Decision 067/2008 Mr David Goldberg and Her Majesty's Inspectors of Constabulary
Names contained within a report produced by Her Majesty's Inspectorate of Constabulary
Reference No: 200701161
Decision Date: 18 June 2008
Summary
Mr Goldberg requested a copy of a report written on behalf of Her Majesty's Chief Inspectorate of Constabulary (the Inspector). The Inspector responded, withholding the Report on the basis that it was exempt by virtue of sections 34(3)(a), 35(1)(g), 36(2) and 38(1)(b) of the Freedom of Information (Scotland) Act 2002 (FOISA). Mr Goldberg was not satisfied with this response and asked the Inspector to review his decision. The Inspector carried out a review and, as a result, notified Mr Goldberg that although it still considered the report to be exempt from disclosure, it wished to withdraw its application of section 34(3)(a) of FOISA but instead to apply sections 26(1) and 30(b)(ii). Mr Goldberg remained dissatisfied and applied to the Commissioner for a decision.
During the course of the investigation, the Inspector withdrew his application of all but section 38(1)(b) of FOISA and released a redacted version of the report to Mr Goldberg. Mr Goldberg maintained that section 38(1)(b) of FOISA had been incorrectly applied by the Inspector and requested that the Commissioner continue to investigate the matter. Following an investigation, the Commissioner found that the Inspector had complied with the provisions of Part 1 of FOISA in responding to Mr Goldberg's request, in particular by applying the exemption in section 38(1)(b).
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) (General entitlement), 2 (Effect of exemptions) and 38(1)(b) (Personal information).
Data Protection Act 1998 (the DPA) sections 1 (Basic interpretative provisions - definition of personal data) and 2 (Sensitive personal data), Schedule 1 (The data protection principles - the first data protection principle).
The full text of each of these provisions is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Background
1.On 4 April 2007 Mr Goldberg wrote to the Inspector's office requesting a copy of the Report into the police investigation concerning the death of Sam Beasley on Tuesday 29 July 2003 on the Isle of Arran.
2.The Inspector's office replied to Mr Goldberg on 25 April 2007, requesting that he clarify that he was seeking a copy of the report which had resulted from the Inspector's review of Strathclyde Police's handling of a complaint in connection with matters arising from the death. Mr Goldberg confirmed that this was the case on 1 May 2007.
3.On 2 May 2007, the Inspector's office wrote to Mr Goldberg in response to his request for information. The Inspector refused to disclose the report to him, stating that it was exempt from disclosure under sections 34(3)(a), 35(1)(g), 36(2) and 38(1)(b) of FOISA.
4.Mr Goldberg wrote to the Inspector on 14 May 2007, requesting a review of his decision. In particular, Mr Goldberg indicated that he was unhappy with the Inspectorate's grounds for refusal, and with its application (where relevant) of the public interest test in relation to the information requested.
5.On 11 June 2007, the Inspector wrote to notify Mr Goldberg of the outcome of his review. He withdrew his reliance on sections 34(3)(a) and 36(2) of FOISA, and instead applied the exemptions in sections 26(a) and 30(b)(ii).
6.On 28 August 2007, Mr Goldberg wrote to the Commissioner's Office, stating that he was dissatisfied with the outcome of the Inspector's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
7.The application was validated by establishing that Mr Goldberg had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
8.On 29 August 2007, the Inspector was notified in writing that an application had been received from Mr Goldberg and asked to provide copies of the information withheld from him. The Inspector's office responded with the information requested and the case was then allocated to an investigating officer.
9.The investigating officer subsequently contacted the Inspector, asking him to provide comments on the application (as required by section 49(3)(a) of FOISA and to respond to specific questions, specifically in support of his application of the various exemptions claimed.
