Decision 042/2018: Mr Stephen Magee and Fife Council Critical Incident Reports and Serious Case Reviews Reference No: 201700645 Decision Date: 28 March 2018 Summary The Council was asked for copies of Critical Incident Reports and Serious Case Reviews undertaken in relation to its Social Work Department over a period of 10 years. The Council disclosed some information, but withheld the remainder under a number of exemptions in FOISA. The Commissioner found that the Council had correctly withheld one report and some personal data from other reports. However, he also found that the Council was not entitled to withhold other information, which he required the Council to disclose, and identified shortcomings in the refusal notice given to Mr Magee.

  Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1), (2)(c) and (2)(e)(ii) (Effect of exemptions); 16(1)(d) and (3) (Refusal of request); 30(c) (Prejudice to effective conduct of public affairs); 35(1)(a) and (b) (Law enforcement); 36(2) (Confidentiality); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definition of "the data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of personal data); 2(e) and (g) (Sensitive personal data); Schedules 1 (The data protection principles) (the first data protection principle) and 3 (Conditions relevant for the purposes of the first principle: processing of sensitive personal data) (conditions 1 and 5)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

  Background

1. On 19 January 2017, Mr Magee (of the BBC) made a request for information to Fife Council (the Council) in the following terms:

"I would like copies of all Critical Incident Reports and Serious Case Reviews [SCRs] undertaken about cases involving Fife Social Work Department over the last ten years. I appreciate reports will be redacted and/or drafted to avoid the release of personal information."

2. The Council responded on 7 February 2017 and provided links to where two SCRs had been published already. The Council also cited section 36(2) of FOISA (Confidentiality) in relation to any remaining information

3. On 8 February 2017, Mr Magee wrote to the Council requesting a review of its decision. He accepted that two of the SCRs were in the public domain, but was of the view that the other information held could be disclosed in the form of anonymised summaries.

4. The Council notified Mr Magee of the outcome of its review on 29 March 2017. It advised him that it held three other SCRs and that one of these was being withheld in its entirety under section 35(1) of FOISA (Law enforcement). The Council disclosed parts of the other two SCRs, but withheld the remainder of the information in them under the exemptions in sections 36(2) (Confidentiality), 38(1)(b) (Personal information) and 30(c) (Prejudice to effective conduct of public affairs) of FOISA.

5. On 4 April 2017, Mr Magee wrote to the Commissioner. Mr Magee applied to the Commissioner for a decision in terms of section 47(1) of FOISA. He was dissatisfied with the outcome of the Council's review because he believed that (i) further information should be disclosed to him from two of the SCRs, to allow them to be understood more fully, and (ii) further explanation was required from the Council as to the degree of prejudice that would be caused by disclosure of the third.

  Investigation

6. The application was accepted as valid. The Commissioner confirmed that Mr Magee made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

7. On 30 May 2017, the Council was notified in writing that Mr Magee had made a valid application. It was asked to send the Commissioner the information withheld from Mr Magee. The Council provided the information and the case was allocated to an investigating officer.

8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and to answer specific questions, focusing on the exemptions claimed in the review outcome.

9. The Council provided its submissions in relation to these exemptions, and also in relation to section 26(a) (Prohibitions on disclosure) of FOISA (which it stated it would wish to rely on if the 35(1) exemptions were not upheld).

10. Mr Magee was also asked for his submissions as to why he believed it was in the public interest for the information to be disclosed and he, too, provided the Commissioner with submissions.

11. During the investigation, the Council also provided the investigating officer with comments from Police Scotland in relation to the SCR withheld in its entirety.

  Commissioner's analysis and findings

12. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both Mr Magee and the Council. He is satisfied that no matter of relevance has been overlooked.

Background to SCRs

13. The Council provided a background to the SCR process, explaining that:

"A Significant Case Review (SCR) is a nationally recognised multi-agency process for establishing the facts of a situation where a child has died or been significantly harmed.

Partners working in child protection across Scotland regularly use SCRs to learn lessons and improve services. SCRs involve partners who work together to protect children including council services, police and health. An independent reviewer is appointed to lead a rigorous, impartial review of all the processes and circumstances involved in each case. They speak with staff and may have access to all files. The SCR is arranged by the Child Protection Committee in Fife. The final SCR is presented to the Fife Chief Officers' Group with representatives from Police Scotland; Fife Council; NHS Fife and Fife Child Protection Committee and the Group determine the extent to which information is published."

