Decision 078/2007 | Scottish Information Commissioner

Home Decisions

Decision 078/2007

Decision 078/2007 ? Mr Paul Wilson and the Chief Constable of Lothian and Borders Police

Request for information about the nature of the evidence which led to Mr Wilson being arrested by Lothian and Borders Police on a particular date.

Applicant: Mr Paul Wilson
Authority: The Chief Constable of Lothian and Borders Police
Case No: 200600586
Decision Date: 23 May 2007

Kevin Dunion
Scottish Information Commissioner

Request for information about the nature of the evidence which led to Mr Wilson being arrested by Lothian and Borders Police on a particular date ?Lothian and Borders Police indicated that this request was dealt with by them under the terms of the Data Protection Act 1998 and not under the Freedom of Information (Scotland) Act 2002

Relevant Statutory Provisions and other Sources

Freedom of Information (Scotland) Act 2002 sections 1(1) (General entitlement); 2(1)(b) (Public interest test); 8 (Requesting information); 16 (Refusal of request); 19 (content of certain notices); 21 (Review by Scottish public authority); 38(1)(a) (Personal information); 38(1)(b) (Personal information).

Data Protection Act 1998 sections 1(1) (Basic interpretative provisions); 2 (Sensitive personal data); Schedule 1 (The data protection principles ? first, second and sixth principles).

The full text of each of these provisions is reproduced in the Appendix to this decision. The Appendix forms part of this decision.

The Association of Chief Police Officers in Scotland (ACPOS) Freedom of Information (Scotland) Act 2002 Manual of Guidance.

Facts

Iain Smith and Partners, Solicitors submitted an information request to the Chief Constable of Lothian and Borders Police on behalf of Mr Wilson, for the nature of the evidence which led to Mr Wilson being arrested by Lothian and Borders Police (the Police) on a particular date. In response, the Police provided some information to Mr Wilson, while other information was withheld on the basis of the Data Protection Act 1998 (the DPA). The Police did not indicate that they were citing any exemptions under the Freedom of Information (Scotland) Act 2002 (FOISA) for withholding information from Mr Wilson, or provide Mr Wilson with information as to his rights under FOISA. Nevertheless Mr Wilson sought a review from the Police. In response to the request for review the Police upheld their original decision. Mr Wilson applied to the Commissioner for a decision.

Following an investigation, the Commissioner found that the Police failed to comply with Part 1of FOISA in dealing with this request for information under the Data Protection Act 1998. The Commissioner also found that the Police had failed to comply with Part 1 of FOISA in certain technical respects, but that the information withheld was in any event exempt under sections 38(1)(a) and 38(1)(b) of FOISA.

Background

1. Iain Smith & Partners, Solicitors, submitted an information request to the Police on behalf of Mr Wilson on 31 August 2005. In this request Mr Wilson was seeking information about the nature of the evidence which led to him being arrested by Lothian and Borders Police on a particular date.

2. The Police responded to the request on 13 September 2005, providing some information in relation to Mr Wilson's arrest. In this response, the Police did not advise as to whether they were withholding any information from Mr Wilson, nor did they cite any exemptions under FOISA in respect of the information requested. The Police did not advise Mr Wilson of his rights to request a review of their response or make an application to me.

3. Iain Smith & Partners wrote to the Police again on 19 September 2005. At this time, they acknowledged the information that had been provided by the Police, but indicated that they required further detail as to the nature of the evidence which led to their client being arrested.

4. The Police provided a response to this letter on 29 September 2005. In this letter the Police indicated that the nature of the evidence which led to Mr Wilson being arrested was stated within the information that had already been disclosed. The Police went on to state that they were unable to provide any further information, as to do so would breach the DPA.

5. Iain Smith & Partners sought a review of the Police's responses, on Mr Wilson's behalf, on 14 December 2005.

6. Iain Smith & Partners sent a further letter to the Police on 17 January 2006, asking when they would be likely to receive a response to the request for review that had been submitted.