10.On 2 November 2007, the Inspector wrote to the investigating officer, stating that it had reconsidered Mr Goldberg's request and decided to withdraw all of the exemptions which it had previously applied to the report, with the exception of section 38(1)(b). On that basis, he released a redacted version of the report to Mr Goldberg, with what the Inspector argued to be personal information relating to certain individuals deleted. The Inspector also provided detailed submissions relating to his application of section 38(1)(b) to the redacted information.
11.Having received the redacted report, Mr Goldberg advised that he remained dissatisfied with the Inspectorate's application of section 38(1)(b) to the remainder of the information and requested that the investigation continue.
12.As the Inspector now only seeks to rely on section 38(1)(b) of FOISA, this decision will consider the application of that exemption only. I will consider the relevant points made by both parties fully in my analysis and findings below.
13.Mr Goldberg also raised a number of points underpinning his belief that the exemption in section 38(1)(b) did not apply to the redacted information. He argued that reviews of complaints against police officers should be dealt with in an open and transparent manner.
14.Additionally, he stated that the police officers whose names had been redacted from the report were acting in the course of their duty, and had given evidence on the matter during a public trial. He also argued that witnesses to the incident to which the complaint related, and the accused, had also given evidence at a public trial. The court had placed no restriction on the dissemination of information aired in the course of that trial.
15.Mr Goldberg concluded by stating that it was in the public interest to know whether police officers who had been subject to internal complaints had been found to have behaved professionally or to be in neglect of their duty.
16.The Inspector redacted from the report the home address of the individuals who had brought the matter to his attention. During the investigation, Mr Goldberg confirmed that he did not with to pursue the disclosure of that address. Consequently, that information will not be considered further in this decision.
Commissioner's analysis and findings
17.In coming to a decision on this matter, the Commissioner has considered all of the information and the submissions presented to him by both Mr Goldberg and the Inspector and is satisfied that no matter of relevance has been overlooked.
18.Mr and Mrs Beasley's son was killed in a road accident in 2003. The driver of the car involved in the accident was subsequently found guilty of careless driving. Following the Sherriff Court judgement, Mr and Mrs Beasley made a complaint about the way in which the accident was investigated by Strathclyde Police. The complaint led to an internal investigation into the matter.
19.Upon receipt of the findings of Strathclyde Police, Mr and Mrs Beasley made a further complaint to the Inspector. This complaint related to the way in which Strathclyde Police carried out the investigation into the original complaint made by Mr and Mrs Beasley. The Inspector's report contained the names of the driver and occupants of the car, witnesses to the accident and the police officers involved in its investigation. Mr Goldberg has requested a copy of the report produced by the Inspector and is continuing to pursue disclosure of the names redacted from the Report. It is to this information that the Commissioner's decision in this case relates.
Section 38(1)(b) ? personal data of a third party
20.Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (as appropriate) section 38(2)(b), allows an authority to withhold personal data if disclosure would contravene any of the data protection principles laid down in Schedule 1 to the DPA. This particular exemption is an absolute exemption, in that it is not subject to the public interest test required by section 2(1)(b) of FOISA. This means that where a Scottish public authority considers that information falls within the scope of this exemption, it is not required to consider whether the public interest would be better served by the information being disclosed or withheld.
21.The Inspector argued that in this case the information which had been redacted from his report was personal data as defined by the DPA and that to disclose the information would breach the first data protection principle. He was of the opinion that to disclose it would be unfair to the individuals whose personal data had been redacted.
22.The first consideration in respect of section 38(1)(a) is whether the redacted information constitutes personal data for the purposes of the DPA. Personal data is defined in section 1 of the DPA as:
Data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (see the full definition in the Appendix).
23.As indicated above, the information which has been withheld from Mr Goldberg comprises the names of the occupants of the car involved in the accident which led to the death of Mr and Mrs Beasley's son, witnesses to the accident and police officers who were involved in its investigation.
24.The Commissioner accepts that the information redacted from the report would constitute the personal data of the individuals named. The individuals can be identified from the information. It is biographical in a significant sense and focuses on those individuals. I therefore accept that it relates to them.
