|
Decision 066/2010Mr N and the Scottish Public Services Ombudsman
Contents of complaint file
Reference No: 201000045
Decision Date: 17 May 2010 |
Summary
Mr N requested from the Scottish Public Services Ombudsman (SPSO) information contained in a complaint file.The SPSO responded by providing information under the Data Protection Act while withholding other information under section 36 of FOISA. Following a review, Mr N remained dissatisfied and applied to the Commissioner for a decision.
Following an investigation, the Commissioner found that the SPSO had partially failed to deal with Mr N's request for information in accordance with Part 1 of FOISA, by dealing with all of the withheld information as Mr N's personal data and in a number of technical respects.He also concluded, however, that the SPSO was entitled to withhold the information under section 26(a) of FOISA, on the basis that other legislation prohibited disclosure.He did not require the SPSO to take any action.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(b) and (e)(ii) (Effect of exemptions); 8 (Requesting information); 15 (Duty to provide advice and assistance); 16(1) and (6) (Refusal of request); 19 (Content of certain notices); 20(3) and (4) (Requirement for review of refusal etc.); 21(4), (5) and (10) (Review by Scottish public authority); 26(a) (Prohibitions on disclosure), and 38(1)(a) and (5) (definition of "personal data") (Personal information)
Data Protection Act 1998 (DPA): section 1(1) (Basic interpretative provisions) (definition of "personal data")
Scottish Public Services Ombudsman Act 2002 (the SPSOA): sections 2(1) and (2) (Power of investigation) and 19 (Confidentiality of Information)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Background
1.Mr N had been in correspondence with the SPSO relative to a complaint he had raised regarding the Council Tax banding placed on his home by Lothian Valuation Joint Board (LVJB).
2.On 6 October 2009 Mr N wrote to the SPSO, including the following request in his email:
? I request access to SPSO file on our case so that we may evaluate the nature of the requests made to LVJB and their responses to SPSO.
He also intimated when it would be suitable for him to attend at SPSO premises to inspect the file in question.
3.On 15 October 2009 Mr N called at the SPSO and left a further note, intimating he was unwilling to wait 40 days and requesting the file within 7 days, indicating again that he would call at the office.
4.The SPSO responded on 22 October 2009 and apologised that it had not responded to his letter of 6 October 2009.It further indicated that his letter of 6 October 2009 and his note of 15 October 2009 were being dealt with as a subject access request under the Data Protection Act 1998 (the DPA).
5.On 3 November 2009 the SPSO responded to Mr N, informing him that his request had been processed in line with the DPA and enclosing a copy of the complaints file.He was informed that an email address had been redacted from the released information and that a report by the LVJB was being withheld as confidential under section 36 of FOISA.Mr N was also informed that he had the right to request a review and that if dissatisfied with the outcome of any review he could apply to the Information Commissioner (ICO), who oversees the DPA across the whole of the UK, contact details for whom were provided.
6.On 12 November 2009, Mr N wrote to the SPSO requesting a review of its decision. He asked for the date and title of the withheld report and asked that the SPSO specify under which sub-section of section 36 of FOISA the information was being withheld.
7.The SPSO notified Mr N of the outcome of its review on 14 December 2009.Mr N was informed the report was undated but had been received by the SPSO on 20 May 2009: further details could not be provided as the report was confidential.It was therefore being withheld in terms of section 36(2) of FOISA.He was also advised that he might wish to request a copy of the information from LVJB directly.As in the SPSO's response to his initial request, he was informed that if he was dissatisfied with the outcome of the review he had a right of appeal to the ICO under the DPA.
8.On 2 January 2010, Mr N wrote to the Commissioner, stating that he was dissatisfied with the outcome of the SPSO's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
9.The application was validated by establishing that Mr N had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request (see below).
Investigation
10.On 26 January 2010, the SPSO was notified in writing that an application had been received from Mr N and asked to provide the Commissioner with any information withheld from him.The SPSO responded with the information requested and the case was then allocated to an investigating officer.
11.The investigating officer subsequently contacted the SPSO, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions.In particular, the SPSO was asked to justify its reliance on any provisions of FOISA it considered applicable to the information requested and to explain why it had dealt with Mr N's request in the way that it did.
12.The SPSO responded, explaining that in line with its current processes Mr N's request had been dealt with as a subject access request under the DPA, on the basis that it contained his personal data.As a consequence, it considered the report to be covered by section 38(1)(a) of FOISA.Having dealt with the request under the DPA, it acknowledged that it should not have relied on the exemption in section 36(2) of FOISA to withhold the LVJB report.
