|
Decision 058/2015: Mr Mark Howarth and Chief Constable of the Police Service of Scotland
Significant Case Review
Reference No: 201402660
Decision Date: 29 April 2015
Summary
On 12 June 2014, Mr Howarth asked the Chief Constable of the Police Service of Scotland (Police Scotland) for a full copy of the Significant Case Review (SCR) report in the case of Mr Kevin Rooney.
In response, Police Scotland informed Mr Howarth that a redacted version of the SCR report was already publicly accessible. They refused to provide the redacted information, arguing that disclosure would breach the data protection principles. Following a review, at which point Police Scotland stated that the redacted information was sensitive personal data, Mr Howarth remained dissatisfied and applied to the Commissioner for a decision.
The Commissioner investigated and found that Police Scotland had responded to Mr Howarth's request for information properly, in accordance with Part 1 of FOISA.
|
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i) and (2)(b) and (5) (definition of "the data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of personal data); 2 (Sensitive personal data); (3) (The special purposes); Schedules 1 (The data protection principles) (the first data protection principle); 3 (Conditions relevant for the purposes of the first principle: processing of sensitive personal data) (conditions 1, 5 and 10).
Data Protection (Processing of Sensitive Personal Data) Order 2000 (Circumstances in which Sensitive Personal Data may be processed - paragraph 3)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 12 June 2014, Mr Howarth made a request for information to Police Scotland. The information requested was that contained in the entire Significant Case Review (the SCR, or the report) regarding the case of Kevin Rooney.
2. Police Scotland responded on 27 June 2014. They informed Mr Howarth that a redacted version of the report was available publicly[1].
3. Police Scotland withheld the information redacted from the full report on the basis that it contained personal data and its disclosure would cause significant distress to the victim's family. In Police Scotland's view, therefore, disclosure of this information would breach the first data protection principle and the information was exempt under section 38(1)(b) of FOISA.
4. On 11 July 2014, Mr Howarth wrote to Police Scotland requesting a review of their decision, on the basis that the victim's family had expressed an interest in the full report being published and he did not accept that all the personal data could be withheld.
5. Police Scotland notified Mr Howarth of the outcome of their review on 29 July 2014. Police Scotland maintained their reliance on section 38(1)(b) of FOISA, explaining that the information withheld consisted of sensitive personal data.
6. On 17 July 2014, Mr Howarth wrote to the Commissioner. He applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr Howarth stated he was dissatisfied with the outcome of Police Scotland's review because he did not accept that section 38(1)(b) had been applied correctly. He considered there to be a significant public interest in the disclosure of the full SCR report.
Investigation
7. The application was accepted as valid. The Commissioner confirmed that Mr Howarth made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.
8. On 21 November 2014, Police Scotland were notified in writing that Mr Howarth had made a valid application. Police Scotland were asked to send the Commissioner the information withheld from him. They provided the information and the case was allocated to an investigating officer.
9. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. Police Scotland were invited to comment on this application, justifying their reliance on any provisions of FOISA they considered applicable to the information requested.
Commissioner's analysis and findings
10. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr Howarth and Police Scotland. She is satisfied that no matter of relevance has been overlooked.
Background to request
11. A Significant Case Review (SCR) is undertaken, generally, in the following circumstances:
a) When an offender managed under Multi-Agency Public Protection Arrangements (MAPPA) is charged with murder, attempted murder or a crime of serious sexual harm,
b) Significant concern has been raised in respect of the management of a MAPPA offender which gives rise to serious concerns about professional and/or service involvement, or
c) Where it appears that an offender managed under MAPPA is killed or is seriously injured as a direct result of his/her status as a sex offender becoming known.
12. The overarching objectives of SCRs are to:
a) Establish whether there are lessons to be learnt about how better to protect the public from risk of harm,
b) Make recommendations for action,
c) Address accountability,
d) Provide public reassurance in relation to the actions of the responsible authorities in the specific circumstances, and
e) Identify good practice.
13. A SCR was commissioned by the Edinburgh Offender Management Committee at Edinburgh City Council, following the death of Rosina Sutherland on 30 October 2011. Kevin Rooney, a registered sex offender, was convicted of Mrs Sutherland's murder. A redacted version of the SCR report and a timeline was published on 29 July 2014.
Redactions made to SCR report
14. Mr Howarth recognised that the names of individuals redacted from the report could be legitimately withheld for data protection purposes, but believed there was a clear public interest in the remainder of the information being disclosed.
15. Police Scotland withheld complete sections of the SCR report and made smaller redactions in other areas, on the basis that section 38(1)(b) (read in conjunction with (2)(a)(i)) of FOISA applied.
16. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) (or, as appropriate, (2)(b)), exempts personal data if its disclosure to a member of the public, otherwise than under FOISA, would contravene any of the data protection principles.
Is the information under consideration personal data?
17. "Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller" (the full definition is set out in the Appendix).
18. The Commissioner has considered the submissions received from Police Scotland on this point, along with the withheld information. The Commissioner is satisfied that the information is personal data: it is possible to identify individuals from the data itself, in line with the definition of personal data. The information is biographical in relation to Mr Rooney, and therefore can be said to relate to him.
Is the withheld information sensitive personal data?
19. In their submissions, Police Scotland submitted that the redacted information comprised sensitive personal data.
20. The definition of sensitive personal data is contained in section 2 of the DPA (see Appendix 1).
21. The Commissioner has carefully reviewed the withheld information in the SCR report, in order to establish how much of it is sensitive personal data. The Commissioner is satisfied that the personal data withheld falls into at least one of the categories in section 2 of the DPA and therefore represents the sensitive personal data of an individual. (The Commissioner is unable to confirm which of the categories of sensitive personal data are relevant here without, in effect, disclosing the sensitive personal data.)
Would disclosure contravene the first data protection principle?
22. In their submissions, Police Scotland argued that the disclosure of the withheld personal data would contravene the first data protection principle. This requires that personal data are processed fairly and lawfully and, in particular, are not processed unless at least one of the conditions in Schedule 2 to the DPA is met. For sensitive personal data, at least one of the conditions in Schedule 3 to the DPA must also be met.
The first data protection principle: sensitive personal data
23. Given the additional restrictions surrounding the disclosure of sensitive personal data, it is necessary in this case to consider whether there are any conditions in Schedule 3 which would permit the data to be disclosed, before considering the Schedule 2 conditions. The conditions listed in Schedule 3 have been considered by the Commissioner, as have the additional conditions for processing sensitive personal data contained in secondary legislation, such as the Data Protection (Processing of Sensitive Personal Data) Order 2000.
24. Guidance issued by the Commissioner regarding the exemption in section 38(1)(b) notes that, generally, only the first and fifth conditions are likely to be relevant when considering a request for sensitive personal data under FOISA. Condition 1 would allow personal data to be disclosed where the data subject has given explicit (i.e. fully informed and freely given) consent to their release. Condition 5 would allow the personal data to be disclosed if the data have been made public as a result of steps deliberately taken by the data subject.
25. Police Scotland informed the Commissioner that they had not considered it appropriate to ask the data subject, Mr Rooney, if he would consent to disclosure of his personal information. Police Scotland also submitted that, even if consent had been provided, it was unlikely that it could be relied upon as fully informed and freely given, given Mr Rooney's current status (in prison). The Commissioner accepts these conclusions.
26. Police Scotland also submitted that they had no knowledge of Mr Rooney taking any steps to release any of his personal data into the public domain deliberately. The Commissioner is also satisfied that the information has not been made public as a result of steps deliberately taken by the data subject, and so condition 5 is not met in this case.
27. Condition 10 of Schedule 3 is that the personal data are processed in circumstances specified in an order made by the Secretary of State. As noted above, the relevant order is the Data Protection (Processing of Sensitive Personal Data) Order 2000.
28. Article 2 of that Order provides that the circumstances specified in any of the paragraphs in the Schedule to the Order are circumstances in which sensitive personal data may be processed.
28. Mr Howarth argued that paragraph 3 of the Schedule to the Order applied in this case. The remaining paragraphs refer to "processing", which covers both disclosure and other forms of processing. Paragraph 3 differs, in referring only to "disclosure". Paragraph 3 provides for sensitive personal data being disclosed where it:
a) Is in the substantial public interest,
b) Is in connection with the commission by any person of any unlawful act, whether alleged or established,
c) Is for the special purposes defined in section 3 of the DPA, i.e. the purposes of journalism or artistic or literary purposes, and
d) Is made with a view to the publication of those data by any person and the data controller reasonably believes that such publication would be in the public interest.
29. Mr Howarth set out in detail why he considered disclosure to be in the substantial public interest. He argued that this case went beyond a casual public interest of being in possession of interesting information.
30. He went on to argue that there was a "prevalence of sex offender activity" across Scotland and suggested that there appeared to be a degree of "incompetence or neglect" in how sex offenders were managed in the community. He argued that this "incompetence or neglect" was evidenced in the number of SCR reports, not least the one which is the subject of this decision. Mr Howarth provided a list of all serious crimes committed by Registered Sex Offenders (RSOs) in Scotland since the introduction of MAPPA which he was aware of as a result of newspaper reporting.
31. Mr Howarth noted that SCRs were conducted and published in only a small number of cases, with the result, in his view, that details of how and why MAPPA failed to successfully manage each of these sex offenders remained largely unknown.
