Decision 056/2014 Mr Michael Roulston and the Scottish Police Authority
Estimated costs of undergoing a misconduct hearing
Reference No: 201301436
Decision Date: 5 March 2014
Summary
On 2 March 2013, Mr Roulston asked Central Scotland Joint Police Board (the Board) (now succeeded by the Scottish Police Authority (the SPA)) for information concerning a misconduct case involving a senior police officer. Following a review, the SPA disclosed information to Mr Roulston which was related to the information that he had requested.
During the investigation, the SPA accepted that it held information falling within the scope of Mr Roulston's request. The SPA withheld this information on the basis that it comprised personal data and was exempt from disclosure in terms of section 38(1)(b) of FOISA.
Following an investigation, the Commissioner found that the SPA had breached FOISA by initially failing to identify the information that it held which fell within the scope of Mr Roulston's request. However, the Commissioner accepted that the SPA was entitled to withhold the information that it held under the exemption in section 38(1)(b) of FOISA.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i) and (b) and (5) (definitions of "the data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (conditions 1 and 6)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Note: Mr Roulston's request was made initially to Central Scotland Joint Police Board. However, the decision has been issued in the name of the Scottish Police Authority as the statutory successor to Central Scotland Joint Police Board, in terms of the Scottish Police Authority Property Transfer Scheme 2013, made by the Scottish Ministers under Schedule 5 to the Police and Fire Reform (Scotland) Act 2012.
Background
1. On 2 March 2013, Mr Roulston emailed the SPA via the whatdotheyknow website[1] in the following terms:
"On or around the 27th January 2012, the Board was discussing a misconduct case involving a senior police officer (ACPOS rank). Their deliberations apparently included the "estimated costs of undergoing a misconduct hearing" previously supplied to the Board on or around 20th May 2011. Could you confirm (1) what that figure was, (2) how it was calculated and (3) what margin was allowed for any increased, unexpected or unknown costs given that the total costs relies on the attendance of witnesses from both sides involved in the discipline procedure."
2. The SPA responded on 28 March 2013, giving notice under section 18(1) of FOISA. Section 18(1) allows Scottish public authorities to refuse to reveal whether information exists or is held by them, where, if the information did exist and was held by the authority, the authority could give a refusal notice under section 16(1) of FOISA on the basis that the information was exempt information under any of a number of specified exemptions and if the authority considers that to reveal whether the information exists or is held would be contrary to the public interest. The SPA informed Mr Roulston that the exemptions in sections 30(c) and 36(1) of FOISA would apply if the information existed and was held by it.
3. On 9 May 2013, Mr Roulston emailed the SPA requesting a review of its decision. Mr Roulston considered there was a great public interest in justifying the costs of holding a misconduct hearing. He also considered that the anticipated costs must have risen substantially over time and there was therefore a public interest in knowing whether the initial estimate made in 2010 was accurate in the first place.
4. The SPA notified Mr Roulston of the outcome of its review on 13 June 2013. The SPA confirmed that the estimated costs of investigating a complaint against a Chief Constable and conducting an efficiency enquiry into poor performance at Assistant Chief Constable rank had been provided to a Board meeting on 27 January 2012. The SPA disclosed this information to Mr Roulston. The SPA also stated that the estimated costs did not include the costs of undergoing a misconduct hearing.
5. On 27 June 2013, Mr Roulston wrote to the Commissioner, stating that he was dissatisfied with the outcome of the SPA's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
6. The application was validated by establishing that Mr Roulston made a request for information to a Scottish public authority and applied to the Commissioner for a decision only after asking the authority to review its response to that request. The case was then allocated to an investigating officer.
Investigation
7. The investigating officer subsequently contacted the SPA, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions. The SPA was asked to clarify the searches it had undertaken in order to locate and retrieve information falling within the scope of Mr Roulston's request.
8. The SPA responded on 5 August 2013. It explained that some information had been passed to it (as the successor organisation to the Board) by Falkirk Council, and confirmed that it held information relating to the costs of a misconduct hearing.
9. The SPA indicated that it had discussed the matter with Mr Roulston and had informed him that this information clearly related to a named person and comprised personal data; however, Mr Roulston had indicated that this was not the information he was seeking. The SPA considered that the information it had disclosed to Mr Roulston on 13 June 2013 was the information that he was seeking in his request.
10. At this stage, the SPA also provided the investigating officer with background information on the case including an appendix to a previous meeting of the Board on 27 January 2012 ("appendix 3").