13.On the basis that Mr N's request was a valid request for information under section 1(1) of FOISA, the SPSO submitted that it considered the information to be exempt in terms of section 26(a), 36(2) and section 38(1)(a) and (b) of FOISA.It confirmed that it was reviewing its internal guidance and processes on dealing with information requests.
14.Mr N provided the Commissioner with submissions relative to his dealings with the LVJB regarding his Council Tax banding and subsequent complaint to the SPSO.The Commissioner, however, can only comment on whether or not the SPSO dealt with his request for information in compliance with Part 1of FOISA.
15.The relevant submissions by both Mr N and the SPO will be considered fully in the Commissioner's analysis and findings below.
Commissioner's analysis and findings
16.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Mr N and the SPSO and is satisfied that no matter of relevance has been overlooked.
17.Mr N's request for review and application to the Commissioner relate specifically to the withholding of the LVJB report.Consequently, the Commissioner will not consider in this decision the other information referred to in the SPSO's initial response to Mr N as having been redacted from the complaint file.
18.Mr N's request for information and subsequent correspondence raised a number of technical issues surrounding the way in which the SPSO handled the request in terms of FOISA.Before deciding whether or not the SPSO was correct in withholding the requested information, therefore, the Commissioner finds it necessary to consider and comment on the technical issues identified.
Technical requirements of FOISA ? sections 16, 19 and 21
19.Section 1(1) of FOISA states that a person who requests information from a Scottish public authority which holds it is entitled to be given it.In this case, Mr N made the request for information set out at paragraph 2 above and the Commissioner is satisfied that this met the requirements for a valid request under section 1(1), as set out in section 8 of FOISA.It was in writing, stated the name and address of the applicant and an address for correspondence and described the information requested.
20.The Commissioner is also satisfied that Mr N's request for review of 12 November met all the requirements set out in section 20(3) of FOISA: as a consequence, it was a valid requirement for review ? and indeed appears to have been dealt with as such by the SPSO, at least in part.Given that it was clearly a request for review (for which there is no equivalent provision under the DPA), it should in any event have been clear by this point that Mr N was pursuing his rights under FOISA.
21.The Commissioner notes the submissions made by the SPSO regarding the processing of the request under the DPA.As outlined above, however, he considers the request to have been a valid request for information under FOISA ? and it should have been clear, from receipt of Mr N's request for review, if not earlier, that this was the basis on which he was pursuing the matter.Also, while it might in certain circumstances be appropriate to deal with a file on the handling of a complaint as a subject access request (under the DPA), this will not necessarily be the case, particularly if the subject matter of the complaint is not directly related to the complainer[1]: given the SPSO's broad remit in relation to the investigation of complaints, the Commissioner does not believe it can necessarily be assumed that a request by the complainer for access to the file on a complaint they have made is a request for that complainer's personal data.
22.Having considered the circumstances of this particular case, therefore, the Commissioner is of the view that any response to the request, and the subsequent request for review, should have been in compliance with Part 1 of FOISA.
23.The Commissioner further notes that where an authority wishes to claim the exemption contained in section 38(1)(a) of FOISA on the basis that any of the requested information is the applicant's personal data, the applicant should (in addition to being informed of their rights under FOISA) be informed of their right to request the information under the DPA, in line with the authority's duty to provide reasonable advice and assistance under section 15 of FOISA.In this case, there appears to have been at least a lack of clarity as to which regime the request was being processed under, which does not appear to have been consistent with the SPSO's duty under section 15 of FOISA.
24.The Commissioner considers the SPSO's initial response to Mr N to have been confusing, informing him that his request for information had been processed in line with the DPA but also that some information was being withheld under section 36 of FOISA.The SPSO confirmed in the response to his request for review that the report was being withheld under section 36(2) of FOISA, although this response still appears to suggest that the request was being treated in its entirety as a DPA matter.In both responses, Mr N was informed that he had the right to make an application to the (United Kingdom) Information Commissioner, who has responsibility for the DPA but has no jurisdiction in relation to FOISA, if he was dissatisfied with the outcome of any review.
25.The Commissioner will consider further below the question of whether the requested information was properly dealt with as Mr N's personal data.
26.Section 16(1) of FOISA states that any refusal notice (i.e. the notice a Scottish public authority must issue in response to a request under section 1(1) of FOISA, to the extent that it claims any of the information requested to be exempt under any provision of Part 2 of FOISA) must be in writing and ?
(a) disclose that it holds the information;
(b) state that it claims it to be exempt;
(c) specify the exemption in question; and
(d) state (if not otherwise apparent) why the exemption applies.
Section 16(6) states that subsection (1) is subject to section 19 of FOISA.