14. As noted earlier, the Council redacted some of the information from two SCRs and withheld the third in its entirety. The Commissioner will firstly consider the Council's application of section 35(1) of FOISA to one of the SCRs in its entirety.

Section 35(1)(a) and (b) - Law enforcement

15. In order for an exemption under section 35(1)(a) and/or (b) to apply, the Commissioner has to be satisfied that disclosure of the information would, or would be likely to, prejudice substantially the prevention or detection of crime (section 35(1)(a)) and/or the apprehension or prosecution of offenders (section 35(1)(b)).

16. There is no definition of "substantial prejudice" in FOISA, but the Commissioner considers the authority would have to identify harm of real and demonstrable significance. The harm would also have to be at least likely, and therefore more than simply a remote possibility.

17. The exemptions in section 35 are subject to the public interest test contained in section 2(1)(b) of FOISA.

18. As the Commissioner's guidance[1] on section 35(1)(a) highlights, the term "prevention or detection of crime" is wide ranging, encompassing any action taken to anticipate and prevent crime, or to establish the identity and secure prosecution of persons suspected of being responsible for crime. This could mean activities in relation to a specific (anticipated) crime or wider strategies for crime reduction and detection.

19. In relation to section 35(1)(b), the Commissioner's guidance states that there is likely to be a considerable overlap between information relating to "the apprehension or prosecution of offenders" and that relating to "the prevention or detection of crime". He considers section 35(1)(b) relates to all aspects of the process of identifying, arresting or prosecuting those suspected of being responsible for criminal activity. Again, this term could refer to the apprehension or prosecution of specific offenders or to more general techniques (such as the investigative processes used).

20. As noted above, in its response to Mr Magee's review requirement, the Council was not clear as to the reasons why it felt section 35(1)(b) of FOISA should apply in this case. The Commissioner asked the Council for submissions on why it believed section 35 of FOISA applied.

21. The Council explained that it had contacted Police Scotland during the internal review process. Police Scotland advised the Council that they had spoken to the Procurator Fiscal (PF) upon receipt of the Council's enquiry and the PF had confirmed that this case was still subject to ongoing criminal proceedings and that any disclosure of the information contained within the withheld SCR would substantially prejudice these proceedings.

22. When the Council was notified that Mr Magee had made an application to the Commissioner, the Council contacted Police Scotland for an update. Police Scotland advised the Council that the position had not changed. The Council explained that there was a police contact who was responsible for the one to one dialogue with the PF in respect of SCR updates, including this particular case. The Council received confirmation from Police Scotland that legal proceedings were still ongoing in relation to this matter.

23. The Council therefore concluded that the SCR should be exempt from disclosure in terms of section 35(1)(a), as disclosure would, or would be likely to, prejudice substantially the prevention or detection of crime, and section 35(1)(b), as disclosure would, or would be likely to, prejudice substantially the apprehension or prosecution of offenders.

24. The Commissioner has considered carefully the arguments presented to him. Having done so, he is satisfied that the information contained in the relevant SCR could be considered to be held for purposes relating to the prevention or detection of crime and/or the apprehension or prosecution of offenders. On the basis of the arguments presented, he is also satisfied that disclosure of this information would carry with it sufficient risk of the required substantial prejudice for the exemptions claimed to apply.

25. The Commissioner accepts, therefore, that the Council was entitled to respond to Mr Magee's request by applying the exemptions in section 35(1)(a) and (b) of FOISA to the information.

The public interest

 Submissions from the Council

26. The Council acknowledged that there was a general public interest in transparency in the conduct of public affairs and a substantial public interest in ensuring the Council was fulfilling its functions effectively, especially in the context where it was responsible for assisting vulnerable people. However, the Council maintained that it was contrary to the public interest for an investigation of this type to be prejudiced as a result of the release of the information and evidence prior to the conclusion of the investigation. For these reasons, the Council concluded that the public interest favoured withholding the information.

27. A communication from Police Scotland also pointed out that the PF had stipulated that the SCR could not be disclosed until legal proceedings against certain parties had been concluded.

