|
Decision 054/2010 Ms D and the Chief Constable of Strathclyde Police
Investigation report
Reference No: 200901839
Decision Date: 30 March 2010 |
Summary
Ms D requested from the Chief Constable of Strathclyde Police (Strathclyde Police) a copy of an investigation report conducted by Strathclyde Police into a complaint made by her against named police officers. Strathclyde Police withheld the report on the basis that it was exempt from disclosure under the Freedom of Information (Scotland) Act 2002 (FOISA). Following a review, Ms D remained dissatisfied and applied to the Commissioner for a decision.
Following an investigation, the Commissioner found that Strathclyde Police had dealt with Ms D's request for information in accordance with Part 1 of FOISA by correctly applying the exemptions contained in section 38(1)(a) and 38(1)(b) of FOISA to all of the withheld information.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and 2(e) (Effect of exemptions) and 38(1)(a), (b) and (2)(a)(i) and (b) (Personal information)
Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles) (the first principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (Condition 6(1))
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Background
1.On 3 August 2009, Ms D wrote to Strathclyde Police requesting a copy of a report (along with associated papers) regarding an investigation carried out by Strathclyde Police. This concerned complaints made by Ms D against named police officers.
2.Strathclyde Police responded on 31 August 2009, advising Ms D that they considered the information exempt from disclosure in terms of sections 35(1)(g), 38(1)(a) and 38(1)(b) of FOISA.
3.On 16 September 2009, Ms D wrote to Strathclyde Police requesting a review of their decision. In particular, Ms D considered there would be information contained within the report to which she was entitled.
4.Strathclyde Police notified Ms D of the outcome of their review on 9 October 2009. A number of documents were released to Ms D. However, in relation to the remainder of the report, Strathclyde Police upheld their earlier decision that the information was exempt from disclosure under the exemptions previously cited.
5.On 20 October 2009, Ms D wrote to the Commissioner, stating that she was dissatisfied with the outcome of Strathclyde Police's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
6.The application was validated by establishing that Ms D had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
7.On 13 November 2009, Strathclyde Police were notified in writing that an application had been received from Ms D and were asked to provide the Commissioner with any information withheld from her. Strathclyde Police responded with the information requested and the case was then allocated to an investigating officer.
8.The investigating officer subsequently contacted Strathclyde Police, giving them an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking them to respond to specific questions. In particular, Strathclyde Police were asked to justify their reliance on any provisions of FOISA they considered applicable to the information requested.
9.Strathclyde Police responded on 27 January 2010 providing submissions on their application of the exemptions in sections 35(1)(g), 38(1)(a) and 38(1)(b) of FOISA.
10.Ms D was also invited to provide comments on the case and, in particular, to set out her views on why she believed the information should be disclosed under FOISA. These are summarised and considered (along with Strathclyde Police's submissions) in the Commissioner's analysis and findings section below.
Commissioner's analysis and findings
11.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Ms D and Strathclyde Police and is satisfied that no matter of relevance has been overlooked.
Section 38(1)(a) of FOISA ? personal information of the applicant
12.Section 38(1)(a) of FOISA contains an absolute exemption in relation to personal data of which the applicant is the data subject.This exemption exists under FOISA because individuals have a separate right make a request for their own personal data (commonly known as a subject access request) under section 7 of the DPA.The DPA will usually determine whether a person has a right to information about themselves.Therefore, the effect of the exemption in section 38(1)(a) of FOISA is not to deny individuals a right of access to information about themselves, but to ensure that the right is exercised under the DPA and not under FOISA.
13.Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).
14.Strathclyde Police submitted that all of the withheld information (which comprised a misconduct report and supporting evidence) had as its focus the allegations of Ms D, the actions of the named police officers and the historical interaction between these parties.Strathclyde Police contended that all of the withheld documents comprised information which related to Ms D and from which she could be identified.As a result, they applied the exemption in section 38(1)(a) to the withheld information in its entirety.
