Decision 065/2022: Observations on driving behaviour at specific location
Public authority: Chief Constable of the Police Service of Scotland
Case Ref: 202101223
Summary
Police Scotland were asked about driving behaviour at a specific location in East Kilbride. They disclosed some information and withheld the remainder on the basis that disclosure would either prejudice the effective conduct of public affairs or would breach data protection laws. The Commissioner investigated and found that Police Scotland had partially breached FOISA in responding to the request. While the Commissioner found that Police Scotland had correctly withheld some information, he found that they had failed to provide the Applicant with all the information falling within the scope of his request, and had wrongly withheld some information under the exemptions claimed.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2), (4) and (6) (General entitlement); 2(1) and (2)(e) (Effect of exemptions); 30(b)(ii) and (c) (Prejudice to effective conduct of public affairs); 38(1)(a) and (b), (2A), (5) (definitions of “the data protection principles”, “data subject”, “personal data” and “processing”, “the UK GDPR”) and (5A) (Personal information)
United Kingdom General Data Protection Regulation (the UK GDPR) articles 4(1) (definition of ”personal data”) (Definitions); 5(1)(a) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness of processing)
Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (10), (14)(a), (c) and (d) (Terms relating to the processing of personal data)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 6 June 2021, the Applicant made a request for information to the Chief Constable of the Police Service of Scotland (Police Scotland) in relation to an earlier complaint regarding poor driving behaviour at a specific location in East Kilbride, which had been passed to the Police Investigations and Review Commissioner (PIRC). The information requested was:
Please provide me with records in all forms including emails and telephone records of actions taken since the outcome of the investigation by PIRC. This should include records of all actions and observations of the junction on question and records of communications with all involved since the outcome of the PIRC investigation.
2. Police Scotland responded on 5 July 2021. They disclosed information, some of which they had redacted (variously) under section 30(b)(ii) (Prejudice to effective conduct of public affairs) and section 38(1)(b) (Personal information) of FOISA.
3. For the information redacted under section 30(b)(ii), Police Scotland explained that this exemption allowed for open and honest discussions to be undertaken whilst, at the same time affording some protection to relevant information. Police Scotland recognised the public interest in accountability of the efficiency and effectiveness of the Police Service, but as this information was “indicative”, disclosure would hinder the proper purpose of such deliberation. As such, Police Scotland considered the public interest favoured non-disclosure.
4. For the information redacted under section 38(1)(b), Police Scotland explained this was personal data. While they accepted the Applicant may have a legitimate interest in the data, Police Scotland believed that interest was overridden by the data subjects’ rights and freedoms, and disclosure would therefore be unlawful.
5. On 5 July 2021, the Applicant wrote to Police Scotland requesting a review of their decision to withhold some information. He referred to correspondence received from a local Police Inspector regarding his complaint which, in his view, suggested that a Road Traffic officer had attended at the locus and reported no issues found. The Applicant stated he wished to be assured, in clear terms, that no officer previously involved in the issue of problems at this locus was subsequently involved in the observations in any way.
6. Police Scotland notified the Applicant of the outcome of their review on 29 July 2021, upholding their original decision in full. Police Scotland stated that, overall, very little information had been redacted. They confirmed their view that the exemptions cited did apply to the information withheld.
7. On 28 September 2021, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Applicant stated he was dissatisfied with the outcome of Police Scotland’s review because he could see no valid reason for the redactions. In his view, an officer previously involved in his complaint to PIRC had further involvement in reporting circumstances at the junction which was the subject of his original complaint.
Investigation
8. The application was accepted as valid. The Commissioner confirmed that the Applicant had made a request for information to a Scottish public authority and had asked the authority to review its response to that request before applying to him for a decision.
9. On 26 October 2021, Police Scotland were notified in writing that the Applicant had made a valid application. Police Scotland were asked to send the Commissioner the information withheld from the Applicant. Police Scotland provided the information and the case was subsequently allocated to an investigating officer.
10. On examination of the withheld information, it was clear to the Investigating Officer that full copies had not been provided to the Commissioner. Police Scotland were asked to resubmit complete copies, clearly showing which exemption was being applied to which information. Police Scotland duly did so.
11. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. On 14 March 2022, Police Scotland were invited to comment on this application and to answer specific questions. These focussed on Police Scotland’s justification for withholding some of the information requested under the exemptions claimed. Police Scotland were also asked to confirm their approach to information which appeared to comprise the Applicant’s own personal data.
12. The Applicant was also invited to submit his comments on the public interest in disclosure of the information withheld under section 30(b)(ii), and to explain why the personal information withheld under section 38(1)(b) was important to him or of value to the public.