27.Section 19 of FOISA states that a refusal notice under section 16(1) must contain particulars-
(a) of the procedure provided by the authority for dealing with complaints about the handling by it of requests for information; and
(b) about the rights of application to the authority and the Commissioner conferred by sections 20(1) and 47(1) respectively.
28.Section 21(10) of FOISA states that a Scottish public authority's response to the applicant (under section 21(5)) following a review carried out under section 21 must contain particulars about the rights of application to the Commissioner and of appeal to the Court of Session conferred by sections 47(1) and 56 respectively.
29.In this case, it is apparent that the SPSO's response to Mr N's request, dated 3 November 2009, did not meet the requirements of section 16 of FOISA in that it did not contain the required elements set out above.Neither did it meet the requirements of section 19 of FOISA, in that it made no reference to the applicant's right of application to the Scottish Information Commissioner.
30.Similarly in the SPSO's responses to Mr N's request for review, Mr N was not informed of his right of application to the Commissioner or of his right of appeal to the Court of Session, as required by section 21(10) of FOISA.
31.In this case, the Commissioner acknowledges that the SPSO has recognised the confusion caused by its responses and is reviewing its processes and guidance with a view to making them clearer.In the circumstances, whilst the Commissioner finds that the SPSO breached Part 1 of FOISA by failing to meet the requirements of sections 16, 19 and 21 of FOISA as outlined above, he does not require the SPSO to take any action in respect of these breaches in response to this particular application.
Section 38(1)(a) of FOISA ? Personal Information
32.Section 38(1)(a) of FOISA contains an absolute exemption in relation to personal data of which the applicant is the data subject.This exemption exists under FOISA because data subjects have rights to access their own personal data, subject to certain qualifications and exemptions, under section 7 of the DPA.The rules under the DPA (which are framed with personal privacy in mind, rather than general access to information) will determine whether the person has a right to information about themselves.The effect of the exemption in section 38(1)(a), therefore, is not to deny individuals a right of access to information about themselves but to ensure the right is exercised under the appropriate legal regime.
33.As section 38(1)(a) is an absolute exemption, it is not subject to the public interest test set out in section 2(1)(b) of FOISA.Consequently, if the Commissioner finds that section 38(1)(a) applies to any of the information requested by Mr N he cannot order the SPSO to disclose that information.
34."Personal data" is defined in section 1(1) of the DPA as:
"data which relate to a living individual who can be identified ?
i.from those data, or
ii. from those data and from other information which is in the possession or is likely to come into the possession of the data controller
and includes any expression of opinion about the individual and any indication of the intentions of the data controlled or any other person in respect of the individual."
35.The SPSO submitted that on this definition Mr N's request was for personal data of which he was the data subject and, its submissions to the Commissioner, claimed that the withheld information was exempt in terms of section 38(1)(a) of FOISA.
36.Having considered the information within the withheld report, the Commissioner considers that whilst elements of that information fall within the definition of Mr N's personal data, the same could not be said for the report in its entirety.There are clearly severable elements which relate to more general aspects of the LVJB's practice rather than those directly affecting Mr N's own property.This information should have been considered under FOISA, even if the remainder would more properly have been dealt with under the DPA.
37.In addition to the exemption under section 38(1)(a), the SPSO also submitted that the information was exempt in terms of sections 26(a), 36(2) and 38(1)(b) of FOISA.The Commissioner will consider the exemption under section 26(a) next.
Section 26(a) of FOISA (Prohibitions on disclosure)
38.The SPSO has argued that the disclosure of the information requested by Mr Nis prohibited by section 19(1) of Scottish Public Services Ombudsman Act 2002 (the SPSOA) and therefore that the information is exempt in terms of section 26(a) of FOISA.
39.Section 26(a) of FOISA exempts information from disclosure under FOISA where disclosure of that information (otherwise than under FOISA) is prohibited by or under any enactment. This is an absolute exemption in that it is not subject to the public interest test set down in section 2(1)(b) of FOISA.
40.Section 19(1) of the SPSOA states that information obtained by the Ombudsman or any of the Ombudsman's advisers in connection with any matter in respect of which a complaint or a request has been made (to the Ombudsman) must not be disclosed except for any of the purposes specified in subsection (2) (of section 19) or as permitted by subsection (3).The full text of section 19 is set out in the Appendix to this decision.
41.Section 19(2) and (3) of the SPSOA, therefore, set out specific conditions under which information obtained by the SPSO in connection with an investigation section 2 of the SPSOA can be disclosed.Given the terms of these provisions, the Commissioner is satisfied that in the absence of any of these conditions, section 19(1) constitutes a prohibition on disclosure for the purposes of section 26(a) of FOISA.