25.Having concluded that the redacted information is the personal data of the individuals named, the Commissioner must go on to consider whether its disclosure would contravene any of the data protection principles. As mentioned previously, the Inspector argued that release of the information would contravene the first data protection principle.
26.The first data protection principle requires that personal data shall be processed fairly and lawfully and, in particular, that it shall not be processed unless at least one of the conditions in Schedule 2 (to the DPA) is met. In this case, the Inspector argues that release of the redacted information would breach the first data protection principle as he maintains that its processing (by disclosure) would be unfair to the data subjects.
27.The first data protection principle also requires that, in the case of sensitive personal data, at least one of the conditions in Schedule 3 of the DPA must also be met before processing can be fair and lawful.
28.Section 2 (g) of the DPA defines sensitive personal data as including information as to:
the commission or alleged commission by [the data subject] of any offence.
29.Here, the driver involved in the accident was subsequently charged with careless driving, while certain of the allegations in respect of the police officers were criminal in nature.Insofar as the information withheld relates to those matters, it will be sensitive personal data as defined in section 2(g) of the DPA.
30.As the name of the driver and (in certain respects) the names of the police officers are sensitive personal data, the next consideration must be whether at least one of the conditions in Schedule 3 of the DPA is met.
31.The first condition in Schedule 3 is that the data subject has given their explicit consent to the processing of their personal data. The Inspectorate sought the consent of the individuals concerned for their personal data to be disclosed but no such consent was forthcoming.
32.The Commissioner has examined the remaining conditions in Schedule 3 of and is not satisfied that any of them are, or can be, met in the circumstances of this case. He would therefore conclude that to disclose the name of the driver breach the first data protection principle, as would disclosure of the names of the police officers where they appear in the context of conduct alleged to be of a criminal nature.
33.The Inspector argued that the names of the witnesses to the accident (including the other occupants of the vehicle involved) were not in the public domain, and neither would those witnesses expect their personal data to be put into the public domain as a result of disclosure of the report. He pointed out that the names of these individuals were not already in the public domain, there being no reference to them in the press coverage of the court proceedings and Sheriff Court transcripts and judgements not being released as a general rule.
34.The Information Commissioner, who is responsible for enforcing the DPA, has provided guidance (Freedom of Information Act Awareness Guidance No 1 ? Personal Data) on the consideration of the data protection principles within the context of freedom of information legislation. This guidance recommends that public authorities should consider the following questions when deciding if release of information would breach the first data protection principle:
a)Would disclosure cause unnecessary or unjustified distress or damage to the person who the information is about?
b)Would the third party expect that his or her information might be disclosed to others? Is disclosure incompatible with the purposes for which it was obtained?
c)Has the person been led to believe that his or her information would be kept secret?
d)Has the third party expressly refused consent to disclosure of the information?
35.Here, the witnesses to the accident were bystanders to a tragic event. The Inspector has advised that they would not have been aware that the report contained their personal details, at least not before being approached in the context of Mr Goldberg's information request. In the course of the investigation, certain of them have provided explicit statements to the effect that they do not wish their personal details to be disclosed. In the circumstances, the Commissioner does not consider that these individuals will have any reasonable expectation that their personal data from the report might be put into the public domain as a result of the request: in fact, in the case of some of them the expectation will be that the information will be withheld.
36.As noted above, the Commissioner regards the names of the police officers as being their personal data. To the extent that it does not constitute sensitive personal data, there remains a need to consider whether disclosure would be fair and therefore consistent with the first data protection principle. In doing so, the Commissioner has again taken into account the guidance from the Information Commissioner referred to in paragraph 33 above.
37.The guidance distinguishes between information relating to an individual's private and public lives, suggesting that information about an individual acting in an official or work capacity is less likely to deserve protection. Potential damage or distress to the individual in a personal or private capacity should be taken into account, although the section 38(1)(b) exemption should not be used simply to spare officials embarrassment in their working lives. It accepts that there will be information relating to a public authority's employees which it would be unfair to disclose, while also acknowledging that the strong public interest in the expenditure of public funds may mean that it is not unfair to disclose certain information about staff. In all of this, an important consideration will be the seniority of the staff concerned, it being less likely that disclosure will be unfair the more senior the official is. Among the classes of information the guidance suggests would not normally be disclosed is information relating to internal disciplinary matters.