13. Both parties provided submissions to the Commissioner.
14. In their submissions, Police Scotland stated they now wished to also rely on the exemption in section 30(c) of FOISA to withhold some information which comprised direct dial telephone numbers and information in email addresses.
15. In light of Police Scotland’s change of position, the Applicant was invited to provide any further comments on the public interest in disclosure of the information now being withheld under section 30(c).
16. In response, the Applicant confirmed he was raising no dissatisfaction with Police Scotland’s decision to withhold direct dial telephone numbers under section 30(c). However, for any other redactions in the body of emails, or in email headers relating to the identity of officers, he sought disclosure of that information.
Commissioner’s analysis and findings
17. In coming to a decision on this matter, the Commissioner has considered all the withheld information and the relevant submissions, or parts of submissions, made to him by both the Applicant and Police Scotland. He is satisfied that no matter of relevance has been overlooked.
Whether Police Scotland held any further relevant information
18. In terms of section 1(4) of FOISA, the information to be provided in response to a request under section 1(1) is that falling within the scope of the request and held by the authority at the time the request is received.
19. The standard of proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities. In determining where the balance of probabilities lies, the Commissioner considers the scope, quality, thoroughness and results of the searches carried out by the public authority. He also considers, where appropriate, any reason offered by the public authority to explain why it does not hold the information. While it may be relevant as part of this exercise to explore expectations about what information the authority should hold, ultimately the Commissioner's role is to determine what relevant recorded information is (or was, at the time the request was received) actually held by the public authority.
Police Scotland’s submissions on the information held
20. Police Scotland explained the searches and enquiries they had undertaken to identify the information requested, and explained why they considered these adequate in the circumstances:
- Searches of Police Scotland’s incident recording system (STORM) returned no results.
- Locally based officers from the national Roads Policing Unit carried out a search for any relevant information, which was negative. This led them to conclude that any issues raised would have been investigated by the local Division, which turned out to be the case.
- The local area Command Team identified the relevant correspondence.
21. In conclusion, Police Scotland considered these searches to be both relevant and sufficient, given the nature of the request (which sought information regarding an alleged road traffic issue at a particular location).
Police Scotland’s submissions on the information disclosed
22. Police Scotland were asked to explain why they did not provide the Applicant with full copies of the information, redacted where necessary, when they responded.
23. Police Scotland submitted that, at the time of their original response, staff had no access to redaction software at home and were unable to attend office premises in person to redact hard copy files. Therefore, they had provided the “body” of the emails only, which were copied and pasted into the response along with a summary, but without the “header and footer” information. Police Scotland explained that they would normally have worked through each document applying redactions, but they did what they could in the time available to provide the information sought. In doing so, Police Scotland accepted that, effectively, they had withheld this additional information. Notwithstanding this, Police Scotland acknowledged that not all this additional information attracted the exemptions claimed.
The Commissioner’s views on the information held
24. The Commissioner has considered all relevant submissions and the terms of the request, including the searches undertaken by Police Scotland to establish whether they held any further information that was relevant to the request.
25. He is satisfied that any information relevant to the Applicant’s request would have been capable of being identified as a result of the searches and enquiries carried out by Police Scotland.
26. The Commissioner sympathises with Police Scotland’s position at the time they responded to the Applicant’s request, which was clearly impacted by restrictions imposed as a result of the COVID-19 pandemic. However, he has no option but to find that Police Scotland failed to provide the Applicant with the additional information within that correspondence to which he was entitled (subject to any relevant exemption or provision in FOISA). Accordingly, in failing to do so, the Commissioner has no option but to find that Police Scotland failed to comply with section 1(1) of FOISA.
27. As Police Scotland are relying on exemptions to withhold some of this additional information, the Commissioner will consider this, under the relevant exemptions, in what follows. In respect of the additional information for which Police Scotland is claiming no exemptions, the Commissioner requires Police Scotland to disclose it to the Applicant.
Section 38(1)(a) - Personal information (of the Applicant)
28. Section 38(1)(a) of FOISA contains an absolute exemption in relation to personal data of which an applicant is the data subject. (The fact that it is absolute means that it is not subject to the public interest test set out in section 2(1)(b) of FOISA.)
29. This exemption exists under FOISA because individuals have a separate right to make a request for their own personal data under the UK GDPR/DPA 2018. This route is more appropriate for individuals accessing their personal data as it ensures the information is disclosed only to the individual. As recognised by Police Scotland, disclosure under FOISA is considered disclosure into the public domain.
