Decision 059/2025: Refusal to confirm or deny
Authority: Chief Constable of the Police Service of Scotland
Case Ref: 202401494
Summary
The Applicant made a request for information to the Authority relating to police activity. The Authority refused to confirm or deny whether it held the information requested. The Commissioner investigated and found that the Authority was entitled to refuse to confirm or deny whether the information requested existed or was held.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1)(a) and (2)(e)(i) (Effect of exemptions); 18(1) (Further provisions as respects responses to request); 38(1)(a) and (5) (definitions of “the data protection principles”, “data subject”, “personal data” and “the UK GDPR”) (Personal information); 47(1) and (2) (Application for decision by Commissioner
United Kingdom General Data Protection Regulation (the UK GDPR) Articles 4(1) and (11) (Definitions) and 15(1) (Right of access by the data subject)
Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (5) and (14) (Terms relating to the processing of personal data)
Background
1. On 28 August 2024, the Applicant made a request for information to the Authority relating to police activity.
2. The Authority responded on 28 October 2024. It refused to confirm or deny whether it held the information requested or whether it existed, relying on section 18(1) of FOISA in conjunction with sections 34(1)(b), 35(1)(a) & (b) and 38(1)(a).
3. On 29 October 2024, the Applicant wrote to the Authority requesting a review of its decision. They stated that they were dissatisfied with the decision because they considered the cited FOISA exemptions had been wrongly applied.
4. The Authority notified the Applicant of the outcome of its review on 13 November 2024, which fully upheld its original response.
5. On 14 November 2024, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. They stated that they were dissatisfied with the outcome of the Authority’s review because it undermined the principles of transparency and accountability in public institutions and the cited FOISA exemptions had been wrongly applied.
Investigation
6. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
7. On 3 December 2024, the Authority was notified in writing that the Applicant had made a valid application. The case was subsequently allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Authority was invited to comment on this application and to answer specific questions relating to its reasons for relying on section 18(1) of FOISA. The Authority provided the Commissioner with its comments.
9. The Applicant asked more than one question in their request but only challenged one question (the first question in their request) in their requirement for review. The Commissioner will therefore only consider the Authority’s response to that question in his decision notice.
Section 18(1) of FOISA – “neither confirm nor deny”
10. The Authority refused to confirm nor deny whether it held any information falling within the scope of the Applicant’s request.
11. Section 18(1) of FOISA allows public authorities to refuse to confirm nor deny whether they hold information in the following limited circumstances:
(i) a request has been made to the authority for information which may or may not be held by it; and
(ii) if the information existed and were held by the authority (and it need not be), it could give a refusal notice under section 16(1) of FOISA, on the basis that the information was exempt information by virtue of any of the exemptions in sections 28 to 35, 38, 39(1) or 41 of FOISA; and
(iii) the authority considers that to reveal whether the information exists or is held by it would be contrary to the public interest.
12. Where a public authority has chosen to rely on section 18(1) of FOISA, the Commissioner must establish whether the authority is justified in stating that to reveal whether the information exists or is held would be contrary to the public interest. He must also establish whether, if the information existed and were held by the public authority, the authority would be justified in refusing to disclose the information by virtue of any of the exemptions listed in section 18(1).
13. In any case where section 18(1) of FOISA is under consideration, the Commissioner must ensure that his decision notice does not confirm one way or the other whether the information requested exists or is held by the authority. This means that he is unable to comment in any depth on the reliance by the public authority on any of the exemptions listed in section 18(1), or on other matters which could have the effect of indicating whether the information existed or was held by the authority.
14. It is not sufficient to claim that one or more of the relevant exemptions applies. Section 18(1) makes it clear that the authority must be able to give a refusal notice under section 16(1), on the basis that any relevant information, if held, would be exempt information under one or more of the listed exemptions.
15. In this case, the Authority submitted that, if it held any information falling within scope of the Applicant’s request, it would be exempt from disclosure under several FOISA exemptions, including section 38(1)(a).
