Decision 077/2020: Looked-after children

Public authority: Dundee City Council
Case Ref: 201900322

Summary

The Council was asked for statistical data covering the five year period 2013-2018, concerning looked after children (1) placed into the Dundee City area by other local authorities and (2) placed outwith Dundee by the Council.

The Council responded by disclosing some data, but it withheld some low figures (less than five) under section 38(1)(b) of FOISA, claiming disclosure would contravene the first data protection principle. It believed identification of living individuals was possible from these data.

The Commissioner was not satisfied from the Council's submissions that the withheld information qualified as personal data, and ordered disclosure.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and 2(e)(ii) (Effect of exemptions); 38(1)(b) and (5) (definition of "personal data")

Data Protection Act 2018 (the DPA 2018) sections 3(2) and (3) (Terms relating to the processing of personal data)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 3 December 2018, the Applicant made a request for information to Dundee City Council (the Council), asking for information for "the past five financial years (2013/14, 2014/15, 2015/16, 2016/17, and 2017/18)" about looked-after children placed in care:

(a) in the Council's area, by other local authorities, and

(b) from the Council's area, in other local authority areas.

For each year, the Applicant asked for both a list of all the authorities that had placed children in the Council's area/had children placed in their areas by the Council, and the number of children involved in each case.

2. The Council responded on 3 January 2019, disclosing some information but stating that information for 2013/14 was not available. The Council also stated that it was withholding some information (figures less than five) under section 38(1)(b) of FOISA, in line with what it described as "standard data protection practice".

3. On 12 February 2019, the Applicant wrote to the Council. requesting a review of its application of section 38(1)(b) as, in her view, the Council had not shown how identification would be possible and she did not consider the information to be personal data. She did not express dissatisfaction with the Council's claim that certain information was not held.

4. On 19 February 2019, the Council notified the Applicant of the outcome of its review, upholding its original decision. It provided more detail of its rationale for withholding information.

5. On 19 February 2019, the Applicant wrote to the Commissioner. She applied to the Commissioner for a decision in terms of section 47(1) of FOISA, stating why she did not accept that the withheld information could be described as personal data.

Investigation

6. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

7. On 11 March 2019, the Council was notified in writing that the Applicant had made a valid application. The Council was asked to send the Commissioner the information withheld from the Applicant and did so on 20 May 2019. The case was allocated to an investigating officer.

8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and to answer specific questions, with particular reference to how identification would be possible using the withheld information.

Commissioner's analysis and findings

9. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both the Applicant and the Council. He is satisfied that no matter of relevance has been overlooked.

Section 38(1)(b) (Personal information)

10. In its submissions, the Council confirmed that it was applying section 38(1)(b) of FOISA to the withheld information. Section 38(1)(b), read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is "personal data" (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the GDPR.

11. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

12. In order to rely on this exemption, the Council must show that the information being withheld is personal data for the purposes of the DPA 2018 and that its disclosure into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Article 5(1) of the GDPR.

Is the withheld information personal data?

13. The first question the Commissioner must address is whether the information is personal data for the purposes of section 3(2) of the DPA 2018. The definition is set out in full in Appendix 1.

14. The Commissioner's briefing on section 38 (Personal information)[1] notes that the two main elements of personal data are that:

(i) the information must "relate to" a living individual; and

(ii) the living individual must be identifiable.

15. Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.

16. An "identifiable living individual" is one who can be identified, directly or indirectly, by reference to an identifier (such as a name) or one or more factors specific to the individual (see section 3(3) of the DPA 2018).

17. The Applicant referred to the Commissioner's briefing on section 38 and to the decision of the Court of Justice of the European Union in the case of Beyer vs. Bundesrepublik Deutschland (considered in the Commissioner's Decision 019/2019: Ms R and Lothian Health Board [2] and also at paragraph 23 of the current version of the briefing). She noted the need for a realistic prospect of identification, which can take account of information in the hands of a third party. However, in line with paragraph 23 of the briefing, she submitted that there must be a realistic causal chain - she contended that if the risk of identification is insignificant, the information will not be personal data.