7. The Police responded to the request for a review on 24 January 2006. In this response the Police indicated (ambiguously) that they still felt that there was sufficient reason, in the circumstances, to release the names of third parties. In subsequent correspondence, the Police indicated that the letter should have read that there was insufficient reason, in the circumstances, to release the names of third parties.

8. On 17 March 2006, Iain Smith & Partners, on behalf of Mr Wilson, submitted an application to me for a decision as to whether the Police had breached Part 1 of FOISA in their response to Mr Wilson. The case was subsequently allocated to an investigating officer and the application validated by establishing that Ian Smith & Partners, acting on Mr Wilson's behalf, had made a request for information to a Scottish public authority and had applied to me for a decision only after asking the authority to review its response to their request.

The Investigation

9. A letter was sent by the investigating officer to the Police on 11 April 2006, asking for their comments on the application in terms of section 49(3)(a) of FOISA. The Police were asked to provide, amongst other items, a copy of any information which had been withheld, confirmation of which exemption(s) they were relying on in not disclosing the information to Mr Wilson and an analysis of the public interest test where applicable.

10. A response was received from the Police on 21 April 2006. Within this response the Police indicated that they had not dealt with Mr Wilson's request for information under the terms of FOISA, but rather had dealt with it under the DPA as "business as usual".

11. The Police questioned whether the request submitted on behalf of Mr Wilson was a request under FOISA, but argued that if it were to be so regarded the exemptions in sections 38(1)(a), 38(1)(b) and 39(1) of FOISA would apply to the information withheld.

12. In their submissions to my Office, Iain Smith & Partners advised that the information they were seeking on behalf of Mr Wilson was not simply his personal information but also details of the witness concerned, the place, date and time of the alleged incident and generally the whole information available to the Police at the time Mr Wilson was arrested. They have indicated that it was their intention when they submitted the request for information to the Police that this should be dealt with under FOISA.

The Commissioners Analysis and Findings

Have the Police dealt with the request for information correctly?

13. In their submissions to my Office, the Police have indicated that they dealt with the request for information on behalf of Mr Wilson under the terms of the DPA.

14. The Police stated that it was their normal practice to deal with requests from solicitors acting on behalf of clients, where they were seeking information held by the Police about their clients, under the terms of the DPA. The Police advised that this has been their normal practice since before FOISA came into effect, and that as a result they treated these requests under the DPA as "business as usual".

15. The Association of Chief Police Officers in Scotland (ACPOS) has produced a FOISA Manual of Guidance, which sets out guidance on how Scottish police forces should deal with requests for information under FOISA. Within this manual is a definition of what is meant by "business as usual".

16. In the ACPOS manual, best practice guidance indicates that where a request comes in and it does not stipulate that it is being made under FOISA, then the request must satisfy the criteria for a valid request in section 8 of FOISA (see Appendix). Also, the information requested should not relate to something which is a normal business process. ACPOS details what it deems to be a normal business process and lists these under the heading "Business as Usual".

17. One of the business practices listed under "Business as Usual" is "Data Protection Subject Access Requests (where no third party data is involved)". The Police have confirmed that it was this definition they relied upon in dealing with the request submitted on behalf of Mr Wilson under the DPA.

18. It is clear from the submissions made and information provided by the parties that the information which was being sought on behalf of Mr Wilson would have contained third party data.

19. In their responses to Iain Smith & Partners the Police quoted the terms of the DPA as justification for information not being disclosed to Mr Wilson. The Police did not cite any of the exemption(s) under FOISA in these responses, or issue a refusal notice as required under section 16 of FOISA. The Police did not advise Iain Smith & Partners, who are acting on behalf of Mr Wilson, of their client's right to request a review of the Police's decision, or for that matter their right to apply to me on Mr Wilson's behalf, as they are required to do under section 19 of FOISA.