11. The investigating officer subsequently contacted Mr Roulston in order to clarify his grounds for dissatisfaction with the SPA's response to his requirement for review. Mr Roulston confirmed that the information that he was seeking was that contained in his original request of 2 March 2013. He indicated that the information disclosed to him by the SPA on 13 June 2013 was not the information that he had requested.
12. The investigating officer then contacted the SPA, pointing out that the information contained in appendix 3 appeared to comprise the information sought by Mr Roulston in his request of 2 March 2013. The SPA was asked for its views on this. The investigating officer also informed the SPA that Mr Roulston remained dissatisfied with the information that had been disclosed to him. In response, the SPA agreed that some of the information that it held appeared to comprise the estimated costs that Mr Roulston was seeking.
13. Following further discussions, the SPA and the investigating officer agreed that the information held by the SPA appeared to be the personal data of a senior police officer. In the SPA's view, the information would therefore be exempt from disclosure in terms of section 38(1)(b) of FOISA.
14. The investigating officer subsequently wrote to the SPA asking it to provide submissions explaining why it considered the information to be exempt from disclosure under section 38(1)(b) of FOISA. The SPA was also asked to explain the searches that had been undertaken in order to locate and retrieve any relevant information falling within the scope of the request. The investigating officer also provided the SPA with a copy of an email which the data subject had sent to the investigating officer. The email stated (in relation to the information sought by Mr Roulston) "Please note I believe disclosure is in the public interests and provide authority in this email for such disclosure". The SPA was asked whether, in view of this email from the data subject, it was prepared to disclose the information to Mr Roulston.
15. The SPA responded on 16 January 2014. It explained the searches that had been undertaken in order to locate any information falling within the scope of Mr Roulston's request. The SPA also provided submissions explaining why it considered that the information was exempt from disclosure under section 38(1)(b) of FOISA. The SPA considered disclosure of the information under FOISA would breach the first and second data protection principles, and it was not prepared to disclose the information to Mr Roulston.
16. During the investigation, the investigating officer sought and received submissions from Mr Roulston regarding the SPA's application of the exemption in section 38(1)(b) of FOISA.
Commissioner's analysis and findings
17. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr Roulston and the SPA. She is satisfied that no matter of relevance has been overlooked.
Has all relevant information been located and retrieved by the SPA?
18. In correspondence with the investigating officer, Mr Roulston indicated that he considered the SPA ought to hold additional relevant information besides appendix 3. Mr Roulston considered that the Board must have reviewed the escalating costs of undertaking the misconduct hearing as time progressed. He stated that he had hoped to see documents that revealed the extent of this escalation and the relevant review dates.
19. In its submissions to the Commissioner, the SPA explained that the information that it held had been received from Falkirk Council (the Council) as custodians of the Board's files. The SPA stated that it did not receive any information electronically from the Council, and explained that it had had to conduct a manual search of the un-indexed boxes of material. This had taken three weeks. The SPA stated that, having completed these searches, it had not identified any additional information falling within the scope of Mr Roulston's request.
20. The Commissioner considers that the SPA has conducted adequate searches in order to establish whether it holds any additional information falling within the scope of Mr Roulston's request beyond that previously identified. Accordingly, she is satisfied that the only relevant information that the SPA holds is appendix 3.
21. The Commissioner is aware that the Council had not passed all information from the Board to the SPA at the time when the SPA was first dealing with Mr Roulston's request. However, from 1 April 2013, the SPA was the successor authority to the Board and therefore "held" the information for the purposes of FOISA. By failing initially to identify information which fell within the scope of Mr Roulston's request, the Commissioner finds that the SPA breached Part 1 of FOISA, in particular section 1(1), when responding to Mr Roulston's request for review.
Section 38(1)(b) - Personal information
22. The SPA applied the exemption in section 38(1)(b) to the information which it held which fell within the scope of Mr Roulston's request (appendix 3, which contained estimated costs relating to a relevant misconduct hearing). The SPA argued that disclosure of this information would breach the first and second data protection principles.
23. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or, as appropriate, 38(2)(b), exempts information from disclosure if it is "personal data" (as defined in section 1(1) of the DPA) and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.
24. In order to rely on this exemption, the SPA must therefore show that the information being withheld is personal data for the purposes of the DPA and that its disclosure into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Schedule 1 to the DPA.
Is the information personal data?
25. Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).
26. The Commissioner is satisfied that the withheld information is personal data, in line with the definition in part a) of section 1(1) of the DPA. A living individual, i.e. the named senior police officer, can be identified from this information. The estimates are detailed and contain information as to the background of the misconduct inquiry, together with information about matters related to the complaint. The information clearly relates to the named officer.
