(1)(b) of FOISA.

62. In considering the application of this exemption, the Commissioner will first consider whether the information in question is personal data as defined in section 1(1) of the DPA. If it is, she will go on to consider whether disclosure of the information would breach the first data protection principle as claimed.

63. This is an absolute exemption, which means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

Is the information under consideration personal data?

64. The definition of "personal data" is summarised at paragraph 51 above and set out in full in Appendix 1.

65. The SPS submitted that the information related to the personal lives of the individuals to whom it referred. It was highly sensitive as it related to behaviours and punishments in prison.

66. The Commissioner notes Mr I's submission that information from which an individual cannot be identified does not amount to personal data or sensitive personal data. Having considered this withheld information (i.e. what remains, following previous disclosures to Mr I), the Commissioner is satisfied that it could not be redacted in any meaningful way to allow disclosure without a significant risk of individuals being identified.

67. The Commissioner has considered the submissions received from the SPS and Mr I on this point, along with the withheld information. The Commissioner is satisfied that living individuals can be identified from the information, either by itself or with information in the possession of, or likely to come into the possession of, the data controller (and others). Given the nature of the information, the Commissioner finds that it relates to the individuals concerned. Consequently, the Commissioner accepts that the information is those individuals' personal data, as defined by section 1(1) of the DPA.

68. The SPS submitted that the information sought was also sensitive personal data. The Commissioner will consider whether it is, and the implications of that, after she has considered whether any Schedule 2 conditions can be met in relation to the withheld personal data.

The first data protection principle

69. The first data protection principle states that personal data shall be processed fairly and lawfully. The processing in this case would be disclosure of the information into the public domain, in response to Mr I's request. The first principle also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. In the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA must also be met.

70. There are three separate aspects to the first data protection principle:

(i) fairness,

(ii) lawfulness and

(iii) the conditions in the schedules.

These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 (and, where relevant, Schedule 3) which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.

71. The Commissioner will firstly consider whether there are any conditions in Schedule 2 which would permit the withheld personal data to be disclosed. If any of these conditions can be met, she must then consider whether disclosure of the personal data would be fair and lawful. If none of these conditions can be met, there will be no requirement to go on to consider the application of the conditions in Schedule 3.

Can any of the conditions in Schedule 2 be met?

72. In the circumstances, it appears to the Commissioner that condition 6 in Schedule 2 is the only one which might permit disclosure to Mr I. In any event, neither Mr I nor the SPS has argued that any other condition would be relevant. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individual(s) to whom the data relate).

73. There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:

(i) Is Mr I pursuing a legitimate interest or interests?

(ii) If yes, is the processing involved necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subject?

(iii) Even if the processing is necessary for Mr I's legitimate interests, is that processing nevertheless unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?

74. There is no presumption in favour of the disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. Accordingly, the legitimate interests of Mr I must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the SPS would be correct to refuse to disclose the personal data to Mr I.

Is the applicant pursuing a legitimate interest or interests?

75. The SPS submitted that, beyond what had been supplied to him already, Mr I had no legitimate interest in this information.

76. Mr I submitted to the Commissioner that he was pursuing a legitimate interest in the withheld information, given that he was challenging disciplinary proceedings taken against himself, where he believed the charge had not been properly specified, and needed the information requested to understand the manner in which such charges were dealt with by the SPS, and the kind of conduct typically alleged.

77. Having considered all relevant submissions, the Commissioner accepts that Mr I is pursuing a legitimate interest in seeking information on the matters he has described.

Is disclosure necessary for the purposes of these interests?

78. The Commissioner must now consider whether disclosure of the requested information is necessary for achieving the legitimate interests she has identified, and in doing so she must consider whether these interests might reasonably be met by any alternative means.

79. The SPS submitted that disclosure was not necessary for any legitimate interest that Mr I may have and that disclosure would be disproportionate.

80. The Commissioner has considered the information disclosed to Mr I already in this connection. Mr I has been provided with the number of cases involving such a disciplinary charge, the number (within a range) found guilty and the range of punishments imposed.

81. The Commissioner is satisfied that the information already disclosed to Mr I, without identifying individuals, goes some way towards addressing his legitimate interest. The withheld personal data might provide some additional information regarding the charges faced by others, but the Commissioner does not believe they would add materially to Mr I's understanding of the process, and thus to his legitimate interest.

82. In all the circumstances, the Commissioner concludes that disclosure of the withheld personal data would not be necessary to meet the legitimate interests identified above. The Commissioner must therefore conclude that condition 6 cannot be met in this case and, in the absence of a condition permitting disclosure, she must also conclude that disclosure would be unlawful.

83. Given that she has concluded that no condition in Schedule 2 can be met, the Commissioner is not required to go on to consider whether the information in question is sensitive personal data and, if so, whether a condition in Schedule 3 could be met.

84. The Commissioner therefore finds that the first data protection principle would be breached by disclosure, and so the personal data under consideration here may be withheld by the SPS under section 38(1)(b) of FOISA.

Decision

The Commissioner finds that the Scottish Prison Service (the SPS) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to parts the information request made by Mr I. The SPS was correct in withholding information in terms of section 38(1)(a) and (in part) section 25(1) of FOISA.

The Commissioner finds failures to comply with Part 1 of FOISA in other aspects of the SPS's handling of the request. It failed to identify correctly the information covered by part f) of the request, and so breached section 1(1) of FOISA. It was also incorrect in its application of section 12(1) of FOISA to part e) of the request. In both cases, the Commissioner finds that the SPS was entitled to withhold the information under exemptions in section 38 of FOISA, and therefore does not require any action to be taken in respect of these failures, in response to Mr I's application.

Appeal

Should either Mr I or the Scottish Prison Service wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Rosemary Agnew
Scottish Information Commissioner

26 March 2015

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.

(6) This section is subject to sections 2, 9, 12 and 14.

12 Excessive cost of compliance

(1) Section 1(1) does not oblige a Scottish public authority to comply with a request for information if the authority estimates that the cost of complying with the request would exceed such amount as may be prescribed in regulations made by the Scottish Ministers; and different amounts may be so prescribed in relation to different cases.

17 Notice that information is not held

(1) Where-

(a) a Scottish public authority receives a request which would require it either-

(i) to comply with section 1(1); or

(ii) to determine any question arising by virtue of paragraph (a) or (b) of section 2(1),

if it held the information to which the request relates; but

(b) the authority does not hold that information,

it must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it.

25 Information otherwise accessible

(1) Information which the applicant can reasonably obtain other than by requesting it under section 1(1) is exempt information.

38 Personal information

(1) Information is exempt information if it constitutes-

(a) personal data of which the applicant is the data subject;

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

[1]

[2]

[3]