30. Section 38(1)(a) of FOISA does not deny individuals a right to access information about themselves, but ensures that the right is exercised under the correct legislation (the UK GDPR/DPA 2018) and not under FOISA.
Is the information withheld personal data?
31. Personal data are defined in section 3(2) of the DPA 2018 which, read with section 3(3), incorporates the definition of personal data in Article 4(1) of the UK GDPR. The definition of personal data is set out in full in Appendix 1 (see also paragraphs 38 and 39 below).
32. In their submissions to the Commissioner, Police Scotland applied section 38(1)(a) to the Applicant’s own personal information. They confirmed that they had invited the Applicant to engage in the Subject Access Request process (under the DPA 2018).
33. The Commissioner has considered the information that falls within the scope of the Applicant’s request and the submissions received from Police Scotland. It is clear to the Commissioner that some of the information withheld is the personal data of the Applicant and therefore would be his own personal data as defined in section 3(2) of the DPA 2018. This information is therefore exempt from disclosure under section 38(1)(a) of FOISA. The Commissioner will not go on to consider whether it is also exempt from disclosure under any other of the exemptions in FOISA.
Section 38(1)(b) – Personal information (of third parties)
34. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is "personal data" (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or (where relevant) in the DPA 2018.
35. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
36. To rely on this exemption, Police Scotland must show that the information withheld is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Article 5(1) of the UK GDPR.
37. The Commissioner must decide whether Police Scotland were correct to withhold the information requested under section 38(1)(b) of FOISA.
Is the withheld information personal data?
38. The first question that the Commissioner must address is whether the withheld information is personal data for the purposes of section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable individual. "Identifiable living individual" is defined in section 3(3) of the DPA 2018 see Appendix 1. (This definition reflects the definition of personal data in Article 4(1) of the UK GDPR, also set out in in Appendix 1.)
39. Information which could identify individuals will only be personal data if it relates to those individuals. Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.
40. In their submissions to the Commissioner, Police Scotland explained that the information in question comprised all the names of third parties recorded in the information and the make and model of a vehicle.
41. Police Scotland conceded that the make and model of the vehicle could potentially be disclosed. They explained they had initially assessed that, given it was a relatively uncommon make and model, combined with the locality, the Applicant may know who the individual was. Police Scotland now recognised that the risk of identification was hypothetical in the circumstances.
42. Having considered the withheld information, it is clear to the Commissioner that the names of third parties being withheld in this case “relate to” identifiable living individuals.
43. The Commissioner therefore concludes that this particular information is personal data for the purposes of section 3(2) of the DPA 2018.
44. However, the Commissioner is not persuaded that the information relating to the vehicle make and model is of a level of detail sufficient to be deemed to be the personal data of an identifiable individual. Without knowledge of any additional factors, for example the vehicle registration mark, the Commissioner does not accept that the information being withheld “relates to” an identifiable living individual or individuals.
45. As such, he concludes that the information regarding the vehicle make and model is not personal data for the purposes of section (3)(2) of the DPA 2018 and therefore Police Scotland were not entitled to withhold this information under section 38(1)(b) of FOISA.
46. As Police Scotland are not relying on any other exemption to withhold this information, the Commissioner requires them to disclose this information to the Applicant.
Which of the data protection principles would be contravened by disclosure?
47. Police Scotland stated that disclosure of this personal data would contravene the first data protection principle (Article 5(1)(a) of the UK GDPR). Article 5(1)(a) states that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.
48. In terms of section 3(4)(d) of the DPA 2018, disclosure is a form of processing. In the case of FOISA, personal data is processed when it is disclosed in response to a request.
49. The Commissioner must now consider if disclosure of the personal data would be lawful (Article 5(1)(a)). In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed. The Commissioner considers condition (f) in Article 6(1) to be the only one which could potentially apply in the circumstances of this case.
Condition (f): legitimate interests
50. Condition (f) states that the processing will be lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data (in particular where the data subject is a child).
51. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA (see Appendix 1) makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
52. The tests which must be met before Article 6(1)(f) can be met are as follows:
(i) Does the Applicant have a legitimate interest in obtaining the personal data?
(ii) If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?
(iii) Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?
Does the Applicant have a legitimate interest in obtaining the personal data?
53. In his application to the Commissioner, the Applicant suspected that an officer previously involved in his complaint to PIRC had further involvement in reporting circumstances at the junction which was the subject of his original complaint.
54. During the investigation, the Applicant made further submissions in support of his position. He described poor driving behaviour at the location in question and his dissatisfaction with the action taken by Police Scotland in relation to his complaints in this regard, which resulted in a complaint being submitted to PIRC. In terms of deciding his next steps, the Applicant argued that it was of major significance that all email content be disclosed, including the identity of the parties to the correspondence, as he believed these involved an officer concerned with his previous complaint.
