|
Decision 039/2010 Mr J and the Scottish Social Services Council
Investigation of complaints
Reference No: 200900809
Decision Date: 11 March 2010 |
Summary
Mr J requested from the Scottish Social Services Council (the SSSC) information relating to the investigation of certain complaints.The SSSC responded by withholding the information under a number of exemptions.Following a review, Mr J remained dissatisfied and applied to the Commissioner for a decision.
Following an investigation, the Commissioner found that the SSSC had dealt Mr J's request for information in accordance with Part 1 of FOISA, by correctly applying the exemption under section 38(1)(b) of FOISA to the withheld information, which constituted personal data the disclosure of which would breach the first data protection principle.He did not require the SSSC to take any action.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) sections 1(1) (definition of "personal data") (Basic interpretative provisions) and 2 (Sensitive personal data); Part 1 of Schedule 1 (The data protection principles ? the first data protection principle); Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data ? condition 6)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision.The Appendix forms part of this decision.
Background
1.On 14 July 2008, Mr J wrote to the Scottish Social Services Council (SSSC) requesting the information "made available to" the SSSC and the "source(s)", which had served as a basis for its decision on certain complaints.
2.The SSSC responded on 12 August 2008, providing certain information but withholding other items under sections 35(1)(d) and 38(1)(b) of FOISA.
3.On 14 August 2008, Mr J wrote to the SSSC requesting a review of its response to his information request.He considered this initial decision to be flawed.
4.On 29 January 2009, the SSSC responded to Mr J's letter of 14 August 2008, stating that it had dealt with his dissatisfaction with its response to his Freedom of Information request as a complaint under its Complaints Procedure.It confirmed that it was also willing to carry out a review under its Freedom of Information Procedure, should he wish one.He confirmed that he did by submitting the relevant form on 9 February 2009.
5.The SSSC notified Mr J of the outcome of its review on 5 March 2009, confirming its original decision to withhold the information under sections 35 and 38 of FOISA.
6.On 28 April 2009 Mr J wrote to the Commissioner, stating that he was dissatisfied with the outcome of the SSSC's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
7.The application was validated by establishing that Mr J had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
8.On 20 May 2009, the SSSC was notified in writing that an application had been received from Mr J and asked to provide the Commissioner with any information withheld from him. The SSSC provided the withheld information and the case was then allocated to an investigating officer.
9.The investigating officer subsequently contacted the SSSC, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions.In particular, the SSSC was asked to justify its reliance on any provisions of FOISA it considered applicable to the information requested (with particular reference to the exemptions it had claimed in its responses to Mr J) and to explain the steps it had taken to establish what relevant information it held.
10.During the investigation, further information falling within the scope of Mr J's request (to which the SSSC extended the same arguments as it had provided in respect of the information originally withheld) was identified and supplied to the investigating officer.The Commissioner is satisfied with the SSSC's submissions in respect of the scope of Mr J's request and the steps taken by it to identify and locate the information falling within it.All of this information, along with the relevant submissions received from both parties, will be considered fully in the Commissioner's analysis and findings below.
Commissioner's analysis and findings
11.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Mr J and the SSSC and is satisfied that no matter of relevance has been overlooked.
Section 38(1)(b) ? personal information
12.The SSSC has withheld all the information under section 38(1)(b) of FOISA, arguing that it is personal data the disclosure of which would contravene the first data protection principle.
13.Section 38(1)(b), read in conjunction with section 38(2)(a)(i) (or, where appropriate, 38(2)(b)) exempts information from disclosure if it is personal data (as defined by section 1(1) of the DPA) and its disclosure to a member of the public otherwise than under FOISA would contravene any of the data protection principles set out in Schedule 1 to the DPA.The exemption is absolute and therefore is not subject to the public interest test in section 2(1)(b) of FOISA.
Is any of the withheld information personal data?
14.Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).
15.Having considered the withheld information, the Commissioner accepts that it is the personal data of a specific living individual or individuals.The individual(s) can be identified from the information, which is significantly biographical of, and focuses on, them.Consequently, the Commissioner considers the information to relate to the individual(s) in question.
Would disclosure of the information breach the first data protection principle?
16.In this case, the SSSC argued that disclosure of the information would breach the first data protection principle.The first data protection principle requires that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 (to the DPA) is met, and in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.In this case, processing would be by disclosure in response to Mr J's information request.
Sensitive personal data
17.Having considered the information which was withheld by the SSSC, the Commissioner is satisfied that elements of it are sensitive personal data.Sensitive personal data is defined in section 2 of the DPA, which is reproduced in the Appendix.
18.The Commissioner has issued updated guidance on the interpretation of the exemption in section 38 of FOISA (http://www.itspublicknowledge.info/Law/FOISA-EIRsGuidance/section38/Section38.aspx ).In that guidance, he notes that for the purposes of section 38 it is likely that only conditions 1 and 5 of schedule 3 will be relevant, given that the other conditions in schedule 3 are very restrictive in nature.It is clear that the data subject(s) in this case have neither given their explicit consent to disclosure nor taken deliberate steps which have resulted in the sensitive personal data being made public.The Commissioner has considered all of the other conditions in schedule 3, but is not satisfied in the circumstances that any of them would allow the sensitive personal data to be disclosed.