32. Highlighting the circumstances, Mr Howarth argued that this particular SCR was the most vital of all in aiding public understanding of how MAPPA coped when confronted with unpredictable criminality. He stated that transparency and completeness might eliminate complacency and improve MAPPA in the light of open scrutiny, so it might retain public confidence or inform proper debate on whether there were preferable systems and strategies.
33. Mr Howarth considered the consequences of disclosure. He understood that the spectre of vigilantism had been raised by authorities as a reason for keeping information about RSOs to a bare minimum. It had also been suggested that sex offenders were likely to "go underground" should there be a heightened risk of identification through publication of data. Mr Howarth suggested that these factors were not applicable in this instance due to the status of the offender.
34. Mr Howarth, a freelance journalist, highlighted that journalism was one of the "special purposes" defined in section 3 of the DPA and that he intended to publish the results of his research, submitting that there was a significant public interest in doing so.
35. In response to this, Police Scotland submitted that it had taken cognisance of paragraphs 3(1)(a) and (d) of this Order, highlighting that both of these elements contained a public interest test under which they (as data controller) were required to balance the privacy rights of Mr Rooney against the public interest in release of the requested sensitive personal data, even in cases whether there was a journalistic purpose.
36. Police Scotland acknowledged that there is a public interest in disclosure, to demonstrate how MAPPA operated and whether the arrangements operated effectively in a particular case. Police Scotland argued that serving that public interest does not necessarily require all sensitive personal data to be disclosed.
37. Police Scotland acknowledged that there was public interest relating to Mr Rooney's management within the community, but did not accept that this translated into disclosing all the personal data they held in relation to him and which was included in the report. Police Scotland maintained that disclosure of all of the sensitive personal data could not be justified under paragraph 3 of the Sensitive Personal Data Order, or under any other Schedule 3 condition, and to do so would be a clear breach of the first data protection principle.
38. The Commissioner has considered the arguments presented by both parties carefully. The key consideration is whether disclosure would be in the substantial public interest. In this instance the Commissioner is aware that a substantial volume of the report has been published, including all of the recommendations arising from the report. The information which has been withheld is Mr Rooney's sensitive personal data, which may be of interest to the public but would not provide transparency in relation to the MAPPA process as argued by Mr Howarth. In light of this, the Commissioner is satisfied that the conditions in paragraph 3 of the Schedule to the Data Protection (Processing of Sensitive Personal Data) Order 2000 cannot be met in this case.
39. Having reached these conclusions, and having concluded that no other condition in Schedule 3 applies in this case, the Commissioner finds that the disclosure of Mr Rooney's sensitive personal data would breach the first data protection principle. She therefore finds that Police Scotland were correct to withhold this information under section 38(1)(b) of FOISA.
Decision
The Commissioner finds that Chief Constable of Police Service of Scotland complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Howarth.
|
Appeal
Should either Mr Howarth or the Chief Constable of the Police Service of Scotland (Police Scotland) wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
29 April 2015
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
?
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
?
(e) in subsection (1) of section 38 -
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
?
"personal data" means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
2 Sensitive personal data
In this Act "sensitive personal data" means personal data consisting of information as to-
(a) the racial or ethnic origin of the data subject,
(b) his political opinions,
(c) his religious beliefs or other beliefs of a similar nature,
(d) whether he is a member of a trade union (within the meaning of the Trade Union and Labour Relations (Consolidation) Act 1992),
(e) his physical or mental health or condition,
(f) his sexual life,
(g) the commission or alleged commission by him of any offence, or
(h) any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings.
3 The special purposes
In this Act "the special purposes" means any one or more of the following-
(a) the purposes of journalism,
?
Schedule 1 - The data protection principles
Part I - The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
?
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
Schedule 3 - Conditions relevant for the purposes of the first principle: processing of sensitive personal data
1. The data subject has given his explicit consent to the processing of the personal data.
5. The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.
10. The personal data are processed in circumstances specified in an order made by the Secretary of State for the purposes of this paragraph.
The Data Protection (Processing of Sensitive Personal Data) Order 2000
Circumstances in which Sensitive Personal Data may be processed
3. (1) The disclosure of personal data -
(a) is in the substantial public interest;
(b) is in connection with -
(i) the commission by any person of any unlawful act (whether alleged or established),
(ii) dishonesty, malpractice or other seriously improper conduct by, or the unfitness or incompetence of, any person (whether alleged or established), or
(iii) mismanagement in the administration of, or failure in services provided by, any body or association (whether alleged or established);
(c) is for special purposes as defined in section 3 of the Act; and
(d) is made with a view to the publication of those data by any person and the data controller reasonably believes that such publication would be in the public interest.
[1]