Would disclosure breach the first data protection principle?
27. As noted above, the SPA argued that making this information available would breach the first data protection principle. This states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. (In the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA would also have to be met.) The processing in this case would be making the information available in response to Mr Roulston's request.
28. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. However, these three aspects are interlinked. For example, if there is a specific condition which permits the personal data to be disclosed, it is likely that disclosure would also be fair and lawful.
29. The Commissioner will first consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed. Where a Schedule 2 condition can be met, she will then go on to consider whether disclosure of the personal data would otherwise be fair and lawful.
30. When considering the conditions in Schedule 2, the Commissioner has noted Lord Hope's comment in the case of Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[2] that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject.
Can any schedule 2 condition be met?
31. In the Commissioner's guidance on section 38(1)(b)[3], the Commissioner notes that, in dealing with requests under FOISA, conditions 1 and 6(1) are the only ones likely to be relevant.
32. Condition 1 of Schedule 2 allows personal data to be processed where the data subject has given his consent to the processing. Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data, to which the DPA gives effect, defines an individual's consent as:
any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed.
33. The Commissioner has considered the email from the data subject (referred to in paragraph 14 above) which appears to consent to disclosure of their personal data into the public domain. However, the Commissioner can only take into account the circumstances as they existed when the SPA responded to Mr Roulston's requirement for review. At that point in time, the Commissioner is satisfied that that the data subject was not aware of the specific content of the withheld information and had not provided specific and informed consent to its disclosure. Accordingly, the Commissioner is satisfied that condition 1 of Schedule 2 cannot be met in this case.
34. Condition 6 allows personal data to be processed if that processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
35. There are, therefore, a number of tests which must be met before condition 6(1) can apply. These are:
a. Is Mr Roulston pursuing a legitimate interest or interests?
b. If yes, is the processing (in this case, the disclosure of the information into the public domain) necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced to its ends, or could these legitimate interests be achieved by means which interfere less with the privacy of the data subject?
c. Even if the processing is necessary for Mr Roulston's legitimate interests, is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject? As noted by Lord Hope in the CSA case, given that there is no presumption in favour of the release of personal data, the legitimate interests of Mr Roulston must outweigh the rights, freedoms or legitimate interests of the data subject before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the Council was correct to refuse to disclose the personal data to Mr Roulston.
Is Mr Roulston pursuing a legitimate interest or interests?
36. There is no definition within the DPA of what constitutes a "legitimate interest", but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. The Commissioner's published guidance on section 38 of FOISA states:
In some cases, the legitimate interest might be personal to the applicant - e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety.
37. In his submissions to the Commissioner, Mr Roulston argued that there was clearly a public interest in the scrutiny of the effective administration of such a case, including any cost benefit analysis process.
38. The SPA stated that it had no idea whether Mr Roulston had a legitimate interest in obtaining the information. The SPA submitted that it had no idea who Mr Roulston was or what his motives were.
39. In this case, the Commissioner accepts that Mr Roulston has a legitimate interest in understanding the processes followed by the SPA in this case and scrutinising its actions in relation to public expenditure.
Is the processing necessary for the purposes of those interests?
40. The Commissioner must now consider whether disclosure of the personal data is necessary in order to satisfy the legitimate interests identified above. In doing so, she must consider whether these interests might reasonably be met by any alternative means.
41. The SPA made no specific submission on this point, other than to state that it had no idea who Mr Roulston was on the day that he made his request, nor what his interests were. (The Commissioner comments on this at the end of the decision.)
42. In all the circumstances of this case, the Commissioner can identify no viable means of meeting Mr Roulston's legitimate interests which would interfere less with the privacy of the relevant data subject than the provision of the withheld personal data. In the circumstances, she is satisfied that disclosure of the personal data is necessary to meet the legitimate interests in question.
Would disclosure cause unwarranted prejudice to the legitimate interests of the data subject?
43. As the Commissioner is satisfied that disclosure of the withheld personal data would be necessary to fulfil Mr Roulston's legitimate interests, she is now required to consider whether that disclosure would nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject. As noted above, this involves a balancing exercise between the legitimate interests of Mr Roulston and the data subject in question. Only if the legitimate interests of Mr Roulston outweigh those of the data subject can the information be disclosed without breaching the first data protection principle.