 Submissions from Mr Magee

28. Mr Magee stated there were inconsistencies in the way SCRs were undertaken across Scotland. With this in mind, he considered it was important that there was transparency and openness, so the public and other professionals could be assured proper checks and balances were in place.

29. Mr Magee went on to submit that the Council's own published objectives for SCRs included a number of points: to promote learning; ensure accountability; increase public confidence, and to identify national issues and good practice. He also highlighted the reference in the Scottish Government's guidance to SCRs being a learning process, to help better protect children in Scotland in the future, and believed disclosure of the information would address all these objectives.

 The Commissioner's conclusions

30. The Commissioner accepts that there is a clear public interest in understanding how SCRs are carried out, so the public can be assured that the process is working consistently across Scotland and that lessons in relation to good practice are being drawn out. Disclosure of information from this report would go a way towards satisfying these aims.

31. However, the Commissioner is also satisfied (as discussed above) that the likely effect of disclosing the information contained in this report would be to undermine an ongoing police investigation. Given the substantial harm he has already acknowledged, and having taken into account the public interest arguments from both parties, the Commissioner finds that the balance of the public interest falls in favour of maintaining the exemption. He therefore finds that the Council correctly withheld this information under section 35(1)(a) and (b) of FOISA.

32. In the light of this finding, the Commissioner is not required to go on to consider whether this information would also be exempt from disclosure under section 26(a) of FOISA, as claimed by the Council.

Section 16 of FOISA - Refusal of request

33. In relation to the SCR withheld under section 35 of FOISA, Mr Magee submitted that he had expected the Council to provide more by way of explanation for applying the exemption.

34. Section 16(1)(d) of FOISA states that where a public authority is applying an exemption, the refusal notice it gives the applicant must state why it believes the exemption applies, if that is not otherwise apparent. Section 16(3) provides a limited derogation from this requirement, but only insofar as giving the statement would disclose information which would itself be exempt information.

35. In its review outcome of 29 March 2017, the point at which it first applied the exemptions in section 35, the Council addressed the public interest briefly, but did not explain why it believed these exemptions applied. It simply restated the exemptions in question.

36. The Commissioner considers the Council should have provided Mr Magee with an explanation of why it believed these exemptions applied, as required by section 16(1)(d) of FOISA. The Commissioner cannot disclose exempt information in a decision yet has still been able to provide the analysis set out above in relation to the section 35 exemptions, including adequate explanation from the Council (provided during the investigation) as to why it considered these exemptions applicable. That explanation could have been given to Mr Magee in the Council's review outcome, without disclosing exempt information.

37. The Commissioner therefore finds that the Council failed to comply with Part 1 of FOISA in responding to the review request made by Mr Magee. The Council failed to give Mr Magee a notice, meeting the requirements of section 16(1)(d) of FOISA, stating why it considered the exemptions in section 35(1)(a) and (b) of FOISA to apply to the SCR in question.

The redacted SCRs

38. In respect of the other two SCRs, the Council withheld complete sections of the reports and made smaller redactions in other areas, on the basis that section 38(1)(b) (read in conjunction with section 38(2)(a)(i)) of FOISA applied. The Council also sought to rely on section 30(c) and 36(2) of FOISA for these reports. Its reliance on section 38(1)(b) will be considered first.

Section 38(1)(b) of FOISA - Personal data

39. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (2)(b) (as appropriate), exempts personal data if their disclosure to a member of the public, otherwise than under FOISA, would contravene any of the data protection principles.

40. In considering the application of this exemption, the Commissioner will first consider whether the information in question is personal data as defined in section 1(1) of the DPA. If it is, he will go on to consider whether disclosure of the information would breach the first data protection principle (as claimed by the Council in this case). This particular exemption is an absolute exemption, which means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

Is the information under consideration personal data?

41. "Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller" (the full definition is set out in Appendix 1).

42. The Council submitted the withheld information largely focused on individuals and family members, details relating to them, their lives and their interaction with various agencies. While no personal names were included, the Council submitted that parts of the information were the sensitive personal data of living individuals who, given the content of the SCRs along with the geography and population of the region, would be identifiable by its disclosure.

43. If service users could be identified from the reports, it followed that service users' relatives or representatives could also be identified.