42.Firstly, the Commissioner is satisfied that the information requested was obtained by the SPSO during and in connection with an investigation under section 2 of the SPSOA.It was obtained from the LVJB in connection with the SPSO's investigation of Mr N's complaint against the LVJB.
43.The Commissioner also acknowledges that disclosure of the information as a result of a request under section 1(1) of FOISA is not disclosure for a purpose specified in subsection (2), or permitted under subsection (3), of section 19 of the SPSOA. He is satisfied, therefore, that disclosure of the information sought by Mr Nis prohibited under section 19(1) of the SPSOA and therefore that the information is exempt from disclosure in terms of section 26(a) of FOISA.He is satisfied that this conclusion applies to all of the information in the report, including any information he would accept as being Mr N's personal data.
44.Given that the Commissioner has concluded that all of the withheld information was properly withheld under section 26(a) of FOISA, he is not required (and does not intend) to consider the exemptions in section 36(2) or 38(1)( b) in relation to that information.
DECISION
The Commissioner finds that the Scottish Public Services Ombudsman (the SPSO) failed to deal with Mr N's request in accordance with section 1(1) of FOISA, by not providing him with adequate notices in line with the requirements of sections 16(1), 19 and 21(10) of FOISA.He also finds that the SPSO was not entitled to deal with all of the withheld information as Mr N's personal data under section 38(1)(a) of FOISA, and that in withholding all of the information under that exemption it failed to comply with section 1(1) of FOISA.
The Commissioner also finds, however, that the SPSO was entitled to withhold the information under section 26(a) (on the basis that other legislation prohibited disclosure) and 38(1)(a) (but only to the extent that it constituted Mr N's personal data) of FOISA.
Given that the SPSO is reviewing its processes and guidance with a view to clarifying its approach to the FOISA/DPA interface, the Commissioner does not require it to take any action in response to these failures in response to this particular application.
Appeal
Should either Mr N or the Scottish Public Services Ombudsman wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Margaret Keyse
Head of Enforcement
17 May 2010
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a) the provision does not confer absolute exemption; and
?
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(b) section 26;
?
(e) in subsection (1) of section 38 ?
?
(ii)paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
8 Requesting information
(1) Any reference in this Act to "requesting" information is a reference to making a request which-
(a) is in writing or in another form which, by reason of its having some permanency, is capable of being used for subsequent reference (as, for example, a recording made on audio or video tape);
(b) states the name of the applicant and an address for correspondence; and
(c) describes the information requested.
(2) For the purposes of paragraph (a) of subsection (1) (and without prejudice to the generality of that paragraph), a request is to be treated as made in writing where the text of the request is-
(a) transmitted by electronic means;
(b) received in legible form; and
(c) capable of being used for subsequent reference.
15 Duty to provide advice and assistance
(1) A Scottish public authority must, so far as it is reasonable to expect it to do so, provide advice and assistance to a person who proposes to make, or has made, a request for information to it.
(2) A Scottish public authority which, in relation to the provision of advice or assistance in any case, conforms with the code of practice issued under section 60 is, as respects that case, to be taken to comply with the duty imposed by subsection (1).
16 Refusal of request
(1) Subject to section 18, a Scottish public authority which, in relation to a request for information which it holds, to any extent claims that, by virtue of any provision of Part 2, the information is exempt information must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant a notice in writing (in this Act referred to as a "refusal notice") which-
(a) discloses that it holds the information;
(b) states that it so claims;
(c) specifies the exemption in question; and
(d) states (if not otherwise apparent) why the exemption applies.
?
(6) Subsections (1), (4) and (5) are subject to section 19.
19 Content of certain notices
A notice under section 9(1) or 16(1), (4) or (5) (including a refusal notice given by virtue of section 18(1)) or 17(1) must contain particulars-
(a) of the procedure provided by the authority for dealing with complaints about the handling by it of requests for information; and
(b) about the rights of application to the authority and the Commissioner conferred by sections 20(1) and 47(1).
20 Requirement for review of refusal etc.
?
(3) A requirement for review must-
(a) be in writing or in another form which, by reason of its having some permanency, is capable of being used for subsequent reference (as, for example, a recording made on audio or video tape);
(b) state the name of the applicant and an address for correspondence; and
(c) specify-
(i) the request for information to which the requirement for review relates; and
(ii) the matter which gives rise to the applicant's dissatisfaction mentioned in subsection (1).
(4) For the purposes of paragraph (a) of subsection (3) (and without prejudice to the generality of that paragraph), a requirement for review is treated as made in writing where the text of the requirement is as mentioned in paragraphs (a) to (c) of section 8(2).