20. In communication with Iain Smith & Partners, they made it clear that at the time that the information request was submitted on Mr Wilson's behalf to Lothian and Borders Police, it was their intention that this should be dealt with under FOISA. Also, in their submissions to my Office, Iain Smith & Partners have advised that the information they were seeking from the Police was not simply Mr Wilson's personal data. Iain Smith & Partners have indicated that the specific information they were seeking on behalf of Mr Wilson was the details of the witness concerned, the place, date and time of alleged incident and generally the whole information available to the Police at the time Mr Wilson was arrested.

21. I accept that a solicitor has the right to make such a subject access request on behalf of their client under the DPA, and that it is normal practice for the Police to deal with such a request under the DPA. However, in this instance the solicitor was seeking more information than the personal information of his client and has advised me that it was always his intention that the request should have been dealt with under FOISA and not any other legislation. This should have been clear to the Police from correspondence submitted by Iain Smith & Partners.

22. It is my view that where a solicitor is seeking to gain access to information about a client, information which is the personal data of the client, then it would be more appropriate that this information should be sought under the provisions of the DPA. Where a solicitor submits a request for such information to the Police on behalf of a client under FOISA then the Police would have a duty under section 15 of FOISA to provide advice and assistance to the applicant as to the best way to access this information (i.e. by making a subject access request under the DPA). However, where the information that the solicitor is seeking on behalf of the client also includes third party personal data, that is the personal data of someone other than the client, then it would be appropriate to use the provisions of FOISA. What should be borne in mind here is that any disclosure of information under FOISA is, by definition, disclosure of information to the public at large, while disclosure under the DPA is disclosure only to the applicant.

23. Finally, I am satisfied that the request for information submitted on behalf of Mr Wilson met the requirements of section 8 of FOISA.

24. In all the circumstances, therefore, I am not satisfied that Lothian and Borders Police dealt with Mr Wilson's information request correctly. It should have been dealt with under FOISA.

25. The Police have advised my Office that they did give Iain Smith & Partners the opportunity of viewing a CCTV tape which was held as evidence, but that this offer was not taken up.

26. In their submissions, the Police have asserted that if it was concluded that the request submitted on behalf of Mr Wilson was a request under FOISA, then they would apply the terms of the exemptions in sections 38(1)(a), 38(1)(b) and 39(1) of FOISA to the information that they had withheld. Although the Police did not inform Iain Smith & Partners at any time that they would apply these to the information withheld, I am now required to consider the Police's reliance on these.

27. It should be noted that the information supplied to me by the Police for the purposes of my investigation was a combination of information withheld from Mr Wilson and information relating to their handling of the case. All of this was numbered together and I should make clear at this stage that the information withheld from Mr Wilson comprises documents 8, 16 and 18 only. Document 2 was provided to Mr Wilson on the basis that he was making a subject access request under the DPA.

Section 38(1)(a)

28. The exemption under section 38 relates to personal information. Section 38(1)(a) of FOISA exempts information if the information that has been requested is the personal information of the applicant who is requesting it. This is an absolute exemption. This means that where a public authority considers that the information which has been requested falls within the scope of this exemption it will not have to consider the public interest in whether or not the information should be disclosed.

29. In order to determine whether the information which has been withheld is personal data, I have referred to the definition of personal data in the Data Protection Act 1998 (see the Appendix below).

30. Having considered the definition of personal data under section 1(1) of the DPA, together with the content of the information in documents 8, 16 and 18 (information withheld), I am satisfied that information contained in each of these documents would constitute the personal data of Mr Wilson. I am satisfied that this is the case, as in documents 8 and 16 the focus of the information is Mr Wilson, while this is also the case with part of the information in document 18. The relevant information relates to actions that Mr Wilson has taken in relation to his personal life and clearly identifies Mr Wilson as being the subject of that information. In that regard I am satisfied that it would constitute his personal data. Documents 8, 16 and 18 also contain personal data of third parties.

