|
Decision 039/2015: Mr Paul Hutcheon and the Chief Constable of the Police Service of Scotland
Stop and Search event in Fife
Reference No: 201402573
Decision Date: 27 March 2015
Summary
On 9 August 2014, Mr Hutcheon asked the Chief Constable of the Police Service of Scotland (Police Scotland) for information relating to a Stop and Search event held in Fife. Following a request for review, Police Scotland provided some information but withheld other information under the exemptions relating to personal information and the effective conduct of public affairs.
Mr Hutcheon remained dissatisfied and applied to the Commissioner for a decision. Further information was located during the investigation, some of which was also withheld under these exemptions.
The Commissioner found that Police Scotland was correct to withhold some information under section 38(1)(b) of FOISA, but also that it had incorrectly withheld other information, failed to locate all of the information within the scope of the request until during her investigation and failed to disclose information to which it had not applied any exemptions. The Commissioner required Police Scotland to provide Mr Hutcheon with the information to which it had not applied any exemptions.
|
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions); 30(c) (Prejudice to effective conduct of public affairs); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information).
Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedule 1 (The data protection principles, Part I: the principles) (the first data protection principle) and Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6).
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 9 August 2014, Mr Hutcheon made a request for information to Police Scotland. The request stated:
"Between January 1st 2014 and January 15th 2014, please provide me with all internal and external correspondence on a) the organisation of the Police Scotland stop and search event in Fife on January 15th this year, b) the timing of the Police Scotland stop and search event in Fife on January 15th this year."
2. Having received no substantive response to his request, Mr Hutcheon wrote to Police Scotland on 23 September 2014 and asked for a review.
3. Police Scotland notified Mr Hutcheon of the outcome of their review on 9 October 2014. It provided Mr Hutcheon with copies of some email correspondence, with a number of redactions under sections 38(1)(b) and 30(b)(ii) of FOISA.
4. On 4 November 2014, Mr Hutcheon wrote to the Commissioner. He applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr Hutcheon stated he was dissatisfied with the outcome of Police Scotland's review because he was unhappy with the partial response and wanted all of the information.
Investigation
5. The application was accepted as valid. The Commissioner confirmed that Mr Hutcheon made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.
6. On 11 November 2014, Police Scotland was notified in writing that Mr Hutcheon had made a valid application. It was asked to send the Commissioner a copy of the information withheld from Mr Hutcheon. Police Scotland provided the information and the case was allocated to an investigating officer.
7. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. Police Scotland were invited to comment on this application, with reference to the exemptions applied earlier.
8. Mr Hutcheon also provided submissions and pointed out that the earliest email in the redacted chain provided to him did not appear to be the first communication about the organisation of the Stop and Search press conference. He also provided arguments as to why he believed the withheld information should be disclosed, confirming that he did not require personal contact details.
9. Police Scotland subsequently disclosed to Mr Hutcheon two pieces of the redacted information from the initial email chain and also uncovered a further email chain falling within the scope of his request. Police Scotland stated that it wished to withhold the remaining redacted parts of the first email chain under section 38(1)(b) of FOISA and the redacted parts of the second email chain under sections 38(1)(b) and 30(c) of FOISA.
Commissioner's analysis and findings
10. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr Hutcheon and Police Scotland. She is satisfied that no matter of relevance has been overlooked.
Information held by Police Scotland
11. Section 1(1) of FOISA provides that a person who requests information from a Scottish public authority which holds it is entitled to be given that information by the authority. This is subject to qualifications which, by virtue of section 1(6) of FOISA, allow Scottish public authorities to withhold information or charge a fee for it. The qualifications contained in section 1(6) are not relevant in this case.
12. Police Scotland submitted that all relevant departments were contacted in order to determine whether information relevant to Mr Hutcheon's request was held. It listed the departments, and areas within departments, contacted. Police Scotland stated that the departments and areas contacted were those that were either involved in the planning of the event, or which were likely to have been involved in the event on the day. The process was undertaken at the original request and review stage, and was undertaken afresh as part of the appeal process, Police Scotland stated.
