Decision 060/2018: Mrs Karen Maclean and Orkney Islands Council Students on the Sex Offenders Register Reference No: 201800012 Decision Date: 25 April 2018 Summary The Council was asked for information about students who were enrolled at Orkney College while on the Sex Offenders Register. The Council withheld the requested information, as it was personal data exempt from disclosure. The Commissioner accepted that the withheld information was exempt from disclosure for the reasons given by the Council.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (4) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provision) (definition of personal data); Schedules 1 (The data protection principles, Part 1 - the principles) (the first data protection principle); 3 (Conditions relevant for purposes of the first principle: processing of sensitive personal data (conditions 1 and 5))

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. Orkney College is a non-incorporated college under the Further and Higher Education (Scotland) Act 1992. The college is governed through Orkney Islands Council[1]. For the purposes of FOISA and this decision, the public authority is considered to be Orkney Islands Council (the Council). Subsequent references to information sought from Orkney College are to be read as information sought from the Council on behalf of Orkney College.

2. On 27 November 2017, Mrs Maclean made a request for information to Orkney College. The information requested was:

· How many students have you enrolled in your college in the following academic years, in the knowledge that they were listed on the Sex Offenders Register at that time?

- 2015-16

- 2016-17

- 2017-18 (to date)

· How many of these students were subject to a MAPPA plan or similar conditions?

· How many of these students failed to adhere to the conditions applied?

· How many of these students attained the qualification they were seeking?

3. The Council responded on 4 December 2017. It stated that the requested numbers were low and the information was exempt under section 38(1)(b) of FOISA (Personal information) because disclosure would be unfair, in terms of the first data protection principle.

4. On 7 December 2017, Mrs Maclean emailed the Council requesting a review of its decision on the basis that she considered that, in the sharing of such statistical data, the chances of any public disclosure about any individual data subject would be low.

5. The Council notified Mrs Maclean of the outcome of its review on 3 January 2018. It upheld its previous decision without modification.

6. On 3 January 2018, Mrs Maclean applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mrs Maclean did not agree that the exemption had been correctly applied, and reiterated the points she had made in her request for review.

Investigation

7. The application was accepted as valid. The Commissioner confirmed that Mrs Maclean made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

8. On 29 January 2018, the Council was notified in writing that Mrs Maclean had made a valid application. The Council was asked to send the Commissioner the information withheld from Mrs Maclean. The Council provided the information and the case was allocated to an investigating officer.

9. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and answer specific questions including justifying its reliance on any provisions of FOISA it considered applicable to the information requested. It responded on 14 March 2018.

10. Mrs Maclean was asked for, and provided, comments on her legitimate interest in the withheld information.

11. Aspects of the Council's submissions were clarified during the investigation.

Commissioner's analysis and findings

12. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both Mrs Maclean and the Council. He is satisfied that no matter of relevance has been overlooked.

Section 38(1)(b) of FOISA (Personal information)

13. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or, as appropriate, section 38(2)(b), exempts information from disclosure if it is "personal data" (as defined in section 1(1) of the DPA) and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.

14. The exemption in section 38(1)(b) of FOISA is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

15. In order to rely on this exemption, the Council must show that the information being withheld is personal data for the purposes of the DPA and that its disclosure into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Schedule 1 to the DPA. The Council considered disclosure of the information would breach the first data protection principle.

Is the withheld information personal data?

16. "Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller" (the full definition is set out in Appendix 1).

17. The Council submitted that the withheld information is the personal data of one or more identifiable living individuals. The Council stated that, as the numbers are very small, it would be possible to combine this information with other information in the public domain to identify the individual or individuals.

18. The Council explained that Orkney is a small community with a population of 21,500 across all the islands. The population of Kirkwall is less than 8,000. The local newspaper includes reports of criminal cases calling at Kirkwall Sheriff Court, and there is a reasonable probability that the relevant conviction(s) would be reported. The Council submitted that members of the local community are likely to be aware of the identity of persons who are on the Sex Offenders Register and enrolled at the College. Furthermore, if the information [about the number of students on the Sex Offenders Register] was released, the Council considered it likely that an ordinary individual would be able to identify any individual or individuals covered by the other parts of the request.

