|
Decision 078/2011 Dr X and the Scottish Ministers
Personal data
Reference No: 201100340
Decision Date: 20 April 2011 |
Summary
Dr X requested from the Scottish Ministers (the Ministers) certain correspondence relating to Dr X.The Ministers responded by treating this as a subject access request under the Data Protection Act 1998.Following a review, as a result of which the Ministers also relied on section 38(1)(a) of FOISA, Dr X remained dissatisfied and applied to the Commissioner for a decision.
Following an investigation, the Commissioner found that the Ministers had dealt with Dr X's request for information in accordance with Part 1 of FOISA, by withholding the information as the applicant's personal data in accordance with the exemption in section 38(1)(a) of FOISA. He did not require the Ministers to take any action.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and(2)(e)(i) (Effect of exemptions) and 38(1)(a) and (5) (definitions of "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data")
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision.The Appendix forms part of this decision.
Background
1.On 25 November 2010, Dr X wrote to the Ministers requesting all the letters the First Minister's office and Minister of Education had exchanged with the University of Edinburgh and/or other third parties, if any, "related to me".Dr X considered it more appropriate to have the request dealt with under FOISA rather than the DPA.
2.The Ministers responded on 26 November 2010. They explained that as Dr X's request was for Dr X's own personal data it would be dealt with under the DPA.They requested certain information in order to process the request under the DPA.
3.Following further correspondence reiterating that Dr X wished the request to be dealt with under FOISA rather than the DPA, on 31 December 2010 Dr X wrote to the Ministers requesting a review of their decision not to respond to the request under FOISA.
4.The Ministers notified Dr X of the outcome of their review on 19 January 2011. They stated that the exemption under section 38(1)(a) (Personal information) of FOISA applied to all of the information Dr X had requested.The Ministers explained that this was because the information was personal information of which Dr X was the data subject, including any correspondence between others discussing Dr X.Accordingly, the Ministers explained, they were required to deal with the request as a subject access request under the DPA.
5.On 21 February 2011, Dr X wrote to the Commissioner, expressing dissatisfaction with the outcome of the Ministers' review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
6.The application was validated by establishing that Dr X had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
7.On 25 February 2011, the Ministers were notified in writing that an application had been received from Dr X.
8.The investigating officer subsequently contacted the Ministers, giving them an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA).The Ministers provided a submission in response, which will be considered (along with the relevant submissions provided by Dr X) in the Commissioner's analysis and findings below.
Commissioner's analysis and findings
9.In coming to a decision on this matter, the Commissioner has considered all of the submissions made to him by both Dr X and the Ministers and is satisfied that no matter of relevance has been overlooked.
Consideration of section 38(1)(a) ? Personal information
10.Section 38(1)(a) of FOISA contains an absolute exemption in relation to personal data of which the applicant is the data subject.The fact that it is absolute means that it is not subject to the public interest test set out in section 2(1) of FOISA.
11.This exemption exists under FOISA because individuals have a separate right to make a request for their own personal data (commonly known as a "subject access request") under section 7 of the DPA.This ensures that such information is disclosed to the data subject (rather than to the world at large, which is the effect of disclosure under FOISA) under a regime designed for such purposes.It is not one of the purposes of FOISA to give the data subject a more extensive right of access to their own personal data than they would enjoy under the regime primarily governing the processing of that data, even if the applicant might wish that to be the case.
12.Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).
13.Dr X request sought information, in Dr X's own words, "related to me".The Ministers asserted that it followed that this was obviously a request for Dr X's own personal data, which was exempt under section 38(1)(a) of FOISA.In the circumstances, given that such information could only be located by reference to Dr X, the Commissioner is satisfied that the request could only have been interpreted as being for personal data of which Dr X was the data subject.
14.The Commissioner has therefore concluded that the Ministers were correct to withhold the information requested by Dr X under section 38(1)(a) of FOISA.
15.As noted above, the exemption in section 38(1)(a) is an absolute one and the Commissioner is therefore not required (or entitled) to go on to consider whether the public interest lies in the information being disclosed or withheld.The fact that the information is the applicant's personal data means that it is exempt, and if that is the case the Commissioner must (even where the applicant has expressed a clear wish that disclosure should be under FOISA) accept that it should be withheld.
DECISION
The Commissioner finds that the Scottish Ministers complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Dr X.
Appeal
Should either by Dr X or the Scottish Ministers wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Margaret Keyse
Head of Enforcement
20 April 2011
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a) the provision does not confer absolute exemption; and
?
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(e) in subsection (1) of section 38 ?
(i) paragraphs (a), (c) and (d); and
?
38 Personal information
(1) Information is exempt information if it constitutes-
(a) personal data of which the applicant is the data subject;
...
(5) In this section-
?
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