31. I am therefore satisfied that the information in documents 8, 16 and 18 would be exempt from disclosure under section 38(1)(a) of FOISA. I am also satisfied that document 2, which was provided to Ian Smith & Partners on the basis that they were making a subject access request on Mr Wilson's behalf, meets the same criteria and is therefore also exempt from wider disclosure under section 38(1)(a). As the exemption under section 38(1)(a) is an absolute exemption I am not required to consider the application of the public interest test.

Section 38(1)(b)

32. The Police have also cited the exemption in section 38(1)(b) as one which they would have relied on, if they had dealt with the request for information under FOISA. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (as appropriate) section 38(2)(b), exempts information if it constitutes personal data, the disclosure of which to a member of the public would contravene any of the data protection principles. This particular exemption is also an absolute exemption and therefore a public authority is not required to consider the public interest in whether or not the information should be disclosed if it considers that the information falls within the scope of this exemption.

33. In order to rely on this exemption, the Police would have to show that the information which had been requested was personal data for the purposes of the DPA, and that disclosure of the information to a member of the public would contravene any of the data protection principles (which are to be found in Schedule 1 to the DPA).

34. In their submissions, the Police have indicated that the information that has been withheld from Mr Wilson is biographical in relation to certain individuals and if released would lead to their identification. The Police have also asserted that release of this information would be in breach of the first, second and sixth data protection principles

35. The Police have indicated that they believe the disclosure of the information which has been withheld from Mr Wilson would lead to the personal data of third parties being processed in a manner which is inconsistent with the first data protection principle. This requires that personal data shall be processed fairly and lawfully and in particular shall not be processed unless at least one of the conditions in Schedule 2 (to the DPA) is met, and in the case of sensitive personal data (as defined in section 2 of the DPA), at least one of the conditions in Schedule 3 is also met. Given that at least some of the information withheld relates to the commission or alleged commission of offences by certain individuals, I am satisfied that to that extent it is sensitive personal data as defined in section 2 of the DPA.

36. The Police have submitted that because some of the names of the third parties whose details Mr Wilson is seeking do not appear in the relevant police report, these individuals would not have expected to give evidence in court, and as such that it would not be fair to expect that their names should be released unless their permission were sought. The Police have also indicated that they are not aware of which witnesses were called to court in respect of this case as they do not have access to the court records. The Police go on to advise that it was their view that seeking to obtain the individuals' permission to have their names released was not deemed to be appropriate due to the circumstances of the case. The Police also state that there is a common law duty of confidentiality on them, which has been stressed by the Lord Advocate, where it will protect those who may not otherwise provide information to the Police and help enforce the law, and ensure safety of the community. The Police contend that release of this information would not be fair processing.

37. In relation to their assertion that disclosure of the requested information would breach the second data protection principle, the Police have indicated that the information which Mr Wilson is seeking was gathered and held as part of the criminal process. The Police have advised that this information can be made available through the legal process, but once that legal process is over, and if the information has not been made accessible (for example it has not been used in court), then this information about the third parties cannot be processed again unless the processing is permitted under the DPA. The Police stated that in considering the second principle of the DPA they were also mindful of taking into account the possible intentions of Mr Wilson in terms of how he may use the information should it be disclosed to him.

38. In providing justification for their contention that disclosure of the requested information would be in breach of the sixth data protection principle, the Police have advised that the sixth principle of DPA interlinks with the first and second principles. The Police have noted that the data subjects' rights which would have to be taken into account are the rights of the third parties to privacy, and for the Police to be able to release the requested information they would have to be able to satisfy at least one of the conditions in Schedule 2 of the DPA or have the consent of the third parties.