19.As the Commissioner is satisfied that there are no conditions in Schedule 3 which would permit disclosure of the withheld sensitive personal data, he is not required to go on to consider whether any of the conditions in Schedule 2 can be met in relation to these data or whether their disclosure would otherwise be fair and lawful.He considers it appropriate in the circumstances, however, that his analysis of the Schedule 2 conditions and the remainder of the first data protection principle should consider all of the withheld information.
Schedule 2 to the DPA
20.The Commissioner considers condition 6 to be the only condition in Schedule 2 which might permit disclosure in this case.The SSSC's submissions focus on this condition.Condition 6 permits personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights, freedoms or legitimate interests of the data subject(s) (the individual or individuals to whom the withheld information relates).It is clear from the wording of this condition that each case will turn on its own facts and circumstances.
21.There are, therefore a number of different tests which must be considered before condition 6 can be met.These are;
a.Does Mr J have a legitimate interest in obtaining the personal data?
b.If yes, is the disclosure necessary to achieve these legitimate aims?In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the individual(s) in question?
c.Even if the processing is necessary for Mr J's legitimate purposes, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject(s).There is no presumption in favour of the release of personal data under the general obligation laid down by FOISA.Accordingly, the legitimate interests of Mr J must outweigh the rights and freedoms or legitimate interests of the data subject(s) before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the SSSC was correct to refuse to disclose the personal data to Mr J.
Legitimate interests
22.In his application to the Commissioner and in subsequent communications with the investigating officer, Mr J provided his reasons for requiring the withheld information.In the circumstances, the Commissioner accepts that Mr J's personal interest in the information is sufficient to show he has a legitimate interest in obtaining it.
Is disclosure necessary to achieve these legitimate aims?
23.The Commissioner must now go on to consider whether disclosure of the personal data in the report is necessary to achieve Mr J's legitimate aims.Having considered these aims, the nature of the information requested and all other circumstances of this case, he would conclude that (for certain purposes at least) there would be no other way of doing this. Consequently, he cannot identify a means of meeting Mr J's legitimate interests which would be less intrusive than disclosure of the withheld personal data.
24.As the Commissioner is satisfied that disclosure of the withheld information would be necessary to achieve at least some of Mr J's legitimate interests, he is required to go on to consider whether it would nevertheless cause unwarranted prejudice to the rights, freedoms or legitimate interests of the data subject(s) whose data comprises that withheld information.
Would disclosure cause unwarranted prejudice to the rights and freedoms or legitimate interests of the individual's whose personal data is in the report?
25.The SSSC submitted that there was no provision in the statutory process governing complaints of this kind for the complainer (in this case Mr J) to be provided with information of the kind he had requested.There was, on the other hand, a strong expectation on the part of any person complained about that any information gathered for the purposes of the investigation of a complaint would be used only for that purpose, such persons being entitled to expect that the professional regulator would protect information provided for that purpose in the context of a fair and unbiased investigation.The SSSC provided further information specific to the circumstances of this case and pointed out in addition that Mr J had exhausted all avenues available to him under the SSSC's own procedures.
26.The Commissioner notes the context in which the information was provided to the SSSC and accepts that a person who is the subject of a complaint and investigation of this nature would have a reasonable expectation that information provided in connection with it would be held in confidence and used only for the limited purposes of the investigation. In the circumstances, he accepts that disclosure would constitute an unwarranted intrusion into the private life of the data subject(s).
27.On balance, therefore, the Commissioner finds that any legitimate interests served by disclosure of the withheld information to Mr J would not outweigh the unwarranted prejudice that would be caused to the rights, freedoms or legitimate interests of the data subject(s).The Commissioner is therefore satisfied that condition 6 in Schedule 2 to the DPA is not met in this case.
28.Having accepted that disclosure of the withheld information would lead to unwarranted prejudice to the rights, freedoms and legitimate interest of the data subject(s) as described above, the Commissioner must also conclude that disclosure would be unfair.As condition 6 is not met, he would also regard disclosure as unlawful.In all the circumstances, therefore, the Commissioner's conclusion is that the first data protection principle would be breached by disclosure and therefore that the withheld personal data was properly withheld under section 38(1)(b) of FOISA.
29.The SSSC also withheld this information under the exemption in section 35(1)(g), read in conjunction with section 35(2)(d)(ii).The Commissioner need not consider this exemption in relation to the withheld information as he has already found all of it to be exempt from disclosure under section 38(1)(b) of FOISA.
DECISION
The Commissioner finds that the SSSC complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in relation to the matters specified in the application by Mr J.
Appeal
Should either Mr J or the SSSC wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Margaret Keyse
Head of Enforcement
11 March 2010
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a) the provision does not confer absolute exemption; and
...
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(e) in subsection (1) of section 38 ?
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1)In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a) from those data, or
(b)from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
2 Sensitive personal data
In this Act "sensitive personal data" means personal data consisting of information as to-
(a)the racial or ethnic origin of the data subject,
(b)his political opinions,
(c)his religious beliefs or other beliefs of a similar nature,
(d)whether he is a member of a trade union (within the meaning of the Trade Union and Labour Relations (Consolidation) Act 1992),
(e)his physical or mental health or condition,
(f)his sexual life,
(g)the commission or alleged commission by him of any offence, or
(h)any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings.
Schedule 1 ? The data protection principles
Part I ? The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data
...
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
