Decision 077/2012 Mrs L A Davidson and Highland Health Board
Number of complaints made against a doctor
Reference No: 201200312
Decision Date: 26 April 2012
Summary
Mrs Davidson asked Highland Health Board (NHS Highland) for information about the number of complaints against a doctor during their employment with NHS Highland.NHS Highland withheld this information under section 38(1)(b) of FOISA, arguing that it was the doctor's personal data and that its disclosure would breach the first data protection principle.This decision was upheld when NHS Highland reviewed its response to Mrs Davidson's request.
After investigation, the Commissioner found that NHS Highland had complied with Part 1 of FOISA in dealing with Mrs Davidson's request.She found that the information had been correctly withheld under section 38(1)(b) of FOISA.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i) and (b) and (5)(definitions of "the data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision.The Appendix forms part of this decision.
Background
1.On 25 August 2011, Mrs Davidson asked NHS Highland to provide her with the number of complaints against a named doctor during their employment with NHS Highland.
2.On 19 September 2011, NHS Highland responded to Mrs Davidson's request. NHS Highland refused the request, taking the view that to provide the information would contravene the DPA.NHS Highland cited section 38(1)(a) of the DPA, although the wording used in the refusal notice suggests that it intended to cite section 38(1)(b) of FOISA instead.
3.On 30 September 2011, Mrs Davidson wrote to NHS Highland to ask for a review of the decision to withhold the information she had asked for.
4.On 23 November 2011, NHS Highland sent Mrs Davidson the outcome of its review.It confirmed the decision to withhold the information, but acknowledged that it should have explained its reasons in more detail.NHS Highland confirmed that the information had been withheld under section 38(1)(b) of FOISA on the grounds that disclosure of the information to a member of the public would contravene the first data protection principle.
5.On 8 February 2012, Mrs Davidson wrote to the Commissioner, expressing her dissatisfaction with the outcome of NHS Highland's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.Mrs Davidson explained that she wished to take forward complaints against the doctor in question through the Scottish Public Services Ombudsman (the SPSO) and the General Medical Council (the GMC).
6.The application was validated by establishing that Mrs Davidson had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
7.On 5 March 2012, NHS Highland was notified in writing that an application had been received from Mrs Davidson and asked to provide the withheld information.Once this had been received, the case was allocated to an investigating officer.
8.The investigating officer subsequently contacted NHS Highland, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions. In particular, NHS Highland was invited to provide further explanation of its decision to withhold information under section 38(1)(b) of FOISA.
9.On 20 April 2012, NHS Highland provided the Commissioner with further information and comments in relation to Mrs Davidson's application.
10.The investigating officer also contacted Mrs Davidson, to ask whether she needed to know the exact number of complaints against the doctor in order to make a complaint to the SPSO or the GMC.Mrs Davidson replied on 29 March 2012.
11.The submissions from both NHS Highland and Mrs Davidson (where relevant) are summarised and considered in the Commissioner's analysis and findings section below.
Commissioner's analysis and findings
12.In coming to a decision on this matter,the Commissioner has considered all of the withheld information and the submissions made to him by both Mrs Davidson and NHS Highland and is satisfied that no matter of relevance has been overlooked.
Section 38(1)(b) ? personal information
13.NHS Highland withheld the number of complaints made against a doctor during their employment with NHS Highland, finding this information to be exempt from disclosure under section 38(1)(b) of FOISA.
14.Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (as appropriate) section 38(2)(b), exempts information if it is personal data and if its disclosure to a member of the public otherwise than under FOISA would breach any of the data protection principles set out in Schedule 1 to the DPA.
15.The exemption in section 38(1)(b) is an absolute exemption, not subject to the public interest test laid down by section 2(1)(b) of FOISA
Is the information personal data?
16.Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).
17.The Commissioner accepts that the withheld information is personal data as defined in section 1(1) of the DPA, as it relates to a living individual who can be identified from that information.The Commissioner will go on to consider whether this information is exempt from disclosure under section 38(1)(b) of FOISA.
Would disclosure breach the first data protection principle?
18.NHS Highland argued that disclosure of the information requested by Mrs Davidson would breach the first data protection principle, which requires that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. In the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA must also be met.
19.The Commissioner does not consider any of the personal data withheld in this case to be sensitive personal data.She will therefore consider whether any of the conditions in Schedule 2 to the DPA would permit disclosure of the information.
Can any of the conditions in Schedule 2 to the DPA be met?
20.When considering the conditions in Schedule 2, the Commissioner notes Lord Hope's comment in Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[1] that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights and freedoms or legitimate interests of the data subject.
21.The Commissioner considers that condition 6 of Schedule 2 of the DPA would appear to be the only condition which might permit disclosure of the personal data requested by Mrs Davidson.Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
22.There are a number of different tests which must therefore be satisfied before condition 6 can be met.These are:
Does Mrs Davidson have a legitimate interest in obtaining the personal data?
If she does, is the disclosure necessary to achieve these legitimate aims?In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subject?(In this case, the data subject is the doctor named in Mrs Davidson's request.)
Even if the processing is necessary for Mrs Davidson's legitimate purposes, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject?
23.There is no presumption in favour of the release of personal data under the general obligation laid down by FOISA.Accordingly, the legitimate interests of Mrs Davidson must outweigh the rights and freedoms or legitimate interests of the data subject before condition 6 will permit the personal data to be disclosed.If the two are evenly balanced, the Commissioner must find that NHS Highland was correct to refuse to disclose the personal data to Mrs Davidson.
Does Mrs Davidson have a legitimate interest?
24.Mrs Davidson explained that she believed the doctor to be a danger to the public who, by being dangerous, had forfeited any right to keep personal data private.She wished to make a complaint to the SPSO and the GMC, and believed that without information about the number of complaints, the complaint would not receive full consideration by the GMC.
25.The GMC website offers guidance and information about the process by which the GMC investigates complaints and concerns about doctors' fitness to practice, and the circumstances in which it can take action.Having studied this information and made enquiries to the GMC, the Commissioner is satisfied that Mrs Davidson is not required to provide the GMC with the number of complaints made against the doctor in order for her to raise a complaint with the GMC.
26.Because it is not necessary for Mrs Davidson to provide the GMC with the total number of complaints against the doctor before a complaint can be taken forward, the Commissioner finds that Mrs Davidson has failed to demonstrate any legitimate interest which would require disclosure of this personal data, with the result that condition 6 of Schedule 2 of the DPA cannot be met in this case.In the absence of a condition permitting disclosure, disclosure would be unlawful.Disclosure of the information would therefore contravene the first data protection principle, which means that the information is exempt from disclosure under section 38(1)(b) of FOISA.
27.The Commissioner therefore finds that NHS Highland was correct to withhold the information in question under section 38(1)(b) of FOISA.
DECISION
The Commissioner finds that Highland Health Board complied with Part 1 of FOISA in responding to the information request from Mrs Davidson.
Appeal
Should either Mrs Davidson or Highland Health Board wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Margaret Keyse
Acting Scottish Information Commissioner
26 April 2012
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2Effect of exemptions
(1)To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a)the provision does not confer absolute exemption; and
?
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(e) in subsection (1) of section 38 ?
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1Basic interpretative provisions
(1)In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a)from those data, or
(b)from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 ? The data protection principles
Part I ? The principles
1.Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a)at least one of the conditions in Schedule 2 is met, and
?
Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data
...
6(1)The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
[1] http://www.publications.parliament.uk/pa/ld200708/ldjudgmt/jd080709/comm-1.htm