44. However, the Commissioner takes the view that not all of the information withheld under this exemption comprises personal data. She is satisfied that some of the information relates to identifiable individuals. The information is clearly about the individuals concerned, is linked to them and has some biographical significance for them. It is therefore the individuals' personal data.

45. Other information, however, focuses on Council practice, discussions, findings, recommendations and other information from which it is not possible to identify (and which could not be said to relate to) individuals.

46. The Commissioner must therefore find that section 38(1)(b) of FOISA does not apply to the latter information. Later in this decision he will go on to consider the Council's application of the exemptions in sections 30(c) and/or 36(2) of FOISA to this information.

47. The Commissioner will now go on to look at the Council's further submissions under section 38(1)(b) of FOISA for the information that he has accepted is personal data.

Would disclosure contravene the first data protection principle?

48. Personal data is not exempt from disclosure under FOISA simply because it is personal data. It will, however, be exempt from disclosure, in line with section 38(1)(b) of FOISA (as read with section 38(2)(a)(i) or (b)) if disclosure to a member of the public, otherwise than under FOISA, would contravene one or more of the data protection principles.

49. The first data protection principle (applied by the Council in this case) states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 (to the DPA) is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 (also to the DPA) is met.

Sensitive personal data

50. The definition of sensitive personal data is set out in section 2 of the DPA. In terms of section 2(e), personal data consisting of information as to a data subject's physical or mental health or condition is sensitive personal data. In terms of section 2(g), personal data consisting of the commission or alleged commission by individuals of any offence is also sensitive personal data.

51. It is clear that some of the information relating to social work service users and their families is sensitive personal data. The reports also include some references to the health or physical condition of other individuals and also police involvement with some of the families for various reasons.

52. For sensitive personal data to be disclosed under FOISA, at least one of the conditions in both Schedule 2 and Schedule 3 to the DPA must be capable of being fulfilled. Given that the conditions in Schedule 3 are, intentionally, much more stringent than those in Schedule 2, the Commissioner considers it appropriate to look at these first.

53. Guidance[2] issued by the Commissioner regarding the exemption in section 38(1)(b) notes that, in most cases, only the first and fifth conditions listed in Schedule 3 are likely to be relevant when considering a request for sensitive personal data under FOISA. Condition 1 would allow personal data to be disclosed where the data subject has given explicit (i.e. fully informed and freely given) consent to their disclosure. Condition 5 would allow personal data to be disclosed if the data had been made public as a result of steps deliberately taken by the data subject.

54. The Commissioner has not received any evidence to show that individuals were asked to consent to the processing of their sensitive personal data, nor that any steps were taken by the data subjects to make the information public. He is satisfied, given the context of the reports, that it would not have been appropriate for such consent to have been sought.

55. Having considered the remaining conditions in Schedule 3, the Commissioner has concluded that there are no conditions in the Schedule which would permit the sensitive personal data to be disclosed. As such, given the requirement to find a condition in both Schedules 2 and 3, he finds that disclosure of the sensitive personal data would breach the first data protection principle and that the sensitive personal data is accordingly exempt from disclosure under section 38(1)(b) of FOISA.

Non-sensitive personal data

56. To the extent that the withheld personal data are not sensitive personal data, the Commissioner needs to be satisfied that a Schedule 2 condition can be met before concluding that disclosure would be consistent with the first data protection principle. He also needs to be satisfied that disclosure would otherwise be fair and lawful.

Can any of the conditions in Schedule 2 be met?

57. When considering the conditions in Schedule 2, the Commissioner has noted Lord Hope's comment in the case of Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[3], that the conditions required careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interest of the data subject (i.e. the person or persons to whom the data relate).

58. The Commissioner is of the view that the only condition in Schedule 2 which might be relevant is Condition 6. No other condition has been suggested to him as being of potential application in this case. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects.

59. There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:

(i) Does Mr Magee have a legitimate interest in obtaining the personal data?

(ii) If so, is the disclosure necessary to achieve that legitimate interest? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could the interest be achieved by means which interfere less with the privacy of the data subjects (i.e. the individuals to whom the data relate)?

(iii) Even if the processing is necessary for the legitimate interest of Mr Magee, would the disclosure nonetheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?