18. In line with Decision 019/2019, the Applicant highlighted that small numbers should be considered on a case-by-case basis in determining whether they can be disclosed under FOISA. In this case, she did not believe the Council had identified any sources of information that could be combined with the figures in question to make individuals identifiable. The information was historic, summarised and did not include any personal identifiers. It related to large enough population sizes that it would not be possible to identify anyone directly from it. She did not believe even a motivated third party would be able to deduce any individual's identity using this information, as opposed to other information they already had access to.

19. In its submissions, the Council explained that it has certain responsibilities in relation to looked-after children, as set out in the Children (Scotland) Act 1995. Bearing in mind these responsibilities and the vulnerability of the children concerned, it had erred on the side of caution in its approach to the request.

20. The Council submitted that the test it had applied was whether there was a realistic prospect of individuals being identified from the withheld information. Acknowledging that the withheld information, when viewed on its own, might not lead to identification of individuals, it still believed such identification would be possible through a process of triangulation with other information. In other words, information already available could be used in combination to the withheld information to identify the children concerned.

21. The Council acknowledged that Dundee was a city of reasonable population, but it was also a close-knit community and geographically small, with the result that families were well known. It considered the risk of identification to be heightened by the small numbers of looked-after children and widespread use of social media. It noted that it had received requests previously "which clearly had the aim of identifying individuals". The Applicant herself had also sought information in relation to looked-after children in schools and, given the small numbers involved, both sets of information together could realistically allow for the identification of children. It provided copies of previous responses, and also examples of how it believed information might be pieced together from various sources to identify children.

22. The Commissioner notes that not all of the information disclosed to the Applicant previously pertains to looked after children or has them as its focus. Not all of the responses involve the disclosure of information. Looking at the actual information disclosed, it is not apparent to the Commissioner how anything disclosed in response to these earlier requests would be likely to assist identification of any looked-after children, either by itself or in combination with the information under consideration here. Neither is it apparent how either the withheld information, with or without any other information disclosed to the Applicant, would be of value to anyone seeking to identify the children in any of the scenarios described by the Council.

23. The Commissioner understands why the Council would emphasise that these are vulnerable children and that a precautionary approach should be taken to their personal data, but it still needs to be able to establish that the withheld information qualifies as personal data. It still needs to establish that there would be a realistic prospect of identification, in which the withheld information would play a useful part. The Council's concerns about looked after children being at risk of identification may well be genuine, but it is not clear how the information under consideration here - essentially confirming that small numbers of (unidentified) children are to be found in specific areas of significant population (and, in a number of cases, significant geographical extent) - could make a meaningful contribution to the process of identification. If that process were to be more than speculation and guesswork, the key would have to come from information already known to the person carrying out the search, not the information under consideration here.

24. In all the circumstances, therefore, the Commissioner finds that the withheld information in this case is not personal data for the purposes of section 3(2) of the DPA 2018. He therefore finds that the Council was incorrect in applying section 38(1)(b) to the information.

25. In light of these findings, the Commissioner requires the Council to disclose the withheld information to the Applicant, by the date specified in the decision paragraph below.

Decision

The Commissioner finds that, in respect of the matters specified in the application, Dundee City Council failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.

The Commissioner does not accept that the withheld information falls within the definition of personal data and so finds that the Council incorrectly withheld this data under section 38(1)(b) of FOISA.

The Commissioner therefore requires the Council to disclose the withheld information by 4 August 2020.

Appeal

Should either the Applicant or the Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If the Council fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Council has failed to comply. The Court has the right to inquire into the matter and may deal with the Council as if it had committed a contempt of court.

Margaret Keyse
Head of Enforcement

18 June 2020

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

…

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

…

(e) in subsection (1) of section 38 -

…

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied.

38 Personal information

(1) Information is exempt information if it constitutes-

…

(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);

…

(5) In this section-

"the GDPR", "personal data", "processing" and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4), (10), (11) and (14) of that Act);

…

Data Protection Act 2018

3 Terms relating to the processing of personal data

…

(2) "Personal data" means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).

(3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to -

(a) an identifier such as a name, an identification number, location data or an online identifier, or

(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

…

---