?
21 Review by Scottish public authority
?
(4) The authority may, as respects the request for information to which the requirement relates-
(a) confirm a decision complained of, with or without such modifications as it considers appropriate;
(b) substitute for any such decision a different decision; or
(c) reach a decision, where the complaint is that no decision had been reached.
(5) Within the time allowed by subsection (1) for complying with the requirement for review, the authority must give the applicant notice in writing of what it has done under subsection (4) and a statement of its reasons for so doing.
?
(10) A notice under subsection (5) or (9) must contain particulars about the rights of application to the Commissioner and of appeal conferred by sections 47(1) and 56.
26 Prohibitions on disclosure
Information is exempt information if its disclosure by a Scottish public authority (otherwise than under this Act)-
(a) is prohibited by or under an enactment;
?
38 Personal information
(1) Information is exempt information if it constitutes-
(a) personal data of which the applicant is the data subject;
?
(5) In this section-
?
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act; ?
Data Protection Act 1998
1Basic interpretative provisions
(1)In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a)from those data, or
(b)from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Scottish Public Services Ombudsman Act 2002
2 Power of investigation
(1) The Ombudsman may investigate any matter, whenever arising, if ?
(a) the matter consists of action taken by or on behalf of a person liable to investigation under this Act;
(b)the matter is one which the Ombudsman is entitled to investigate, and
(c) a complaint in respect of the matter has been duly made to the Ombudsman.
(2) The Ombudsman may investigate any matter, whenever arising, if ?
(a) paragraphs (a) and (b) of subsection (1) are satisfied, and
(b) the person liable to investigation has requested the Ombudsman to investigate the matter.
?
19 Confidentiality of information
(1) Information obtained by the Ombudsman or any of the Ombudsman's advisers in connection with any matter in respect of which a complaint or a request has been made must not be disclosed except for any of the purposes specified in subsection (2) or as permitted by subsection (3).
(2) Those purposes are?
(a) the purposes of?
(i) any consideration of the complaint or request (including any statement under section 11),
(ii) any investigation of the matter (including any report of such an investigation),
(b) the purposes of any proceedings for?
(i) an offence under the Official Secrets Acts 1911 to 1989 alleged to have been committed in respect of information obtained by the Ombudsman,
(ii) an offence of perjury alleged to have been committed in the course of any investigation of the matter,
(c) the purposes of an inquiry with a view to the taking of any of the proceedings mentioned in paragraph (b),
(d) the purposes of any proceedings under section 14.
(3) Where information referred to in subsection (1) is to the effect that any person is likely to constitute a threat to the health or safety of patients, the Ombudsman may disclose the information to any person to whom the Ombudsman thinks it should be disclosed in the interests of the health and safety of patients.
(4) In relation to information disclosed under subsection (3), the Ombudsman must?
(a) where the Ombudsman knows the identity of the person to whom the information relates, inform that person of the disclosure of the information and of the identity of the person to whom it has been disclosed, and
(b) inform the person from whom the information was obtained of the disclosure.
(5)It is not competent to call upon the Ombudsman or the Ombudsman's advisers to give evidence in any proceedings (other than proceedings referred to in subsection (2)) of matters coming to the knowledge of the Ombudsman or advisers in connection with any matter in respect of which a complaint or request has been made.
(6) A member of the Scottish Executive may give notice in writing to the Ombudsman with respect to?
(a) any document or information specified in the notice, or
(b) any class of document or information so specified,
that, in the opinion of the member of the Scottish Executive, the disclosure of the document or information, or of documents or information of that class, would be contrary to the public interest.
(7) Where such a notice is given nothing in this Act is to be construed as authorising or requiring the Ombudsman or any of the Ombudsman's advisers to communicate to any person or for any purpose any document or information specified in the notice, or any document or information of a class so specified.
(8) Information obtained from-
(a)the Information Commissioner by virtue of section 76 of the Freedom of Information Act 2000 (c. 36), or
(b)the Scottish Information Commissioner by virtue of section 63 of the Freedom of Information (Scotland) Act 2002 (asp 13),
is to be treated for the purposes of subsection (1) as obtained in connection with any matter in respect of which a complaint or request has been made.
(9)In relation to such information, subsection (2)(a) has effect as if?
(a) the reference in sub-paragraph (i) to the complaint or request were a reference to any complaint or request, and
(b) the reference in sub-paragraph (ii) to the matter were a reference to any matter.
(10) In this section and section 20 references to the Ombudsman's advisers are to persons from whom the Ombudsman obtains advice under paragraph 10 of schedule 1.