60. There is no presumption in favour of the release of personal data under the general obligations laid down by section 1(1) of FOISA. Accordingly, the legitimate interests of Mr Magee must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit disclosure. If the two are evenly balanced, the Commissioner must find that the Council was correct to refuse to disclose the personal data to Mr Magee.

Does Mr Magee have a legitimate interest in obtaining the personal data?

61. There is no definition within the DPA of what constitutes a "legitimate interest", but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. The Commissioner's published guidance states:

"In some cases, the legitimate interest might be personal to the applicant - e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety."

62. Mr Magee explained to the Commissioner that he was a BBC producer and that a BBC Scotland Investigates documentary (for which he was responsible) had spent significant time over the last year investigating social work involvement in serious incidents involving children, in particular in Fife. During the Commissioner's investigation, Mr Magee produced a one-hour documentary broadcast on BBC1 Scotland, which he stated raised significant new evidence about cases involving children. The BBC team had also followed up with news coverage revealing new information after the documentary. He was of the view that SCRs had proved extremely important to this process and he was seeking these reports as part of the ongoing investigation.

63. Mr Magee went on to explain that, in 2012, a survey undertaken by the Scottish Government found that there were inconsistencies across local authority areas in how SCRs were being undertaken. He stated that public money pays for the investigations and also pays for social services. He believed it was therefore important that there was transparency and openness so that the public and other professionals can be assured proper checks and balances had taken place.

64. The Commissioner considers that Mr Magee has demonstrated a strong legitimate interest in understanding the circumstances surrounding serious adverse events in which the safety or care of social work service users was, or could have been, compromised. The reviews of such events may well highlight strengths and weaknesses in systems, training or resources, and help ensure that people can learn from what has gone wrong.

65. Additionally, for similar reasons, the Commissioner is satisfied that the general public has a legitimate interest in obtaining information which would allow scrutiny and understanding of each significant case review and the way in which the agencies involved responded, including the steps they took to address any identified failings.

Is disclosure of the information necessary for the purposes of these legitimate interests?

66. Having established that Mr Magee does have a legitimate interest in the information, the Commissioner must now consider whether its disclosure is necessary for the purposes of that legitimate interest.

67. The Council submitted that as the recommendations in each of the SCRs had been disclosed to Mr Magee, this should satisfy his legitimate interest.

68. The Commissioner considers Mr Magee's (and the public's) legitimate interest extends to the fullest possible understanding of the incidents described in the reports, the lessons learned and the steps taken afterwards. He cannot identify any viable means of fully meeting those legitimate interests which would interfere less with the privacy of the data subjects than providing the withheld personal data. For this reason, the Commissioner is satisfied that disclosure of the information is necessary for the purposes of Mr Magee's legitimate interests.

Would disclosure be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?

69. The Commissioner must now consider whether the processing is unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects. This test involves a balancing exercise between the legitimate interests of Mr Magee and those of the data subjects. Only if the legitimate interests of Mr Magee outweigh those of the data subjects can the information be made available without breaching the first data protection principle.

70. In the Commissioner's guidance, he notes a number of factors which should be taken into account in carrying out the balancing exercise. These include:

(i) whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)

(ii) the potential harm or distress that may be caused by the disclosure

(iii) whether the individual objected to the disclosure

(iv) the reasonable expectations of the individuals as to whether the information should be disclosed.

71. The Council submitted that releasing this information into the public domain would be both harmful and distressing to the data subjects and their families. Disclosure would result in extensive identifiable personal information being placed in the public domain about vulnerable individuals. The Council stated that there was no publicity around these cases at the time and therefore no expectation that this level of information (given in confidence to the relevant authorities) would be made publicly available.

72. The Commissioner accepts that disclosure of the information would be likely to cause distress to the data subjects, who would have a reasonable expectation of privacy that personal data relating to their involvement in social work service provision (in this context) would not be disclosed under FOISA.

73. The data subjects have not been given the opportunity to consent or object to disclosure of their personal data, and the Commissioner has accepted that this was appropriate, in the circumstances of this case.

74. The Commissioner has considered whether there is a general expectation that some or all of the information from an SCR Report would be made public. He has taken account of the statutory guidance for conducting a significant case review "National Guidance for Child Protection Committees for Conducting a Significant Case Review" (Scottish Government, 2015)[4].