55. In their submissions to the Commissioner, Police Scotland explained they had not asked the Applicant for his legitimate interest in the information. However, they were prepared to accept that he had a legitimate interest. In Police Scotland’s experience, people were curious as to what information the police service held for all kinds of reasons, some more justified than others. In this case, there appeared to be a further personal interest.
56. The Commissioner accepts that disclosure of the withheld personal information would facilitate transparency and accountability to the Applicant regarding the role and accountability of those involved in the observations on driving behaviour conducted by Police Scotland at the location in question. Consequently, the Commissioner accepts that the Applicant has a legitimate interest in disclosure of this personal data.
Is disclosure of the personal data necessary?
57. Having accepted that the Applicant has a legitimate interest in the withheld personal information, the Commissioner must consider whether disclosure of those personal data is necessary for the Applicant's legitimate interests. In doing so, he must consider whether these interests might reasonably be met by any alternative means.
58. The Commissioner has considered this carefully in light of the decision by the Supreme Court in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55.
59. "Necessary" means "reasonably" rather than "absolutely" or "strictly" necessary. When considering whether disclosure would be necessary, public authorities should consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the requester's legitimate interests can be met by means which interfere less with the privacy of the data subject.
60. In their submissions to the Commissioner, Police Scotland did not consider it could ever by necessary for personal information of this nature to be disclosed through FOI. Further, they argued that there were very limited circumstances in which third party personal information will be disclosed on request outwith FOI.
61. The Commissioner accepts that disclosure of the remaining personal data is necessary to achieve the Applicant's legitimate interests. The Commissioner can identify no viable means of fully meeting the Applicant's legitimate interests which would interfere less with the privacy of the data subjects than providing the remaining withheld information in full. In all the circumstances, therefore, the Commissioner is satisfied that disclosure of the information is necessary for the purposes of the Applicant's legitimate interests.
62. The Commissioner will now consider whether the Applicant’s legitimate interest in obtaining the remaining withheld information outweighs the rights and freedoms of the data subjects.
The data subjects' interests or fundamental rights and freedoms
63. The Commissioner must balance the legitimate interests in disclosure against the data subjects' interests or fundamental rights and freedoms. In doing so, it is necessary to consider the impact of disclosure. For example, if the data subjects would not reasonably expect that the information would be disclosed to the public under FOISA in response to the request, or if such disclosure would cause unjustified harm, their interests or rights are likely to override any legitimate interests in disclosure. Only if the legitimate interests of the Applicant outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle.
64. The Commissioner's guidance on section 38 of FOISA notes factors that should be taken into account in balancing the interests of parties. He notes that much will depend on the reasonable expectations of the data subjects. These are some of the factors public authorities should consider:
(i) Does the information relate to an individual's public life (their work as a public official or employee) or to their private life (their home, family, social life or finances)?
(ii) Would the disclosure cause harm or distress?
(iii) Whether the individual has objected to the disclosure.
Does the information relate to public or private life?
65. The Commissioner acknowledges that the withheld information relates to the individuals' public lives, in that it identifies them as Police Scotland officers and staff. However, he also acknowledges that, by association, the information also relates to their private lives.
66. In the circumstances, the Commissioner concludes that the withheld information relates to both the private and public lives of the data subjects.
Would disclosure cause harm or distress to the data subjects and has the individual objected to the disclosure?
67. The Commissioner has also considered the harm or distress that might be caused by disclosure.
68. He notes that disclosure under FOISA is public disclosure; information disclosed under FOISA is effectively placed into the public domain.
69. The Commissioner has considered Police Scotland’s arguments that the fundamental rights and freedoms of the data subjects overrode the interest of any third party. While Police Scotland acknowledged that the Applicant, as a complainer, may have personal knowledge as to the identity of the individuals involved, Police Scotland took into account that disclosure under FOISA was a public disclosure of information.
70. The Commissioner has taken account of all relevant submissions, together with the personal information withheld. He is not persuaded that the harm or distress claimed by Police Scotland applies to all the remaining withheld personal information. Research carried out during the investigation by the Investigating Officer identified that some of that information (i.e. the names of certain third party individuals) was already in the public domain, published in articles or documents on reputable websites. The Commissioner cannot accept, therefore, that disclosure of that same information, in response to the Applicant’s request, would equate to an unwarranted intrusion into the private lives of those individuals, regardless of the individual’s position or rank. Accordingly, the Commissioner does not accept that Police Scotland have sufficiently evidenced that disclosure of some of the remaining withheld personal information would cause any harm or distress to the data subjects, or that they have objected to
disclosure.