15.The Commissioner is aware that Ms D has sought (and received) information relating to this case using her subject access rights under the DPA. Although some information has been provided to Ms D under the DPA, the information under consideration in this case must be evaluated solely in terms of the requirements of FOISA.
16.Having examined the documents in question, the Commissioner is satisfied that they contain a significant amount of personal information about Ms D from which she can be identified, which relates to her in a significant sense, and is biographical in nature in that it reflects her personal and work circumstances at the time of the investigation.
17.The Commissioner is therefore satisfied that Strathclyde Police were correct in their application of this exemption to the personal data of Ms D and that this information is exempt from disclosure in terms of section 38(1)(a) of FOISA.
18.As the exemption in section 38(1)(a) is absolute, the Commissioner is not required to go on to consider the public interest test in section 2(1)(b) of FOISA.
Section 38(1)(b) of FOISA ? personal information of other individuals
19.The exemption in section 38(1)(b), read in conjunction with section 38(2)(a)(i) (or, where appropriate, section 38(2)(b)) exempts information from disclosure if it is "personal data" as defined by section 1(1) of the DPA, and its disclosure to a member of the public otherwise than under FOISA would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.This exemption is absolute in that it is not subject to the public interest test laid down by section 2(1)(b) of FOISA.
20.In order for a public authority to rely on this exemption, it must show firstly that the information which has been requested is personal data for the purposes of the DPA, and secondly that disclosure of the information would contravene at least one of the data protection principles laid down in the DPA.
21.Strathclyde Police have applied this exemption to all of the information within the report which comprises the personal data of individuals other than Ms D who contributed to the report, predominantly through the provision of witness statements.
Is the information personal data?
22.As noted above, "personal data" is defined in section 1(1) of the DPA which is reproduced in the Appendix to this decision.
23.Having considered the withheld information, the Commissioner accepts that it contains the personal data of a number of living individuals, including the police officers against whom Ms D made complaints, and other individuals who provided witness statements in the course of the investigation of her complaints.A significant amount of information contained in the report and associated documents relates to these individuals, who can be identified from the information (alone or in conjunction with other information held by Strathclyde Police.)
Would disclosure of the information breach the first data protection principle?
24.Strathclyde Police argued that disclosure of the personal data of third parties contained in the report would contravene the first data protection principle in the DPA, which states that information shall be processed fairly and lawfully, and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 of the DPA is met, and in the case of sensitive personal data, at least one of the conditions in Schedule 3 of the DPA is also met. The Commissioner has considered the definition of sensitive personal data set out in section 2 of the DPA and, he is satisfied that the personal data of third parties under consideration in this case does not fall into this category. Therefore, it is not necessary to consider the conditions in Schedule 3 of the DPA in this particular case.
25.There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. However, these three aspects are inter-linked. If there is a specific condition which permits the personal data to be disclosed, it is likely that the disclosure will be fair and lawful.
26.The Commissioner will now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed. If any of these conditions can be met, he must then consider whether the disclosure of the third parties' personal data would be fair and lawful.
Can any of the conditions in schedule 2 of the DPA be met?
27.The Commissioner considers that only condition 6(1) of Schedule 2 to the DPA might be considered to apply in this case.Condition 6(1) allows personal data to be processed (in this case, disclosed into the public domain in response to Ms D's information request) if disclosure of the data is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
28.Strathclyde Police submitted that condition 6 could not be fulfilled in this case. They argued that, although Ms D may have a personal interest which may be legitimised through due legal process, they did not see how disclosure of the information would add to the legitimacy of her complaints.