38.The report under consideration in this case, whilst not a record of a disciplinary investigation, does arise from a review of the conduct of an internal investigation into a complaint against the actions of certain police officers. These officers, while they may have had a relatively high profile in their own community, were all relatively junior in rank. The report comments on the officers' actions and describes events in the context of allegations of misconduct and their investigation. In Decision 223/2007 Ms Mary McCallum and the Chief Constable of Strathclyde Police, the Commissioner reiterated a position he had taken in a number of similar cases, that where public sector employees are the subject of a complaint and/or potential/actual disciplinary action some protection must then be afforded to information relating to the allegations made and the information supplied as part of that process, with a view to protecting the integrity of the internal complaints system and also the individuals concerned and their fair treatment.
39.The purpose of the report was to review whether the investigation of a complaint made to Strathclyde Police had been carried out properly. The disclosure of the report made to date by the Inspector (which, incidentally, appears to be consistent with the general level of disclosure of similar reports now being made by the Police Complaints Commissioner for Scotland) addresses that purpose fully. In the context of the Inspector's review, the Commissioner does not believe that the officers concerned would have had any reasonable expectation that their personal details would be disclosed to the public.
40.In all the circumstances of this particular case, having considered all of the information remaining withheld, the Commissioner finds that its disclosure would contravene the first data protection principle. Where the information is not sensitive personal data, its disclosure would be contrary to the reasonable expectations (and in some cases the express wishes) of the individuals concerned and therefore would be unfair. Having found that the disclosure of the information would be unfair, the Commissioner is not required to go on to consider whether it would be unlawful or whether any of the conditions in Schedule 2 to the DPA could be met. Where the information is sensitive personal data, the Commissioner can identify no Schedule 3 condition that would permit disclosure and therefore cannot find that disclosure would be consistent with the first principle. Therefore, the Commissioner finds that the Inspector was correct to withhold the information under the exemption in section 38(1)(b) of FOISA.
41.The relevant part of section 38(1)(b) confers absolute exemption and therefore not is subject to the public interest test.
Decision
I find that by Her Majesty's Chief Inspectorate of Constabulary acted in accordance with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Goldberg, in particular by withholding the information remaining withheld under the exemption in section 38(1)(b) of FOISA.
Appeal
Should either Mr Goldberg or Her Majesty's Chief Inspectorate of Constabulary wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Kevin Dunion
Scottish Information Commissioner
18 June 2008
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
(?)
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a) the provision does not confer absolute exemption; and
(?)
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
(?)
(e) in subsection (1) of section 38 ?
(?)
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
(?)
38 Personal information
(1) Information is exempt information if it constitutes-
(?)
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
(?)
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
(?)
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
Data Protection Act 1998
1 Basic interpretative provisions
In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
2 Sensitive personal data
In this Act "sensitive personal data" means personal data consisting of information as to-
(a) the racial or ethnic origin of the data subject,
(b) his political opinions,
(c) his religious beliefs or other beliefs of a similar nature,
(d) whether he is a member of a trade union (within the meaning of the Trade Union and Labour Relations (Consolidation) Act 1992),
(e) his physical or mental health or condition,
(f) his sexual life,
(g) the commission or alleged commission by him of any offence, or
(h) any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings.
Schedule 1 ? The data protection principles
Part I ? The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
2. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.
3. Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.
4. Personal data shall be accurate and, where necessary, kept up to date.
5. Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.
6. Personal data shall be processed in accordance with the rights of data subjects under this Act.
7. Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.
8. Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level or protection for the rights and freedoms of data subjects in relation to the processing of personal data.
(?)