71. For the remainder of the personal information withheld, the Commissioner recognises that it records the involvement of those individuals in the observations referred to in the Applicant’s request. Insofar as the withheld personal information relates to Police Scotland officers or staff, the Commissioner acknowledges that some of these individuals can be considered relatively senior and therefore subject to a higher level of scrutiny. It is still appropriate, however, to consider what reasonable expectations they would have in relation to disclosure of the information concerned (including information in email addresses which would enable identification). In all the circumstances, having considered the information in question and all relevant submissions, the Commissioner does not believe any of these individuals, to whom the remaining personal data relates, would have a reasonable expectation that their personal information would be publicly disclosed in response to a request for information under FOISA. He recognises their right to privacy in this regard.
Balance of legitimate interests
72. After carefully balancing the legitimate interests of the data subjects against those of the Applicant, the Commissioner finds that, for the personal information which is already publicly available, the balance of legitimate interests falls in favour of the Applicant.
73. For that information, the Commissioner notes that Police Scotland have not chosen to apply section 25(1) (Information otherwise accessible) of FOISA to that information. Given this information is already available in the public domain, the Commissioner cannot identify any reason why disclosure of that same information, in the context of the request under consideration here, could prejudice the rights and freedoms or legitimate interests of those data subjects.
74. The Commissioner does not accept that there would be a degree of distress caused to the data subjects by the disclosure of this information, sufficient to override the legitimate interests of the Applicant. In all the circumstances, he concludes that condition (f) could be met in this case and that disclosure of the information would therefore be lawful.
75. Accordingly the Commissioner does not accept that Police Scotland were entitled to rely on section 38(1)(b) to withhold the personal information which is already in the public domain (i.e. the names of certain third party individuals, including that contained in email addresses).
76. For the remainder of the withheld personal information, the Commissioner has balanced the competing interests set out above. Having done so in this case, in relation to this particular information, the Commissioner finds that the legitimate interest in transparency is outweighed by the prejudice to the rights and freedoms of the data subjects that would result from disclosure. He therefore finds that the balance of legitimate interests falls in favour of the data subjects, for the remaining withheld personal information and that the requirements of condition (f) cannot be met here.
77. In the absence of a condition which would permit disclosure of the remaining withheld personal information, the Commissioner must conclude that disclosure would be unlawful.
Fairness
78. Given that the Commissioner has determined that the processing of the personal data would be lawful, and bearing in mind his reasons for reaching that conclusion, he can identify no reason for finding that disclosure would be other than fair.
Conclusion on the data protection principles
79. For the personal information found to have been correctly withheld, the Commissioner finds that disclosure of this information would breach the first data protection principle and that this particular information is therefore exempt from disclosure (and was properly withheld) under section 38(1)(b) of FOISA.
80. For the remaining withheld personal information, i.e. other than the personal information found to have been incorrectly withheld and which is publicly available (i.e. the names of certain third party individuals), the Commissioner is satisfied that this particular information has been wrongly withheld under section 38(1)(b), and can be disclosed without breaching the data protection principles in Article 5(1) of the UK GDPR.
81. As Police Scotland are also relying on section 30(c) of FOISA to withhold information in the email addresses of those individuals whose names the Commissioner has ordered disclosure of, he will now go on to consider whether Police Scotland were entitled to rely on section 30(c) for that particular information.
Section 30(c) of FOISA – Prejudice to effective conduct of public affairs – “otherwise” prejudice
82. Section 30(c) of FOISA provides that information is exempt information if its disclosure would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs. This exemption is subject to the public interest test in section 2(1)(b) of FOISA.
83. The word "otherwise" distinguishes the harm required from that envisaged by the exemptions in section 30(a) and (b). This is a broad exemption and the Commissioner expects any public authority applying it to show what specific harm would (or would be likely to) be caused to the conduct of public affairs by disclosure of the information, and how that harm would be expected to follow from disclosure.
84. There is no definition of "substantial prejudice" in FOISA, but the Commissioner considers the harm in question would require to be of real and demonstrable significance. The authority must also be able to satisfy the Commissioner that the harm would, or would be likely to, occur: therefore, the authority needs to establish a real risk or likelihood of actual harm occurring as a consequence of disclosure at some time in the near (certainly the foreseeable) future, not simply that the harm is a remote possibility.