13. During the investigation, in response to further questions from the investigating officer, the local Police Commander arranged for further searches to be undertaken across relevant information storage systems. This focused on electronic systems, in order to locate any emails which might have been created earlier in the process of organising and planning the event.
14. Police Scotland confirmed searches included email and shared drive areas. It submitted that recorded exchanges were more likely to have been conducted electronically, i.e. by email, and therefore would have been held in this medium. Search terms used included "Re: Stop/Search", "stop search" and "Glenrothes" in order to identify relevant information.
15. As part of this process, the Commissioner notes, ICT staff were asked to assist in recovering any relevant emails which might have been deleted. As a result additional information relevant to the Mr Hutcheon's request was located (the second email chain).
16. Having considered all relevant submissions and the terms of the request, the Commissioner accepts that (by the close of the investigation) Police Scotland had taken adequate steps to identify and locate any relevant information it held. From the information located during the investigation, however, it is also clear that it failed to do this satisfactorily in responding to Mr Hutcheon's request and requirement for review.
17. Police Scotland also initially withheld two pieces of information from the first batch of emails, which it disclosed during the investigation. In failing to provide this information earlier, and in failing to locate the second email chain earlier, Police Scotland failed to comply fully with section 1(1) of FOISA in responding to this request.
18. As Mr Hutcheon has now received this information, the Commissioner does not require Police Scotland to take any further action in relation to this breach.
19. At the time of writing this decision, Mr Hutcheon had not received the unredacted information from the second email chain, although Police Scotland stated that they intended to disclose this information. In the absence of any exemptions being applied to this information, the Commissioner requires Police Scotland to disclose the information.
The information still being withheld
20. The remaining redacted information in the first email chain relates to members of the public involved in the Stop and Search event which formed the subject of Mr Hutcheon's request. This was withheld under section 38(1)(b) of FOISA.
21. The redacted parts of the second email chain consist of
(i) further information about those members of the public - withheld under section 38(1)(b) of FOISA, and
(ii) contact details for Police Scotland staff, officers and departments - withheld under section 30(c).
Mr Hutcheon has already confirmed he does not require personal contact details, such as phone numbers and addresses, so the Commissioner is not required to consider the application of section 30(c) or, in relation to such details, section 38(1)(b).
22. The Commissioner will therefore consider section 38(1)(b), insofar as it relates to the remainder of the information withheld under that exemption.
Section 38(1)(b) - Personal Information
23. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (2)(b) (as appropriate) exempts personal data if their disclosure to a member of the public, otherwise than under FOISA, would contravene any of the data protection principles.
24. Police Scotland submitted that the information was personal data for the purposes of the DPA and that its disclosure would contravene the first data protection principle. Therefore, it argued that the information was exempt under section 38(1)(b) of FOISA.
25. In considering the application of this exemption, the Commissioner will first consider whether the information in question is personal data as defined in section 1(1) of the DPA. If it is, she will go on to consider whether disclosure of the information would breach the first data protection principle as claimed.
26. This is an absolute exemption, which means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
Is the information under consideration personal data?
27. "Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller" (the full definition is set out in the Appendix).
28. The Commissioner has considered the submissions received from Police Scotland on this point, along with the withheld information. The information withheld under this exemption is information from which individual members of the public can be identified. It is information about their participation in this event and about their personal lives, and the Commissioner is satisfied that it relates to them. It is their personal data, as defined by section 1(1) of the DPA.
29. The Commissioner has gone on to consider whether the withheld information could be disclosed without breaching any of the data protection principles.
The first data protection principle
30. The first data protection principle states that personal data shall be processed fairly and lawfully. The processing in this case would be disclosure of the information into the public domain, in response to Mr Hutcheon's request. The first principle also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. In the case of sensitive personal data, as defined in section 2 of the DPA, at least one of the conditions in Schedule 3 to the DPA must also be met. The Commissioner considers some of the withheld information to be sensitive personal data, but will first consider whether there are any conditions in Schedule 2 which would permit the withheld personal data to be disclosed. If any of these conditions can be met, she must then consider whether the disclosure of the personal data would be fair and lawful.