75. He notes that the Protocol in Annex 9 of this guidance states:

"The learning obtained from an SCR is largely dependent on the willingness of individual professionals and family members to engage in the process. They need to have confidence that any information they give will be treated with respect, and they should be made aware if it could be used for any purpose other than that for which it was intended."

76. The Commissioner must consider what expectation the data subjects might reasonably have regarding disclosure of information from the SCR Report, in view of the guidance described above. In considering whether the information is exempt from disclosure under section 38(1)(b) of FOISA, the Commissioner can only consider the data subjects' expectations regarding disclosure to the public at large, (bearing in mind that this is what disclosure under FOISA amounts to).

77. Having regard to the guidance under which the SCR was conducted, the Commissioner is satisfied that the data subjects would not have any reasonable expectation that their personal data would be publicly disclosed in the context of Mr Magee's information request.

78. On balance, therefore, while the Commissioner accepts that disclosure of the withheld information would be necessary to fulfil Mr Magee's legitimate interests, in this instance he does not agree that this outweighs the prejudice that would be caused by disclosure to the data subjects' rights and freedoms or legitimate interests. Consequently, he finds that such prejudice would be unwarranted. The Commissioner is therefore satisfied that condition 6 of Schedule 2 to the DPA Is not met in this case.

79. Having concluded that disclosure of the withheld information would lead to unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects, the Commissioner must also conclude that disclosure would be unfair. In the absence of a condition permitting disclosure, he would also regard disclosure as unlawful. In all the circumstances, therefore, he finds that disclosure would breach the first data protection principle and that the information was properly withheld under section 38(1)(b) of FOISA.

80. The Commissioner will now go on to consider the Council's application of sections 36(2) and 30(c) of FOISA, in respect of the information in the reports for which he has not found section 38(1)(b) of FOISA to apply.

Section 36(2) of FOISA - Confidentiality

81. The exemption in section 36(2) (which is set out in full in the Appendix) contains two tests, both which must be met before it can be relied upon. The first is that the information must have been obtained by a Scottish public authority from another person. "Person" is defined widely and means another individual, another Scottish public authority or any other legal entity, such as a company or partnership.

Was the information obtained by a Scottish public authority from another person?

82. The Council submitted that SCRs involve partners who work together to protect children, including council services, police and health. The Council stated that an independent reviewer is appointed to lead an impartial review of all the processes and circumstances involved in each SRC case and the reviewer is authorised to speak with staff and access to all files, including the Council's own files.

83. The Council submitted that the information regarding their personal circumstances had been provided by service users to social workers.

84. The Commissioner accepts that a lot of the information in the reports is information provided by service users, but he has already found this information to be exempt from disclosure under section 38(1)(b) of FOISA.

85. The remaining information which is being considered under section 36(2) of FOISA relates to Council practice, discussions, findings, recommendations and other information, from which it is not possible to identify individuals. This information has been created and put together by the Fife Child Protection Committee and is not information which has been given to social workers by service users.

86. Based on the information available to him, the Commissioner is not satisfied that the first part of the two-stage test can be met to justify the withholding of the information in terms of section 36(2) of FOISA. The information would not appear to have been obtained by the Council from another person.

87. Consequently, the Commissioner can only conclude that the Council was not entitled to rely upon section 36(2) of FOISA in withholding the information, other than personal data he has already found to be exempt under section 38(1)(b) of FOISA.

88. The Commissioner will now go on to consider the Council's application of section 30(c) of FOISA.

Section 30(c) of FOISA - Prejudice to the effective conduct of public affairs

89. Section 30(c) of FOISA exempts information if its disclosure "would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs". The use of the word "otherwise" distinguishes the harm required from that envisaged by the exemptions in section 30(a) and (b). This is a broad exemption and the Commissioner expects any public authority citing it to show what specific harm would (or would be likely to) be caused to the conduct of public affairs by disclosure of the information, and how that harm would be expected to follow from disclosure. This exemption is subject to the public interest test in section 2(1)(b) of FOISA.