85. During the investigation, Police Scotland confirmed they were relying on this exemption to withhold some information, namely direct dial telephone numbers and information in email addresses. They clarified that they were applying section 30(c) in isolation to withhold direct dial telephone numbers, and both section 30(c) and section 38(1)(b) for the information in email addresses.
86. In his submissions to the Commissioner, the Applicant confirmed he was raising no dissatisfaction with Police Scotland’s decision to withhold direct dial telephone numbers under section 30(c), but sought disclosure of any other information redacted in the body of emails or in email headers relating to the identity of officers.
87. In respect of the information being withheld under section 30(c) relating to direct dial contact numbers, the Commissioner notes that the Applicant confirmed he was raising no dissatisfaction with Police Scotland’s decision to withhold this information under section 30(c). Accordingly, the Commissioner will not consider this matter further in this Decision Notice.
88. As set out above, the Commissioner has already found that Police Scotland correctly withheld some of the personal information falling within the scope of the request under section 38(1)(b) of FOISA. This included the personal information within email addresses which would identify certain individuals. As the Commissioner has found that this information has been properly withheld under the exemption in section 38(1)(b), he is not required to go on to consider the exemption in section 30(c) for that same information.
89. For the information which the Commissioner has found to be wrongly withheld under section 38(1)(b) (i.e. the names of certain individuals which are already in the public domain), the Commissioner must now consider whether Police Scotland was entitled to withhold, under section 30(c), that same information (i.e. the information in email addresses relating to these individuals).
Police Scotland’s submissions on section 30(c)
90. Police Scotland submitted that disclosure of the information being withheld under section 30(c) (i.e. that which related to information in email addresses) would allow members of the public to circumvent using existing contact procedures already in place. These procedures existed to ensure that interactions with Police Scotland were appropriately recorded and responded to.
91. In Police Scotland’s view, individuals who were not well intentioned could use these contact details to bombard officers and staff with disruptive messages, leading to a disruption to the service Police Scotland were able to provide.
The Commissioner’s views on section 30(c)
92. The Commissioner has taken account of all of the relevant submissions, together with the withheld information.
93. In assessing whether the exemption in section 30(c) applies, the Commissioner has taken account of a number of factors, including the timing of the request. He must make his decision based on Police Scotland’s position at the time they issued their review outcome (i.e. their response of 29 July 2021).
94. For the information in the email addresses being withheld under section 30(c), the Commissioner concurs with Police Scotland’s position that disclosure of this remaining information into the public domain would, or would be likely to, substantially prejudice their ability to effectively conduct their business. He accepts that disclosure of this information could enable individuals to circumvent using the established routes set up by Police Scotland for public contact, and cause unnecessary disruption, whether intentional or not. The Commissioner is therefore satisfied that the exemption in section 30(c) is engaged for this information.
95. In respect of the information for which the Commissioner has found section 30(c) to be engaged, he will now go on to consider where the balance of public interest lies in the disclosure of the information, as required by section 2(1)(b) of FOISA.
The public interest – section 30(c)
96. As noted above, the exemption in section 30(c) is subject to the public interest test required by section 2(1)(b) of FOISA.
97. In their submissions to the Commissioner, Police Scotland recognised that individuals with particular grievances would want to know who was involved in handing their complaints and how to contact those individuals. Recognising that this may, on occasion, be appropriate at a personal level, Police Scotland argued that it did not automatically follow that public disclosure was appropriate.
98. Police Scotland submitted that they could identify no public interest in disclosing the information requested, given this could lead to the existing contact procedures being compromised and to the provision of a less efficient and effective service, irrespective of intent. In Police Scotland’s view, the public interest was satisfied by the existing means whereby individuals can make contact via their general “Contact Us” measures, which included email contact.
99. Police Scotland also highlighted that, in this case, they had already provided the Applicant with some details of the individuals involved (i.e. rank and department) in order to assist. In their view, the further information requested would not add to that already disclosed in any meaningful way and would only serve to be disruptive.
100. The Commissioner has considered the submissions along with the remaining information withheld under section 30(c). He recognises there is a general public interest in disclosing information held by Scottish public authorities.
101. However, the Commissioner has already accepted that disclosure of this information would provide opportunity for unnecessary disruption and substantially prejudice Police Scotland’s ability to effectively conduct their business. He also considers that the public interest in disclosure of this particular information is met, to some extent, by the existing routes for public contact.
102. On balance, the Commissioner concludes that the public interest in maintaining the exemption outweighs that in disclosure in respect of the remaining information withheld under section 30(c). Accordingly, he finds that Police Scotland were entitled to withhold this information under section 30(c) of FOISA.