29.There are a number of different tests which must be satisfied before condition 6 can be met. These are:
a.Does Ms D have a legitimate interest in obtaining the personal data?
b.If yes, is the disclosure necessary to achieve these legitimate aims?In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subjects in question?
c.Even if the processing is necessary for Ms D's legitimate purposes, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects? There is no presumption in favour of the release of personal data under the general obligation laid down by FOISA.Accordingly, the legitimate interests of Ms D must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed.If the two are evenly balanced, the Commissioner must find that Strathclyde Police were correct to refuse to disclose the personal data to Ms D.
Is there a legitimate interest?
30.In her submissions to the Commissioner, Ms D contended that she had a legitimate interest in obtaining the information for a number of personal reasons (these were explained to the Commissioner) and to enable her to identify whether any malpractice had occurred. The Commissioner has noted all of Ms D's reasons for requiring the information and her personal involvement in the matters she is concerned about and in all the circumstances, is satisfied that she has a legitimate interest in obtaining the withheld personal data.
Is disclosure of the information necessary to achieve those legitimate interests?
31.The Commissioner must next consider whether disclosure is necessary for those legitimate interests. In this case, the Commissioner has concluded, taking into account the personal reasons referred to by Ms D, that it is and that Ms D's interests could not be met through any means other than by access to the information contained within the report.
Would disclosure cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?
32.The Commissioner must now consider whether disclosure would nevertheless cause unwarranted prejudice to the rights, freedoms and legitimate interests of the data subjects. As noted above, this involves a balancing exercise between the legitimate interests of Ms D and the individuals in question. Only if the legitimate interests of Ms D outweigh those of the individuals in question can the information be disclosed without breaching the first data protection principle.
33.In her submissions, Ms D observed that it was difficult for her to address this issue without knowing the content of the withheld information. She considered however that there would only be a likelihood of unwarranted prejudice if a statement made by a third party had been false and misleading in which case, their freedoms and legitimate interests would be forfeited.
34.Additionally, Ms D also provided a number of very personal reasons setting out why she believed the benefits of disclosure would outweigh those in withholding the information.
35.In their submissions, Strathclyde Police stated that the complaints made against the named officers had not been upheld and none of the individuals contributing to the investigation had an expectation that the information they provided would be the subject of public disclosure. Strathclyde Police considered that disclosure of such information would be unwarranted and the individuals who were the subject of the complaints should be permitted to continue their careers free from further supposition or innuendo.
36.The Commissioner has balanced the legitimate interests of the data subjects against the legitimate interests identified by Ms D. Having done so, and, having taken account of the data subjects' expectations of privacy, the Commissioner finds that the legitimate interests served by disclosure to Ms D would not outweigh the unwarranted prejudice that would be caused to the rights, freedoms or legitimate interests of the third parties. The Commissioner is therefore satisfied that condition 6 of schedule 2 of the DPA is not met in this case.
37.Having accepted that disclosure of the withheld personal data would lead to unwarranted prejudice to the rights, freedoms and legitimate interest of the data subjects as described above, the Commissioner must also conclude that disclosure would be unfair. As condition 6 is not met, he would also regard disclosure as unlawful. In all the circumstances, therefore, the Commissioner's conclusion is that the first data protection principle would be breached by disclosure of the information and therefore that the withheld personal data of third parties was properly withheld under section 38(1)(b) of FOISA.
38.As the Commissioner has upheld the withholding of the investigation report in its entirety under section 38(1)(a) and 38(1)(b) of FOISA, he is not required to go onto consider whether section 35(1)(g) additionally cited by Strathclyde Police should be upheld.
DECISION
The Commissioner finds that the Chief Constable of Strathclyde Police complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Ms D.
Appeal
Should either Ms D or Strathclyde Police wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Margaret Keyse
Head of Enforcement
30 March 2010
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a) the provision does not confer absolute exemption; and
?
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(e) in subsection (1) of section 38 ?
(i) paragraphs (a), (c) and (d); and
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
(a) personal data of which the applicant is the data subject;
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
Data Protection Act 1998
1 Basic interpretative provisions
(1)In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 ? The data protection principles
Part I ? The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data
...
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