39. In considering the information contained in documents 8, 16 and 18 which have been withheld from Mr Wilson, I am satisfied that there is certain information contained within documents 8, 16 and 18 (in fact, all of the information in those documents which is not the personal data of Mr Wilson) which would constitute personal data of third parties. I am satisfied that this information is biographical and could lead to the identification of these third parties. I am also satisfied that it relates to actions taken by these individuals in their private or professional lives, and that in the case of some of the information contained in document 18 the third parties are the focus of this information. Therefore this information comes within the definition of personal data laid down in section 1(1) of the DPA.

40. As I am satisfied that certain of the information contained in documents 8, 16 and 18 does contain personal data of third parties, I am now required to go on to consider whether release of this information would be in breach any of the data protection principles.

41. In determining whether release of the third party information contained in documents 8, 16 and 18 would breach the first principle of the DPA, I will first of all address the question of fairness.

42. In doing so, I have taken into consideration the submissions that have been made by the Police. I note the submission made by the Police that the names of some of the third parties whose details Mr Wilson is seeking do not appear in the police report. On looking at the police report (document 18) I do not accept that this is the case. However, I accept the submissions from the Police that the third parties would not have any expectation that their names would be released in this manner, without having been asked for their consent. I also accept that on the basis of the submissions given by the Police that it would be inappropriate to approach the third parties for their consent. In the circumstances, I am satisfied that release of this information by the Police in response to a request under FOISA would amount to unfair processing.

43. As I have concluded that it would not be fair to release this information, I am not required to consider whether it would be lawful or whether any of the conditions in Schedule 2 and Schedule 3 can be met. I am therefore satisfied that the Police would be in breach of the first data protection principle if they did release this information to a member of the public.

44. In considering whether the release of the third party information contained in documents 8, 16 and 18 would breach the second data protection principle, I have taken into account the relevant provisions in Part II of Schedule 1 to the DPA and also the submissions that have been provided by the Police. I accept the submissions from the Police that the information was obtained as part of the criminal process and that to release this information in response to a request under FOISA would not be compatible with that purpose. I also accept as relevant and have taken account of the submissions from the Police relating to their concerns as to how the information might be processed if it were released. In all the circumstances, I am satisfied that the Police would be in breach of the second data protection principle if they did release this information.

45. As I am satisfied that the release of the third party information withheld from Mr Wilson would breach the first and second data protection principles, and considering the Police's argument in relation to the sixth data protection principle refer back to these two other principles in any event, I do not consider that I am required to consider the application if the sixth principle to the information in question.

Section 39(1)

46. I am now satisfied that all of the information withheld from Mr Wilson would be exempt from disclosure under either section 38(1)(a) or section 38(1)(b) of FOISA. Therefore, while the Police also argued that the information was exempt under section 39(1) of FOISA, I am not required to go on and consider the application of that exemption to the information withheld.

Technical Breaches

47. Because the Police did not deal with the request submitted on behalf of Mr Wilson under FOISA, this has led to several technical breaches of Part 1 of FOISA having been committed.

48. In responding to the request, the Police did not provide Mr Wilson with a refusal notice detailing that they were withholding certain information from him and outlining the exemption(s) under FOISA that they relying on in doing so and their reasons for relying on them. This is contrary to section 16 of FOISA.

49. In providing responses to the request submitted by Iain Smith & Partners, Solicitors, on behalf of Mr Wilson the Police did not advise Mr Wilson of his right to request a review of their decision and of his right to appeal the matter to me. This is contrary to section 19 of FOISA.

50. The Police did not respond to the request for a review, which was submitted to them by Iain Smith & Partners, Solicitors, acting on behalf of Mr Wilson within the 20 working day timescale laid down in section 21(1) of FOISA. This is contrary to section 21 of FOISA.

51. Mr Wilson was not, however, prejudiced significantly in the exercise of his rights under FOISA as a consequence of these breaches and therefore I will not require the Police to take any action as a consequence of them.

Decision

I find that the Chief Constable of Lothian and Borders Police (the Police) failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in dealing with Iain Smith & Partners' request for information on behalf of Mr Wilson under the Data Protection Act 1998.