Section 30(b)(ii) – Prejudice to effective conduct of public affairs – free and frank exchange of views for the purposes of deliberation
103. Section 30(b)(ii) of FOISA provides that information is exempt information if its disclosure would, or would be likely to, inhibit substantially the free and frank exchange of views for the purposes of deliberation. This exemption is subject to the public interest test in section 2(1)(b) of FOISA.
104. In applying the exemption in section 30(b)(ii), the chief consideration is not whether the information constitutes opinion or views, but whether the disclosure of that information would, or would be likely to, inhibit substantially the free and frank exchange of views. The inhibition must be substantial and therefore of real and demonstrable significance.
105. Each request must be considered on a case by case basis, taking into account the effect (or likely effect) of disclosure of that particular information on the future exchange of views. The content of the withheld information will require to be considered, taking into account factors such as its nature, subject matter, manner of expression, and also whether the timing of disclosure would have any bearing.
106. As with other exemptions involving a similar test, the Commissioner expects authorities to demonstrate or explain why there is a real risk or likelihood that actual inhibition will occur at some time in the near future, not simply a remote or hypothetical possibility.
Police Scotland’s submissions on section 30(b)(ii)
107. In this case, Police Scotland relied on section 30(b)(ii) to withhold some information in one email which, they submitted, comprised the frank views of a police officer on a particular matter. Police Scotland argued that these offered the officer’s own operational views and were explicitly not providing a “Police Scotland” response.
108. Police Scotland submitted that such exchanges between officers on specific subjects take place routinely in police business. These document the thoughts and opinions of officers and staff on the issues raised, plus any conclusions drawn or actions deemed necessary. Such consultations take place in confidence to discuss or speculate on any potential issues which may arise. They are informal and operational in nature, discussing practical day-to-day issues as opposed to (for example) a formal consultation process or providing a statement concerning a complaint. Police Scotland stressed that this was not a formal request for opinion, rather an exchange of views between operational staff members with an explicit comment that the views should not be taken as representative of the views of Police Scotland more generally.
109. In Police Scotland’s view, there was no reasonable expectation to make those conversations public as this would undermine the purpose of this process which, in this case, was to seek the views of an experienced officer. If released, Police Scotland believed that frank exchange of views would be substantially inhibited, prejudicing the ability of officers to participate effectively in such discussions.
110. Police Scotland recognised that all information gathered was subject to FOISA, but argued that there are some discussions which must necessarily take place, the content of which is not suitable for public disclosure. In their view, where officers and staff were conscious that their correspondence could be made public, they would correspond less freely, thus inhibiting substantially the free and frank exchange of views for the purposes of deliberation insofar as on matters such as this.
111. Police Scotland acknowledged that, where any issues or challenges were identified, these could be properly addressed and commented upon formally via the appropriate channels, e.g. the Complaints Against the Police process.
The Commissioner’s views on section 30(b)(ii)
112. The Commissioner has taken account of all of the relevant submissions, together with the withheld information.
113. In assessing whether the exemption in section 30(b)(ii) applies, the Commissioner has taken account of a number of factors, including the timing of the request. He must make his decision based Police Scotland’s position at the time they issued their review outcome.
114. Having examined the withheld information, the Commissioner notes it records the matters observed and the opinions of officers involved in those observations, which appear to have been expressed freely and frankly. He also notes, and concurs with, Police Scotland’s arguments that some of that information is stated to be the personal view of one of the officers involved, as opposed to an official Police Scotland view.
115. While the Commissioner accepts that much of the information created by Police Scotland in any situation commands, by its very nature, expectations of confidentiality to varying degrees, the Commissioner notes that Police Scotland had no issue with disclosing other information, in the same document, that also recorded the observations and opinions of those involved.
116. In the Commissioner’s view, the content of the remaining withheld information does not appear, to him, to be of sufficient sensitivity to warrant substantial prejudice to Police Scotland being able to conduct their public affairs. Similar to that information already disclosed by Police Scotland in this case, he considers that this remaining withheld information was created for the same purpose with, in his view, the same level of expectation of confidentiality.
117. The Commissioner has carefully considered Police Scotland’s arguments that disclosure of this remaining withheld information would substantially inhibit the free and frank exchange of views in future, and would prejudice the ability of officers to participate effectively in such discussions. However, he is not persuaded, for this particular information, that such prejudice would ensue directly as a result of its disclosure.
118. The Commissioner is therefore not persuaded, from the submissions he has received, that disclosure of the information withheld under section 30(b)(ii) would result in the harm claimed by Police Scotland.