16. The Commissioner must first consider whether the Authority could have given a refusal notice under section 16(1) of FOISA in relation to the information in question, if it existed and were held – in other words, whether the Authority could have refused to provide the information (if it existed and were held) on the grounds that it was exempt from disclosure under the exemptions cited by the Authority.
Section 38(1)(a) of FOISA – Personal information of the data subject
17. Section 38(1)(a) of FOISA contains an absolute exemption in relation to personal data of which the applicant is the data subject. The fact that it is an absolute exemption means that it is not subject to the public interest test set out in section 2(1)(b) of FOISA.
18. Personal data are defined in section 3(2) of the DPA 2018 which, read with section 3(3), incorporates the definition of personal data in Article 4(1) of the UK GDPR:
“… any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”
19. The Commissioner has considered the precise wording of the Applicant’s request for information, which he cannot reproduce in his decision notice, but which was framed with reference to their address. The request, and its context, means that the information requested, if it existed and were held, would comprise their own personal data, as defined by section 3(2) of the DPA 2018. He considers that the Authority’s interpretation of the request was reasonable.
20. The Commissioner is therefore satisfied that the information requested, if it existed and were held, would be exempt from disclosure under section 38(1)(a) of FOISA. In other words, disclosure of the information requested (if it existed and were held) in response to the request as worded would effectively disclose the Applicant’s personal data.
21. As the Commissioner is satisfied that the information requested, if it existed and were held, would be exempt from disclosure under section 38(1)(a) of FOISA, he is not required to consider the other exemptions applied by the Authority.
22. Having accepted that the Authority could have given a refusal notice under section 16(1) of FOISA on the basis that any relevant information, if held, would be exempt information by virtue of section 38(1)(a) of FOISA, the Commissioner is required by section 18(1) to go on to consider whether the Authority was entitled to conclude that it would be contrary to the public interest to reveal whether the information existed or was held.
The public interest – section 18(1) of FOISA
23. The Applicant was invited to provide specific public interest arguments. They provided reasons why they believed the information requested (if it existed and were held) should be disclosed. The Commissioner will not reproduce all of these reasons here, but he has fully considered them in what follows.
24. In general terms, the Applicant argued that it was in the public interest to reveal whether the information requested exists or is held, for reasons of accountability and transparency regarding the actions of the Authority.
25. The Authority submitted that it was in the public interest that it neither confirm nor deny whether it held the information requested or whether it existed. While it accepted that the Applicant had a personal interest in disclosure of the information requested (if it existed and were held), it argued that, given disclosure of the information (if it existed and were held) would prejudice the protection of an individual’s right to privacy, to reveal whether the information requested existed or was held
would be contrary to the public interest.
26. Disclosure under FOISA is disclosure to the world at large. Given that he has found that the information (if it existed and were held) would be the Applicant’s own personal data, the Commissioner is satisfied that to reveal whether the information requested existed or was held would, in itself and in all the circumstances, be contrary to data protection legislation, which cannot be in the public interest.
27. In the circumstances, the Commissioner considers that the Authority provided the Applicant with appropriate advice and assistance, in line with section 15 of FOISA, by advising them – in general terms – of their right to access their own personal information held by the Authority, by submitting a subject access request in terms of the DPA 2018/UK GDPR.
28. Having considered the arguments submitted by both parties, the Commissioner is satisfied, in all the circumstances of this case, that it would have been contrary to the public interest for the Authority to reveal whether it held the information requested or whether it existed.
29. As a result, the Commissioner is satisfied that the Authority was entitled to refuse to confirm or deny, in accordance with section 18(1) of FOISA, whether it held the information requested by the Applicant, or whether such information existed.
Decision
The Commissioner finds that the Authority complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by the Applicant
Appeal
Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Euan McCulloch
Head of Enforcement
4 March 2025