I find that the Police would have been correct to apply the exemptions under sections 38(1)(a) and 38(1)(b) to the information which was withheld from Mr Wilson, and also to apply the exemption under section 38(1)(a) of FOISA to the information released to Mr Wilson in response to his subject access request under the DPA.

However, I find that the Chief Constable of Lothian and Borders Police failed to comply with Part 1 of FOISA, in that they failed to provide Mr Wilson with a refusal notice detailing that they were withholding certain information from him and outlining the exemption(s) under FOISA that they relied on in doing so and their reasons for relying on them, contrary to section 16 of FOISA.

I find that the Police failed to comply with Part 1 of FOISA, in that they did not advise Mr Wilson of his right to request a review of their decision and his right to appeal the matter to me, contrary to section 19 of FOISA.

I find that the Chief Constable of Lothian and Borders Police failed to comply with Part 1 of FOISA, in that they did not respond to Mr Wilson's request for a review within the timescale laid down in section 21(1) of FOISA.

I do not require the Chief Constable of Lothian and Borders Police to take any action in relation to these technical breaches.

Appeal

Should either Mr Wilson or the Police wish to appeal against this decision there is an appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days of receipt of this decision notice.

Kevin Dunion
Scottish Information Commissioner
23 May 2007

APPENDIX

Relevant Statutory Provisions

Freedom of Information (Scotland) Act 2002:

1 General entitlement

(1) A person who requests information from a Scottish public authority who holds it is entitled to be given it by the authority.

2 Public interest test

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

8 Requesting information

(1) Any reference in this Act to "requesting" information is a reference to making a request which ?

(a) is in writing or in another form which, by reason of it having some permanency is capable of being used for subsequent reference (as, for example, a recording made on audio or video tape);

(b) states the name of the applicant and an address for correspondence; and

(2) For the purposes of paragraph (a) of subsection (1) (and without prejudice to the generality of that paragraph), a request is to be treated as made in writing where the text of the request is-

(a) transmitted by electronic means;

(b) received in legible form; and

16 Refusal of request

(1) ?..a Scottish public authority which, in relation to a request for information which it holds, to any extent claims that, by virtue of any provision of Part 2, the information is exempt information must, within the time allowed or by virtue of section 10 for complying with the request, give the applicant a notice in writing (in this Act referred to as a "refusal notice") which-

(a) discloses that it holds the information;

(b) states that it so claims;

(d) states (if not otherwise apparent) why the exemption applies

(2) Where the authority's claim is made only by virtue of a provision in Part 2 which does not confer absolute exemption, the notice must state the authority's reason for claiming that, in all the circumstances of the case, the public interest in maintaining the exemption outweighs that in disclosure of the information.

19 Content of certain notices

A notice under section 9(1) or 16(1), (4) or (5) (including a refusal notice given by virtue of section 18(1) or 17(1) must contain particulars-

(a) of the procedure provided by the authority for dealing with complaints about the handling of its requests for information; and

(b) about the rights of application to the authority and the Commissioner conferred by sections 20(1) and 47(1).

21 Review by Scottish public authority

(1) Subject to subsection (2), a Scottish public authority receiving a requirement for review must (unless that requirement is withdrawn or is as mentioned in subsection (8)) comply promptly; and in any event not later than the twentieth working day after receipt of the requirement.

38 Personal information

(1) Information is exempt information if it constitutes-

(a) personal data of which the applicant is the data subject;

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

(ii) section 10 of that Act (right to prevent processing likely to cause damage or distress); and

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

(3) The second condition is that, by virtue of any provision of Part IV of that Act, the information is exempt from section 7(1)(c) of that Act (data subject's right of access to personal data).

Data Protection Act 1998

Section (1) ? Basic interpretative provisions

(1) "Personal data" means data which relate to a living individual who can be identified ?

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;