119. In the absence of any submissions persuading him otherwise, the Commissioner does not accept that disclosure of this information would, or would be likely to, inhibit substantially the free and frank exchange of views for the purposes of deliberation. He does not believe such a conclusion can be reached on the basis of the arguments provided.
120. The Commissioner does not, therefore, accept that the exemption in section 30(b)(ii) of FOISA should be upheld in respect of the information withheld under this exemption.
121. Given that the Commissioner does not accept the application of the exemption for the information withheld under section 30(b)(ii), he is not required to consider the public interest in section 2(1)(b) for that information.
122. As Police Scotland are not relying on any other exemption to withhold this information, he requires Police Scotland to disclose it to the Applicant.
Action required by Police Scotland
123. In line with this Decision Notice, the Commissioner requires Police Scotland to disclose to the Applicant:
(i) the additional information identified as falling within the scope of his request, which Police Scotland failed to include in their original response, including any which the Commissioner has found to be wrongly withheld under the exemptions claimed;
(ii) the information which the Commissioner has found to have been incorrectly withheld under the exemptions in section 30(b)(ii) and section 38(1)(b) of FOISA.
124. This will be marked up on copies of the withheld information to be provided to Police Scotland with this Decision Notice.
Decision
The Commissioner finds that the Chief Constable of the Police Service of Scotland (Police Scotland) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.
The Commissioner finds that Police Scotland were entitled to withhold some information under the exemptions in sections 30(c), 38(1)(a) and 38(1)(b) of FOISA.
However, the Commissioner also finds Police Scotland failed to comply with Part 1 of FOISA (and, in particular, with section 1(1) of FOISA) by:
- failing to provide the Applicant with all information falling within the scope of his request; and
- incorrectly withholding certain information (variously) under the exemptions in sections 30(b)(ii) and 38(1)(b) of FOISA.
The Commissioner therefore requires Police Scotland to provide the Applicant with:
- the additional information identified as falling within the scope of his request, which Police Scotland failed to include in their original response, including any of that information which the Commissioner has found to be wrongly withheld under the exemptions claimed; and
- the information which the Commissioner has found to have been incorrectly withheld under the exemptions in sections 30(b)(ii) and 38(1)(b) of FOISA,
by 28 November 2022.
Appeal
Should either the Applicant or Police Scotland wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Enforcement
If Police Scotland fail to comply with this decision, the Commissioner has the right to certify to the Court of Session that Police Scotland have failed to comply. The Court has the right to inquire into the matter and may deal with Police Scotland as if they had committed a contempt of court.
Margaret Keyse
Head of Enforcement
12 October 2022
?
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
(2) The person who makes such a request is in this Part and in Parts 2 and 7 referred to as the “applicant.”
…
(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.
…
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that –
(a) the provision does not confer absolute exemption; and
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption –
(e) in subsection (1) of section 38 –
(i) paragraphs (a), (c) and (d); and
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied.
30 Prejudice to effective conduct of public affairs
Information is exempt information if its disclosure under this Act-
…
(b) would, or would be likely to, inhibit substantially-
…
(ii) the free and frank exchange of views for the purposes of deliberation; or
(c) would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.
38 Personal information
(1) Information is exempt information if it constitutes-
(a) personal data of which the applicant is the data subject;
(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);
…
(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act -
(a) would contravene any of the data protection principles, or
(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.
…
(5) In this section-
"the data protection principles" means the principles set out in –
(a) Article 5(1) of the UK GDPR, and
(b) section 34(1) of the Data Protection Act 2018;
"data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
…
“personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act);
“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).
(5A) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information, Article 6(1) of the UK GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.
…
UK General Data Protection Regulation
Article 4 Definitions
For the purpose of this Regulation:
1 'personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
…
Article 5 Principles relating to processing of personal data
1 Personal data shall be:
a. processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”)
…
Article 6 Lawfulness of processing
1 Processing shall be lawful only if and to the extent that at least one of the following applies:
…
f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.
Data Protection Act 2018
3 Terms relating to the processing of personal data
...
(2) “Personal data” means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).
(3) “Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to –
(a) an identifier such as a name, an identification number, location data or an online identifier, or
(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
(4) “Processing”, in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as –
…
(d) disclosure by transmission, dissemination or otherwise making available,
…
(10) “The UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4)).
…
(14) In Parts 5 to 7, except where otherwise provided –
(a) references to the UK GDPR are to the UK GDPR read with Part 2;
…
(c) references to personal data, and the processing of personal data, are to personal data and processing to which Part 2, Part 3 or Part 4 applies;
(d) references to a controller or processor are to a controller or processor in relation to the processing of personal data to which Part 2, Part 3 or Part 4 applies.