31. There are three separate aspects to the first data protection principle:
(i) fairness,
(ii) lawfulness and
(iii) the conditions in the schedules.
These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.
Can any of the conditions in Schedule 2 be met?
32. In the circumstances, it appears to the Commissioner that condition 6 in Schedule 2 is the only one which might permit disclosure to Mr Hutcheon. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individual(s) to whom the data relate).
33. There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:
(i) Is Mr Hutcheon pursuing a legitimate interest or interests?
(ii) If yes, is the processing involved necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subject?
(iii) Even if the processing is necessary for Mr Hutcheon's legitimate interests, is that processing nevertheless unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?
34. There is no presumption in favour of the disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. Accordingly, the legitimate interests of Mr Hutcheon must outweigh the rights and freedoms or legitimate interests of the data subject before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the Police Scotland was correct to refuse to disclose the personal data to Mr Hutcheon.
Is the applicant pursuing a legitimate interest or interests?
35. The Commissioner notes that Mr Hutcheon asked for the information in his capacity as a journalist, with a view to writing a newspaper article on the subject. He has identified an interest in news management in relation to this event. Highlighting the involvement in the event of a particular individual, he also identified an interest in understanding Police Scotland's policy on involving victims of crime in such events.
36. In the circumstances, the Commissioner accepts that Mr Hutcheon is pursuing a legitimate interest in seeking the information he has requested, with a view to providing the kind of context he describes. The matters he has highlighted are of legitimate public concern. She does not accept that this extends to all of the withheld personal data as they relate largely to personal arrangements and circumstances with only a peripheral bearing on the Stop and Search event, or to other private individuals entirely (whose involvement has no relevance to the kinds of argument presented by Mr Hutcheon).
Is disclosure necessary for the purposes of these interests?
37. Police Scotland submitted that disclosure of the withheld personal data was not necessary to understand the planning and organisation of this event. Having considered Mr Hutcheon's arguments (above) carefully, the Commissioner agrees. In all the circumstances, she does not accept that disclosure of the remaining withheld personal data could be considered necessary for the purposes of Mr Hutcheon's legitimate interests. She does not consider these data to cast any useful additional light on either Police Scotland's news management in relation to the event or its policy on involving victims of crime in such events.
38. As the Commissioner does not find disclosure to be necessary (and, in relation to the remainder of the withheld personal data, does not find Mr Hutcheon to be pursuing a legitimate interest), she must find that condition 6 of Schedule 2 cannot be met in this case. In the absence of a condition permitting disclosure, she must find that disclosure to be unlawful. In all the circumstances, therefore, she finds that disclosure would breach the first data protection principle and that the information withheld under section 38(1)(b) of FOISA was properly withheld.
Decision
The Commissioner finds that the Chief Constable of the Police Service of Scotland (Police Scotland) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Hutcheon.
The Commissioner finds that by correctly withholding information under 38(1)(b) of FOISA, Police Scotland complied with Part 1 of FOISA.
However, by incorrectly withholding other information, failing to identify all of the information that fell within the scope of Mr Hutcheon's request and failing to disclose information to which no exemptions had been applied, Police Scotland failed to comply fully with section 1(1) of FOISA.
The Commissioner requires Police Scotland to disclose the unredacted information from the second email chain, by 14 May 2015.
|
Appeal
Should either Mr Hutcheon or Police Scotland wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Scottish Information Commissioner
27 March 2015
Enforcement
If Police Service of Scotland fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that Police Service of Scotland has failed to comply. The Court has the right to inquire into the matter and may deal with Police Service of Scotland as if it had committed a contempt of court.
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
?
(e) in subsection (1) of section 38 -
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
30 Prejudice to effective conduct of public affairs
Information is exempt information if its disclosure under this Act-
?
(c) would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
?
"personal data" means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 - The data protection principles
Part I - The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data
...
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