19. Having considered the submissions received from the Council and the withheld information, the Commissioner accepts the arguments put forward by the Council, and is satisfied that it would be possible for a determined individual to identify the living individual or living individuals covered by the request, if the requested information was combined with other information likely to be accessible to Mrs Maclean (and others). The withheld information clearly relates to one or more living individuals. Consequently, the Commissioner accepts that the information is personal data, as defined by section 1(1) of the DPA.

Is the information under consideration sensitive personal data?

20. The Council submitted that the withheld information constituted sensitive personal data. The Council provided reasons, and referred to the definition of sensitive personal data within section 2 of the DPA.

21. In this case, the Commissioner is satisfied that all of the withheld personal data falls into the category of sensitive personal data listed in section 2(g) of the DPA (see Appendix 1).

Would disclosure of the personal data contravene the first data protection principle?

22. In its submissions, the Council argued that disclosure of the withheld personal data would contravene the first data protection principle, which requires that personal data are processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. In the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA must also be met. The processing in this case would comprise making the information publicly available in response to Mrs Maclean's request.

23. Given the additional restrictions surrounding the disclosure of sensitive personal data, it is necessary in this case to consider whether there are any conditions in Schedule 3 which would permit the data to be disclosed, before considering the Schedule 2 conditions.

24. The conditions listed in Schedule 3 to the DPA have been considered by the Commissioner, as have additional conditions for processing sensitive personal data contained in legislation such as the Data Protection (Processing of Sensitive Personal Data) Order 2000. The Commissioner has not identified any of these additional conditions as potentially applicable in this case.

25. The Commissioner's guidance on section 38(1)(b)[2] notes that the conditions in Schedule 3 are very restrictive in nature and that, generally, only the first and fifth conditions are likely to be relevant when considering a request for sensitive personal data under FOISA.

26. Condition 1 allows processing where the data subject has given explicit (and fully informed) consent to the processing (which in this case would be disclosure in response to Mrs Maclean's request). Condition 5 allows processing where information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.

27. Having considered these conditions, the Commissioner has concluded that it would not be reasonable or appropriate to seek consent from the data subject(s) for disclosure of the personal data. The Commissioner has therefore concluded that condition 1 could not be met in this case. He is also satisfied that none of the information under consideration has been made public as a result of steps deliberately taken by the data subject(s), and so condition 5 could not be met in this case.

28. Having reached these conclusions, and also having concluded that no other condition in Schedule 3 (or any other legislation) applies in the circumstances of this case, the Commissioner finds that there are no conditions which would allow the sensitive personal data to be disclosed.

29. In the absence of a condition in Schedule 3 permitting the sensitive personal data to be disclosed, the Commissioner must find that disclosure would be unfair. In the absence of such a condition, disclosure would also be unlawful. Consequently, disclosure of the sensitive personal data would contravene the first data protection principle. The Commissioner therefore finds that the Council was correct to withhold the information requested by Mrs Maclean, as it was exempt from disclosure under section 38(1)(b) of FOISA.

Decision The Commissioner finds that the Council complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mrs Maclean.

Appeal

Should either Mrs Maclean or the Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement

30 April 2018

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

…

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

…

(e) in subsection (1) of section 38 -

…

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

…

38 Personal information

(1) Information is exempt information if it constitutes-

…

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

…

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

…

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

…

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

…

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

…

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

…

2 Sensitive personal data

In this Act "sensitive personal data" means personal data consisting of information as to-

…

(g) the commission or alleged commission by [the data subject] of any offence, or

…

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

…

Schedule 3 - Conditions relevant for purposes of the first principle: processing of sensitive personal data

1. The data subject has given his explicit consent to the processing of the personal data.

…

5. The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.

---