90. In order for the exemption in section 30(c) to be upheld, the prejudice caused by disclosure must be substantial, in other words of real and demonstrable significance. The Commissioner expects authorities to demonstrate a real risk or likelihood of substantial prejudice at some time in the near (certainly foreseeable) future, and not just show that such prejudice is a remote or hypothetical possibility. Each request should be considered on a case-by-case basis, taking into consideration the content of the information and all other relevant circumstances.

91. This exemption is subject to the public interest test in section 2(1)(b) of FOISA.

Submissions from the Council

92. In its submissions in support of the application of section 30(c) of FOISA, the Council stated that the Fife Chief Officers Group asked for "reassurance that information was shared with the right people at the right time and with the right detail". The Council stated that the recommendations from the two reports had been disclosed and argued that disclosure of additional information would prejudice substantially the conduct of public affairs because service users would be reluctant to engage with the service if they feared their personal situation would be made public.

93. The Council submitted that this would adversely affect its ability to deliver its service, stating that it could not execute its primary duty of protecting vulnerable individuals in society if they did not trust the service enough to share vital information.

94. The Commissioner understands how the above submissions from the Council might apply to information which could identify the service users. However, the information under consideration here is information from which the Commissioner is satisfied that there is no such risk.

95. In the light of this, the arguments from the Council do not hold up. The Council has not provided any alternative reasons as to why the effective conduct of public affairs would be substantially prejudiced by disclosure of this information.

96. Therefore, the Commissioner does not accept that the Council correct to withhold this information under the exemption in section 30(c) of FOISA.

97. Given that the Commissioner does not accept that section 30(c) applies, he is not required to consider the public interest test in section 2(1)(b) of FOISA.

Decision The Commissioner finds that Fife Council partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Magee. The Commissioner finds that by withholding some information from two Serious Case Reviews (SCRs) as personal data under section 38(1)(b) of FOISA, and by withholding one of the reports in its entirety under section 35(1) of FOISA, the Council complied with Part 1. However, the Council was not entitled to withhold other information under sections 30(c), 36(2) and 38(1)(b) of FOISA and the refusal notice issued in response to Mr Magee's request did not comply with section 16(1)(d) of FOISA. In these respects, the Council failed to comply with Part 1of FOISA. The Commissioner therefore requires the Council to disclose the incorrectly withheld information, by 12 May 2018. The Commissioner will provide the Council with marked up copies of the two SCRs, indicating what information is to be disclosed to Mr Magee.

 Appeal

Should either Mr Magee or Fife Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

 Enforcement

If Fife Council (the Council) fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Council has failed to comply. The Court has the right to inquire into the matter and may deal with the Council as if it had committed a contempt of court.

Margaret Keyse
Head of Enforcement

28 March 2018

 Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

 

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

…

(c) section 36(2);

…

(e) in subsection (1) of section 38 -

…

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

16 Refusal of request

(1) Subject to section 18, a Scottish public authority which, in relation to a request for information which it holds, to any extent claims that, by virtue of any provision of Part 2, the information is exempt information must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant a notice in writing (in this Act referred to as a "refusal notice") which-

…

(d) states (if not otherwise apparent) why the exemption applies.

…

(3) The authority is not obliged to make a statement under subsection (1)(d) in so far as the statement would disclose information which would itself be exempt information.

30 Prejudice to effective conduct of public affairs

Information is exempt information if its disclosure under this Act-

…

(c) would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.

 

35 Law enforcement

(1) Information is exempt information if its disclosure under this Act would, or would be likely to, prejudice substantially-

(a) the prevention or detection of crime;

(b) the apprehension or prosecution of offenders;

…

36 Confidentiality

…

(2) Information is exempt information if-

(a) it was obtained by a Scottish public authority from another person (including another such authority); and

(b) its disclosure by the authority so obtaining it to the public (otherwise than under this Act) would constitute a breach of confidence actionable by that person or any other person.

38 Personal information

(1) Information is exempt information if it constitutes-

…

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

…

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

…

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

…

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

…

…

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

…

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

…

2 Sensitive personal data

In this Act "sensitive personal data" means personal data consisting of information as to-

…

(e) his physical or mental health or condition,

…

(g) the commission or alleged commission by him of any offence, or

…

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

…

Schedule 3 - Conditions relevant for purposes of the first principle: processing of sensitive personal data

1. The data subject has given his explicit consent to the processing of the personal data.

…

5. The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.

---