44. In the Commissioner's briefing on personal information, she notes a number of factors which should be taken into account in carrying out the balancing exercise. These include:
? whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)
? the potential harm or distress that may be caused by disclosure
? whether the individual objected to the disclosure
? the reasonable expectations of the individual as to whether the information should be disclosed
45. In its submissions, the SPA reiterated that it had no idea who Mr Roulston was nor what his motives were in obtaining the information. The SPA submitted that the information related to an ongoing hearing and disclosure of the information into the public domain might prejudice either party.
46. The SPA stated that it had not construed the email from the data subject in this case (referred to in paragraph 14 above) as approval for all disclosures and did not consider that it permitted the SPA to disclose all and any personal information about the data subject to any FOISA applicant.
47. Mr Roulston submitted that there was clearly a public interest in the effective administration of cases such as this which must include a cost-benefit analysis process. In Mr Roulston's view, disclosure of the information was unlikely to cause an unnecessary or unjustified distress to the data subject. Mr Roulston did not believe that any exemption should be applied in order to spare officials embarrassment for poor administrative decisions. Mr Roulston also submitted that there was a strong public interest in the provision of information about how an authority has spent its money.
48. The Commissioner has considered all of the submissions made by the SPA and Mr Roulston when considering the balancing test in this case. The Commissioner recognises that Mr Roulston has an interest in obtaining the information in order to scrutinise the administrative and financial actions of the SPA.
49. In this instance, and at the time of the SPA's decision on review, the Commissioner takes the view that the data subject did not know the content of the information under consideration and could not therefore have given informed consent to its disclosure under FOISA. At that time, the data subject would not have had any reasonable expectation that their personal data would be publicly disclosed in the context of the information request made by Mr Roulston, which is the effect of disclosure of the information under FOISA.
50. On balance, while the Commissioner accepts that disclosure of the withheld information would be necessary to fulfil Mr Roulston's legitimate interests, she does not agree that this outweighs the prejudice that would be caused to the data subject's rights, freedoms and legitimate interests. The Commissioner does not consider there would have been any reasonable expectation on the part of the data subject that such sensitive information would have been disclosed into the public domain. The Commissioner considers that such disclosure of specific details of the actions taken, and those being considered by the SPA in relation to the misconduct inquiry, would have been extremely damaging and distressing to the data subject. She considers that such prejudice would be unwarranted in this case. The Commissioner is therefore satisfied that condition 6 of Schedule 2 is not met in this case.
51. Having concluded that disclosure of the withheld information would lead to unwarranted prejudice to the rights, freedoms and legitimate interests of the data subject, the Commissioner must also conclude that disclosure would be unfair. As condition 6 cannot be met, she would also regard disclosure as unlawful. In all the circumstances, therefore, she finds that disclosure would breach the first data protection principle and that the information was properly withheld under section 38(1)(b) of FOISA.
52. Given that the Commissioner has found that disclosure of the information would breach the first data protection principle, she has not gone on to consider whether its disclosure under FOISA would breach the second data protection principle.
Additional comment on section 38(1)(b)
53. As noted above, the SPA stated that it did not know whether Mr Roulston had a legitimate interest in obtaining the withheld information. The SPA provided no indication that it had asked Mr Roulston why he wanted the information. As stated in her briefing on personal data (at page 12), the Commissioner considers it good practice, when assessing whether an applicant has a legitimate interest, for authorities to ask the applicant why they want the information, unless it is already clear from the information request or from previous correspondence.
DECISION
The Commissioner finds the Scottish Police Authority (the SPA) partially failed to deal with Mr Roulston's request for information in accordance with Part 1 of FOISA. By initially failing to identify the information that it held which fell within the scope of the request, the Commissioner finds that the SPA failed to comply with section 1(1). The Commissioner does not require the SPA to take any action in response to this failure.
The Commissioner also finds that the SPA was entitled to withhold the information that it held under the exemption in section 38(1)(b) of FOISA.
Appeal
Should either Mr Roulston or the Scottish Police Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
5 March 2014
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
...
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
?
(e) in subsection (1) of section 38 -
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
?
"personal data" means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 - The data protection principles
Part I - The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data
1. The data subject has given his consent to the processing.
?
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
[1] https://www.whatdotheyknow.com/request/costs_of_undergoing_a_misconduct#outgoing-272867
[2] http://www.publications.parliament.uk/pa/ld200708/ldjudgmt/jd080709/comm-1.htm
[3] http://www.itspublicknowledge.info/Law/FOISA-EIRsGuidance/section38/Section38.aspx
